9e36c1c9a8cc9977a61bb93cd85f7ebc0de74597e4071d65df7941bdcb347c2db0f214dd54326baf1eeef1211e542f5d4f5172e12dfc63c4de78593c52df0f3f1cbe1b8a9fb1f59242309c8f2699a66588a87ceefa0f660f304d8e8e7295448cb1cc350192833990f7d89225022c9a6205cdfcacccf996cd9e24fd1c419528f032a04d9437c2b72869961c90495ebc306707c04cb6d01cb1001c6d262fd69ed76e58a2e96d6297e608dfb100986549addd3150f7c163c206d33f3fb6de8e9c549086f61e5cf8cbf776ce8b6fedf4751b1be37a5c3339fb584d5e9d3d0e16d6a34ff5fadab7e335f230689641d171b5ff30b03042c28b6b1163f74a82d97930c05cf0c41b8229336aaf18d1d47e7bee5e7d7e50b33d0feccc6d411f6b881b2334083e3a8bc8d3bad4070176a853ee277684b4f3f812d9b624679ce3a5923f427dcab5f737288a3cabffa858e29030b70346925a82d6440bd2e6405ca6f0b21c713183ead55fea3af313920528d660f0beb935ec50c881eae3bbeb3c70100710dc9f7e8582ec00cc8461de0ec4b4f577f9b68020093fed727ae02fd689bb2e38f5817f3736050e3b9c53c0357a2df8807316c0e8336242f1977d1cb7f1d8a6cf1cc6c8a4f3521e3fa7719e58a148f068bdd20b1104f43b6f762292d10a3169dfdad50d668e1f109b9d7eeb76b3ba48d3302c5971d4df1b34d4c4a92929f3876d3bb868cefd02c9a08c364c1e557d5d0c246d5c28235f43cac9aa0f371bcba120235660e6b73b5a975e826607201241b7c385c5fab5c0e34c9dc1b33c4e48ca0a37525e2b4db287a180eed1f092a989db67f6b95c9850bf4326ac2a20f2a1403c553a085c035f7fbba1fe9f7d35066f6e2a68771bdeec7d401a6c654fc06d529ea1b0de033083343109c2ad1c5ad43f64502e026fa37f5fc59afcbb0a51a3c42484b7d21abfbb357fb4bb8cbefd135183b1adfe5e21456b0d7bd9d25eb81f7285424f5bc28ab69be3f9601f41ba2e7318c4dac37561ecf8dbddcc7ebaaa3671f0ab6e1faf58d7bb53d91c4f332a68ed9a36d2955a1d6e2bd19bb9dc11a69a49103188df42ef4767014da485b9c18f3d354a6d19608050c4d073bb7602fcd419b1acab536a852c2b4b3188257f250040cc3c06c0cd19f126a2d4bd2f930546e8f4f7c97090b2a906d57d0668050dc00ec93af78290fdd92da915883954ca1bea5a3858cad4dec18419e24f8e0eaf6e8f9ea9c38acb89033c4c28e30dfb054029a3766892f2e4a2a751572be31d93be94d92366a4c6260a3968a896b652be9a26bd3f162539883dbc0bb543559d9a825ac76b270254f0f3b70856051823afaf3fd2b54588d3be0b805e210def0b252900213e782bac9b1c917f9fd4ac8f51c13f4fa84360465172a97d3dabcb337f9fbe6bb72b8e18ef364a263408e2c8fe4891e31bb619db5f1b99b8256bef563f9f1acc37027112a53248fe7e5a6c8792685e5a0c13120cb2ae906c521214174bfd3cd783b7cc586eb09ba16dd4692fa08ed01b91496d4edc3a8cc421b023d34d4e2a1921513b457fddddebaa262f91f8953d3a7193b68fa3c779a9ef51a68ec227280eb78480ee34228c5db3f18699da509eb2f51aba41f6e39a9ade8efa2e1d5707fd293c5358c3c7ef35231a5831566db8dc2b8181e278bdbbca477a87590c48759eb3f862bd8a4770e2b7ef64484eeacea001737315a470bf68f6f5824d3a1f1d5a3b3c6157b03b5b9aca864dbf7877b7b1d20c8b6c2fdf5dab424ce1076391359f6daaa313c5b1384479f8a61ce733c4432389464dc414a60ee1b0c7efdc5fcc53811a144b10ca19159207baa775b2145d0b82d4fbc93116326e8d9c26a605812324cf8883f9bb7a7e28c0dcce5dbdedd835a36715201a1464bdad0783888e2916fe36a38aad080c287e0dd1ca6d966e5ba200941a8cd6df2b902feff11135ca87a79b0446e07897fd6555549352ebd8d4ba0aff161a5f6dcdd5d960abaa1b2cdab9b5d7c4332d967f480e21ff75064bffb6a9dd15f1ca9d6c4b9b1f65f16536f3d3be128fbba656c14270cf5174e692bde77ecd317f1e61632245fe13b6de7968739c4f0c18e0ccd85bf4e0979d63b283b2de3f460a579ca2b6ad93e16e1d50eb1886d2a1666937f631f89f9fa18a4e74a582e43b4181ccfd87df8640af31fb3f6a35de47318b1d0c13f9e4679f1c32819919edd25691284a237102efc085d342d5273f60186ab0b6071b1cfdf7e54529669515e9f69338b819f4044c6e0c299503c3cc464b7a40587da07605cc2a6134cd1801f29646b031846d6411598862a56e1313494cc5d54d85fca772697f8fc69ac997b6e570d4fa0f796ca0809fb36c9c76535dd6a5f0db924f09013a8a26be2426f4a3fecfe1b83f6bd16f4d9f2f7d40e1ef4ce3dfb647827b2d180b3e9fb8978a3dc64735403612e90f9178ace54a32786cf1640b6c1554b8dfc87455817e832dde45ffb37bab5746230dee9550ebb01626f31de99cbfcd1eeefa5f16e97c6caa795b6f12237f70c9419bd81718f27d08406e72b26474ecfc27c52b6de20cb2dd4b82c7e0e413f196471e86ac666dcdfa71ae0da22be2c071208b678837b55f50835f3f6605f2f2f822708f3d74b2c419a8db9b3ee7a2a0c000eb80225f4d1e5a01805af179220935805255987df25ee15322ccbf5c42393f04d9c36de56e38331edc7a630843cb22235d77ea92b496134d81725fef0dcaec37ca5e7e77e91ff38b8377eb0abe88a9c2919f539124f4c7a1a1bc0ae85fc601364f05bbfac17de50c7c13b2fb4667726c4e5dc5b647439bd11e3eef22a59b778c527d5181af55319e7750c1d941feb55489d391203b245af211638632b3a9894598042a8507858d2c28cdbb55d84adc84e05f961acd3a7f2a24f1b5e375f0401ac6727ad500713a49bf7cd41596badb1fde93a4d65598f1e9546384c93018e22dd4724930294bfd407c059a54e29064528e98b863503c2201f9c8676c47eb8297c40adda21a45b854ea5d682c7f823700a02d8b61b972fc91431b780d9d2bfdad2f6e882a170c4cb3a9b3e4f97fc34c2ec56fa6b0ba95679327373b190f5ed8102b32cd040949abfd4424ab1808f1df3895d678037bbcdc49d6fdb833885efeaf9ecc00986e3d06ca47e86c3c6cbd3a228fd7785158d4812e5941f8f071431ee4c5bddd9c4100db52b69f13d9322ef8181cf230ce1e15b88f651d51ad6b8107c69f040a5f5462290ef0d1454e622f8af8833733a7d5f974ca0ff873f2e85367f4801eff4ea2577845716a31fc066effe1936367c50788de3badcae8f97a4f9a938434151359836747d917df2010863bf00c69d324e03f72e05e65a25a21f17f6eb1a58234cffaa57d611bebe6ed013d2e7feb13d01f128616c7acc1dd097ba9fc2c0e0f881496be7f59240f9c0f23630c23cbc4f5f8017deab15befd7c9e0e3c7865d975c001b28c6d29d4d2e1c078158af58a78fd822f28788731c5db8c902bab8c825c521d5be6ca4d876ea4cbdef41053739f2e74f802986f744be65abb203e5fdbcd6898be36da8cc4a3ccb93666c6cb0409232545e6cc5168e21942e66c2668b6a29de01a13bf7402800261553a955f2a52f441c13cacb0bc9a5047355c9fe4f21f515bb05f0edc2e3ba5a5abfa64255c536823e289674508ce7877deb526ee4e5071a4917558c7f942af83fa4246725545037b48578ab5f4a92c9a9cbd40436fedaba7d6b9bbe09bb8a950e765fce47b04f6f4f24da6f270f61e72d1c03a0eab02441596c4593abc25897e48b889fd0e46511167012d2eded4fa4e151378e6cfbfe41e551f9f05bb0d2682e4372603eb0f798321d228f39f98519ae9f45537d0ac1c58077dcd4f09f8bdfefd9b2e83429df481e76f1782ce604063a5b0ebf9d61410f23f339ed6be0c481b1ca87739cbe677bf12f1a94d3d5599b93b381af29b459ebde519291602e971363570c98ee9ed5d6aa5b8839bf73a06f24c4f265568b036c5ae65bb3273826523e95e59166907ad996d96f42e6b354fd793f85642ff216476d80df359829cf068f8608449fa3032cc2d87c72ee1d0fac0ff643287174a8c260c37659f09dacc254924f0b37eec4d42f477b8421fc93de0cf3067ebd965296d7849644a12305c0d70ebf6718afc7ad2f950a007ca53ca832781fbcb4e43de8885e492ab21e0dc5e0e16da16191ec3db4d5a05f92a5d2c3e79d0527f26370f24daf8e4e7b20d69646cd0f30774d29e45ba74f89a6dda8f779ec05b0e7cc4e65f69dc02587b8e53779368eda849359528d1eb495dd33baa5658940d51af8be82a4b7f1a7e1f1f1511cec52ea56b99c7cde55ea05adbde760262e1fd4beb3c0bb8516f050a099b06e4e75da29af597242fc746d42f7e5add204428bd35e4d2a06ccf4822b8d137ef863e5ac35a4c2246a95da45f5b3b9cded7d41fc93aeb98114ce0edfbcaaee4314ffa95c35cda0c8c4d62b8e721395a220182e809e2d3cf48fda10253e67ec56ee8db3455c33f41890cf6e08e6c188aa73bc396d945c1fca00c4752179a497ad7c5c56ef3511152bf27e0109a86554e7a781b4e5a4904c4c59994083ba0b1d4ad14a475b5ce841c2c017281eb54ddd0803b25a6df9e09b8e7340913afb5c0f659d82f28bd6a54cdd54e61960be12c75dd688b0c4ebd672d54ea4771f0046afabe8f8e7e98f960280f0afd7373ba1770b9ff0624fcfe5187f2ce4bb3adaa5398dd73"})

06:38:33 executing program 3:
ioctl$KVM_CHECK_EXTENSION(0xffffffffffffffff, 0xae03, 0x3f)
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_TRAP_GET(r1, &(0x7f0000000740)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000700)={&(0x7f0000000600)={0x100, 0x0, 0x2, 0x70bd27, 0x25dfdbff, {}, [{@pci={{0x8}, {0x11}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}]}, 0x100}}, 0x28001)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r1, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
socket$phonet_pipe(0x23, 0x5, 0x2)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r2, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
r3 = socket(0x4, 0x1, 0x5)
sendmsg$IPVS_CMD_GET_INFO(r3, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x68, 0x0, 0x100, 0x70bd29, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8}, @IPVS_CMD_ATTR_DAEMON={0x44, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e22}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x4}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'geneve1\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xfffffffd}]}, 0x68}, 0x1, 0x0, 0x0, 0x50}, 0xc5)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="db1e29bd7000fbdbdf250600000008000300", @ANYRES32, @ANYBLOB='\f'], 0x30}}, 0x0)

06:38:33 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x64, 0x0, &(0x7f0000000240)=[@request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1000, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86ba206193131b1cf46e59dc8c518c380ed9793f370ae8da49c0092cd1726257d73f52570191f5ba4f868b372a713ffb555f5cb9c80fbec9354c1dc632ba43fc554dc34c3e552eac551d208b0c798ca1ae9c75a3fc3d6c039a343f5597f8593416a4bfb734d63dba7634586b1f4578667624810b8aa4fc7907767b39ed553d1ff659ec928ce4c8e62c8b80ae6f3bc6ba99adb7e4cdfbce49785cc407e7f59ef2f2b0bb58d91b2119ebc2639bfad3b159673c60b24f82512823a6de589ec029adb3e149f2ebe17426cfeac48b92064b33cc59d3ae6a368807c021aca1ff29dfe1889382b730ee97d7d187f7f1bb97cfb296f20fbe2e1aeeb773a1d10da3592f15998825d5283c0fcfba7de857ae7268cad3732ab5dcd73448062fe9a365a91d0b67e0d7d785a895a6aa058904a054695c31b09c9c2c801865ca3cc8b0cb4b2ceb9819d3f62ed199f5c21fae71d029e163671022e5aaf3b25b42c3b55c30533630efb3c6a131fd56a612e2fa5703f1d3357573b8c87e04b46110ee5e7d66a5c4375c30382ac9d09963edd7f41785ac774bb459dd540e2c0a618b82dacc0b325870f03b8d1451c7aa47fe5b6a2c74101bc6ff67ba1af363ddeb04e4322d78b7864f43c2eda43fd9c798b3e2c0c65d7fbb9ba5afb3b7c6406d1ae4da4941183f75b8475b7f92c0291cf7c8a9d44f629f8078e59eff8703e840c80e69d328eb73925a5cdbd57acb19618211ea117d7a8a1ed5de76ba3b2c128ec17beb65b9f17303b2ed51a226ae18167d3abc5979197bea0453519ed268c083b1b5eb85c9380eccc007151124d8170afa8382e39cff375f43c191964f502e39f722b444f7f36866782d8771c5f8b610a6b99c9041bdbc8b451a68e2fdbc2ad7a0762c1fdbd97659ba74d7daca6a63bf03f7ac2578ee96912996b8fa003a88a9cebffb9e36c1c9a8cc9977a61bb93cd85f7ebc0de74597e4071d65df7941bdcb347c2db0f214dd54326baf1eeef1211e542f5d4f5172e12dfc63c4de78593c52df0f3f1cbe1b8a9fb1f59242309c8f2699a66588a87ceefa0f660f304d8e8e7295448cb1cc350192833990f7d89225022c9a6205cdfcacccf996cd9e24fd1c419528f032a04d9437c2b72869961c90495ebc306707c04cb6d01cb1001c6d262fd69ed76e58a2e96d6297e608dfb100986549addd3150f7c163c206d33f3fb6de8e9c549086f61e5cf8cbf776ce8b6fedf4751b1be37a5c3339fb584d5e9d3d0e16d6a34ff5fadab7e335f230689641d171b5ff30b03042c28b6b1163f74a82d97930c05cf0c41b8229336aaf18d1d47e7bee5e7d7e50b33d0feccc6d411f6b881b2334083e3a8bc8d3bad4070176a853ee277684b4f3f812d9b624679ce3a5923f427dcab5f737288a3cabffa858e29030b70346925a82d6440bd2e6405ca6f0b21c713183ead55fea3af313920528d660f0beb935ec50c881eae3bbeb3c70100710dc9f7e8582ec00cc8461de0ec4b4f577f9b68020093fed727ae02fd689bb2e38f5817f3736050e3b9c53c0357a2df8807316c0e8336242f1977d1cb7f1d8a6cf1cc6c8a4f3521e3fa7719e58a148f068bdd20b1104f43b6f762292d10a3169dfdad50d668e1f109b9d7eeb76b3ba48d3302c5971d4df1b34d4c4a92929f3876d3bb868cefd02c9a08c364c1e557d5d0c246d5c28235f43cac9aa0f371bcba120235660e6b73b5a975e826607201241b7c385c5fab5c0e34c9dc1b33c4e48ca0a37525e2b4db287a180eed1f092a989db67f6b95c9850bf4326ac2a20f2a1403c553a085c035f7fbba1fe9f7d35066f6e2a68771bdeec7d401a6c654fc06d529ea1b0de033083343109c2ad1c5ad43f64502e026fa37f5fc59afcbb0a51a3c42484b7d21abfbb357fb4bb8cbefd135183b1adfe5e21456b0d7bd9d25eb81f7285424f5bc28ab69be3f9601f41ba2e7318c4dac37561ecf8dbddcc7ebaaa3671f0ab6e1faf58d7bb53d91c4f332a68ed9a36d2955a1d6e2bd19bb9dc11a69a49103188df42ef4767014da485b9c18f3d354a6d19608050c4d073bb7602fcd419b1acab536a852c2b4b3188257f250040cc3c06c0cd19f126a2d4bd2f930546e8f4f7c97090b2a906d57d0668050dc00ec93af78290fdd92da915883954ca1bea5a3858cad4dec18419e24f8e0eaf6e8f9ea9c38acb89033c4c28e30dfb054029a3766892f2e4a2a751572be31d93be94d92366a4c6260a3968a896b652be9a26bd3f162539883dbc0bb543559d9a825ac76b270254f0f3b70856051823afaf3fd2b54588d3be0b805e210def0b252900213e782bac9b1c917f9fd4ac8f51c13f4fa84360465172a97d3dabcb337f9fbe6bb72b8e18ef364a263408e2c8fe4891e31bb619db5f1b99b8256bef563f9f1acc37027112a53248fe7e5a6c8792685e5a0c13120cb2ae906c521214174bfd3cd783b7cc586eb09ba16dd4692fa08ed01b91496d4edc3a8cc421b023d34d4e2a1921513b457fddddebaa262f91f8953d3a7193b68fa3c779a9ef51a68ec227280eb78480ee34228c5db3f18699da509eb2f51aba41f6e39a9ade8efa2e1d5707fd293c5358c3c7ef35231a5831566db8dc2b8181e278bdbbca477a87590c48759eb3f862bd8a4770e2b7ef64484eeacea001737315a470bf68f6f5824d3a1f1d5a3b3c6157b03b5b9aca864dbf7877b7b1d20c8b6c2fdf5dab424ce1076391359f6daaa313c5b1384479f8a61ce733c4432389464dc414a60ee1b0c7efdc5fcc53811a144b10ca19159207baa775b2145d0b82d4fbc93116326e8d9c26a605812324cf8883f9bb7a7e28c0dcce5dbdedd835a36715201a1464bdad0783888e2916fe36a38aad080c287e0dd1ca6d966e5ba200941a8cd6df2b902feff11135ca87a79b0446e07897fd6555549352ebd8d4ba0aff161a5f6dcdd5d960abaa1b2cdab9b5d7c4332d967f480e21ff75064bffb6a9dd15f1ca9d6c4b9b1f65f16536f3d3be128fbba656c14270cf5174e692bde77ecd317f1e61632245fe13b6de7968739c4f0c18e0ccd85bf4e0979d63b283b2de3f460a579ca2b6ad93e16e1d50eb1886d2a1666937f631f89f9fa18a4e74a582e43b4181ccfd87df8640af31fb3f6a35de47318b1d0c13f9e4679f1c32819919edd25691284a237102efc085d342d5273f60186ab0b6071b1cfdf7e54529669515e9f69338b819f4044c6e0c299503c3cc464b7a40587da07605cc2a6134cd1801f29646b031846d6411598862a56e1313494cc5d54d85fca772697f8fc69ac997b6e570d4fa0f796ca0809fb36c9c76535dd6a5f0db924f09013a8a26be2426f4a3fecfe1b83f6bd16f4d9f2f7d40e1ef4ce3dfb647827b2d180b3e9fb8978a3dc64735403612e90f9178ace54a32786cf1640b6c1554b8dfc87455817e832dde45ffb37bab5746230dee9550ebb01626f31de99cbfcd1eeefa5f16e97c6caa795b6f12237f70c9419bd81718f27d08406e72b26474ecfc27c52b6de20cb2dd4b82c7e0e413f196471e86ac666dcdfa71ae0da22be2c071208b678837b55f50835f3f6605f2f2f822708f3d74b2c419a8db9b3ee7a2a0c000eb80225f4d1e5a01805af179220935805255987df25ee15322ccbf5c42393f04d9c36de56e38331edc7a630843cb22235d77ea92b496134d81725fef0dcaec37ca5e7e77e91ff38b8377eb0abe88a9c2919f539124f4c7a1a1bc0ae85fc601364f05bbfac17de50c7c13b2fb4667726c4e5dc5b647439bd11e3eef22a59b778c527d5181af55319e7750c1d941feb55489d391203b245af211638632b3a9894598042a8507858d2c28cdbb55d84adc84e05f961acd3a7f2a24f1b5e375f0401ac6727ad500713a49bf7cd41596badb1fde93a4d65598f1e9546384c93018e22dd4724930294bfd407c059a54e29064528e98b863503c2201f9c8676c47eb8297c40adda21a45b854ea5d682c7f823700a02d8b61b972fc91431b780d9d2bfdad2f6e882a170c4cb3a9b3e4f97fc34c2ec56fa6b0ba95679327373b190f5ed8102b32cd040949abfd4424ab1808f1df3895d678037bbcdc49d6fdb833885efeaf9ecc00986e3d06ca47e86c3c6cbd3a228fd7785158d4812e5941f8f071431ee4c5bddd9c4100db52b69f13d9322ef8181cf230ce1e15b88f651d51ad6b8107c69f040a5f5462290ef0d1454e622f8af8833733a7d5f974ca0ff873f2e85367f4801eff4ea2577845716a31fc066effe1936367c50788de3badcae8f97a4f9a938434151359836747d917df2010863bf00c69d324e03f72e05e65a25a21f17f6eb1a58234cffaa57d611bebe6ed013d2e7feb13d01f128616c7acc1dd097ba9fc2c0e0f881496be7f59240f9c0f23630c23cbc4f5f8017deab15befd7c9e0e3c7865d975c001b28c6d29d4d2e1c078158af58a78fd822f28788731c5db8c902bab8c825c521d5be6ca4d876ea4cbdef41053739f2e74f802986f744be65abb203e5fdbcd6898be36da8cc4a3ccb93666c6cb0409232545e6cc5168e21942e66c2668b6a29de01a13bf7402800261553a955f2a52f441c13cacb0bc9a5047355c9fe4f21f515bb05f0edc2e3ba5a5abfa64255c536823e289674508ce7877deb526ee4e5071a4917558c7f942af83fa4246725545037b48578ab5f4a92c9a9cbd40436fedaba7d6b9bbe09bb8a950e765fce47b04f6f4f24da6f270f61e72d1c03a0eab02441596c4593abc25897e48b889fd0e46511167012d2eded4fa4e151378e6cfbfe41e551f9f05bb0d2682e4372603eb0f798321d228f39f98519ae9f45537d0ac1c58077dcd4f09f8bdfefd9b2e83429df481e76f1782ce604063a5b0ebf9d61410f23f339ed6be0c481b1ca87739cbe677bf12f1a94d3d5599b93b381af29b459ebde519291602e971363570c98ee9ed5d6aa5b8839bf73a06f24c4f265568b036c5ae65bb3273826523e95e59166907ad996d96f42e6b354fd793f85642ff216476d80df359829cf068f8608449fa3032cc2d87c72ee1d0fac0ff643287174a8c260c37659f09dacc254924f0b37eec4d42f477b8421fc93de0cf3067ebd965296d7849644a12305c0d70ebf6718afc7ad2f950a007ca53ca832781fbcb4e43de8885e492ab21e0dc5e0e16da16191ec3db4d5a05f92a5d2c3e79d0527f26370f24daf8e4e7b20d69646cd0f30774d29e45ba74f89a6dda8f779ec05b0e7cc4e65f69dc02587b8e53779368eda849359528d1eb495dd33baa5658940d51af8be82a4b7f1a7e1f1f1511cec52ea56b99c7cde55ea05adbde760262e1fd4beb3c0bb8516f050a099b06e4e75da29af597242fc746d42f7e5add204428bd35e4d2a06ccf4822b8d137ef863e5ac35a4c2246a95da45f5b3b9cded7d41fc93aeb98114ce0edfbcaaee4314ffa95c35cda0c8c4d62b8e721395a220182e809e2d3cf48fda10253e67ec56ee8db3455c33f41890cf6e08e6c188aa73bc396d945c1fca00c4752179a497ad7c5c56ef3511152bf27e0109a86554e7a781b4e5a4904c4c59994083ba0b1d4ad14a475b5ce841c2c017281eb54ddd0803b25a6df9e09b8e7340913afb5c0f659d82f28bd6a54cdd54e61960be12c75dd688b0c4ebd672d54ea4771f0046afabe8f8e7e98f960280f0afd7373ba1770b9ff0624fcfe5187f2ce4bb3adaa5398dd73"})

[ 1625.876912][T10420] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.3'.
06:38:33 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x6c, 0x0, &(0x7f0000000340)=[@acquire, @acquire_done, @exit_looper, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xa1, 0x0, &(0x7f00000003c0)="81f4bf5574322fe2f759e010e412a85afd76c59793bd41a5db1b3652a9cc81d13103ec6b01d8e5631a6cfd388e3486c8f8d4ddc7cb97bf470c301912c8d80e0309da9b3a77c91376587e2d1c2dae5b0c0c81a81f3060148938c2b26885697ca67b741d01f14f68d0d97387e10d49b1e0037c396d30e3c95073055a2d4d18c8a25c4f9b4db1058bed144023bfabb6c161af32bed1f6afe54d20cec0602c3a50ced5"})

06:38:33 executing program 0:
gettid()
gettid()
waitid(0x0, 0x0, &(0x7f00000000c0), 0x20000000, 0x0)

06:38:33 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x50, 0x0, &(0x7f00000001c0)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@weak_handle={0x77682a85, 0x100a, 0x2}, @flat=@weak_binder={0x77622a85, 0x110a, 0x3}, @fda={0x66646185, 0x5, 0x1, 0x1b}}, &(0x7f0000000100)={0x0, 0x18, 0x30}}, 0x1000}, @exit_looper], 0x0, 0x0, 0x0})
ioctl$KVM_GET_API_VERSION(0xffffffffffffffff, 0xae00, 0x0)

06:38:33 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x1c, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death={0x400c630e, 0x1}, @decrefs], 0x1000, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86ba206193131b1cf46e59dc8c518c380ed9793f370ae8da49c0092cd1726257d73f52570191f5ba4f868b372a713ffb555f5cb9c80fbec9354c1dc632ba43fc554dc34c3e552eac551d208b0c798ca1ae9c75a3fc3d6c039a343f5597f8593416a4bfb734d63dba7634586b1f4578667624810b8aa4fc7907767b39ed553d1ff659ec928ce4c8e62c8b80ae6f3bc6ba99adb7e4cdfbce49785cc407e7f59ef2f2b0bb58d91b2119ebc2639bfad3b159673c60b24f82512823a6de589ec029adb3e149f2ebe17426cfeac48b92064b33cc59d3ae6a368807c021aca1ff29dfe1889382b730ee97d7d187f7f1bb97cfb296f20fbe2e1aeeb773a1d10da3592f15998825d5283c0fcfba7de857ae7268cad3732ab5dcd73448062fe9a365a91d0b67e0d7d785a895a6aa058904a054695c31b09c9c2c801865ca3cc8b0cb4b2ceb9819d3f62ed199f5c21fae71d029e163671022e5aaf3b25b42c3b55c30533630efb3c6a131fd56a612e2fa5703f1d3357573b8c87e04b46110ee5e7d66a5c4375c30382ac9d09963edd7f41785ac774bb459dd540e2c0a618b82dacc0b325870f03b8d1451c7aa47fe5b6a2c74101bc6ff67ba1af363ddeb04e4322d78b7864f43c2eda43fd9c798b3e2c0c65d7fbb9ba5afb3b7c6406d1ae4da4941183f75b8475b7f92c0291cf7c8a9d44f629f8078e59eff8703e840c80e69d328eb73925a5cdbd57acb19618211ea117d7a8a1ed5de76ba3b2c128ec17beb65b9f17303b2ed51a226ae18167d3abc5979197bea0453519ed268c083b1b5eb85c9380eccc007151124d8170afa8382e39cff375f43c191964f502e39f722b444f7f36866782d8771c5f8b610a6b99c9041bdbc8b451a68e2fdbc2ad7a0762c1fdbd97659ba74d7daca6a63bf03f7ac2578ee96912996b8fa003a88a9cebffb9e36c1c9a8cc9977a61bb93cd85f7ebc0de74597e4071d65df7941bdcb347c2db0f214dd54326baf1eeef1211e542f5d4f5172e12dfc63c4de78593c52df0f3f1cbe1b8a9fb1f59242309c8f2699a66588a87ceefa0f660f304d8e8e7295448cb1cc350192833990f7d89225022c9a6205cdfcacccf996cd9e24fd1c419528f032a04d9437c2b72869961c90495ebc306707c04cb6d01cb1001c6d262fd69ed76e58a2e96d6297e608dfb100986549addd3150f7c163c206d33f3fb6de8e9c549086f61e5cf8cbf776ce8b6fedf4751b1be37a5c3339fb584d5e9d3d0e16d6a34ff5fadab7e335f230689641d171b5ff30b03042c28b6b1163f74a82d97930c05cf0c41b8229336aaf18d1d47e7bee5e7d7e50b33d0feccc6d411f6b881b2334083e3a8bc8d3bad4070176a853ee277684b4f3f812d9b624679ce3a5923f427dcab5f737288a3cabffa858e29030b70346925a82d6440bd2e6405ca6f0b21c713183ead55fea3af313920528d660f0beb935ec50c881eae3bbeb3c70100710dc9f7e8582ec00cc8461de0ec4b4f577f9b68020093fed727ae02fd689bb2e38f5817f3736050e3b9c53c0357a2df8807316c0e8336242f1977d1cb7f1d8a6cf1cc6c8a4f3521e3fa7719e58a148f068bdd20b1104f43b6f762292d10a3169dfdad50d668e1f109b9d7eeb76b3ba48d3302c5971d4df1b34d4c4a92929f3876d3bb868cefd02c9a08c364c1e557d5d0c246d5c28235f43cac9aa0f371bcba120235660e6b73b5a975e826607201241b7c385c5fab5c0e34c9dc1b33c4e48ca0a37525e2b4db287a180eed1f092a989db67f6b95c9850bf4326ac2a20f2a1403c553a085c035f7fbba1fe9f7d35066f6e2a68771bdeec7d401a6c654fc06d529ea1b0de033083343109c2ad1c5ad43f64502e026fa37f5fc59afcbb0a51a3c42484b7d21abfbb357fb4bb8cbefd135183b1adfe5e21456b0d7bd9d25eb81f7285424f5bc28ab69be3f9601f41ba2e7318c4dac37561ecf8dbddcc7ebaaa3671f0ab6e1faf58d7bb53d91c4f332a68ed9a36d2955a1d6e2bd19bb9dc11a69a49103188df42ef4767014da485b9c18f3d354a6d19608050c4d073bb7602fcd419b1acab536a852c2b4b3188257f250040cc3c06c0cd19f126a2d4bd2f930546e8f4f7c97090b2a906d57d0668050dc00ec93af78290fdd92da915883954ca1bea5a3858cad4dec18419e24f8e0eaf6e8f9ea9c38acb89033c4c28e30dfb054029a3766892f2e4a2a751572be31d93be94d92366a4c6260a3968a896b652be9a26bd3f162539883dbc0bb543559d9a825ac76b270254f0f3b70856051823afaf3fd2b54588d3be0b805e210def0b252900213e782bac9b1c917f9fd4ac8f51c13f4fa84360465172a97d3dabcb337f9fbe6bb72b8e18ef364a263408e2c8fe4891e31bb619db5f1b99b8256bef563f9f1acc37027112a53248fe7e5a6c8792685e5a0c13120cb2ae906c521214174bfd3cd783b7cc586eb09ba16dd4692fa08ed01b91496d4edc3a8cc421b023d34d4e2a1921513b457fddddebaa262f91f8953d3a7193b68fa3c779a9ef51a68ec227280eb78480ee34228c5db3f18699da509eb2f51aba41f6e39a9ade8efa2e1d5707fd293c5358c3c7ef35231a5831566db8dc2b8181e278bdbbca477a87590c48759eb3f862bd8a4770e2b7ef64484eeacea001737315a470bf68f6f5824d3a1f1d5a3b3c6157b03b5b9aca864dbf7877b7b1d20c8b6c2fdf5dab424ce1076391359f6daaa313c5b1384479f8a61ce733c4432389464dc414a60ee1b0c7efdc5fcc53811a144b10ca19159207baa775b2145d0b82d4fbc93116326e8d9c26a605812324cf8883f9bb7a7e28c0dcce5dbdedd835a36715201a1464bdad0783888e2916fe36a38aad080c287e0dd1ca6d966e5ba200941a8cd6df2b902feff11135ca87a79b0446e07897fd6555549352ebd8d4ba0aff161a5f6dcdd5d960abaa1b2cdab9b5d7c4332d967f480e21ff75064bffb6a9dd15f1ca9d6c4b9b1f65f16536f3d3be128fbba656c14270cf5174e692bde77ecd317f1e61632245fe13b6de7968739c4f0c18e0ccd85bf4e0979d63b283b2de3f460a579ca2b6ad93e16e1d50eb1886d2a1666937f631f89f9fa18a4e74a582e43b4181ccfd87df8640af31fb3f6a35de47318b1d0c13f9e4679f1c32819919edd25691284a237102efc085d342d5273f60186ab0b6071b1cfdf7e54529669515e9f69338b819f4044c6e0c299503c3cc464b7a40587da07605cc2a6134cd1801f29646b031846d6411598862a56e1313494cc5d54d85fca772697f8fc69ac997b6e570d4fa0f796ca0809fb36c9c76535dd6a5f0db924f09013a8a26be2426f4a3fecfe1b83f6bd16f4d9f2f7d40e1ef4ce3dfb647827b2d180b3e9fb8978a3dc64735403612e90f9178ace54a32786cf1640b6c1554b8dfc87455817e832dde45ffb37bab5746230dee9550ebb01626f31de99cbfcd1eeefa5f16e97c6caa795b6f12237f70c9419bd81718f27d08406e72b26474ecfc27c52b6de20cb2dd4b82c7e0e413f196471e86ac666dcdfa71ae0da22be2c071208b678837b55f50835f3f6605f2f2f822708f3d74b2c419a8db9b3ee7a2a0c000eb80225f4d1e5a01805af179220935805255987df25ee15322ccbf5c42393f04d9c36de56e38331edc7a630843cb22235d77ea92b496134d81725fef0dcaec37ca5e7e77e91ff38b8377eb0abe88a9c2919f539124f4c7a1a1bc0ae85fc601364f05bbfac17de50c7c13b2fb4667726c4e5dc5b647439bd11e3eef22a59b778c527d5181af55319e7750c1d941feb55489d391203b245af211638632b3a9894598042a8507858d2c28cdbb55d84adc84e05f961acd3a7f2a24f1b5e375f0401ac6727ad500713a49bf7cd41596badb1fde93a4d65598f1e9546384c93018e22dd4724930294bfd407c059a54e29064528e98b863503c2201f9c8676c47eb8297c40adda21a45b854ea5d682c7f823700a02d8b61b972fc91431b780d9d2bfdad2f6e882a170c4cb3a9b3e4f97fc34c2ec56fa6b0ba95679327373b190f5ed8102b32cd040949abfd4424ab1808f1df3895d678037bbcdc49d6fdb833885efeaf9ecc00986e3d06ca47e86c3c6cbd3a228fd7785158d4812e5941f8f071431ee4c5bddd9c4100db52b69f13d9322ef8181cf230ce1e15b88f651d51ad6b8107c69f040a5f5462290ef0d1454e622f8af8833733a7d5f974ca0ff873f2e85367f4801eff4ea2577845716a31fc066effe1936367c50788de3badcae8f97a4f9a938434151359836747d917df2010863bf00c69d324e03f72e05e65a25a21f17f6eb1a58234cffaa57d611bebe6ed013d2e7feb13d01f128616c7acc1dd097ba9fc2c0e0f881496be7f59240f9c0f23630c23cbc4f5f8017deab15befd7c9e0e3c7865d975c001b28c6d29d4d2e1c078158af58a78fd822f28788731c5db8c902bab8c825c521d5be6ca4d876ea4cbdef41053739f2e74f802986f744be65abb203e5fdbcd6898be36da8cc4a3ccb93666c6cb0409232545e6cc5168e21942e66c2668b6a29de01a13bf7402800261553a955f2a52f441c13cacb0bc9a5047355c9fe4f21f515bb05f0edc2e3ba5a5abfa64255c536823e289674508ce7877deb526ee4e5071a4917558c7f942af83fa4246725545037b48578ab5f4a92c9a9cbd40436fedaba7d6b9bbe09bb8a950e765fce47b04f6f4f24da6f270f61e72d1c03a0eab02441596c4593abc25897e48b889fd0e46511167012d2eded4fa4e151378e6cfbfe41e551f9f05bb0d2682e4372603eb0f798321d228f39f98519ae9f45537d0ac1c58077dcd4f09f8bdfefd9b2e83429df481e76f1782ce604063a5b0ebf9d61410f23f339ed6be0c481b1ca87739cbe677bf12f1a94d3d5599b93b381af29b459ebde519291602e971363570c98ee9ed5d6aa5b8839bf73a06f24c4f265568b036c5ae65bb3273826523e95e59166907ad996d96f42e6b354fd793f85642ff216476d80df359829cf068f8608449fa3032cc2d87c72ee1d0fac0ff643287174a8c260c37659f09dacc254924f0b37eec4d42f477b8421fc93de0cf3067ebd965296d7849644a12305c0d70ebf6718afc7ad2f950a007ca53ca832781fbcb4e43de8885e492ab21e0dc5e0e16da16191ec3db4d5a05f92a5d2c3e79d0527f26370f24daf8e4e7b20d69646cd0f30774d29e45ba74f89a6dda8f779ec05b0e7cc4e65f69dc02587b8e53779368eda849359528d1eb495dd33baa5658940d51af8be82a4b7f1a7e1f1f1511cec52ea56b99c7cde55ea05adbde760262e1fd4beb3c0bb8516f050a099b06e4e75da29af597242fc746d42f7e5add204428bd35e4d2a06ccf4822b8d137ef863e5ac35a4c2246a95da45f5b3b9cded7d41fc93aeb98114ce0edfbcaaee4314ffa95c35cda0c8c4d62b8e721395a220182e809e2d3cf48fda10253e67ec56ee8db3455c33f41890cf6e08e6c188aa73bc396d945c1fca00c4752179a497ad7c5c56ef3511152bf27e0109a86554e7a781b4e5a4904c4c59994083ba0b1d4ad14a475b5ce841c2c017281eb54ddd0803b25a6df9e09b8e7340913afb5c0f659d82f28bd6a54cdd54e61960be12c75dd688b0c4ebd672d54ea4771f0046afabe8f8e7e98f960280f0afd7373ba1770b9ff0624fcfe5187f2ce4bb3adaa5398dd73"})

06:38:33 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

06:38:33 executing program 3:
ioctl$KVM_CHECK_EXTENSION(0xffffffffffffffff, 0xae03, 0x3f)
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_TRAP_GET(r1, &(0x7f0000000740)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000700)={&(0x7f0000000600)={0x100, 0x0, 0x2, 0x70bd27, 0x25dfdbff, {}, [{@pci={{0x8}, {0x11}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}]}, 0x100}}, 0x28001)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r1, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
socket$phonet_pipe(0x23, 0x5, 0x2)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r2, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
socket(0x4, 0x1, 0x5)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="db1e29bd7000fbdbdf250600000008000300", @ANYRES32, @ANYBLOB='\f'], 0x30}}, 0x0)

06:38:34 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x6c, 0x0, &(0x7f0000000340)=[@acquire, @acquire_done, @exit_looper, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xa1, 0x0, &(0x7f00000003c0)="81f4bf5574322fe2f759e010e412a85afd76c59793bd41a5db1b3652a9cc81d13103ec6b01d8e5631a6cfd388e3486c8f8d4ddc7cb97bf470c301912c8d80e0309da9b3a77c91376587e2d1c2dae5b0c0c81a81f3060148938c2b26885697ca67b741d01f14f68d0d97387e10d49b1e0037c396d30e3c95073055a2d4d18c8a25c4f9b4db1058bed144023bfabb6c161af32bed1f6afe54d20cec0602c3a50ced5"})

06:38:34 executing program 0:
gettid()
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
waitid(0x0, 0x0, &(0x7f00000000c0), 0x20000000, 0x0)

06:38:34 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="03630840", @ANYRES64=0x0, @ANYBLOB="fa0d437a544e9c0d630000351767c6b5bb9c3f020d6b5f322de56517045b34cfb16ad316e243da0312e90cb2e428cb4767ddb0554c760676b310dd8b0070d6ced35eb7d0883fc3d36250e4c1772db14a5820f6bf146f6a092d78960e88dad47f4db90e1c5a02af6e28128e874b39e67ae34a9ed405f72de996c764d4f72b0ab9fcb55d3d3cf2fe22f3745a4c32b013e6b842b11dfe70"], 0x0, 0x0, 0x0})

06:38:34 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x24, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death={0x400c630e, 0x1}, @increfs, @decrefs], 0x1000, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86ba206193131b1cf46e59dc8c518c380ed9793f370ae8da49c0092cd1726257d73f52570191f5ba4f868b372a713ffb555f5cb9c80fbec9354c1dc632ba43fc554dc34c3e552eac551d208b0c798ca1ae9c75a3fc3d6c039a343f5597f8593416a4bfb734d63dba7634586b1f4578667624810b8aa4fc7907767b39ed553d1ff659ec928ce4c8e62c8b80ae6f3bc6ba99adb7e4cdfbce49785cc407e7f59ef2f2b0bb58d91b2119ebc2639bfad3b159673c60b24f82512823a6de589ec029adb3e149f2ebe17426cfeac48b92064b33cc59d3ae6a368807c021aca1ff29dfe1889382b730ee97d7d187f7f1bb97cfb296f20fbe2e1aeeb773a1d10da3592f15998825d5283c0fcfba7de857ae7268cad3732ab5dcd73448062fe9a365a91d0b67e0d7d785a895a6aa058904a054695c31b09c9c2c801865ca3cc8b0cb4b2ceb9819d3f62ed199f5c21fae71d029e163671022e5aaf3b25b42c3b55c30533630efb3c6a131fd56a612e2fa5703f1d3357573b8c87e04b46110ee5e7d66a5c4375c30382ac9d09963edd7f41785ac774bb459dd540e2c0a618b82dacc0b325870f03b8d1451c7aa47fe5b6a2c74101bc6ff67ba1af363ddeb04e4322d78b7864f43c2eda43fd9c798b3e2c0c65d7fbb9ba5afb3b7c6406d1ae4da4941183f75b8475b7f92c0291cf7c8a9d44f629f8078e59eff8703e840c80e69d328eb73925a5cdbd57acb19618211ea117d7a8a1ed5de76ba3b2c128ec17beb65b9f17303b2ed51a226ae18167d3abc5979197bea0453519ed268c083b1b5eb85c9380eccc007151124d8170afa8382e39cff375f43c191964f502e39f722b444f7f36866782d8771c5f8b610a6b99c9041bdbc8b451a68e2fdbc2ad7a0762c1fdbd97659ba74d7daca6a63bf03f7ac2578ee96912996b8fa003a88a9cebffb9e36c1c9a8cc9977a61bb93cd85f7ebc0de74597e4071d65df7941bdcb347c2db0f214dd54326baf1eeef1211e542f5d4f5172e12dfc63c4de78593c52df0f3f1cbe1b8a9fb1f59242309c8f2699a66588a87ceefa0f660f304d8e8e7295448cb1cc350192833990f7d89225022c9a6205cdfcacccf996cd9e24fd1c419528f032a04d9437c2b72869961c90495ebc306707c04cb6d01cb1001c6d262fd69ed76e58a2e96d6297e608dfb100986549addd3150f7c163c206d33f3fb6de8e9c549086f61e5cf8cbf776ce8b6fedf4751b1be37a5c3339fb584d5e9d3d0e16d6a34ff5fadab7e335f230689641d171b5ff30b03042c28b6b1163f74a82d97930c05cf0c41b8229336aaf18d1d47e7bee5e7d7e50b33d0feccc6d411f6b881b2334083e3a8bc8d3bad4070176a853ee277684b4f3f812d9b624679ce3a5923f427dcab5f737288a3cabffa858e29030b70346925a82d6440bd2e6405ca6f0b21c713183ead55fea3af313920528d660f0beb935ec50c881eae3bbeb3c70100710dc9f7e8582ec00cc8461de0ec4b4f577f9b68020093fed727ae02fd689bb2e38f5817f3736050e3b9c53c0357a2df8807316c0e8336242f1977d1cb7f1d8a6cf1cc6c8a4f3521e3fa7719e58a148f068bdd20b1104f43b6f762292d10a3169dfdad50d668e1f109b9d7eeb76b3ba48d3302c5971d4df1b34d4c4a92929f3876d3bb868cefd02c9a08c364c1e557d5d0c246d5c28235f43cac9aa0f371bcba120235660e6b73b5a975e826607201241b7c385c5fab5c0e34c9dc1b33c4e48ca0a37525e2b4db287a180eed1f092a989db67f6b95c9850bf4326ac2a20f2a1403c553a085c035f7fbba1fe9f7d35066f6e2a68771bdeec7d401a6c654fc06d529ea1b0de033083343109c2ad1c5ad43f64502e026fa37f5fc59afcbb0a51a3c42484b7d21abfbb357fb4bb8cbefd135183b1adfe5e21456b0d7bd9d25eb81f7285424f5bc28ab69be3f9601f41ba2e7318c4dac37561ecf8dbddcc7ebaaa3671f0ab6e1faf58d7bb53d91c4f332a68ed9a36d2955a1d6e2bd19bb9dc11a69a49103188df42ef4767014da485b9c18f3d354a6d19608050c4d073bb7602fcd419b1acab536a852c2b4b3188257f250040cc3c06c0cd19f126a2d4bd2f930546e8f4f7c97090b2a906d57d0668050dc00ec93af78290fdd92da915883954ca1bea5a3858cad4dec18419e24f8e0eaf6e8f9ea9c38acb89033c4c28e30dfb054029a3766892f2e4a2a751572be31d93be94d92366a4c6260a3968a896b652be9a26bd3f162539883dbc0bb543559d9a825ac76b270254f0f3b70856051823afaf3fd2b54588d3be0b805e210def0b252900213e782bac9b1c917f9fd4ac8f51c13f4fa84360465172a97d3dabcb337f9fbe6bb72b8e18ef364a263408e2c8fe4891e31bb619db5f1b99b8256bef563f9f1acc37027112a53248fe7e5a6c8792685e5a0c13120cb2ae906c521214174bfd3cd783b7cc586eb09ba16dd4692fa08ed01b91496d4edc3a8cc421b023d34d4e2a1921513b457fddddebaa262f91f8953d3a7193b68fa3c779a9ef51a68ec227280eb78480ee34228c5db3f18699da509eb2f51aba41f6e39a9ade8efa2e1d5707fd293c5358c3c7ef35231a5831566db8dc2b8181e278bdbbca477a87590c48759eb3f862bd8a4770e2b7ef64484eeacea001737315a470bf68f6f5824d3a1f1d5a3b3c6157b03b5b9aca864dbf7877b7b1d20c8b6c2fdf5dab424ce1076391359f6daaa313c5b1384479f8a61ce733c4432389464dc414a60ee1b0c7efdc5fcc53811a144b10ca19159207baa775b2145d0b82d4fbc93116326e8d9c26a605812324cf8883f9bb7a7e28c0dcce5dbdedd835a36715201a1464bdad0783888e2916fe36a38aad080c287e0dd1ca6d966e5ba200941a8cd6df2b902feff11135ca87a79b0446e07897fd6555549352ebd8d4ba0aff161a5f6dcdd5d960abaa1b2cdab9b5d7c4332d967f480e21ff75064bffb6a9dd15f1ca9d6c4b9b1f65f16536f3d3be128fbba656c14270cf5174e692bde77ecd317f1e61632245fe13b6de7968739c4f0c18e0ccd85bf4e0979d63b283b2de3f460a579ca2b6ad93e16e1d50eb1886d2a1666937f631f89f9fa18a4e74a582e43b4181ccfd87df8640af31fb3f6a35de47318b1d0c13f9e4679f1c32819919edd25691284a237102efc085d342d5273f60186ab0b6071b1cfdf7e54529669515e9f69338b819f4044c6e0c299503c3cc464b7a40587da07605cc2a6134cd1801f29646b031846d6411598862a56e1313494cc5d54d85fca772697f8fc69ac997b6e570d4fa0f796ca0809fb36c9c76535dd6a5f0db924f09013a8a26be2426f4a3fecfe1b83f6bd16f4d9f2f7d40e1ef4ce3dfb647827b2d180b3e9fb8978a3dc64735403612e90f9178ace54a32786cf1640b6c1554b8dfc87455817e832dde45ffb37bab5746230dee9550ebb01626f31de99cbfcd1eeefa5f16e97c6caa795b6f12237f70c9419bd81718f27d08406e72b26474ecfc27c52b6de20cb2dd4b82c7e0e413f196471e86ac666dcdfa71ae0da22be2c071208b678837b55f50835f3f6605f2f2f822708f3d74b2c419a8db9b3ee7a2a0c000eb80225f4d1e5a01805af179220935805255987df25ee15322ccbf5c42393f04d9c36de56e38331edc7a630843cb22235d77ea92b496134d81725fef0dcaec37ca5e7e77e91ff38b8377eb0abe88a9c2919f539124f4c7a1a1bc0ae85fc601364f05bbfac17de50c7c13b2fb4667726c4e5dc5b647439bd11e3eef22a59b778c527d5181af55319e7750c1d941feb55489d391203b245af211638632b3a9894598042a8507858d2c28cdbb55d84adc84e05f961acd3a7f2a24f1b5e375f0401ac6727ad500713a49bf7cd41596badb1fde93a4d65598f1e9546384c93018e22dd4724930294bfd407c059a54e29064528e98b863503c2201f9c8676c47eb8297c40adda21a45b854ea5d682c7f823700a02d8b61b972fc91431b780d9d2bfdad2f6e882a170c4cb3a9b3e4f97fc34c2ec56fa6b0ba95679327373b190f5ed8102b32cd040949abfd4424ab1808f1df3895d678037bbcdc49d6fdb833885efeaf9ecc00986e3d06ca47e86c3c6cbd3a228fd7785158d4812e5941f8f071431ee4c5bddd9c4100db52b69f13d9322ef8181cf230ce1e15b88f651d51ad6b8107c69f040a5f5462290ef0d1454e622f8af8833733a7d5f974ca0ff873f2e85367f4801eff4ea2577845716a31fc066effe1936367c50788de3badcae8f97a4f9a938434151359836747d917df2010863bf00c69d324e03f72e05e65a25a21f17f6eb1a58234cffaa57d611bebe6ed013d2e7feb13d01f128616c7acc1dd097ba9fc2c0e0f881496be7f59240f9c0f23630c23cbc4f5f8017deab15befd7c9e0e3c7865d975c001b28c6d29d4d2e1c078158af58a78fd822f28788731c5db8c902bab8c825c521d5be6ca4d876ea4cbdef41053739f2e74f802986f744be65abb203e5fdbcd6898be36da8cc4a3ccb93666c6cb0409232545e6cc5168e21942e66c2668b6a29de01a13bf7402800261553a955f2a52f441c13cacb0bc9a5047355c9fe4f21f515bb05f0edc2e3ba5a5abfa64255c536823e289674508ce7877deb526ee4e5071a4917558c7f942af83fa4246725545037b48578ab5f4a92c9a9cbd40436fedaba7d6b9bbe09bb8a950e765fce47b04f6f4f24da6f270f61e72d1c03a0eab02441596c4593abc25897e48b889fd0e46511167012d2eded4fa4e151378e6cfbfe41e551f9f05bb0d2682e4372603eb0f798321d228f39f98519ae9f45537d0ac1c58077dcd4f09f8bdfefd9b2e83429df481e76f1782ce604063a5b0ebf9d61410f23f339ed6be0c481b1ca87739cbe677bf12f1a94d3d5599b93b381af29b459ebde519291602e971363570c98ee9ed5d6aa5b8839bf73a06f24c4f265568b036c5ae65bb3273826523e95e59166907ad996d96f42e6b354fd793f85642ff216476d80df359829cf068f8608449fa3032cc2d87c72ee1d0fac0ff643287174a8c260c37659f09dacc254924f0b37eec4d42f477b8421fc93de0cf3067ebd965296d7849644a12305c0d70ebf6718afc7ad2f950a007ca53ca832781fbcb4e43de8885e492ab21e0dc5e0e16da16191ec3db4d5a05f92a5d2c3e79d0527f26370f24daf8e4e7b20d69646cd0f30774d29e45ba74f89a6dda8f779ec05b0e7cc4e65f69dc02587b8e53779368eda849359528d1eb495dd33baa5658940d51af8be82a4b7f1a7e1f1f1511cec52ea56b99c7cde55ea05adbde760262e1fd4beb3c0bb8516f050a099b06e4e75da29af597242fc746d42f7e5add204428bd35e4d2a06ccf4822b8d137ef863e5ac35a4c2246a95da45f5b3b9cded7d41fc93aeb98114ce0edfbcaaee4314ffa95c35cda0c8c4d62b8e721395a220182e809e2d3cf48fda10253e67ec56ee8db3455c33f41890cf6e08e6c188aa73bc396d945c1fca00c4752179a497ad7c5c56ef3511152bf27e0109a86554e7a781b4e5a4904c4c59994083ba0b1d4ad14a475b5ce841c2c017281eb54ddd0803b25a6df9e09b8e7340913afb5c0f659d82f28bd6a54cdd54e61960be12c75dd688b0c4ebd672d54ea4771f0046afabe8f8e7e98f960280f0afd7373ba1770b9ff0624fcfe5187f2ce4bb3adaa5398dd73"})

06:38:34 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 1626.701108][T10440] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.3'.
[ 1626.895448][T10445] binder: 10443:10445 unknown command 2051214842
[ 1626.902289][T10445] binder: 10443:10445 ioctl c0306201 20000180 returned -22
06:38:34 executing program 3:
ioctl$KVM_CHECK_EXTENSION(0xffffffffffffffff, 0xae03, 0x3f)
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_TRAP_GET(r1, &(0x7f0000000740)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000700)={&(0x7f0000000600)={0x100, 0x0, 0x2, 0x70bd27, 0x25dfdbff, {}, [{@pci={{0x8}, {0x11}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}]}, 0x100}}, 0x28001)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r1, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
socket$phonet_pipe(0x23, 0x5, 0x2)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r2, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="db1e29bd7000fbdbdf250600000008000300", @ANYRES32, @ANYBLOB='\f'], 0x30}}, 0x0)

06:38:34 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x6c, 0x0, &(0x7f0000000340)=[@acquire, @acquire_done, @exit_looper, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xa1, 0x0, &(0x7f00000003c0)="81f4bf5574322fe2f759e010e412a85afd76c59793bd41a5db1b3652a9cc81d13103ec6b01d8e5631a6cfd388e3486c8f8d4ddc7cb97bf470c301912c8d80e0309da9b3a77c91376587e2d1c2dae5b0c0c81a81f3060148938c2b26885697ca67b741d01f14f68d0d97387e10d49b1e0037c396d30e3c95073055a2d4d18c8a25c4f9b4db1058bed144023bfabb6c161af32bed1f6afe54d20cec0602c3a50ced5"})

06:38:34 executing program 0:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
waitid(0x0, 0x0, &(0x7f00000000c0), 0x20000000, 0x0)

06:38:34 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES64=0x0, @ANYBLOB="1d63c47f"], 0x0, 0x0, 0x0})
setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, 0x0, 0x0)
ioctl$BINDER_GET_NODE_INFO_FOR_REF(0xffffffffffffffff, 0xc018620c, &(0x7f0000000080)={0x1})

06:38:34 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 1627.285421][T10452] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.3'.
06:38:35 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x24, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death={0x400c630e, 0x1}, @increfs, @decrefs], 0x1000, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86ba206193131b1cf46e59dc8c518c380ed9793f370ae8da49c0092cd1726257d73f52570191f5ba4f868b372a713ffb555f5cb9c80fbec9354c1dc632ba43fc554dc34c3e552eac551d208b0c798ca1ae9c75a3fc3d6c039a343f5597f8593416a4bfb734d63dba7634586b1f4578667624810b8aa4fc7907767b39ed553d1ff659ec928ce4c8e62c8b80ae6f3bc6ba99adb7e4cdfbce49785cc407e7f59ef2f2b0bb58d91b2119ebc2639bfad3b159673c60b24f82512823a6de589ec029adb3e149f2ebe17426cfeac48b92064b33cc59d3ae6a368807c021aca1ff29dfe1889382b730ee97d7d187f7f1bb97cfb296f20fbe2e1aeeb773a1d10da3592f15998825d5283c0fcfba7de857ae7268cad3732ab5dcd73448062fe9a365a91d0b67e0d7d785a895a6aa058904a054695c31b09c9c2c801865ca3cc8b0cb4b2ceb9819d3f62ed199f5c21fae71d029e163671022e5aaf3b25b42c3b55c30533630efb3c6a131fd56a612e2fa5703f1d3357573b8c87e04b46110ee5e7d66a5c4375c30382ac9d09963edd7f41785ac774bb459dd540e2c0a618b82dacc0b325870f03b8d1451c7aa47fe5b6a2c74101bc6ff67ba1af363ddeb04e4322d78b7864f43c2eda43fd9c798b3e2c0c65d7fbb9ba5afb3b7c6406d1ae4da4941183f75b8475b7f92c0291cf7c8a9d44f629f8078e59eff8703e840c80e69d328eb73925a5cdbd57acb19618211ea117d7a8a1ed5de76ba3b2c128ec17beb65b9f17303b2ed51a226ae18167d3abc5979197bea0453519ed268c083b1b5eb85c9380eccc007151124d8170afa8382e39cff375f43c191964f502e39f722b444f7f36866782d8771c5f8b610a6b99c9041bdbc8b451a68e2fdbc2ad7a0762c1fdbd97659ba74d7daca6a63bf03f7ac2578ee96912996b8fa003a88a9cebffb9e36c1c9a8cc9977a61bb93cd85f7ebc0de74597e4071d65df7941bdcb347c2db0f214dd54326baf1eeef1211e542f5d4f5172e12dfc63c4de78593c52df0f3f1cbe1b8a9fb1f59242309c8f2699a66588a87ceefa0f660f304d8e8e7295448cb1cc350192833990f7d89225022c9a6205cdfcacccf996cd9e24fd1c419528f032a04d9437c2b72869961c90495ebc306707c04cb6d01cb1001c6d262fd69ed76e58a2e96d6297e608dfb100986549addd3150f7c163c206d33f3fb6de8e9c549086f61e5cf8cbf776ce8b6fedf4751b1be37a5c3339fb584d5e9d3d0e16d6a34ff5fadab7e335f230689641d171b5ff30b03042c28b6b1163f74a82d97930c05cf0c41b8229336aaf18d1d47e7bee5e7d7e50b33d0feccc6d411f6b881b2334083e3a8bc8d3bad4070176a853ee277684b4f3f812d9b624679ce3a5923f427dcab5f737288a3cabffa858e29030b70346925a82d6440bd2e6405ca6f0b21c713183ead55fea3af313920528d660f0beb935ec50c881eae3bbeb3c70100710dc9f7e8582ec00cc8461de0ec4b4f577f9b68020093fed727ae02fd689bb2e38f5817f3736050e3b9c53c0357a2df8807316c0e8336242f1977d1cb7f1d8a6cf1cc6c8a4f3521e3fa7719e58a148f068bdd20b1104f43b6f762292d10a3169dfdad50d668e1f109b9d7eeb76b3ba48d3302c5971d4df1b34d4c4a92929f3876d3bb868cefd02c9a08c364c1e557d5d0c246d5c28235f43cac9aa0f371bcba120235660e6b73b5a975e826607201241b7c385c5fab5c0e34c9dc1b33c4e48ca0a37525e2b4db287a180eed1f092a989db67f6b95c9850bf4326ac2a20f2a1403c553a085c035f7fbba1fe9f7d35066f6e2a68771bdeec7d401a6c654fc06d529ea1b0de033083343109c2ad1c5ad43f64502e026fa37f5fc59afcbb0a51a3c42484b7d21abfbb357fb4bb8cbefd135183b1adfe5e21456b0d7bd9d25eb81f7285424f5bc28ab69be3f9601f41ba2e7318c4dac37561ecf8dbddcc7ebaaa3671f0ab6e1faf58d7bb53d91c4f332a68ed9a36d2955a1d6e2bd19bb9dc11a69a49103188df42ef4767014da485b9c18f3d354a6d19608050c4d073bb7602fcd419b1acab536a852c2b4b3188257f250040cc3c06c0cd19f126a2d4bd2f930546e8f4f7c97090b2a906d57d0668050dc00ec93af78290fdd92da915883954ca1bea5a3858cad4dec18419e24f8e0eaf6e8f9ea9c38acb89033c4c28e30dfb054029a3766892f2e4a2a751572be31d93be94d92366a4c6260a3968a896b652be9a26bd3f162539883dbc0bb543559d9a825ac76b270254f0f3b70856051823afaf3fd2b54588d3be0b805e210def0b252900213e782bac9b1c917f9fd4ac8f51c13f4fa84360465172a97d3dabcb337f9fbe6bb72b8e18ef364a263408e2c8fe4891e31bb619db5f1b99b8256bef563f9f1acc37027112a53248fe7e5a6c8792685e5a0c13120cb2ae906c521214174bfd3cd783b7cc586eb09ba16dd4692fa08ed01b91496d4edc3a8cc421b023d34d4e2a1921513b457fddddebaa262f91f8953d3a7193b68fa3c779a9ef51a68ec227280eb78480ee34228c5db3f18699da509eb2f51aba41f6e39a9ade8efa2e1d5707fd293c5358c3c7ef35231a5831566db8dc2b8181e278bdbbca477a87590c48759eb3f862bd8a4770e2b7ef64484eeacea001737315a470bf68f6f5824d3a1f1d5a3b3c6157b03b5b9aca864dbf7877b7b1d20c8b6c2fdf5dab424ce1076391359f6daaa313c5b1384479f8a61ce733c4432389464dc414a60ee1b0c7efdc5fcc53811a144b10ca19159207baa775b2145d0b82d4fbc93116326e8d9c26a605812324cf8883f9bb7a7e28c0dcce5dbdedd835a36715201a1464bdad0783888e2916fe36a38aad080c287e0dd1ca6d966e5ba200941a8cd6df2b902feff11135ca87a79b0446e07897fd6555549352ebd8d4ba0aff161a5f6dcdd5d960abaa1b2cdab9b5d7c4332d967f480e21ff75064bffb6a9dd15f1ca9d6c4b9b1f65f16536f3d3be128fbba656c14270cf5174e692bde77ecd317f1e61632245fe13b6de7968739c4f0c18e0ccd85bf4e0979d63b283b2de3f460a579ca2b6ad93e16e1d50eb1886d2a1666937f631f89f9fa18a4e74a582e43b4181ccfd87df8640af31fb3f6a35de47318b1d0c13f9e4679f1c32819919edd25691284a237102efc085d342d5273f60186ab0b6071b1cfdf7e54529669515e9f69338b819f4044c6e0c299503c3cc464b7a40587da07605cc2a6134cd1801f29646b031846d6411598862a56e1313494cc5d54d85fca772697f8fc69ac997b6e570d4fa0f796ca0809fb36c9c76535dd6a5f0db924f09013a8a26be2426f4a3fecfe1b83f6bd16f4d9f2f7d40e1ef4ce3dfb647827b2d180b3e9fb8978a3dc64735403612e90f9178ace54a32786cf1640b6c1554b8dfc87455817e832dde45ffb37bab5746230dee9550ebb01626f31de99cbfcd1eeefa5f16e97c6caa795b6f12237f70c9419bd81718f27d08406e72b26474ecfc27c52b6de20cb2dd4b82c7e0e413f196471e86ac666dcdfa71ae0da22be2c071208b678837b55f50835f3f6605f2f2f822708f3d74b2c419a8db9b3ee7a2a0c000eb80225f4d1e5a01805af179220935805255987df25ee15322ccbf5c42393f04d9c36de56e38331edc7a630843cb22235d77ea92b496134d81725fef0dcaec37ca5e7e77e91ff38b8377eb0abe88a9c2919f539124f4c7a1a1bc0ae85fc601364f05bbfac17de50c7c13b2fb4667726c4e5dc5b647439bd11e3eef22a59b778c527d5181af55319e7750c1d941feb55489d391203b245af211638632b3a9894598042a8507858d2c28cdbb55d84adc84e05f961acd3a7f2a24f1b5e375f0401ac6727ad500713a49bf7cd41596badb1fde93a4d65598f1e9546384c93018e22dd4724930294bfd407c059a54e29064528e98b863503c2201f9c8676c47eb8297c40adda21a45b854ea5d682c7f823700a02d8b61b972fc91431b780d9d2bfdad2f6e882a170c4cb3a9b3e4f97fc34c2ec56fa6b0ba95679327373b190f5ed8102b32cd040949abfd4424ab1808f1df3895d678037bbcdc49d6fdb833885efeaf9ecc00986e3d06ca47e86c3c6cbd3a228fd7785158d4812e5941f8f071431ee4c5bddd9c4100db52b69f13d9322ef8181cf230ce1e15b88f651d51ad6b8107c69f040a5f5462290ef0d1454e622f8af8833733a7d5f974ca0ff873f2e85367f4801eff4ea2577845716a31fc066effe1936367c50788de3badcae8f97a4f9a938434151359836747d917df2010863bf00c69d324e03f72e05e65a25a21f17f6eb1a58234cffaa57d611bebe6ed013d2e7feb13d01f128616c7acc1dd097ba9fc2c0e0f881496be7f59240f9c0f23630c23cbc4f5f8017deab15befd7c9e0e3c7865d975c001b28c6d29d4d2e1c078158af58a78fd822f28788731c5db8c902bab8c825c521d5be6ca4d876ea4cbdef41053739f2e74f802986f744be65abb203e5fdbcd6898be36da8cc4a3ccb93666c6cb0409232545e6cc5168e21942e66c2668b6a29de01a13bf7402800261553a955f2a52f441c13cacb0bc9a5047355c9fe4f21f515bb05f0edc2e3ba5a5abfa64255c536823e289674508ce7877deb526ee4e5071a4917558c7f942af83fa4246725545037b48578ab5f4a92c9a9cbd40436fedaba7d6b9bbe09bb8a950e765fce47b04f6f4f24da6f270f61e72d1c03a0eab02441596c4593abc25897e48b889fd0e46511167012d2eded4fa4e151378e6cfbfe41e551f9f05bb0d2682e4372603eb0f798321d228f39f98519ae9f45537d0ac1c58077dcd4f09f8bdfefd9b2e83429df481e76f1782ce604063a5b0ebf9d61410f23f339ed6be0c481b1ca87739cbe677bf12f1a94d3d5599b93b381af29b459ebde519291602e971363570c98ee9ed5d6aa5b8839bf73a06f24c4f265568b036c5ae65bb3273826523e95e59166907ad996d96f42e6b354fd793f85642ff216476d80df359829cf068f8608449fa3032cc2d87c72ee1d0fac0ff643287174a8c260c37659f09dacc254924f0b37eec4d42f477b8421fc93de0cf3067ebd965296d7849644a12305c0d70ebf6718afc7ad2f950a007ca53ca832781fbcb4e43de8885e492ab21e0dc5e0e16da16191ec3db4d5a05f92a5d2c3e79d0527f26370f24daf8e4e7b20d69646cd0f30774d29e45ba74f89a6dda8f779ec05b0e7cc4e65f69dc02587b8e53779368eda849359528d1eb495dd33baa5658940d51af8be82a4b7f1a7e1f1f1511cec52ea56b99c7cde55ea05adbde760262e1fd4beb3c0bb8516f050a099b06e4e75da29af597242fc746d42f7e5add204428bd35e4d2a06ccf4822b8d137ef863e5ac35a4c2246a95da45f5b3b9cded7d41fc93aeb98114ce0edfbcaaee4314ffa95c35cda0c8c4d62b8e721395a220182e809e2d3cf48fda10253e67ec56ee8db3455c33f41890cf6e08e6c188aa73bc396d945c1fca00c4752179a497ad7c5c56ef3511152bf27e0109a86554e7a781b4e5a4904c4c59994083ba0b1d4ad14a475b5ce841c2c017281eb54ddd0803b25a6df9e09b8e7340913afb5c0f659d82f28bd6a54cdd54e61960be12c75dd688b0c4ebd672d54ea4771f0046afabe8f8e7e98f960280f0afd7373ba1770b9ff0624fcfe5187f2ce4bb3adaa5398dd73"})

06:38:35 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x6c, 0x0, &(0x7f0000000340)=[@acquire={0x40046305, 0x3}, @acquire_done, @exit_looper, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

06:38:35 executing program 3:
ioctl$KVM_CHECK_EXTENSION(0xffffffffffffffff, 0xae03, 0x3f)
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_TRAP_GET(r1, &(0x7f0000000740)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000700)={&(0x7f0000000600)={0x100, 0x0, 0x2, 0x70bd27, 0x25dfdbff, {}, [{@pci={{0x8}, {0x11}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}]}, 0x100}}, 0x28001)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r1, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
socket$phonet_pipe(0x23, 0x5, 0x2)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r2, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="db1e29bd7000fbdbdf250600000008000300", @ANYRES32, @ANYBLOB='\f'], 0x30}}, 0x0)

[ 1627.625708][T10461] binder: 10458:10461 unknown command 0
[ 1627.631552][T10461] binder: 10458:10461 ioctl c0306201 20000180 returned -22
06:38:35 executing program 0:
syz_open_dev$binderN(0x0, 0x0, 0x0)
waitid(0x0, 0x0, &(0x7f00000000c0), 0x20000000, 0x0)

[ 1627.698306][T10461] binder: 10458:10461 unknown command 0
[ 1627.704182][T10461] binder: 10458:10461 ioctl c0306201 20000180 returned -22
06:38:35 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000002c0)})

06:38:35 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x24, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death={0x400c630e, 0x1}, @increfs, @decrefs], 0x1000, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86ba206193131b1cf46e59dc8c518c380ed9793f370ae8da49c0092cd1726257d73f52570191f5ba4f868b372a713ffb555f5cb9c80fbec9354c1dc632ba43fc554dc34c3e552eac551d208b0c798ca1ae9c75a3fc3d6c039a343f5597f8593416a4bfb734d63dba7634586b1f4578667624810b8aa4fc7907767b39ed553d1ff659ec928ce4c8e62c8b80ae6f3bc6ba99adb7e4cdfbce49785cc407e7f59ef2f2b0bb58d91b2119ebc2639bfad3b159673c60b24f82512823a6de589ec029adb3e149f2ebe17426cfeac48b92064b33cc59d3ae6a368807c021aca1ff29dfe1889382b730ee97d7d187f7f1bb97cfb296f20fbe2e1aeeb773a1d10da3592f15998825d5283c0fcfba7de857ae7268cad3732ab5dcd73448062fe9a365a91d0b67e0d7d785a895a6aa058904a054695c31b09c9c2c801865ca3cc8b0cb4b2ceb9819d3f62ed199f5c21fae71d029e163671022e5aaf3b25b42c3b55c30533630efb3c6a131fd56a612e2fa5703f1d3357573b8c87e04b46110ee5e7d66a5c4375c30382ac9d09963edd7f41785ac774bb459dd540e2c0a618b82dacc0b325870f03b8d1451c7aa47fe5b6a2c74101bc6ff67ba1af363ddeb04e4322d78b7864f43c2eda43fd9c798b3e2c0c65d7fbb9ba5afb3b7c6406d1ae4da4941183f75b8475b7f92c0291cf7c8a9d44f629f8078e59eff8703e840c80e69d328eb73925a5cdbd57acb19618211ea117d7a8a1ed5de76ba3b2c128ec17beb65b9f17303b2ed51a226ae18167d3abc5979197bea0453519ed268c083b1b5eb85c9380eccc007151124d8170afa8382e39cff375f43c191964f502e39f722b444f7f36866782d8771c5f8b610a6b99c9041bdbc8b451a68e2fdbc2ad7a0762c1fdbd97659ba74d7daca6a63bf03f7ac2578ee96912996b8fa003a88a9cebffb9e36c1c9a8cc9977a61bb93cd85f7ebc0de74597e4071d65df7941bdcb347c2db0f214dd54326baf1eeef1211e542f5d4f5172e12dfc63c4de78593c52df0f3f1cbe1b8a9fb1f59242309c8f2699a66588a87ceefa0f660f304d8e8e7295448cb1cc350192833990f7d89225022c9a6205cdfcacccf996cd9e24fd1c419528f032a04d9437c2b72869961c90495ebc306707c04cb6d01cb1001c6d262fd69ed76e58a2e96d6297e608dfb100986549addd3150f7c163c206d33f3fb6de8e9c549086f61e5cf8cbf776ce8b6fedf4751b1be37a5c3339fb584d5e9d3d0e16d6a34ff5fadab7e335f230689641d171b5ff30b03042c28b6b1163f74a82d97930c05cf0c41b8229336aaf18d1d47e7bee5e7d7e50b33d0feccc6d411f6b881b2334083e3a8bc8d3bad4070176a853ee277684b4f3f812d9b624679ce3a5923f427dcab5f737288a3cabffa858e29030b70346925a82d6440bd2e6405ca6f0b21c713183ead55fea3af313920528d660f0beb935ec50c881eae3bbeb3c70100710dc9f7e8582ec00cc8461de0ec4b4f577f9b68020093fed727ae02fd689bb2e38f5817f3736050e3b9c53c0357a2df8807316c0e8336242f1977d1cb7f1d8a6cf1cc6c8a4f3521e3fa7719e58a148f068bdd20b1104f43b6f762292d10a3169dfdad50d668e1f109b9d7eeb76b3ba48d3302c5971d4df1b34d4c4a92929f3876d3bb868cefd02c9a08c364c1e557d5d0c246d5c28235f43cac9aa0f371bcba120235660e6b73b5a975e826607201241b7c385c5fab5c0e34c9dc1b33c4e48ca0a37525e2b4db287a180eed1f092a989db67f6b95c9850bf4326ac2a20f2a1403c553a085c035f7fbba1fe9f7d35066f6e2a68771bdeec7d401a6c654fc06d529ea1b0de033083343109c2ad1c5ad43f64502e026fa37f5fc59afcbb0a51a3c42484b7d21abfbb357fb4bb8cbefd135183b1adfe5e21456b0d7bd9d25eb81f7285424f5bc28ab69be3f9601f41ba2e7318c4dac37561ecf8dbddcc7ebaaa3671f0ab6e1faf58d7bb53d91c4f332a68ed9a36d2955a1d6e2bd19bb9dc11a69a49103188df42ef4767014da485b9c18f3d354a6d19608050c4d073bb7602fcd419b1acab536a852c2b4b3188257f250040cc3c06c0cd19f126a2d4bd2f930546e8f4f7c97090b2a906d57d0668050dc00ec93af78290fdd92da915883954ca1bea5a3858cad4dec18419e24f8e0eaf6e8f9ea9c38acb89033c4c28e30dfb054029a3766892f2e4a2a751572be31d93be94d92366a4c6260a3968a896b652be9a26bd3f162539883dbc0bb543559d9a825ac76b270254f0f3b70856051823afaf3fd2b54588d3be0b805e210def0b252900213e782bac9b1c917f9fd4ac8f51c13f4fa84360465172a97d3dabcb337f9fbe6bb72b8e18ef364a263408e2c8fe4891e31bb619db5f1b99b8256bef563f9f1acc37027112a53248fe7e5a6c8792685e5a0c13120cb2ae906c521214174bfd3cd783b7cc586eb09ba16dd4692fa08ed01b91496d4edc3a8cc421b023d34d4e2a1921513b457fddddebaa262f91f8953d3a7193b68fa3c779a9ef51a68ec227280eb78480ee34228c5db3f18699da509eb2f51aba41f6e39a9ade8efa2e1d5707fd293c5358c3c7ef35231a5831566db8dc2b8181e278bdbbca477a87590c48759eb3f862bd8a4770e2b7ef64484eeacea001737315a470bf68f6f5824d3a1f1d5a3b3c6157b03b5b9aca864dbf7877b7b1d20c8b6c2fdf5dab424ce1076391359f6daaa313c5b1384479f8a61ce733c4432389464dc414a60ee1b0c7efdc5fcc53811a144b10ca19159207baa775b2145d0b82d4fbc93116326e8d9c26a605812324cf8883f9bb7a7e28c0dcce5dbdedd835a36715201a1464bdad0783888e2916fe36a38aad080c287e0dd1ca6d966e5ba200941a8cd6df2b902feff11135ca87a79b0446e07897fd6555549352ebd8d4ba0aff161a5f6dcdd5d960abaa1b2cdab9b5d7c4332d967f480e21ff75064bffb6a9dd15f1ca9d6c4b9b1f65f16536f3d3be128fbba656c14270cf5174e692bde77ecd317f1e61632245fe13b6de7968739c4f0c18e0ccd85bf4e0979d63b283b2de3f460a579ca2b6ad93e16e1d50eb1886d2a1666937f631f89f9fa18a4e74a582e43b4181ccfd87df8640af31fb3f6a35de47318b1d0c13f9e4679f1c32819919edd25691284a237102efc085d342d5273f60186ab0b6071b1cfdf7e54529669515e9f69338b819f4044c6e0c299503c3cc464b7a40587da07605cc2a6134cd1801f29646b031846d6411598862a56e1313494cc5d54d85fca772697f8fc69ac997b6e570d4fa0f796ca0809fb36c9c76535dd6a5f0db924f09013a8a26be2426f4a3fecfe1b83f6bd16f4d9f2f7d40e1ef4ce3dfb647827b2d180b3e9fb8978a3dc64735403612e90f9178ace54a32786cf1640b6c1554b8dfc87455817e832dde45ffb37bab5746230dee9550ebb01626f31de99cbfcd1eeefa5f16e97c6caa795b6f12237f70c9419bd81718f27d08406e72b26474ecfc27c52b6de20cb2dd4b82c7e0e413f196471e86ac666dcdfa71ae0da22be2c071208b678837b55f50835f3f6605f2f2f822708f3d74b2c419a8db9b3ee7a2a0c000eb80225f4d1e5a01805af179220935805255987df25ee15322ccbf5c42393f04d9c36de56e38331edc7a630843cb22235d77ea92b496134d81725fef0dcaec37ca5e7e77e91ff38b8377eb0abe88a9c2919f539124f4c7a1a1bc0ae85fc601364f05bbfac17de50c7c13b2fb4667726c4e5dc5b647439bd11e3eef22a59b778c527d5181af55319e7750c1d941feb55489d391203b245af211638632b3a9894598042a8507858d2c28cdbb55d84adc84e05f961acd3a7f2a24f1b5e375f0401ac6727ad500713a49bf7cd41596badb1fde93a4d65598f1e9546384c93018e22dd4724930294bfd407c059a54e29064528e98b863503c2201f9c8676c47eb8297c40adda21a45b854ea5d682c7f823700a02d8b61b972fc91431b780d9d2bfdad2f6e882a170c4cb3a9b3e4f97fc34c2ec56fa6b0ba95679327373b190f5ed8102b32cd040949abfd4424ab1808f1df3895d678037bbcdc49d6fdb833885efeaf9ecc00986e3d06ca47e86c3c6cbd3a228fd7785158d4812e5941f8f071431ee4c5bddd9c4100db52b69f13d9322ef8181cf230ce1e15b88f651d51ad6b8107c69f040a5f5462290ef0d1454e622f8af8833733a7d5f974ca0ff873f2e85367f4801eff4ea2577845716a31fc066effe1936367c50788de3badcae8f97a4f9a938434151359836747d917df2010863bf00c69d324e03f72e05e65a25a21f17f6eb1a58234cffaa57d611bebe6ed013d2e7feb13d01f128616c7acc1dd097ba9fc2c0e0f881496be7f59240f9c0f23630c23cbc4f5f8017deab15befd7c9e0e3c7865d975c001b28c6d29d4d2e1c078158af58a78fd822f28788731c5db8c902bab8c825c521d5be6ca4d876ea4cbdef41053739f2e74f802986f744be65abb203e5fdbcd6898be36da8cc4a3ccb93666c6cb0409232545e6cc5168e21942e66c2668b6a29de01a13bf7402800261553a955f2a52f441c13cacb0bc9a5047355c9fe4f21f515bb05f0edc2e3ba5a5abfa64255c536823e289674508ce7877deb526ee4e5071a4917558c7f942af83fa4246725545037b48578ab5f4a92c9a9cbd40436fedaba7d6b9bbe09bb8a950e765fce47b04f6f4f24da6f270f61e72d1c03a0eab02441596c4593abc25897e48b889fd0e46511167012d2eded4fa4e151378e6cfbfe41e551f9f05bb0d2682e4372603eb0f798321d228f39f98519ae9f45537d0ac1c58077dcd4f09f8bdfefd9b2e83429df481e76f1782ce604063a5b0ebf9d61410f23f339ed6be0c481b1ca87739cbe677bf12f1a94d3d5599b93b381af29b459ebde519291602e971363570c98ee9ed5d6aa5b8839bf73a06f24c4f265568b036c5ae65bb3273826523e95e59166907ad996d96f42e6b354fd793f85642ff216476d80df359829cf068f8608449fa3032cc2d87c72ee1d0fac0ff643287174a8c260c37659f09dacc254924f0b37eec4d42f477b8421fc93de0cf3067ebd965296d7849644a12305c0d70ebf6718afc7ad2f950a007ca53ca832781fbcb4e43de8885e492ab21e0dc5e0e16da16191ec3db4d5a05f92a5d2c3e79d0527f26370f24daf8e4e7b20d69646cd0f30774d29e45ba74f89a6dda8f779ec05b0e7cc4e65f69dc02587b8e53779368eda849359528d1eb495dd33baa5658940d51af8be82a4b7f1a7e1f1f1511cec52ea56b99c7cde55ea05adbde760262e1fd4beb3c0bb8516f050a099b06e4e75da29af597242fc746d42f7e5add204428bd35e4d2a06ccf4822b8d137ef863e5ac35a4c2246a95da45f5b3b9cded7d41fc93aeb98114ce0edfbcaaee4314ffa95c35cda0c8c4d62b8e721395a220182e809e2d3cf48fda10253e67ec56ee8db3455c33f41890cf6e08e6c188aa73bc396d945c1fca00c4752179a497ad7c5c56ef3511152bf27e0109a86554e7a781b4e5a4904c4c59994083ba0b1d4ad14a475b5ce841c2c017281eb54ddd0803b25a6df9e09b8e7340913afb5c0f659d82f28bd6a54cdd54e61960be12c75dd688b0c4ebd672d54ea4771f0046afabe8f8e7e98f960280f0afd7373ba1770b9ff0624fcfe5187f2ce4bb3adaa5398dd73"})

[ 1628.003060][T10469] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.3'.
06:38:35 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x110b, 0x2})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="a9d4aeef4eb3dd68e19152350fcbde45036308402fdb16", @ANYRES16=r0, @ANYRES16=r0], 0x0, 0x0, 0x0})
r1 = syz_open_dev$binderN(&(0x7f00000000c0), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000400)={0x8, 0x0, &(0x7f0000000380)=[@acquire={0x40046305, 0x1}], 0x6, 0x0, &(0x7f00000003c0)="1bcba96107ad"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x10, 0x0, &(0x7f0000000040)=[@decrefs={0x40046307, 0x1}, @acquire={0x40046305, 0x3}], 0x9, 0x0, &(0x7f0000000100)="f30011f11a347db798"})
r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$IPVS_CMD_ZERO(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x7c, r2, 0x4, 0x70bd28, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3ff}, @IPVS_CMD_ATTR_DAEMON={0x38, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @private1}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e22}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0xef}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DAEMON={0x28, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e21}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x20000000}, 0x20004840)

06:38:35 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x6c, 0x0, &(0x7f0000000340)=[@acquire={0x40046305, 0x3}, @acquire_done, @exit_looper, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

06:38:36 executing program 0:
syz_open_dev$binderN(0x0, 0x0, 0x0)
waitid(0x0, 0x0, &(0x7f00000000c0), 0x20000000, 0x0)

06:38:36 executing program 3:
ioctl$KVM_CHECK_EXTENSION(0xffffffffffffffff, 0xae03, 0x3f)
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_TRAP_GET(r1, &(0x7f0000000740)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000700)={&(0x7f0000000600)={0x100, 0x0, 0x2, 0x70bd27, 0x25dfdbff, {}, [{@pci={{0x8}, {0x11}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}]}, 0x100}}, 0x28001)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r1, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
socket$phonet_pipe(0x23, 0x5, 0x2)
socket$nl_generic(0x10, 0x3, 0x10)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="db1e29bd7000fbdbdf250600000008000300", @ANYRES32, @ANYBLOB='\f'], 0x30}}, 0x0)

[ 1628.443585][T10478] binder: 10476:10478 unknown command -273754967
[ 1628.450431][T10478] binder: 10476:10478 ioctl c0306201 20000180 returned -22
06:38:36 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000002c0)})

06:38:36 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x14, 0x0, &(0x7f0000000240)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs], 0x1000, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86ba206193131b1cf46e59dc8c518c380ed9793f370ae8da49c0092cd1726257d73f52570191f5ba4f868b372a713ffb555f5cb9c80fbec9354c1dc632ba43fc554dc34c3e552eac551d208b0c798ca1ae9c75a3fc3d6c039a343f5597f8593416a4bfb734d63dba7634586b1f4578667624810b8aa4fc7907767b39ed553d1ff659ec928ce4c8e62c8b80ae6f3bc6ba99adb7e4cdfbce49785cc407e7f59ef2f2b0bb58d91b2119ebc2639bfad3b159673c60b24f82512823a6de589ec029adb3e149f2ebe17426cfeac48b92064b33cc59d3ae6a368807c021aca1ff29dfe1889382b730ee97d7d187f7f1bb97cfb296f20fbe2e1aeeb773a1d10da3592f15998825d5283c0fcfba7de857ae7268cad3732ab5dcd73448062fe9a365a91d0b67e0d7d785a895a6aa058904a054695c31b09c9c2c801865ca3cc8b0cb4b2ceb9819d3f62ed199f5c21fae71d029e163671022e5aaf3b25b42c3b55c30533630efb3c6a131fd56a612e2fa5703f1d3357573b8c87e04b46110ee5e7d66a5c4375c30382ac9d09963edd7f41785ac774bb459dd540e2c0a618b82dacc0b325870f03b8d1451c7aa47fe5b6a2c74101bc6ff67ba1af363ddeb04e4322d78b7864f43c2eda43fd9c798b3e2c0c65d7fbb9ba5afb3b7c6406d1ae4da4941183f75b8475b7f92c0291cf7c8a9d44f629f8078e59eff8703e840c80e69d328eb73925a5cdbd57acb19618211ea117d7a8a1ed5de76ba3b2c128ec17beb65b9f17303b2ed51a226ae18167d3abc5979197bea0453519ed268c083b1b5eb85c9380eccc007151124d8170afa8382e39cff375f43c191964f502e39f722b444f7f36866782d8771c5f8b610a6b99c9041bdbc8b451a68e2fdbc2ad7a0762c1fdbd97659ba74d7daca6a63bf03f7ac2578ee96912996b8fa003a88a9cebffb9e36c1c9a8cc9977a61bb93cd85f7ebc0de74597e4071d65df7941bdcb347c2db0f214dd54326baf1eeef1211e542f5d4f5172e12dfc63c4de78593c52df0f3f1cbe1b8a9fb1f59242309c8f2699a66588a87ceefa0f660f304d8e8e7295448cb1cc350192833990f7d89225022c9a6205cdfcacccf996cd9e24fd1c419528f032a04d9437c2b72869961c90495ebc306707c04cb6d01cb1001c6d262fd69ed76e58a2e96d6297e608dfb100986549addd3150f7c163c206d33f3fb6de8e9c549086f61e5cf8cbf776ce8b6fedf4751b1be37a5c3339fb584d5e9d3d0e16d6a34ff5fadab7e335f230689641d171b5ff30b03042c28b6b1163f74a82d97930c05cf0c41b8229336aaf18d1d47e7bee5e7d7e50b33d0feccc6d411f6b881b2334083e3a8bc8d3bad4070176a853ee277684b4f3f812d9b624679ce3a5923f427dcab5f737288a3cabffa858e29030b70346925a82d6440bd2e6405ca6f0b21c713183ead55fea3af313920528d660f0beb935ec50c881eae3bbeb3c70100710dc9f7e8582ec00cc8461de0ec4b4f577f9b68020093fed727ae02fd689bb2e38f5817f3736050e3b9c53c0357a2df8807316c0e8336242f1977d1cb7f1d8a6cf1cc6c8a4f3521e3fa7719e58a148f068bdd20b1104f43b6f762292d10a3169dfdad50d668e1f109b9d7eeb76b3ba48d3302c5971d4df1b34d4c4a92929f3876d3bb868cefd02c9a08c364c1e557d5d0c246d5c28235f43cac9aa0f371bcba120235660e6b73b5a975e826607201241b7c385c5fab5c0e34c9dc1b33c4e48ca0a37525e2b4db287a180eed1f092a989db67f6b95c9850bf4326ac2a20f2a1403c553a085c035f7fbba1fe9f7d35066f6e2a68771bdeec7d401a6c654fc06d529ea1b0de033083343109c2ad1c5ad43f64502e026fa37f5fc59afcbb0a51a3c42484b7d21abfbb357fb4bb8cbefd135183b1adfe5e21456b0d7bd9d25eb81f7285424f5bc28ab69be3f9601f41ba2e7318c4dac37561ecf8dbddcc7ebaaa3671f0ab6e1faf58d7bb53d91c4f332a68ed9a36d2955a1d6e2bd19bb9dc11a69a49103188df42ef4767014da485b9c18f3d354a6d19608050c4d073bb7602fcd419b1acab536a852c2b4b3188257f250040cc3c06c0cd19f126a2d4bd2f930546e8f4f7c97090b2a906d57d0668050dc00ec93af78290fdd92da915883954ca1bea5a3858cad4dec18419e24f8e0eaf6e8f9ea9c38acb89033c4c28e30dfb054029a3766892f2e4a2a751572be31d93be94d92366a4c6260a3968a896b652be9a26bd3f162539883dbc0bb543559d9a825ac76b270254f0f3b70856051823afaf3fd2b54588d3be0b805e210def0b252900213e782bac9b1c917f9fd4ac8f51c13f4fa84360465172a97d3dabcb337f9fbe6bb72b8e18ef364a263408e2c8fe4891e31bb619db5f1b99b8256bef563f9f1acc37027112a53248fe7e5a6c8792685e5a0c13120cb2ae906c521214174bfd3cd783b7cc586eb09ba16dd4692fa08ed01b91496d4edc3a8cc421b023d34d4e2a1921513b457fddddebaa262f91f8953d3a7193b68fa3c779a9ef51a68ec227280eb78480ee34228c5db3f18699da509eb2f51aba41f6e39a9ade8efa2e1d5707fd293c5358c3c7ef35231a5831566db8dc2b8181e278bdbbca477a87590c48759eb3f862bd8a4770e2b7ef64484eeacea001737315a470bf68f6f5824d3a1f1d5a3b3c6157b03b5b9aca864dbf7877b7b1d20c8b6c2fdf5dab424ce1076391359f6daaa313c5b1384479f8a61ce733c4432389464dc414a60ee1b0c7efdc5fcc53811a144b10ca19159207baa775b2145d0b82d4fbc93116326e8d9c26a605812324cf8883f9bb7a7e28c0dcce5dbdedd835a36715201a1464bdad0783888e2916fe36a38aad080c287e0dd1ca6d966e5ba200941a8cd6df2b902feff11135ca87a79b0446e07897fd6555549352ebd8d4ba0aff161a5f6dcdd5d960abaa1b2cdab9b5d7c4332d967f480e21ff75064bffb6a9dd15f1ca9d6c4b9b1f65f16536f3d3be128fbba656c14270cf5174e692bde77ecd317f1e61632245fe13b6de7968739c4f0c18e0ccd85bf4e0979d63b283b2de3f460a579ca2b6ad93e16e1d50eb1886d2a1666937f631f89f9fa18a4e74a582e43b4181ccfd87df8640af31fb3f6a35de47318b1d0c13f9e4679f1c32819919edd25691284a237102efc085d342d5273f60186ab0b6071b1cfdf7e54529669515e9f69338b819f4044c6e0c299503c3cc464b7a40587da07605cc2a6134cd1801f29646b031846d6411598862a56e1313494cc5d54d85fca772697f8fc69ac997b6e570d4fa0f796ca0809fb36c9c76535dd6a5f0db924f09013a8a26be2426f4a3fecfe1b83f6bd16f4d9f2f7d40e1ef4ce3dfb647827b2d180b3e9fb8978a3dc64735403612e90f9178ace54a32786cf1640b6c1554b8dfc87455817e832dde45ffb37bab5746230dee9550ebb01626f31de99cbfcd1eeefa5f16e97c6caa795b6f12237f70c9419bd81718f27d08406e72b26474ecfc27c52b6de20cb2dd4b82c7e0e413f196471e86ac666dcdfa71ae0da22be2c071208b678837b55f50835f3f6605f2f2f822708f3d74b2c419a8db9b3ee7a2a0c000eb80225f4d1e5a01805af179220935805255987df25ee15322ccbf5c42393f04d9c36de56e38331edc7a630843cb22235d77ea92b496134d81725fef0dcaec37ca5e7e77e91ff38b8377eb0abe88a9c2919f539124f4c7a1a1bc0ae85fc601364f05bbfac17de50c7c13b2fb4667726c4e5dc5b647439bd11e3eef22a59b778c527d5181af55319e7750c1d941feb55489d391203b245af211638632b3a9894598042a8507858d2c28cdbb55d84adc84e05f961acd3a7f2a24f1b5e375f0401ac6727ad500713a49bf7cd41596badb1fde93a4d65598f1e9546384c93018e22dd4724930294bfd407c059a54e29064528e98b863503c2201f9c8676c47eb8297c40adda21a45b854ea5d682c7f823700a02d8b61b972fc91431b780d9d2bfdad2f6e882a170c4cb3a9b3e4f97fc34c2ec56fa6b0ba95679327373b190f5ed8102b32cd040949abfd4424ab1808f1df3895d678037bbcdc49d6fdb833885efeaf9ecc00986e3d06ca47e86c3c6cbd3a228fd7785158d4812e5941f8f071431ee4c5bddd9c4100db52b69f13d9322ef8181cf230ce1e15b88f651d51ad6b8107c69f040a5f5462290ef0d1454e622f8af8833733a7d5f974ca0ff873f2e85367f4801eff4ea2577845716a31fc066effe1936367c50788de3badcae8f97a4f9a938434151359836747d917df2010863bf00c69d324e03f72e05e65a25a21f17f6eb1a58234cffaa57d611bebe6ed013d2e7feb13d01f128616c7acc1dd097ba9fc2c0e0f881496be7f59240f9c0f23630c23cbc4f5f8017deab15befd7c9e0e3c7865d975c001b28c6d29d4d2e1c078158af58a78fd822f28788731c5db8c902bab8c825c521d5be6ca4d876ea4cbdef41053739f2e74f802986f744be65abb203e5fdbcd6898be36da8cc4a3ccb93666c6cb0409232545e6cc5168e21942e66c2668b6a29de01a13bf7402800261553a955f2a52f441c13cacb0bc9a5047355c9fe4f21f515bb05f0edc2e3ba5a5abfa64255c536823e289674508ce7877deb526ee4e5071a4917558c7f942af83fa4246725545037b48578ab5f4a92c9a9cbd40436fedaba7d6b9bbe09bb8a950e765fce47b04f6f4f24da6f270f61e72d1c03a0eab02441596c4593abc25897e48b889fd0e46511167012d2eded4fa4e151378e6cfbfe41e551f9f05bb0d2682e4372603eb0f798321d228f39f98519ae9f45537d0ac1c58077dcd4f09f8bdfefd9b2e83429df481e76f1782ce604063a5b0ebf9d61410f23f339ed6be0c481b1ca87739cbe677bf12f1a94d3d5599b93b381af29b459ebde519291602e971363570c98ee9ed5d6aa5b8839bf73a06f24c4f265568b036c5ae65bb3273826523e95e59166907ad996d96f42e6b354fd793f85642ff216476d80df359829cf068f8608449fa3032cc2d87c72ee1d0fac0ff643287174a8c260c37659f09dacc254924f0b37eec4d42f477b8421fc93de0cf3067ebd965296d7849644a12305c0d70ebf6718afc7ad2f950a007ca53ca832781fbcb4e43de8885e492ab21e0dc5e0e16da16191ec3db4d5a05f92a5d2c3e79d0527f26370f24daf8e4e7b20d69646cd0f30774d29e45ba74f89a6dda8f779ec05b0e7cc4e65f69dc02587b8e53779368eda849359528d1eb495dd33baa5658940d51af8be82a4b7f1a7e1f1f1511cec52ea56b99c7cde55ea05adbde760262e1fd4beb3c0bb8516f050a099b06e4e75da29af597242fc746d42f7e5add204428bd35e4d2a06ccf4822b8d137ef863e5ac35a4c2246a95da45f5b3b9cded7d41fc93aeb98114ce0edfbcaaee4314ffa95c35cda0c8c4d62b8e721395a220182e809e2d3cf48fda10253e67ec56ee8db3455c33f41890cf6e08e6c188aa73bc396d945c1fca00c4752179a497ad7c5c56ef3511152bf27e0109a86554e7a781b4e5a4904c4c59994083ba0b1d4ad14a475b5ce841c2c017281eb54ddd0803b25a6df9e09b8e7340913afb5c0f659d82f28bd6a54cdd54e61960be12c75dd688b0c4ebd672d54ea4771f0046afabe8f8e7e98f960280f0afd7373ba1770b9ff0624fcfe5187f2ce4bb3adaa5398dd73"})

[ 1628.618183][T10484] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.3'.
06:38:36 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x6c, 0x0, &(0x7f0000000340)=[@acquire={0x40046305, 0x3}, @acquire_done, @exit_looper, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

06:38:36 executing program 3:
ioctl$KVM_CHECK_EXTENSION(0xffffffffffffffff, 0xae03, 0x3f)
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_TRAP_GET(r1, &(0x7f0000000740)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000700)={&(0x7f0000000600)={0x100, 0x0, 0x2, 0x70bd27, 0x25dfdbff, {}, [{@pci={{0x8}, {0x11}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}]}, 0x100}}, 0x28001)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r1, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
socket$phonet_pipe(0x23, 0x5, 0x2)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="db1e29bd7000fbdbdf250600000008000300", @ANYRES32, @ANYBLOB='\f'], 0x30}}, 0x0)

06:38:36 executing program 0:
syz_open_dev$binderN(0x0, 0x0, 0x0)
waitid(0x0, 0x0, &(0x7f00000000c0), 0x20000000, 0x0)

06:38:36 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x14, 0x0, &(0x7f0000000240)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs], 0x1000, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86ba206193131b1cf46e59dc8c518c380ed9793f370ae8da49c0092cd1726257d73f52570191f5ba4f868b372a713ffb555f5cb9c80fbec9354c1dc632ba43fc554dc34c3e552eac551d208b0c798ca1ae9c75a3fc3d6c039a343f5597f8593416a4bfb734d63dba7634586b1f4578667624810b8aa4fc7907767b39ed553d1ff659ec928ce4c8e62c8b80ae6f3bc6ba99adb7e4cdfbce49785cc407e7f59ef2f2b0bb58d91b2119ebc2639bfad3b159673c60b24f82512823a6de589ec029adb3e149f2ebe17426cfeac48b92064b33cc59d3ae6a368807c021aca1ff29dfe1889382b730ee97d7d187f7f1bb97cfb296f20fbe2e1aeeb773a1d10da3592f15998825d5283c0fcfba7de857ae7268cad3732ab5dcd73448062fe9a365a91d0b67e0d7d785a895a6aa058904a054695c31b09c9c2c801865ca3cc8b0cb4b2ceb9819d3f62ed199f5c21fae71d029e163671022e5aaf3b25b42c3b55c30533630efb3c6a131fd56a612e2fa5703f1d3357573b8c87e04b46110ee5e7d66a5c4375c30382ac9d09963edd7f41785ac774bb459dd540e2c0a618b82dacc0b325870f03b8d1451c7aa47fe5b6a2c74101bc6ff67ba1af363ddeb04e4322d78b7864f43c2eda43fd9c798b3e2c0c65d7fbb9ba5afb3b7c6406d1ae4da4941183f75b8475b7f92c0291cf7c8a9d44f629f8078e59eff8703e840c80e69d328eb73925a5cdbd57acb19618211ea117d7a8a1ed5de76ba3b2c128ec17beb65b9f17303b2ed51a226ae18167d3abc5979197bea0453519ed268c083b1b5eb85c9380eccc007151124d8170afa8382e39cff375f43c191964f502e39f722b444f7f36866782d8771c5f8b610a6b99c9041bdbc8b451a68e2fdbc2ad7a0762c1fdbd97659ba74d7daca6a63bf03f7ac2578ee96912996b8fa003a88a9cebffb9e36c1c9a8cc9977a61bb93cd85f7ebc0de74597e4071d65df7941bdcb347c2db0f214dd54326baf1eeef1211e542f5d4f5172e12dfc63c4de78593c52df0f3f1cbe1b8a9fb1f59242309c8f2699a66588a87ceefa0f660f304d8e8e7295448cb1cc350192833990f7d89225022c9a6205cdfcacccf996cd9e24fd1c419528f032a04d9437c2b72869961c90495ebc306707c04cb6d01cb1001c6d262fd69ed76e58a2e96d6297e608dfb100986549addd3150f7c163c206d33f3fb6de8e9c549086f61e5cf8cbf776ce8b6fedf4751b1be37a5c3339fb584d5e9d3d0e16d6a34ff5fadab7e335f230689641d171b5ff30b03042c28b6b1163f74a82d97930c05cf0c41b8229336aaf18d1d47e7bee5e7d7e50b33d0feccc6d411f6b881b2334083e3a8bc8d3bad4070176a853ee277684b4f3f812d9b624679ce3a5923f427dcab5f737288a3cabffa858e29030b70346925a82d6440bd2e6405ca6f0b21c713183ead55fea3af313920528d660f0beb935ec50c881eae3bbeb3c70100710dc9f7e8582ec00cc8461de0ec4b4f577f9b68020093fed727ae02fd689bb2e38f5817f3736050e3b9c53c0357a2df8807316c0e8336242f1977d1cb7f1d8a6cf1cc6c8a4f3521e3fa7719e58a148f068bdd20b1104f43b6f762292d10a3169dfdad50d668e1f109b9d7eeb76b3ba48d3302c5971d4df1b34d4c4a92929f3876d3bb868cefd02c9a08c364c1e557d5d0c246d5c28235f43cac9aa0f371bcba120235660e6b73b5a975e826607201241b7c385c5fab5c0e34c9dc1b33c4e48ca0a37525e2b4db287a180eed1f092a989db67f6b95c9850bf4326ac2a20f2a1403c553a085c035f7fbba1fe9f7d35066f6e2a68771bdeec7d401a6c654fc06d529ea1b0de033083343109c2ad1c5ad43f64502e026fa37f5fc59afcbb0a51a3c42484b7d21abfbb357fb4bb8cbefd135183b1adfe5e21456b0d7bd9d25eb81f7285424f5bc28ab69be3f9601f41ba2e7318c4dac37561ecf8dbddcc7ebaaa3671f0ab6e1faf58d7bb53d91c4f332a68ed9a36d2955a1d6e2bd19bb9dc11a69a49103188df42ef4767014da485b9c18f3d354a6d19608050c4d073bb7602fcd419b1acab536a852c2b4b3188257f250040cc3c06c0cd19f126a2d4bd2f930546e8f4f7c97090b2a906d57d0668050dc00ec93af78290fdd92da915883954ca1bea5a3858cad4dec18419e24f8e0eaf6e8f9ea9c38acb89033c4c28e30dfb054029a3766892f2e4a2a751572be31d93be94d92366a4c6260a3968a896b652be9a26bd3f162539883dbc0bb543559d9a825ac76b270254f0f3b70856051823afaf3fd2b54588d3be0b805e210def0b252900213e782bac9b1c917f9fd4ac8f51c13f4fa84360465172a97d3dabcb337f9fbe6bb72b8e18ef364a263408e2c8fe4891e31bb619db5f1b99b8256bef563f9f1acc37027112a53248fe7e5a6c8792685e5a0c13120cb2ae906c521214174bfd3cd783b7cc586eb09ba16dd4692fa08ed01b91496d4edc3a8cc421b023d34d4e2a1921513b457fddddebaa262f91f8953d3a7193b68fa3c779a9ef51a68ec227280eb78480ee34228c5db3f18699da509eb2f51aba41f6e39a9ade8efa2e1d5707fd293c5358c3c7ef35231a5831566db8dc2b8181e278bdbbca477a87590c48759eb3f862bd8a4770e2b7ef64484eeacea001737315a470bf68f6f5824d3a1f1d5a3b3c6157b03b5b9aca864dbf7877b7b1d20c8b6c2fdf5dab424ce1076391359f6daaa313c5b1384479f8a61ce733c4432389464dc414a60ee1b0c7efdc5fcc53811a144b10ca19159207baa775b2145d0b82d4fbc93116326e8d9c26a605812324cf8883f9bb7a7e28c0dcce5dbdedd835a36715201a1464bdad0783888e2916fe36a38aad080c287e0dd1ca6d966e5ba200941a8cd6df2b902feff11135ca87a79b0446e07897fd6555549352ebd8d4ba0aff161a5f6dcdd5d960abaa1b2cdab9b5d7c4332d967f480e21ff75064bffb6a9dd15f1ca9d6c4b9b1f65f16536f3d3be128fbba656c14270cf5174e692bde77ecd317f1e61632245fe13b6de7968739c4f0c18e0ccd85bf4e0979d63b283b2de3f460a579ca2b6ad93e16e1d50eb1886d2a1666937f631f89f9fa18a4e74a582e43b4181ccfd87df8640af31fb3f6a35de47318b1d0c13f9e4679f1c32819919edd25691284a237102efc085d342d5273f60186ab0b6071b1cfdf7e54529669515e9f69338b819f4044c6e0c299503c3cc464b7a40587da07605cc2a6134cd1801f29646b031846d6411598862a56e1313494cc5d54d85fca772697f8fc69ac997b6e570d4fa0f796ca0809fb36c9c76535dd6a5f0db924f09013a8a26be2426f4a3fecfe1b83f6bd16f4d9f2f7d40e1ef4ce3dfb647827b2d180b3e9fb8978a3dc64735403612e90f9178ace54a32786cf1640b6c1554b8dfc87455817e832dde45ffb37bab5746230dee9550ebb01626f31de99cbfcd1eeefa5f16e97c6caa795b6f12237f70c9419bd81718f27d08406e72b26474ecfc27c52b6de20cb2dd4b82c7e0e413f196471e86ac666dcdfa71ae0da22be2c071208b678837b55f50835f3f6605f2f2f822708f3d74b2c419a8db9b3ee7a2a0c000eb80225f4d1e5a01805af179220935805255987df25ee15322ccbf5c42393f04d9c36de56e38331edc7a630843cb22235d77ea92b496134d81725fef0dcaec37ca5e7e77e91ff38b8377eb0abe88a9c2919f539124f4c7a1a1bc0ae85fc601364f05bbfac17de50c7c13b2fb4667726c4e5dc5b647439bd11e3eef22a59b778c527d5181af55319e7750c1d941feb55489d391203b245af211638632b3a9894598042a8507858d2c28cdbb55d84adc84e05f961acd3a7f2a24f1b5e375f0401ac6727ad500713a49bf7cd41596badb1fde93a4d65598f1e9546384c93018e22dd4724930294bfd407c059a54e29064528e98b863503c2201f9c8676c47eb8297c40adda21a45b854ea5d682c7f823700a02d8b61b972fc91431b780d9d2bfdad2f6e882a170c4cb3a9b3e4f97fc34c2ec56fa6b0ba95679327373b190f5ed8102b32cd040949abfd4424ab1808f1df3895d678037bbcdc49d6fdb833885efeaf9ecc00986e3d06ca47e86c3c6cbd3a228fd7785158d4812e5941f8f071431ee4c5bddd9c4100db52b69f13d9322ef8181cf230ce1e15b88f651d51ad6b8107c69f040a5f5462290ef0d1454e622f8af8833733a7d5f974ca0ff873f2e85367f4801eff4ea2577845716a31fc066effe1936367c50788de3badcae8f97a4f9a938434151359836747d917df2010863bf00c69d324e03f72e05e65a25a21f17f6eb1a58234cffaa57d611bebe6ed013d2e7feb13d01f128616c7acc1dd097ba9fc2c0e0f881496be7f59240f9c0f23630c23cbc4f5f8017deab15befd7c9e0e3c7865d975c001b28c6d29d4d2e1c078158af58a78fd822f28788731c5db8c902bab8c825c521d5be6ca4d876ea4cbdef41053739f2e74f802986f744be65abb203e5fdbcd6898be36da8cc4a3ccb93666c6cb0409232545e6cc5168e21942e66c2668b6a29de01a13bf7402800261553a955f2a52f441c13cacb0bc9a5047355c9fe4f21f515bb05f0edc2e3ba5a5abfa64255c536823e289674508ce7877deb526ee4e5071a4917558c7f942af83fa4246725545037b48578ab5f4a92c9a9cbd40436fedaba7d6b9bbe09bb8a950e765fce47b04f6f4f24da6f270f61e72d1c03a0eab02441596c4593abc25897e48b889fd0e46511167012d2eded4fa4e151378e6cfbfe41e551f9f05bb0d2682e4372603eb0f798321d228f39f98519ae9f45537d0ac1c58077dcd4f09f8bdfefd9b2e83429df481e76f1782ce604063a5b0ebf9d61410f23f339ed6be0c481b1ca87739cbe677bf12f1a94d3d5599b93b381af29b459ebde519291602e971363570c98ee9ed5d6aa5b8839bf73a06f24c4f265568b036c5ae65bb3273826523e95e59166907ad996d96f42e6b354fd793f85642ff216476d80df359829cf068f8608449fa3032cc2d87c72ee1d0fac0ff643287174a8c260c37659f09dacc254924f0b37eec4d42f477b8421fc93de0cf3067ebd965296d7849644a12305c0d70ebf6718afc7ad2f950a007ca53ca832781fbcb4e43de8885e492ab21e0dc5e0e16da16191ec3db4d5a05f92a5d2c3e79d0527f26370f24daf8e4e7b20d69646cd0f30774d29e45ba74f89a6dda8f779ec05b0e7cc4e65f69dc02587b8e53779368eda849359528d1eb495dd33baa5658940d51af8be82a4b7f1a7e1f1f1511cec52ea56b99c7cde55ea05adbde760262e1fd4beb3c0bb8516f050a099b06e4e75da29af597242fc746d42f7e5add204428bd35e4d2a06ccf4822b8d137ef863e5ac35a4c2246a95da45f5b3b9cded7d41fc93aeb98114ce0edfbcaaee4314ffa95c35cda0c8c4d62b8e721395a220182e809e2d3cf48fda10253e67ec56ee8db3455c33f41890cf6e08e6c188aa73bc396d945c1fca00c4752179a497ad7c5c56ef3511152bf27e0109a86554e7a781b4e5a4904c4c59994083ba0b1d4ad14a475b5ce841c2c017281eb54ddd0803b25a6df9e09b8e7340913afb5c0f659d82f28bd6a54cdd54e61960be12c75dd688b0c4ebd672d54ea4771f0046afabe8f8e7e98f960280f0afd7373ba1770b9ff0624fcfe5187f2ce4bb3adaa5398dd73"})

06:38:36 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000002c0)})

[ 1629.164328][T10495] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.3'.
[ 1629.236218][T10479] binder: 10476:10479 unknown command -273754967
[ 1629.243076][T10479] binder: 10476:10479 ioctl c0306201 20000180 returned -22
06:38:37 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x6c, 0x0, &(0x7f0000000340)=[@acquire={0x40046305, 0x3}, @acquire_done, @exit_looper, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000003c0)})

06:38:37 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x806)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r1, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r2, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r2, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r3, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000000c0)={'wlan1\x00'})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000080)=ANY=[@ANYRESHEX=r3, @ANYRESDEC=r2, @ANYRES64=r1], 0x0, 0x0, 0x0})

06:38:37 executing program 0:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
waitid(0x0, 0x0, 0x0, 0x20000000, 0x0)

06:38:37 executing program 3:
ioctl$KVM_CHECK_EXTENSION(0xffffffffffffffff, 0xae03, 0x3f)
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_TRAP_GET(r1, &(0x7f0000000740)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000700)={&(0x7f0000000600)={0x100, 0x0, 0x2, 0x70bd27, 0x25dfdbff, {}, [{@pci={{0x8}, {0x11}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}]}, 0x100}}, 0x28001)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r1, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="db1e29bd7000fbdbdf250600000008000300", @ANYRES32, @ANYBLOB='\f'], 0x30}}, 0x0)

06:38:37 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x14, 0x0, &(0x7f0000000240)=[@enter_looper, @increfs={0x40046304, 0x3}, @decrefs], 0x1000, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86ba206193131b1cf46e59dc8c518c380ed9793f370ae8da49c0092cd1726257d73f52570191f5ba4f868b372a713ffb555f5cb9c80fbec9354c1dc632ba43fc554dc34c3e552eac551d208b0c798ca1ae9c75a3fc3d6c039a343f5597f8593416a4bfb734d63dba7634586b1f4578667624810b8aa4fc7907767b39ed553d1ff659ec928ce4c8e62c8b80ae6f3bc6ba99adb7e4cdfbce49785cc407e7f59ef2f2b0bb58d91b2119ebc2639bfad3b159673c60b24f82512823a6de589ec029adb3e149f2ebe17426cfeac48b92064b33cc59d3ae6a368807c021aca1ff29dfe1889382b730ee97d7d187f7f1bb97cfb296f20fbe2e1aeeb773a1d10da3592f15998825d5283c0fcfba7de857ae7268cad3732ab5dcd73448062fe9a365a91d0b67e0d7d785a895a6aa058904a054695c31b09c9c2c801865ca3cc8b0cb4b2ceb9819d3f62ed199f5c21fae71d029e163671022e5aaf3b25b42c3b55c30533630efb3c6a131fd56a612e2fa5703f1d3357573b8c87e04b46110ee5e7d66a5c4375c30382ac9d09963edd7f41785ac774bb459dd540e2c0a618b82dacc0b325870f03b8d1451c7aa47fe5b6a2c74101bc6ff67ba1af363ddeb04e4322d78b7864f43c2eda43fd9c798b3e2c0c65d7fbb9ba5afb3b7c6406d1ae4da4941183f75b8475b7f92c0291cf7c8a9d44f629f8078e59eff8703e840c80e69d328eb73925a5cdbd57acb19618211ea117d7a8a1ed5de76ba3b2c128ec17beb65b9f17303b2ed51a226ae18167d3abc5979197bea0453519ed268c083b1b5eb85c9380eccc007151124d8170afa8382e39cff375f43c191964f502e39f722b444f7f36866782d8771c5f8b610a6b99c9041bdbc8b451a68e2fdbc2ad7a0762c1fdbd97659ba74d7daca6a63bf03f7ac2578ee96912996b8fa003a88a9cebffb9e36c1c9a8cc9977a61bb93cd85f7ebc0de74597e4071d65df7941bdcb347c2db0f214dd54326baf1eeef1211e542f5d4f5172e12dfc63c4de78593c52df0f3f1cbe1b8a9fb1f59242309c8f2699a66588a87ceefa0f660f304d8e8e7295448cb1cc350192833990f7d89225022c9a6205cdfcacccf996cd9e24fd1c419528f032a04d9437c2b72869961c90495ebc306707c04cb6d01cb1001c6d262fd69ed76e58a2e96d6297e608dfb100986549addd3150f7c163c206d33f3fb6de8e9c549086f61e5cf8cbf776ce8b6fedf4751b1be37a5c3339fb584d5e9d3d0e16d6a34ff5fadab7e335f230689641d171b5ff30b03042c28b6b1163f74a82d97930c05cf0c41b8229336aaf18d1d47e7bee5e7d7e50b33d0feccc6d411f6b881b2334083e3a8bc8d3bad4070176a853ee277684b4f3f812d9b624679ce3a5923f427dcab5f737288a3cabffa858e29030b70346925a82d6440bd2e6405ca6f0b21c713183ead55fea3af313920528d660f0beb935ec50c881eae3bbeb3c70100710dc9f7e8582ec00cc8461de0ec4b4f577f9b68020093fed727ae02fd689bb2e38f5817f3736050e3b9c53c0357a2df8807316c0e8336242f1977d1cb7f1d8a6cf1cc6c8a4f3521e3fa7719e58a148f068bdd20b1104f43b6f762292d10a3169dfdad50d668e1f109b9d7eeb76b3ba48d3302c5971d4df1b34d4c4a92929f3876d3bb868cefd02c9a08c364c1e557d5d0c246d5c28235f43cac9aa0f371bcba120235660e6b73b5a975e826607201241b7c385c5fab5c0e34c9dc1b33c4e48ca0a37525e2b4db287a180eed1f092a989db67f6b95c9850bf4326ac2a20f2a1403c553a085c035f7fbba1fe9f7d35066f6e2a68771bdeec7d401a6c654fc06d529ea1b0de033083343109c2ad1c5ad43f64502e026fa37f5fc59afcbb0a51a3c42484b7d21abfbb357fb4bb8cbefd135183b1adfe5e21456b0d7bd9d25eb81f7285424f5bc28ab69be3f9601f41ba2e7318c4dac37561ecf8dbddcc7ebaaa3671f0ab6e1faf58d7bb53d91c4f332a68ed9a36d2955a1d6e2bd19bb9dc11a69a49103188df42ef4767014da485b9c18f3d354a6d19608050c4d073bb7602fcd419b1acab536a852c2b4b3188257f250040cc3c06c0cd19f126a2d4bd2f930546e8f4f7c97090b2a906d57d0668050dc00ec93af78290fdd92da915883954ca1bea5a3858cad4dec18419e24f8e0eaf6e8f9ea9c38acb89033c4c28e30dfb054029a3766892f2e4a2a751572be31d93be94d92366a4c6260a3968a896b652be9a26bd3f162539883dbc0bb543559d9a825ac76b270254f0f3b70856051823afaf3fd2b54588d3be0b805e210def0b252900213e782bac9b1c917f9fd4ac8f51c13f4fa84360465172a97d3dabcb337f9fbe6bb72b8e18ef364a263408e2c8fe4891e31bb619db5f1b99b8256bef563f9f1acc37027112a53248fe7e5a6c8792685e5a0c13120cb2ae906c521214174bfd3cd783b7cc586eb09ba16dd4692fa08ed01b91496d4edc3a8cc421b023d34d4e2a1921513b457fddddebaa262f91f8953d3a7193b68fa3c779a9ef51a68ec227280eb78480ee34228c5db3f18699da509eb2f51aba41f6e39a9ade8efa2e1d5707fd293c5358c3c7ef35231a5831566db8dc2b8181e278bdbbca477a87590c48759eb3f862bd8a4770e2b7ef64484eeacea001737315a470bf68f6f5824d3a1f1d5a3b3c6157b03b5b9aca864dbf7877b7b1d20c8b6c2fdf5dab424ce1076391359f6daaa313c5b1384479f8a61ce733c4432389464dc414a60ee1b0c7efdc5fcc53811a144b10ca19159207baa775b2145d0b82d4fbc93116326e8d9c26a605812324cf8883f9bb7a7e28c0dcce5dbdedd835a36715201a1464bdad0783888e2916fe36a38aad080c287e0dd1ca6d966e5ba200941a8cd6df2b902feff11135ca87a79b0446e07897fd6555549352ebd8d4ba0aff161a5f6dcdd5d960abaa1b2cdab9b5d7c4332d967f480e21ff75064bffb6a9dd15f1ca9d6c4b9b1f65f16536f3d3be128fbba656c14270cf5174e692bde77ecd317f1e61632245fe13b6de7968739c4f0c18e0ccd85bf4e0979d63b283b2de3f460a579ca2b6ad93e16e1d50eb1886d2a1666937f631f89f9fa18a4e74a582e43b4181ccfd87df8640af31fb3f6a35de47318b1d0c13f9e4679f1c32819919edd25691284a237102efc085d342d5273f60186ab0b6071b1cfdf7e54529669515e9f69338b819f4044c6e0c299503c3cc464b7a40587da07605cc2a6134cd1801f29646b031846d6411598862a56e1313494cc5d54d85fca772697f8fc69ac997b6e570d4fa0f796ca0809fb36c9c76535dd6a5f0db924f09013a8a26be2426f4a3fecfe1b83f6bd16f4d9f2f7d40e1ef4ce3dfb647827b2d180b3e9fb8978a3dc64735403612e90f9178ace54a32786cf1640b6c1554b8dfc87455817e832dde45ffb37bab5746230dee9550ebb01626f31de99cbfcd1eeefa5f16e97c6caa795b6f12237f70c9419bd81718f27d08406e72b26474ecfc27c52b6de20cb2dd4b82c7e0e413f196471e86ac666dcdfa71ae0da22be2c071208b678837b55f50835f3f6605f2f2f822708f3d74b2c419a8db9b3ee7a2a0c000eb80225f4d1e5a01805af179220935805255987df25ee15322ccbf5c42393f04d9c36de56e38331edc7a630843cb22235d77ea92b496134d81725fef0dcaec37ca5e7e77e91ff38b8377eb0abe88a9c2919f539124f4c7a1a1bc0ae85fc601364f05bbfac17de50c7c13b2fb4667726c4e5dc5b647439bd11e3eef22a59b778c527d5181af55319e7750c1d941feb55489d391203b245af211638632b3a9894598042a8507858d2c28cdbb55d84adc84e05f961acd3a7f2a24f1b5e375f0401ac6727ad500713a49bf7cd41596badb1fde93a4d65598f1e9546384c93018e22dd4724930294bfd407c059a54e29064528e98b863503c2201f9c8676c47eb8297c40adda21a45b854ea5d682c7f823700a02d8b61b972fc91431b780d9d2bfdad2f6e882a170c4cb3a9b3e4f97fc34c2ec56fa6b0ba95679327373b190f5ed8102b32cd040949abfd4424ab1808f1df3895d678037bbcdc49d6fdb833885efeaf9ecc00986e3d06ca47e86c3c6cbd3a228fd7785158d4812e5941f8f071431ee4c5bddd9c4100db52b69f13d9322ef8181cf230ce1e15b88f651d51ad6b8107c69f040a5f5462290ef0d1454e622f8af8833733a7d5f974ca0ff873f2e85367f4801eff4ea2577845716a31fc066effe1936367c50788de3badcae8f97a4f9a938434151359836747d917df2010863bf00c69d324e03f72e05e65a25a21f17f6eb1a58234cffaa57d611bebe6ed013d2e7feb13d01f128616c7acc1dd097ba9fc2c0e0f881496be7f59240f9c0f23630c23cbc4f5f8017deab15befd7c9e0e3c7865d975c001b28c6d29d4d2e1c078158af58a78fd822f28788731c5db8c902bab8c825c521d5be6ca4d876ea4cbdef41053739f2e74f802986f744be65abb203e5fdbcd6898be36da8cc4a3ccb93666c6cb0409232545e6cc5168e21942e66c2668b6a29de01a13bf7402800261553a955f2a52f441c13cacb0bc9a5047355c9fe4f21f515bb05f0edc2e3ba5a5abfa64255c536823e289674508ce7877deb526ee4e5071a4917558c7f942af83fa4246725545037b48578ab5f4a92c9a9cbd40436fedaba7d6b9bbe09bb8a950e765fce47b04f6f4f24da6f270f61e72d1c03a0eab02441596c4593abc25897e48b889fd0e46511167012d2eded4fa4e151378e6cfbfe41e551f9f05bb0d2682e4372603eb0f798321d228f39f98519ae9f45537d0ac1c58077dcd4f09f8bdfefd9b2e83429df481e76f1782ce604063a5b0ebf9d61410f23f339ed6be0c481b1ca87739cbe677bf12f1a94d3d5599b93b381af29b459ebde519291602e971363570c98ee9ed5d6aa5b8839bf73a06f24c4f265568b036c5ae65bb3273826523e95e59166907ad996d96f42e6b354fd793f85642ff216476d80df359829cf068f8608449fa3032cc2d87c72ee1d0fac0ff643287174a8c260c37659f09dacc254924f0b37eec4d42f477b8421fc93de0cf3067ebd965296d7849644a12305c0d70ebf6718afc7ad2f950a007ca53ca832781fbcb4e43de8885e492ab21e0dc5e0e16da16191ec3db4d5a05f92a5d2c3e79d0527f26370f24daf8e4e7b20d69646cd0f30774d29e45ba74f89a6dda8f779ec05b0e7cc4e65f69dc02587b8e53779368eda849359528d1eb495dd33baa5658940d51af8be82a4b7f1a7e1f1f1511cec52ea56b99c7cde55ea05adbde760262e1fd4beb3c0bb8516f050a099b06e4e75da29af597242fc746d42f7e5add204428bd35e4d2a06ccf4822b8d137ef863e5ac35a4c2246a95da45f5b3b9cded7d41fc93aeb98114ce0edfbcaaee4314ffa95c35cda0c8c4d62b8e721395a220182e809e2d3cf48fda10253e67ec56ee8db3455c33f41890cf6e08e6c188aa73bc396d945c1fca00c4752179a497ad7c5c56ef3511152bf27e0109a86554e7a781b4e5a4904c4c59994083ba0b1d4ad14a475b5ce841c2c017281eb54ddd0803b25a6df9e09b8e7340913afb5c0f659d82f28bd6a54cdd54e61960be12c75dd688b0c4ebd672d54ea4771f0046afabe8f8e7e98f960280f0afd7373ba1770b9ff0624fcfe5187f2ce4bb3adaa5398dd73"})

06:38:37 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x800, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86ba206193131b1cf46e59dc8c518c380ed9793f370ae8da49c0092cd1726257d73f52570191f5ba4f868b372a713ffb555f5cb9c80fbec9354c1dc632ba43fc554dc34c3e552eac551d208b0c798ca1ae9c75a3fc3d6c039a343f5597f8593416a4bfb734d63dba7634586b1f4578667624810b8aa4fc7907767b39ed553d1ff659ec928ce4c8e62c8b80ae6f3bc6ba99adb7e4cdfbce49785cc407e7f59ef2f2b0bb58d91b2119ebc2639bfad3b159673c60b24f82512823a6de589ec029adb3e149f2ebe17426cfeac48b92064b33cc59d3ae6a368807c021aca1ff29dfe1889382b730ee97d7d187f7f1bb97cfb296f20fbe2e1aeeb773a1d10da3592f15998825d5283c0fcfba7de857ae7268cad3732ab5dcd73448062fe9a365a91d0b67e0d7d785a895a6aa058904a054695c31b09c9c2c801865ca3cc8b0cb4b2ceb9819d3f62ed199f5c21fae71d029e163671022e5aaf3b25b42c3b55c30533630efb3c6a131fd56a612e2fa5703f1d3357573b8c87e04b46110ee5e7d66a5c4375c30382ac9d09963edd7f41785ac774bb459dd540e2c0a618b82dacc0b325870f03b8d1451c7aa47fe5b6a2c74101bc6ff67ba1af363ddeb04e4322d78b7864f43c2eda43fd9c798b3e2c0c65d7fbb9ba5afb3b7c6406d1ae4da4941183f75b8475b7f92c0291cf7c8a9d44f629f8078e59eff8703e840c80e69d328eb73925a5cdbd57acb19618211ea117d7a8a1ed5de76ba3b2c128ec17beb65b9f17303b2ed51a226ae18167d3abc5979197bea0453519ed268c083b1b5eb85c9380eccc007151124d8170afa8382e39cff375f43c191964f502e39f722b444f7f36866782d8771c5f8b610a6b99c9041bdbc8b451a68e2fdbc2ad7a0762c1fdbd97659ba74d7daca6a63bf03f7ac2578ee96912996b8fa003a88a9cebffb9e36c1c9a8cc9977a61bb93cd85f7ebc0de74597e4071d65df7941bdcb347c2db0f214dd54326baf1eeef1211e542f5d4f5172e12dfc63c4de78593c52df0f3f1cbe1b8a9fb1f59242309c8f2699a66588a87ceefa0f660f304d8e8e7295448cb1cc350192833990f7d89225022c9a6205cdfcacccf996cd9e24fd1c419528f032a04d9437c2b72869961c90495ebc306707c04cb6d01cb1001c6d262fd69ed76e58a2e96d6297e608dfb100986549addd3150f7c163c206d33f3fb6de8e9c549086f61e5cf8cbf776ce8b6fedf4751b1be37a5c3339fb584d5e9d3d0e16d6a34ff5fadab7e335f230689641d171b5ff30b03042c28b6b1163f74a82d97930c05cf0c41b8229336aaf18d1d47e7bee5e7d7e50b33d0feccc6d411f6b881b2334083e3a8bc8d3bad4070176a853ee277684b4f3f812d9b624679ce3a5923f427dcab5f737288a3cabffa858e29030b70346925a82d6440bd2e6405ca6f0b21c713183ead55fea3af313920528d660f0beb935ec50c881eae3bbeb3c70100710dc9f7e8582ec00cc8461de0ec4b4f577f9b68020093fed727ae02fd689bb2e38f5817f3736050e3b9c53c0357a2df8807316c0e8336242f1977d1cb7f1d8a6cf1cc6c8a4f3521e3fa7719e58a148f068bdd20b1104f43b6f762292d10a3169dfdad50d668e1f109b9d7eeb76b3ba48d3302c5971d4df1b34d4c4a92929f3876d3bb868cefd02c9a08c364c1e557d5d0c246d5c28235f43cac9aa0f371bcba120235660e6b73b5a975e826607201241b7c385c5fab5c0e34c9dc1b33c4e48ca0a37525e2b4db287a180eed1f092a989db67f6b95c9850bf4326ac2a20f2a1403c553a085c035f7fbba1fe9f7d35066f6e2a68771bdeec7d401a6c654fc06d529ea1b0de033083343109c2ad1c5ad43f64502e026fa37f5fc59afcbb0a51a3c42484b7d21abfbb357fb4bb8cbefd135183b1adfe5e21456b0d7bd9d25eb81f7285424f5bc28ab69be3f9601f41ba2e7318c4dac37561ecf8dbddcc7ebaaa3671f0ab6e1faf58d7bb53d91c4f332a68ed9a36d2955a1d6e2bd19bb9dc11a69a49103188df42ef4767014da485b9c18f3d354a6d19608050c4d073bb7602fcd419b1acab536a852c2b4b3188257f250040cc3c06c0cd19f126a2d4bd2f930546e8f4f7c97090b2a906d57d0668050dc00ec93af78290fdd92da915883954ca1bea5a3858cad4dec18419e24f8e0eaf6e8f9ea9c38acb89033c4c28e30dfb054029a3766892f2e4a2a751572be31d93be94d92366a4c6260a3968a896b652be9a26bd3f162539883dbc0bb543559d9a825ac76b270254f0f3b70856051823afaf3fd2b54588d3be0b805e210def0b252900213e782bac9b1c917f9fd4ac8f51c13f4fa84360465172a97d3dabcb337f9fbe6bb72b8e18ef364a263408e2c8fe4891e31bb619db5f1b99b8256bef563f9f1acc37027112a53248fe7e5a6c8792685e5a0c13120cb2ae906c521214174bfd3cd783b7cc586eb09ba16dd4692fa08ed01b91496d4edc3a8cc421b023d34d4e2a1921513b457fddddebaa262f91f8953d3a7193b68fa3c779a9ef51a68ec227280eb78480ee34228c5db3f18699da509eb2f51aba41f6e39a9ade8efa2e1d5707fd293c5358c3c7ef35231a5831566db8dc2b8181e278bdbbca477a87590c48759eb3f862bd8a4770e2b7ef64484eeacea001737315a470bf68f6f5824d3a1f1d5a3b3c6157b03b5b9aca864dbf7877b7b1d20c8b6c2fdf5dab424ce1076391359f6daaa313c5b1384479f8a61ce733c4432389464dc414a60ee1b0c7efdc5fcc53811a144b10ca19159207baa775b2145d0b82d4fbc93116326"})

[ 1629.866648][T10508] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.3'.
[ 1629.937895][T10510] binder: 10509:10510 unknown command 808482864
[ 1629.944527][T10510] binder: 10509:10510 ioctl c0306201 20000040 returned -22
06:38:37 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x6c, 0x0, &(0x7f0000000340)=[@acquire={0x40046305, 0x3}, @acquire_done, @exit_looper, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000003c0)})

06:38:37 executing program 0:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
waitid(0x0, 0x0, 0x0, 0x20000000, 0x0)

06:38:37 executing program 3:
ioctl$KVM_CHECK_EXTENSION(0xffffffffffffffff, 0xae03, 0x3f)
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_TRAP_GET(r1, &(0x7f0000000740)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000700)={&(0x7f0000000600)={0x100, 0x0, 0x2, 0x70bd27, 0x25dfdbff, {}, [{@pci={{0x8}, {0x11}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}]}, 0x100}}, 0x28001)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="db1e29bd7000fbdbdf250600000008000300", @ANYRES32, @ANYBLOB='\f'], 0x30}}, 0x0)

06:38:37 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000002c0)})

06:38:37 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x24, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @decrefs], 0x1000, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86ba206193131b1cf46e59dc8c518c380ed9793f370ae8da49c0092cd1726257d73f52570191f5ba4f868b372a713ffb555f5cb9c80fbec9354c1dc632ba43fc554dc34c3e552eac551d208b0c798ca1ae9c75a3fc3d6c039a343f5597f8593416a4bfb734d63dba7634586b1f4578667624810b8aa4fc7907767b39ed553d1ff659ec928ce4c8e62c8b80ae6f3bc6ba99adb7e4cdfbce49785cc407e7f59ef2f2b0bb58d91b2119ebc2639bfad3b159673c60b24f82512823a6de589ec029adb3e149f2ebe17426cfeac48b92064b33cc59d3ae6a368807c021aca1ff29dfe1889382b730ee97d7d187f7f1bb97cfb296f20fbe2e1aeeb773a1d10da3592f15998825d5283c0fcfba7de857ae7268cad3732ab5dcd73448062fe9a365a91d0b67e0d7d785a895a6aa058904a054695c31b09c9c2c801865ca3cc8b0cb4b2ceb9819d3f62ed199f5c21fae71d029e163671022e5aaf3b25b42c3b55c30533630efb3c6a131fd56a612e2fa5703f1d3357573b8c87e04b46110ee5e7d66a5c4375c30382ac9d09963edd7f41785ac774bb459dd540e2c0a618b82dacc0b325870f03b8d1451c7aa47fe5b6a2c74101bc6ff67ba1af363ddeb04e4322d78b7864f43c2eda43fd9c798b3e2c0c65d7fbb9ba5afb3b7c6406d1ae4da4941183f75b8475b7f92c0291cf7c8a9d44f629f8078e59eff8703e840c80e69d328eb73925a5cdbd57acb19618211ea117d7a8a1ed5de76ba3b2c128ec17beb65b9f17303b2ed51a226ae18167d3abc5979197bea0453519ed268c083b1b5eb85c9380eccc007151124d8170afa8382e39cff375f43c191964f502e39f722b444f7f36866782d8771c5f8b610a6b99c9041bdbc8b451a68e2fdbc2ad7a0762c1fdbd97659ba74d7daca6a63bf03f7ac2578ee96912996b8fa003a88a9cebffb9e36c1c9a8cc9977a61bb93cd85f7ebc0de74597e4071d65df7941bdcb347c2db0f214dd54326baf1eeef1211e542f5d4f5172e12dfc63c4de78593c52df0f3f1cbe1b8a9fb1f59242309c8f2699a66588a87ceefa0f660f304d8e8e7295448cb1cc350192833990f7d89225022c9a6205cdfcacccf996cd9e24fd1c419528f032a04d9437c2b72869961c90495ebc306707c04cb6d01cb1001c6d262fd69ed76e58a2e96d6297e608dfb100986549addd3150f7c163c206d33f3fb6de8e9c549086f61e5cf8cbf776ce8b6fedf4751b1be37a5c3339fb584d5e9d3d0e16d6a34ff5fadab7e335f230689641d171b5ff30b03042c28b6b1163f74a82d97930c05cf0c41b8229336aaf18d1d47e7bee5e7d7e50b33d0feccc6d411f6b881b2334083e3a8bc8d3bad4070176a853ee277684b4f3f812d9b624679ce3a5923f427dcab5f737288a3cabffa858e29030b70346925a82d6440bd2e6405ca6f0b21c713183ead55fea3af313920528d660f0beb935ec50c881eae3bbeb3c70100710dc9f7e8582ec00cc8461de0ec4b4f577f9b68020093fed727ae02fd689bb2e38f5817f3736050e3b9c53c0357a2df8807316c0e8336242f1977d1cb7f1d8a6cf1cc6c8a4f3521e3fa7719e58a148f068bdd20b1104f43b6f762292d10a3169dfdad50d668e1f109b9d7eeb76b3ba48d3302c5971d4df1b34d4c4a92929f3876d3bb868cefd02c9a08c364c1e557d5d0c246d5c28235f43cac9aa0f371bcba120235660e6b73b5a975e826607201241b7c385c5fab5c0e34c9dc1b33c4e48ca0a37525e2b4db287a180eed1f092a989db67f6b95c9850bf4326ac2a20f2a1403c553a085c035f7fbba1fe9f7d35066f6e2a68771bdeec7d401a6c654fc06d529ea1b0de033083343109c2ad1c5ad43f64502e026fa37f5fc59afcbb0a51a3c42484b7d21abfbb357fb4bb8cbefd135183b1adfe5e21456b0d7bd9d25eb81f7285424f5bc28ab69be3f9601f41ba2e7318c4dac37561ecf8dbddcc7ebaaa3671f0ab6e1faf58d7bb53d91c4f332a68ed9a36d2955a1d6e2bd19bb9dc11a69a49103188df42ef4767014da485b9c18f3d354a6d19608050c4d073bb7602fcd419b1acab536a852c2b4b3188257f250040cc3c06c0cd19f126a2d4bd2f930546e8f4f7c97090b2a906d57d0668050dc00ec93af78290fdd92da915883954ca1bea5a3858cad4dec18419e24f8e0eaf6e8f9ea9c38acb89033c4c28e30dfb054029a3766892f2e4a2a751572be31d93be94d92366a4c6260a3968a896b652be9a26bd3f162539883dbc0bb543559d9a825ac76b270254f0f3b70856051823afaf3fd2b54588d3be0b805e210def0b252900213e782bac9b1c917f9fd4ac8f51c13f4fa84360465172a97d3dabcb337f9fbe6bb72b8e18ef364a263408e2c8fe4891e31bb619db5f1b99b8256bef563f9f1acc37027112a53248fe7e5a6c8792685e5a0c13120cb2ae906c521214174bfd3cd783b7cc586eb09ba16dd4692fa08ed01b91496d4edc3a8cc421b023d34d4e2a1921513b457fddddebaa262f91f8953d3a7193b68fa3c779a9ef51a68ec227280eb78480ee34228c5db3f18699da509eb2f51aba41f6e39a9ade8efa2e1d5707fd293c5358c3c7ef35231a5831566db8dc2b8181e278bdbbca477a87590c48759eb3f862bd8a4770e2b7ef64484eeacea001737315a470bf68f6f5824d3a1f1d5a3b3c6157b03b5b9aca864dbf7877b7b1d20c8b6c2fdf5dab424ce1076391359f6daaa313c5b1384479f8a61ce733c4432389464dc414a60ee1b0c7efdc5fcc53811a144b10ca19159207baa775b2145d0b82d4fbc93116326e8d9c26a605812324cf8883f9bb7a7e28c0dcce5dbdedd835a36715201a1464bdad0783888e2916fe36a38aad080c287e0dd1ca6d966e5ba200941a8cd6df2b902feff11135ca87a79b0446e07897fd6555549352ebd8d4ba0aff161a5f6dcdd5d960abaa1b2cdab9b5d7c4332d967f480e21ff75064bffb6a9dd15f1ca9d6c4b9b1f65f16536f3d3be128fbba656c14270cf5174e692bde77ecd317f1e61632245fe13b6de7968739c4f0c18e0ccd85bf4e0979d63b283b2de3f460a579ca2b6ad93e16e1d50eb1886d2a1666937f631f89f9fa18a4e74a582e43b4181ccfd87df8640af31fb3f6a35de47318b1d0c13f9e4679f1c32819919edd25691284a237102efc085d342d5273f60186ab0b6071b1cfdf7e54529669515e9f69338b819f4044c6e0c299503c3cc464b7a40587da07605cc2a6134cd1801f29646b031846d6411598862a56e1313494cc5d54d85fca772697f8fc69ac997b6e570d4fa0f796ca0809fb36c9c76535dd6a5f0db924f09013a8a26be2426f4a3fecfe1b83f6bd16f4d9f2f7d40e1ef4ce3dfb647827b2d180b3e9fb8978a3dc64735403612e90f9178ace54a32786cf1640b6c1554b8dfc87455817e832dde45ffb37bab5746230dee9550ebb01626f31de99cbfcd1eeefa5f16e97c6caa795b6f12237f70c9419bd81718f27d08406e72b26474ecfc27c52b6de20cb2dd4b82c7e0e413f196471e86ac666dcdfa71ae0da22be2c071208b678837b55f50835f3f6605f2f2f822708f3d74b2c419a8db9b3ee7a2a0c000eb80225f4d1e5a01805af179220935805255987df25ee15322ccbf5c42393f04d9c36de56e38331edc7a630843cb22235d77ea92b496134d81725fef0dcaec37ca5e7e77e91ff38b8377eb0abe88a9c2919f539124f4c7a1a1bc0ae85fc601364f05bbfac17de50c7c13b2fb4667726c4e5dc5b647439bd11e3eef22a59b778c527d5181af55319e7750c1d941feb55489d391203b245af211638632b3a9894598042a8507858d2c28cdbb55d84adc84e05f961acd3a7f2a24f1b5e375f0401ac6727ad500713a49bf7cd41596badb1fde93a4d65598f1e9546384c93018e22dd4724930294bfd407c059a54e29064528e98b863503c2201f9c8676c47eb8297c40adda21a45b854ea5d682c7f823700a02d8b61b972fc91431b780d9d2bfdad2f6e882a170c4cb3a9b3e4f97fc34c2ec56fa6b0ba95679327373b190f5ed8102b32cd040949abfd4424ab1808f1df3895d678037bbcdc49d6fdb833885efeaf9ecc00986e3d06ca47e86c3c6cbd3a228fd7785158d4812e5941f8f071431ee4c5bddd9c4100db52b69f13d9322ef8181cf230ce1e15b88f651d51ad6b8107c69f040a5f5462290ef0d1454e622f8af8833733a7d5f974ca0ff873f2e85367f4801eff4ea2577845716a31fc066effe1936367c50788de3badcae8f97a4f9a938434151359836747d917df2010863bf00c69d324e03f72e05e65a25a21f17f6eb1a58234cffaa57d611bebe6ed013d2e7feb13d01f128616c7acc1dd097ba9fc2c0e0f881496be7f59240f9c0f23630c23cbc4f5f8017deab15befd7c9e0e3c7865d975c001b28c6d29d4d2e1c078158af58a78fd822f28788731c5db8c902bab8c825c521d5be6ca4d876ea4cbdef41053739f2e74f802986f744be65abb203e5fdbcd6898be36da8cc4a3ccb93666c6cb0409232545e6cc5168e21942e66c2668b6a29de01a13bf7402800261553a955f2a52f441c13cacb0bc9a5047355c9fe4f21f515bb05f0edc2e3ba5a5abfa64255c536823e289674508ce7877deb526ee4e5071a4917558c7f942af83fa4246725545037b48578ab5f4a92c9a9cbd40436fedaba7d6b9bbe09bb8a950e765fce47b04f6f4f24da6f270f61e72d1c03a0eab02441596c4593abc25897e48b889fd0e46511167012d2eded4fa4e151378e6cfbfe41e551f9f05bb0d2682e4372603eb0f798321d228f39f98519ae9f45537d0ac1c58077dcd4f09f8bdfefd9b2e83429df481e76f1782ce604063a5b0ebf9d61410f23f339ed6be0c481b1ca87739cbe677bf12f1a94d3d5599b93b381af29b459ebde519291602e971363570c98ee9ed5d6aa5b8839bf73a06f24c4f265568b036c5ae65bb3273826523e95e59166907ad996d96f42e6b354fd793f85642ff216476d80df359829cf068f8608449fa3032cc2d87c72ee1d0fac0ff643287174a8c260c37659f09dacc254924f0b37eec4d42f477b8421fc93de0cf3067ebd965296d7849644a12305c0d70ebf6718afc7ad2f950a007ca53ca832781fbcb4e43de8885e492ab21e0dc5e0e16da16191ec3db4d5a05f92a5d2c3e79d0527f26370f24daf8e4e7b20d69646cd0f30774d29e45ba74f89a6dda8f779ec05b0e7cc4e65f69dc02587b8e53779368eda849359528d1eb495dd33baa5658940d51af8be82a4b7f1a7e1f1f1511cec52ea56b99c7cde55ea05adbde760262e1fd4beb3c0bb8516f050a099b06e4e75da29af597242fc746d42f7e5add204428bd35e4d2a06ccf4822b8d137ef863e5ac35a4c2246a95da45f5b3b9cded7d41fc93aeb98114ce0edfbcaaee4314ffa95c35cda0c8c4d62b8e721395a220182e809e2d3cf48fda10253e67ec56ee8db3455c33f41890cf6e08e6c188aa73bc396d945c1fca00c4752179a497ad7c5c56ef3511152bf27e0109a86554e7a781b4e5a4904c4c59994083ba0b1d4ad14a475b5ce841c2c017281eb54ddd0803b25a6df9e09b8e7340913afb5c0f659d82f28bd6a54cdd54e61960be12c75dd688b0c4ebd672d54ea4771f0046afabe8f8e7e98f960280f0afd7373ba1770b9ff0624fcfe5187f2ce4bb3adaa5398dd73"})

06:38:38 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_open_dev$dri(&(0x7f0000000080), 0xfff, 0x82c80)
ioctl$DRM_IOCTL_NEW_CTX(r1, 0x40086425, &(0x7f00000000c0))
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:38:38 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x6c, 0x0, &(0x7f0000000340)=[@acquire={0x40046305, 0x3}, @acquire_done, @exit_looper, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000003c0)})

06:38:38 executing program 0:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
waitid(0x0, 0x0, 0x0, 0x20000000, 0x0)

[ 1630.529138][T10522] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.3'.
06:38:38 executing program 3:
ioctl$KVM_CHECK_EXTENSION(0xffffffffffffffff, 0xae03, 0x3f)
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
socket$nl_generic(0x10, 0x3, 0x10)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="db1e29bd7000fbdbdf250600000008000300", @ANYRES32, @ANYBLOB='\f'], 0x30}}, 0x0)

06:38:38 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000002c0)})

06:38:38 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x20, 0x0, &(0x7f0000000240)=[@request_death, @increfs={0x40046304, 0x3}, @decrefs], 0x1000, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86ba206193131b1cf46e59dc8c518c380ed9793f370ae8da49c0092cd1726257d73f52570191f5ba4f868b372a713ffb555f5cb9c80fbec9354c1dc632ba43fc554dc34c3e552eac551d208b0c798ca1ae9c75a3fc3d6c039a343f5597f8593416a4bfb734d63dba7634586b1f4578667624810b8aa4fc7907767b39ed553d1ff659ec928ce4c8e62c8b80ae6f3bc6ba99adb7e4cdfbce49785cc407e7f59ef2f2b0bb58d91b2119ebc2639bfad3b159673c60b24f82512823a6de589ec029adb3e149f2ebe17426cfeac48b92064b33cc59d3ae6a368807c021aca1ff29dfe1889382b730ee97d7d187f7f1bb97cfb296f20fbe2e1aeeb773a1d10da3592f15998825d5283c0fcfba7de857ae7268cad3732ab5dcd73448062fe9a365a91d0b67e0d7d785a895a6aa058904a054695c31b09c9c2c801865ca3cc8b0cb4b2ceb9819d3f62ed199f5c21fae71d029e163671022e5aaf3b25b42c3b55c30533630efb3c6a131fd56a612e2fa5703f1d3357573b8c87e04b46110ee5e7d66a5c4375c30382ac9d09963edd7f41785ac774bb459dd540e2c0a618b82dacc0b325870f03b8d1451c7aa47fe5b6a2c74101bc6ff67ba1af363ddeb04e4322d78b7864f43c2eda43fd9c798b3e2c0c65d7fbb9ba5afb3b7c6406d1ae4da4941183f75b8475b7f92c0291cf7c8a9d44f629f8078e59eff8703e840c80e69d328eb73925a5cdbd57acb19618211ea117d7a8a1ed5de76ba3b2c128ec17beb65b9f17303b2ed51a226ae18167d3abc5979197bea0453519ed268c083b1b5eb85c9380eccc007151124d8170afa8382e39cff375f43c191964f502e39f722b444f7f36866782d8771c5f8b610a6b99c9041bdbc8b451a68e2fdbc2ad7a0762c1fdbd97659ba74d7daca6a63bf03f7ac2578ee96912996b8fa003a88a9cebffb9e36c1c9a8cc9977a61bb93cd85f7ebc0de74597e4071d65df7941bdcb347c2db0f214dd54326baf1eeef1211e542f5d4f5172e12dfc63c4de78593c52df0f3f1cbe1b8a9fb1f59242309c8f2699a66588a87ceefa0f660f304d8e8e7295448cb1cc350192833990f7d89225022c9a6205cdfcacccf996cd9e24fd1c419528f032a04d9437c2b72869961c90495ebc306707c04cb6d01cb1001c6d262fd69ed76e58a2e96d6297e608dfb100986549addd3150f7c163c206d33f3fb6de8e9c549086f61e5cf8cbf776ce8b6fedf4751b1be37a5c3339fb584d5e9d3d0e16d6a34ff5fadab7e335f230689641d171b5ff30b03042c28b6b1163f74a82d97930c05cf0c41b8229336aaf18d1d47e7bee5e7d7e50b33d0feccc6d411f6b881b2334083e3a8bc8d3bad4070176a853ee277684b4f3f812d9b624679ce3a5923f427dcab5f737288a3cabffa858e29030b70346925a82d6440bd2e6405ca6f0b21c713183ead55fea3af313920528d660f0beb935ec50c881eae3bbeb3c70100710dc9f7e8582ec00cc8461de0ec4b4f577f9b68020093fed727ae02fd689bb2e38f5817f3736050e3b9c53c0357a2df8807316c0e8336242f1977d1cb7f1d8a6cf1cc6c8a4f3521e3fa7719e58a148f068bdd20b1104f43b6f762292d10a3169dfdad50d668e1f109b9d7eeb76b3ba48d3302c5971d4df1b34d4c4a92929f3876d3bb868cefd02c9a08c364c1e557d5d0c246d5c28235f43cac9aa0f371bcba120235660e6b73b5a975e826607201241b7c385c5fab5c0e34c9dc1b33c4e48ca0a37525e2b4db287a180eed1f092a989db67f6b95c9850bf4326ac2a20f2a1403c553a085c035f7fbba1fe9f7d35066f6e2a68771bdeec7d401a6c654fc06d529ea1b0de033083343109c2ad1c5ad43f64502e026fa37f5fc59afcbb0a51a3c42484b7d21abfbb357fb4bb8cbefd135183b1adfe5e21456b0d7bd9d25eb81f7285424f5bc28ab69be3f9601f41ba2e7318c4dac37561ecf8dbddcc7ebaaa3671f0ab6e1faf58d7bb53d91c4f332a68ed9a36d2955a1d6e2bd19bb9dc11a69a49103188df42ef4767014da485b9c18f3d354a6d19608050c4d073bb7602fcd419b1acab536a852c2b4b3188257f250040cc3c06c0cd19f126a2d4bd2f930546e8f4f7c97090b2a906d57d0668050dc00ec93af78290fdd92da915883954ca1bea5a3858cad4dec18419e24f8e0eaf6e8f9ea9c38acb89033c4c28e30dfb054029a3766892f2e4a2a751572be31d93be94d92366a4c6260a3968a896b652be9a26bd3f162539883dbc0bb543559d9a825ac76b270254f0f3b70856051823afaf3fd2b54588d3be0b805e210def0b252900213e782bac9b1c917f9fd4ac8f51c13f4fa84360465172a97d3dabcb337f9fbe6bb72b8e18ef364a263408e2c8fe4891e31bb619db5f1b99b8256bef563f9f1acc37027112a53248fe7e5a6c8792685e5a0c13120cb2ae906c521214174bfd3cd783b7cc586eb09ba16dd4692fa08ed01b91496d4edc3a8cc421b023d34d4e2a1921513b457fddddebaa262f91f8953d3a7193b68fa3c779a9ef51a68ec227280eb78480ee34228c5db3f18699da509eb2f51aba41f6e39a9ade8efa2e1d5707fd293c5358c3c7ef35231a5831566db8dc2b8181e278bdbbca477a87590c48759eb3f862bd8a4770e2b7ef64484eeacea001737315a470bf68f6f5824d3a1f1d5a3b3c6157b03b5b9aca864dbf7877b7b1d20c8b6c2fdf5dab424ce1076391359f6daaa313c5b1384479f8a61ce733c4432389464dc414a60ee1b0c7efdc5fcc53811a144b10ca19159207baa775b2145d0b82d4fbc93116326e8d9c26a605812324cf8883f9bb7a7e28c0dcce5dbdedd835a36715201a1464bdad0783888e2916fe36a38aad080c287e0dd1ca6d966e5ba200941a8cd6df2b902feff11135ca87a79b0446e07897fd6555549352ebd8d4ba0aff161a5f6dcdd5d960abaa1b2cdab9b5d7c4332d967f480e21ff75064bffb6a9dd15f1ca9d6c4b9b1f65f16536f3d3be128fbba656c14270cf5174e692bde77ecd317f1e61632245fe13b6de7968739c4f0c18e0ccd85bf4e0979d63b283b2de3f460a579ca2b6ad93e16e1d50eb1886d2a1666937f631f89f9fa18a4e74a582e43b4181ccfd87df8640af31fb3f6a35de47318b1d0c13f9e4679f1c32819919edd25691284a237102efc085d342d5273f60186ab0b6071b1cfdf7e54529669515e9f69338b819f4044c6e0c299503c3cc464b7a40587da07605cc2a6134cd1801f29646b031846d6411598862a56e1313494cc5d54d85fca772697f8fc69ac997b6e570d4fa0f796ca0809fb36c9c76535dd6a5f0db924f09013a8a26be2426f4a3fecfe1b83f6bd16f4d9f2f7d40e1ef4ce3dfb647827b2d180b3e9fb8978a3dc64735403612e90f9178ace54a32786cf1640b6c1554b8dfc87455817e832dde45ffb37bab5746230dee9550ebb01626f31de99cbfcd1eeefa5f16e97c6caa795b6f12237f70c9419bd81718f27d08406e72b26474ecfc27c52b6de20cb2dd4b82c7e0e413f196471e86ac666dcdfa71ae0da22be2c071208b678837b55f50835f3f6605f2f2f822708f3d74b2c419a8db9b3ee7a2a0c000eb80225f4d1e5a01805af179220935805255987df25ee15322ccbf5c42393f04d9c36de56e38331edc7a630843cb22235d77ea92b496134d81725fef0dcaec37ca5e7e77e91ff38b8377eb0abe88a9c2919f539124f4c7a1a1bc0ae85fc601364f05bbfac17de50c7c13b2fb4667726c4e5dc5b647439bd11e3eef22a59b778c527d5181af55319e7750c1d941feb55489d391203b245af211638632b3a9894598042a8507858d2c28cdbb55d84adc84e05f961acd3a7f2a24f1b5e375f0401ac6727ad500713a49bf7cd41596badb1fde93a4d65598f1e9546384c93018e22dd4724930294bfd407c059a54e29064528e98b863503c2201f9c8676c47eb8297c40adda21a45b854ea5d682c7f823700a02d8b61b972fc91431b780d9d2bfdad2f6e882a170c4cb3a9b3e4f97fc34c2ec56fa6b0ba95679327373b190f5ed8102b32cd040949abfd4424ab1808f1df3895d678037bbcdc49d6fdb833885efeaf9ecc00986e3d06ca47e86c3c6cbd3a228fd7785158d4812e5941f8f071431ee4c5bddd9c4100db52b69f13d9322ef8181cf230ce1e15b88f651d51ad6b8107c69f040a5f5462290ef0d1454e622f8af8833733a7d5f974ca0ff873f2e85367f4801eff4ea2577845716a31fc066effe1936367c50788de3badcae8f97a4f9a938434151359836747d917df2010863bf00c69d324e03f72e05e65a25a21f17f6eb1a58234cffaa57d611bebe6ed013d2e7feb13d01f128616c7acc1dd097ba9fc2c0e0f881496be7f59240f9c0f23630c23cbc4f5f8017deab15befd7c9e0e3c7865d975c001b28c6d29d4d2e1c078158af58a78fd822f28788731c5db8c902bab8c825c521d5be6ca4d876ea4cbdef41053739f2e74f802986f744be65abb203e5fdbcd6898be36da8cc4a3ccb93666c6cb0409232545e6cc5168e21942e66c2668b6a29de01a13bf7402800261553a955f2a52f441c13cacb0bc9a5047355c9fe4f21f515bb05f0edc2e3ba5a5abfa64255c536823e289674508ce7877deb526ee4e5071a4917558c7f942af83fa4246725545037b48578ab5f4a92c9a9cbd40436fedaba7d6b9bbe09bb8a950e765fce47b04f6f4f24da6f270f61e72d1c03a0eab02441596c4593abc25897e48b889fd0e46511167012d2eded4fa4e151378e6cfbfe41e551f9f05bb0d2682e4372603eb0f798321d228f39f98519ae9f45537d0ac1c58077dcd4f09f8bdfefd9b2e83429df481e76f1782ce604063a5b0ebf9d61410f23f339ed6be0c481b1ca87739cbe677bf12f1a94d3d5599b93b381af29b459ebde519291602e971363570c98ee9ed5d6aa5b8839bf73a06f24c4f265568b036c5ae65bb3273826523e95e59166907ad996d96f42e6b354fd793f85642ff216476d80df359829cf068f8608449fa3032cc2d87c72ee1d0fac0ff643287174a8c260c37659f09dacc254924f0b37eec4d42f477b8421fc93de0cf3067ebd965296d7849644a12305c0d70ebf6718afc7ad2f950a007ca53ca832781fbcb4e43de8885e492ab21e0dc5e0e16da16191ec3db4d5a05f92a5d2c3e79d0527f26370f24daf8e4e7b20d69646cd0f30774d29e45ba74f89a6dda8f779ec05b0e7cc4e65f69dc02587b8e53779368eda849359528d1eb495dd33baa5658940d51af8be82a4b7f1a7e1f1f1511cec52ea56b99c7cde55ea05adbde760262e1fd4beb3c0bb8516f050a099b06e4e75da29af597242fc746d42f7e5add204428bd35e4d2a06ccf4822b8d137ef863e5ac35a4c2246a95da45f5b3b9cded7d41fc93aeb98114ce0edfbcaaee4314ffa95c35cda0c8c4d62b8e721395a220182e809e2d3cf48fda10253e67ec56ee8db3455c33f41890cf6e08e6c188aa73bc396d945c1fca00c4752179a497ad7c5c56ef3511152bf27e0109a86554e7a781b4e5a4904c4c59994083ba0b1d4ad14a475b5ce841c2c017281eb54ddd0803b25a6df9e09b8e7340913afb5c0f659d82f28bd6a54cdd54e61960be12c75dd688b0c4ebd672d54ea4771f0046afabe8f8e7e98f960280f0afd7373ba1770b9ff0624fcfe5187f2ce4bb3adaa5398dd73"})

06:38:38 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x6c, 0x0, &(0x7f0000000340)=[@acquire={0x40046305, 0x3}, @acquire_done, @exit_looper, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x51, 0x0, &(0x7f00000003c0)="81f4bf5574322fe2f759e010e412a85afd76c59793bd41a5db1b3652a9cc81d13103ec6b01d8e5631a6cfd388e3486c8f8d4ddc7cb97bf470c301912c8d80e0309da9b3a77c91376587e2d1c2dae5b0c0c"})

06:38:38 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
ioctl$SNDCTL_SEQ_NRSYNTHS(0xffffffffffffffff, 0x8004510a, &(0x7f0000000280))
mmap$binder(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x4)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080), 0x400000, 0x0)
sendmsg$IPVS_CMD_ZERO(r1, &(0x7f0000000140)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000100)={&(0x7f00000001c0)={0x84, 0x0, 0x200, 0x70bd28, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x80}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x200}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x401}, @IPVS_CMD_ATTR_DEST={0x34, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0xffffffff}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x8}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0xffffff01}, @IPVS_DEST_ATTR_FWD_METHOD={0x8}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x5}, @IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x1}]}, @IPVS_CMD_ATTR_DAEMON={0x20, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @remote}]}]}, 0x84}, 0x1, 0x0, 0x0, 0x880}, 0x8804)

[ 1631.077929][T10537] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.3'.
06:38:38 executing program 0:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
waitid(0x0, 0x0, &(0x7f00000000c0), 0x0, 0x0)

06:38:38 executing program 3:
ioctl$KVM_CHECK_EXTENSION(0xffffffffffffffff, 0xae03, 0x3f)
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="db1e29bd7000fbdbdf250600000008000300", @ANYRES32, @ANYBLOB='\f'], 0x30}}, 0x0)

06:38:39 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000002c0)})

06:38:39 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x20, 0x0, &(0x7f0000000240)=[@request_death, @increfs={0x40046304, 0x3}, @decrefs], 0x1000, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86ba206193131b1cf46e59dc8c518c380ed9793f370ae8da49c0092cd1726257d73f52570191f5ba4f868b372a713ffb555f5cb9c80fbec9354c1dc632ba43fc554dc34c3e552eac551d208b0c798ca1ae9c75a3fc3d6c039a343f5597f8593416a4bfb734d63dba7634586b1f4578667624810b8aa4fc7907767b39ed553d1ff659ec928ce4c8e62c8b80ae6f3bc6ba99adb7e4cdfbce49785cc407e7f59ef2f2b0bb58d91b2119ebc2639bfad3b159673c60b24f82512823a6de589ec029adb3e149f2ebe17426cfeac48b92064b33cc59d3ae6a368807c021aca1ff29dfe1889382b730ee97d7d187f7f1bb97cfb296f20fbe2e1aeeb773a1d10da3592f15998825d5283c0fcfba7de857ae7268cad3732ab5dcd73448062fe9a365a91d0b67e0d7d785a895a6aa058904a054695c31b09c9c2c801865ca3cc8b0cb4b2ceb9819d3f62ed199f5c21fae71d029e163671022e5aaf3b25b42c3b55c30533630efb3c6a131fd56a612e2fa5703f1d3357573b8c87e04b46110ee5e7d66a5c4375c30382ac9d09963edd7f41785ac774bb459dd540e2c0a618b82dacc0b325870f03b8d1451c7aa47fe5b6a2c74101bc6ff67ba1af363ddeb04e4322d78b7864f43c2eda43fd9c798b3e2c0c65d7fbb9ba5afb3b7c6406d1ae4da4941183f75b8475b7f92c0291cf7c8a9d44f629f8078e59eff8703e840c80e69d328eb73925a5cdbd57acb19618211ea117d7a8a1ed5de76ba3b2c128ec17beb65b9f17303b2ed51a226ae18167d3abc5979197bea0453519ed268c083b1b5eb85c9380eccc007151124d8170afa8382e39cff375f43c191964f502e39f722b444f7f36866782d8771c5f8b610a6b99c9041bdbc8b451a68e2fdbc2ad7a0762c1fdbd97659ba74d7daca6a63bf03f7ac2578ee96912996b8fa003a88a9cebffb9e36c1c9a8cc9977a61bb93cd85f7ebc0de74597e4071d65df7941bdcb347c2db0f214dd54326baf1eeef1211e542f5d4f5172e12dfc63c4de78593c52df0f3f1cbe1b8a9fb1f59242309c8f2699a66588a87ceefa0f660f304d8e8e7295448cb1cc350192833990f7d89225022c9a6205cdfcacccf996cd9e24fd1c419528f032a04d9437c2b72869961c90495ebc306707c04cb6d01cb1001c6d262fd69ed76e58a2e96d6297e608dfb100986549addd3150f7c163c206d33f3fb6de8e9c549086f61e5cf8cbf776ce8b6fedf4751b1be37a5c3339fb584d5e9d3d0e16d6a34ff5fadab7e335f230689641d171b5ff30b03042c28b6b1163f74a82d97930c05cf0c41b8229336aaf18d1d47e7bee5e7d7e50b33d0feccc6d411f6b881b2334083e3a8bc8d3bad4070176a853ee277684b4f3f812d9b624679ce3a5923f427dcab5f737288a3cabffa858e29030b70346925a82d6440bd2e6405ca6f0b21c713183ead55fea3af313920528d660f0beb935ec50c881eae3bbeb3c70100710dc9f7e8582ec00cc8461de0ec4b4f577f9b68020093fed727ae02fd689bb2e38f5817f3736050e3b9c53c0357a2df8807316c0e8336242f1977d1cb7f1d8a6cf1cc6c8a4f3521e3fa7719e58a148f068bdd20b1104f43b6f762292d10a3169dfdad50d668e1f109b9d7eeb76b3ba48d3302c5971d4df1b34d4c4a92929f3876d3bb868cefd02c9a08c364c1e557d5d0c246d5c28235f43cac9aa0f371bcba120235660e6b73b5a975e826607201241b7c385c5fab5c0e34c9dc1b33c4e48ca0a37525e2b4db287a180eed1f092a989db67f6b95c9850bf4326ac2a20f2a1403c553a085c035f7fbba1fe9f7d35066f6e2a68771bdeec7d401a6c654fc06d529ea1b0de033083343109c2ad1c5ad43f64502e026fa37f5fc59afcbb0a51a3c42484b7d21abfbb357fb4bb8cbefd135183b1adfe5e21456b0d7bd9d25eb81f7285424f5bc28ab69be3f9601f41ba2e7318c4dac37561ecf8dbddcc7ebaaa3671f0ab6e1faf58d7bb53d91c4f332a68ed9a36d2955a1d6e2bd19bb9dc11a69a49103188df42ef4767014da485b9c18f3d354a6d19608050c4d073bb7602fcd419b1acab536a852c2b4b3188257f250040cc3c06c0cd19f126a2d4bd2f930546e8f4f7c97090b2a906d57d0668050dc00ec93af78290fdd92da915883954ca1bea5a3858cad4dec18419e24f8e0eaf6e8f9ea9c38acb89033c4c28e30dfb054029a3766892f2e4a2a751572be31d93be94d92366a4c6260a3968a896b652be9a26bd3f162539883dbc0bb543559d9a825ac76b270254f0f3b70856051823afaf3fd2b54588d3be0b805e210def0b252900213e782bac9b1c917f9fd4ac8f51c13f4fa84360465172a97d3dabcb337f9fbe6bb72b8e18ef364a263408e2c8fe4891e31bb619db5f1b99b8256bef563f9f1acc37027112a53248fe7e5a6c8792685e5a0c13120cb2ae906c521214174bfd3cd783b7cc586eb09ba16dd4692fa08ed01b91496d4edc3a8cc421b023d34d4e2a1921513b457fddddebaa262f91f8953d3a7193b68fa3c779a9ef51a68ec227280eb78480ee34228c5db3f18699da509eb2f51aba41f6e39a9ade8efa2e1d5707fd293c5358c3c7ef35231a5831566db8dc2b8181e278bdbbca477a87590c48759eb3f862bd8a4770e2b7ef64484eeacea001737315a470bf68f6f5824d3a1f1d5a3b3c6157b03b5b9aca864dbf7877b7b1d20c8b6c2fdf5dab424ce1076391359f6daaa313c5b1384479f8a61ce733c4432389464dc414a60ee1b0c7efdc5fcc53811a144b10ca19159207baa775b2145d0b82d4fbc93116326e8d9c26a605812324cf8883f9bb7a7e28c0dcce5dbdedd835a36715201a1464bdad0783888e2916fe36a38aad080c287e0dd1ca6d966e5ba200941a8cd6df2b902feff11135ca87a79b0446e07897fd6555549352ebd8d4ba0aff161a5f6dcdd5d960abaa1b2cdab9b5d7c4332d967f480e21ff75064bffb6a9dd15f1ca9d6c4b9b1f65f16536f3d3be128fbba656c14270cf5174e692bde77ecd317f1e61632245fe13b6de7968739c4f0c18e0ccd85bf4e0979d63b283b2de3f460a579ca2b6ad93e16e1d50eb1886d2a1666937f631f89f9fa18a4e74a582e43b4181ccfd87df8640af31fb3f6a35de47318b1d0c13f9e4679f1c32819919edd25691284a237102efc085d342d5273f60186ab0b6071b1cfdf7e54529669515e9f69338b819f4044c6e0c299503c3cc464b7a40587da07605cc2a6134cd1801f29646b031846d6411598862a56e1313494cc5d54d85fca772697f8fc69ac997b6e570d4fa0f796ca0809fb36c9c76535dd6a5f0db924f09013a8a26be2426f4a3fecfe1b83f6bd16f4d9f2f7d40e1ef4ce3dfb647827b2d180b3e9fb8978a3dc64735403612e90f9178ace54a32786cf1640b6c1554b8dfc87455817e832dde45ffb37bab5746230dee9550ebb01626f31de99cbfcd1eeefa5f16e97c6caa795b6f12237f70c9419bd81718f27d08406e72b26474ecfc27c52b6de20cb2dd4b82c7e0e413f196471e86ac666dcdfa71ae0da22be2c071208b678837b55f50835f3f6605f2f2f822708f3d74b2c419a8db9b3ee7a2a0c000eb80225f4d1e5a01805af179220935805255987df25ee15322ccbf5c42393f04d9c36de56e38331edc7a630843cb22235d77ea92b496134d81725fef0dcaec37ca5e7e77e91ff38b8377eb0abe88a9c2919f539124f4c7a1a1bc0ae85fc601364f05bbfac17de50c7c13b2fb4667726c4e5dc5b647439bd11e3eef22a59b778c527d5181af55319e7750c1d941feb55489d391203b245af211638632b3a9894598042a8507858d2c28cdbb55d84adc84e05f961acd3a7f2a24f1b5e375f0401ac6727ad500713a49bf7cd41596badb1fde93a4d65598f1e9546384c93018e22dd4724930294bfd407c059a54e29064528e98b863503c2201f9c8676c47eb8297c40adda21a45b854ea5d682c7f823700a02d8b61b972fc91431b780d9d2bfdad2f6e882a170c4cb3a9b3e4f97fc34c2ec56fa6b0ba95679327373b190f5ed8102b32cd040949abfd4424ab1808f1df3895d678037bbcdc49d6fdb833885efeaf9ecc00986e3d06ca47e86c3c6cbd3a228fd7785158d4812e5941f8f071431ee4c5bddd9c4100db52b69f13d9322ef8181cf230ce1e15b88f651d51ad6b8107c69f040a5f5462290ef0d1454e622f8af8833733a7d5f974ca0ff873f2e85367f4801eff4ea2577845716a31fc066effe1936367c50788de3badcae8f97a4f9a938434151359836747d917df2010863bf00c69d324e03f72e05e65a25a21f17f6eb1a58234cffaa57d611bebe6ed013d2e7feb13d01f128616c7acc1dd097ba9fc2c0e0f881496be7f59240f9c0f23630c23cbc4f5f8017deab15befd7c9e0e3c7865d975c001b28c6d29d4d2e1c078158af58a78fd822f28788731c5db8c902bab8c825c521d5be6ca4d876ea4cbdef41053739f2e74f802986f744be65abb203e5fdbcd6898be36da8cc4a3ccb93666c6cb0409232545e6cc5168e21942e66c2668b6a29de01a13bf7402800261553a955f2a52f441c13cacb0bc9a5047355c9fe4f21f515bb05f0edc2e3ba5a5abfa64255c536823e289674508ce7877deb526ee4e5071a4917558c7f942af83fa4246725545037b48578ab5f4a92c9a9cbd40436fedaba7d6b9bbe09bb8a950e765fce47b04f6f4f24da6f270f61e72d1c03a0eab02441596c4593abc25897e48b889fd0e46511167012d2eded4fa4e151378e6cfbfe41e551f9f05bb0d2682e4372603eb0f798321d228f39f98519ae9f45537d0ac1c58077dcd4f09f8bdfefd9b2e83429df481e76f1782ce604063a5b0ebf9d61410f23f339ed6be0c481b1ca87739cbe677bf12f1a94d3d5599b93b381af29b459ebde519291602e971363570c98ee9ed5d6aa5b8839bf73a06f24c4f265568b036c5ae65bb3273826523e95e59166907ad996d96f42e6b354fd793f85642ff216476d80df359829cf068f8608449fa3032cc2d87c72ee1d0fac0ff643287174a8c260c37659f09dacc254924f0b37eec4d42f477b8421fc93de0cf3067ebd965296d7849644a12305c0d70ebf6718afc7ad2f950a007ca53ca832781fbcb4e43de8885e492ab21e0dc5e0e16da16191ec3db4d5a05f92a5d2c3e79d0527f26370f24daf8e4e7b20d69646cd0f30774d29e45ba74f89a6dda8f779ec05b0e7cc4e65f69dc02587b8e53779368eda849359528d1eb495dd33baa5658940d51af8be82a4b7f1a7e1f1f1511cec52ea56b99c7cde55ea05adbde760262e1fd4beb3c0bb8516f050a099b06e4e75da29af597242fc746d42f7e5add204428bd35e4d2a06ccf4822b8d137ef863e5ac35a4c2246a95da45f5b3b9cded7d41fc93aeb98114ce0edfbcaaee4314ffa95c35cda0c8c4d62b8e721395a220182e809e2d3cf48fda10253e67ec56ee8db3455c33f41890cf6e08e6c188aa73bc396d945c1fca00c4752179a497ad7c5c56ef3511152bf27e0109a86554e7a781b4e5a4904c4c59994083ba0b1d4ad14a475b5ce841c2c017281eb54ddd0803b25a6df9e09b8e7340913afb5c0f659d82f28bd6a54cdd54e61960be12c75dd688b0c4ebd672d54ea4771f0046afabe8f8e7e98f960280f0afd7373ba1770b9ff0624fcfe5187f2ce4bb3adaa5398dd73"})

06:38:39 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x6c, 0x0, &(0x7f0000000340)=[@acquire={0x40046305, 0x3}, @acquire_done, @exit_looper, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0x0, &(0x7f00000003c0)="81"})

[ 1631.590642][T10552] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.3'.
06:38:39 executing program 1:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
waitid(0x0, 0x0, 0x0, 0x20000000, 0x0)

06:38:39 executing program 3:
ioctl$KVM_CHECK_EXTENSION(0xffffffffffffffff, 0xae03, 0x3f)
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf250600000008000300", @ANYRES32, @ANYBLOB='\f'], 0x30}}, 0x0)

06:38:39 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x110b, 0x2})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="a9d4aeef4eb3dd68e19152350fcbde45036308402fdb16", @ANYRES16=r0, @ANYRES16=r0], 0x0, 0x0, 0x0})
r1 = syz_open_dev$binderN(&(0x7f00000000c0), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000400)={0x8, 0x0, &(0x7f0000000380)=[@acquire={0x40046305, 0x1}], 0x6, 0x0, &(0x7f00000003c0)="1bcba96107ad"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x10, 0x0, &(0x7f0000000040)=[@decrefs={0x40046307, 0x1}, @acquire={0x40046305, 0x3}], 0x9, 0x0, &(0x7f0000000100)="f30011f11a347db798"})
r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$IPVS_CMD_ZERO(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x7c, r2, 0x4, 0x70bd28, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3ff}, @IPVS_CMD_ATTR_DAEMON={0x38, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @private1}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e22}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0xef}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DAEMON={0x28, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e21}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x20000000}, 0x20004840)

06:38:39 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x400, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86ba206193131b1cf46e59dc8c518c380ed9793f370ae8da49c0092cd1726257d73f52570191f5ba4f868b372a713ffb555f5cb9c80fbec9354c1dc632ba43fc554dc34c3e552eac551d208b0c798ca1ae9c75a3fc3d6c039a343f5597f8593416a4bfb734d63dba7634586b1f4578667624810b8aa4fc7907767b39ed553d1ff659ec928ce4c8e62c8b80ae6f3bc6ba99adb7e4cdfbce49785cc407e7f59ef2f2b0bb58d91b2119ebc2639bfad3b159673c60b24f82512823a6de589ec029adb3e149f2ebe17426cfeac48b92064b33cc59d3ae6a368807c021aca1ff29dfe1889382b730ee97d7d187f7f1bb97cfb296f20fbe2e1aeeb773a1d10da3592f15998825d5283c0fcfba7de857ae7268cad3732ab5dcd73448062fe9a365a91d0b67e0d7d785a895a6aa058904a054695c31b09c9c2c801865ca3cc8b0cb4b2ceb9819d3f62ed199f5c21fae71d029e163671022e5aaf3b25b42c3b55c30533630efb3c6a131fd56a612e2fa5703f1d3357573b8c87e04b46110ee5e7d66a5c4375c30382ac9d09963edd7f41785ac774bb459dd540e2c0a618b82dacc0b325870f03b8d1451c7aa47fe5b6a2c74101bc6ff67ba1af363ddeb04e4322d78b7864f43c2eda43fd9c798b3e2c0c65d7fbb9ba5afb3b7c6406d1ae4da4941183f75b8475b7f92c0291cf7c8a9d44f629f8078e59eff8703e840c80e69d328eb73925a5cdbd57acb19618211ea117d7a8a1ed5de76ba3b2c128ec17beb65b9f17303b2ed51a226ae18167d3abc5979197bea0453519ed268c083b1b5eb85c9380eccc007151124d8170afa8382e39cff375f43c191964f502e39f722b444f7f36866782d8771c5f8b610a6b99c9041bdbc8b451a68e2fdbc2ad7a0762c1fdbd97659ba74d7daca6a63bf03f7ac2578ee96912996b8fa003a88a9cebffb9e36c1c9a8cc9977a61bb93cd85f7ebc0de74597e4071d65df7941bdcb347c2db0f214dd54326baf1eeef1211e542f5d4f5172e12dfc63c4de78593c52df0f3f1cbe1b8a9fb1f59242309c8f2699a66588a87ceefa0f660f304d8e8e7295448cb1cc350192833990f7d89225022c9a6205cdfcacccf996cd9e24fd1c419528f032a04d9437c2b72869961c90495ebc306707c04cb6d01cb1001c6d262fd69ed76e58a2e96d6297e608dfb100986549addd3150f7c163c206d33f3fb6de8e9c549086f61e5cf8cbf776ce8b6fedf4751b1be37a5c3339fb584d5e9d3d0e16d6a34ff5fadab7e335f230689641d171b5ff30b03042c28b6b1163f74a82d97930c05cf0c41b8229336aaf18d1d47e7bee5e7d7e50b33d0feccc6d411f6b881b2334083e3a8bc8d3bad"})

06:38:39 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x20, 0x0, &(0x7f0000000240)=[@request_death, @increfs={0x40046304, 0x3}, @decrefs], 0x1000, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86ba206193131b1cf46e59dc8c518c380ed9793f370ae8da49c0092cd1726257d73f52570191f5ba4f868b372a713ffb555f5cb9c80fbec9354c1dc632ba43fc554dc34c3e552eac551d208b0c798ca1ae9c75a3fc3d6c039a343f5597f8593416a4bfb734d63dba7634586b1f4578667624810b8aa4fc7907767b39ed553d1ff659ec928ce4c8e62c8b80ae6f3bc6ba99adb7e4cdfbce49785cc407e7f59ef2f2b0bb58d91b2119ebc2639bfad3b159673c60b24f82512823a6de589ec029adb3e149f2ebe17426cfeac48b92064b33cc59d3ae6a368807c021aca1ff29dfe1889382b730ee97d7d187f7f1bb97cfb296f20fbe2e1aeeb773a1d10da3592f15998825d5283c0fcfba7de857ae7268cad3732ab5dcd73448062fe9a365a91d0b67e0d7d785a895a6aa058904a054695c31b09c9c2c801865ca3cc8b0cb4b2ceb9819d3f62ed199f5c21fae71d029e163671022e5aaf3b25b42c3b55c30533630efb3c6a131fd56a612e2fa5703f1d3357573b8c87e04b46110ee5e7d66a5c4375c30382ac9d09963edd7f41785ac774bb459dd540e2c0a618b82dacc0b325870f03b8d1451c7aa47fe5b6a2c74101bc6ff67ba1af363ddeb04e4322d78b7864f43c2eda43fd9c798b3e2c0c65d7fbb9ba5afb3b7c6406d1ae4da4941183f75b8475b7f92c0291cf7c8a9d44f629f8078e59eff8703e840c80e69d328eb73925a5cdbd57acb19618211ea117d7a8a1ed5de76ba3b2c128ec17beb65b9f17303b2ed51a226ae18167d3abc5979197bea0453519ed268c083b1b5eb85c9380eccc007151124d8170afa8382e39cff375f43c191964f502e39f722b444f7f36866782d8771c5f8b610a6b99c9041bdbc8b451a68e2fdbc2ad7a0762c1fdbd97659ba74d7daca6a63bf03f7ac2578ee96912996b8fa003a88a9cebffb9e36c1c9a8cc9977a61bb93cd85f7ebc0de74597e4071d65df7941bdcb347c2db0f214dd54326baf1eeef1211e542f5d4f5172e12dfc63c4de78593c52df0f3f1cbe1b8a9fb1f59242309c8f2699a66588a87ceefa0f660f304d8e8e7295448cb1cc350192833990f7d89225022c9a6205cdfcacccf996cd9e24fd1c419528f032a04d9437c2b72869961c90495ebc306707c04cb6d01cb1001c6d262fd69ed76e58a2e96d6297e608dfb100986549addd3150f7c163c206d33f3fb6de8e9c549086f61e5cf8cbf776ce8b6fedf4751b1be37a5c3339fb584d5e9d3d0e16d6a34ff5fadab7e335f230689641d171b5ff30b03042c28b6b1163f74a82d97930c05cf0c41b8229336aaf18d1d47e7bee5e7d7e50b33d0feccc6d411f6b881b2334083e3a8bc8d3bad4070176a853ee277684b4f3f812d9b624679ce3a5923f427dcab5f737288a3cabffa858e29030b70346925a82d6440bd2e6405ca6f0b21c713183ead55fea3af313920528d660f0beb935ec50c881eae3bbeb3c70100710dc9f7e8582ec00cc8461de0ec4b4f577f9b68020093fed727ae02fd689bb2e38f5817f3736050e3b9c53c0357a2df8807316c0e8336242f1977d1cb7f1d8a6cf1cc6c8a4f3521e3fa7719e58a148f068bdd20b1104f43b6f762292d10a3169dfdad50d668e1f109b9d7eeb76b3ba48d3302c5971d4df1b34d4c4a92929f3876d3bb868cefd02c9a08c364c1e557d5d0c246d5c28235f43cac9aa0f371bcba120235660e6b73b5a975e826607201241b7c385c5fab5c0e34c9dc1b33c4e48ca0a37525e2b4db287a180eed1f092a989db67f6b95c9850bf4326ac2a20f2a1403c553a085c035f7fbba1fe9f7d35066f6e2a68771bdeec7d401a6c654fc06d529ea1b0de033083343109c2ad1c5ad43f64502e026fa37f5fc59afcbb0a51a3c42484b7d21abfbb357fb4bb8cbefd135183b1adfe5e21456b0d7bd9d25eb81f7285424f5bc28ab69be3f9601f41ba2e7318c4dac37561ecf8dbddcc7ebaaa3671f0ab6e1faf58d7bb53d91c4f332a68ed9a36d2955a1d6e2bd19bb9dc11a69a49103188df42ef4767014da485b9c18f3d354a6d19608050c4d073bb7602fcd419b1acab536a852c2b4b3188257f250040cc3c06c0cd19f126a2d4bd2f930546e8f4f7c97090b2a906d57d0668050dc00ec93af78290fdd92da915883954ca1bea5a3858cad4dec18419e24f8e0eaf6e8f9ea9c38acb89033c4c28e30dfb054029a3766892f2e4a2a751572be31d93be94d92366a4c6260a3968a896b652be9a26bd3f162539883dbc0bb543559d9a825ac76b270254f0f3b70856051823afaf3fd2b54588d3be0b805e210def0b252900213e782bac9b1c917f9fd4ac8f51c13f4fa84360465172a97d3dabcb337f9fbe6bb72b8e18ef364a263408e2c8fe4891e31bb619db5f1b99b8256bef563f9f1acc37027112a53248fe7e5a6c8792685e5a0c13120cb2ae906c521214174bfd3cd783b7cc586eb09ba16dd4692fa08ed01b91496d4edc3a8cc421b023d34d4e2a1921513b457fddddebaa262f91f8953d3a7193b68fa3c779a9ef51a68ec227280eb78480ee34228c5db3f18699da509eb2f51aba41f6e39a9ade8efa2e1d5707fd293c5358c3c7ef35231a5831566db8dc2b8181e278bdbbca477a87590c48759eb3f862bd8a4770e2b7ef64484eeacea001737315a470bf68f6f5824d3a1f1d5a3b3c6157b03b5b9aca864dbf7877b7b1d20c8b6c2fdf5dab424ce1076391359f6daaa313c5b1384479f8a61ce733c4432389464dc414a60ee1b0c7efdc5fcc53811a144b10ca19159207baa775b2145d0b82d4fbc93116326e8d9c26a605812324cf8883f9bb7a7e28c0dcce5dbdedd835a36715201a1464bdad0783888e2916fe36a38aad080c287e0dd1ca6d966e5ba200941a8cd6df2b902feff11135ca87a79b0446e07897fd6555549352ebd8d4ba0aff161a5f6dcdd5d960abaa1b2cdab9b5d7c4332d967f480e21ff75064bffb6a9dd15f1ca9d6c4b9b1f65f16536f3d3be128fbba656c14270cf5174e692bde77ecd317f1e61632245fe13b6de7968739c4f0c18e0ccd85bf4e0979d63b283b2de3f460a579ca2b6ad93e16e1d50eb1886d2a1666937f631f89f9fa18a4e74a582e43b4181ccfd87df8640af31fb3f6a35de47318b1d0c13f9e4679f1c32819919edd25691284a237102efc085d342d5273f60186ab0b6071b1cfdf7e54529669515e9f69338b819f4044c6e0c299503c3cc464b7a40587da07605cc2a6134cd1801f29646b031846d6411598862a56e1313494cc5d54d85fca772697f8fc69ac997b6e570d4fa0f796ca0809fb36c9c76535dd6a5f0db924f09013a8a26be2426f4a3fecfe1b83f6bd16f4d9f2f7d40e1ef4ce3dfb647827b2d180b3e9fb8978a3dc64735403612e90f9178ace54a32786cf1640b6c1554b8dfc87455817e832dde45ffb37bab5746230dee9550ebb01626f31de99cbfcd1eeefa5f16e97c6caa795b6f12237f70c9419bd81718f27d08406e72b26474ecfc27c52b6de20cb2dd4b82c7e0e413f196471e86ac666dcdfa71ae0da22be2c071208b678837b55f50835f3f6605f2f2f822708f3d74b2c419a8db9b3ee7a2a0c000eb80225f4d1e5a01805af179220935805255987df25ee15322ccbf5c42393f04d9c36de56e38331edc7a630843cb22235d77ea92b496134d81725fef0dcaec37ca5e7e77e91ff38b8377eb0abe88a9c2919f539124f4c7a1a1bc0ae85fc601364f05bbfac17de50c7c13b2fb4667726c4e5dc5b647439bd11e3eef22a59b778c527d5181af55319e7750c1d941feb55489d391203b245af211638632b3a9894598042a8507858d2c28cdbb55d84adc84e05f961acd3a7f2a24f1b5e375f0401ac6727ad500713a49bf7cd41596badb1fde93a4d65598f1e9546384c93018e22dd4724930294bfd407c059a54e29064528e98b863503c2201f9c8676c47eb8297c40adda21a45b854ea5d682c7f823700a02d8b61b972fc91431b780d9d2bfdad2f6e882a170c4cb3a9b3e4f97fc34c2ec56fa6b0ba95679327373b190f5ed8102b32cd040949abfd4424ab1808f1df3895d678037bbcdc49d6fdb833885efeaf9ecc00986e3d06ca47e86c3c6cbd3a228fd7785158d4812e5941f8f071431ee4c5bddd9c4100db52b69f13d9322ef8181cf230ce1e15b88f651d51ad6b8107c69f040a5f5462290ef0d1454e622f8af8833733a7d5f974ca0ff873f2e85367f4801eff4ea2577845716a31fc066effe1936367c50788de3badcae8f97a4f9a938434151359836747d917df2010863bf00c69d324e03f72e05e65a25a21f17f6eb1a58234cffaa57d611bebe6ed013d2e7feb13d01f128616c7acc1dd097ba9fc2c0e0f881496be7f59240f9c0f23630c23cbc4f5f8017deab15befd7c9e0e3c7865d975c001b28c6d29d4d2e1c078158af58a78fd822f28788731c5db8c902bab8c825c521d5be6ca4d876ea4cbdef41053739f2e74f802986f744be65abb203e5fdbcd6898be36da8cc4a3ccb93666c6cb0409232545e6cc5168e21942e66c2668b6a29de01a13bf7402800261553a955f2a52f441c13cacb0bc9a5047355c9fe4f21f515bb05f0edc2e3ba5a5abfa64255c536823e289674508ce7877deb526ee4e5071a4917558c7f942af83fa4246725545037b48578ab5f4a92c9a9cbd40436fedaba7d6b9bbe09bb8a950e765fce47b04f6f4f24da6f270f61e72d1c03a0eab02441596c4593abc25897e48b889fd0e46511167012d2eded4fa4e151378e6cfbfe41e551f9f05bb0d2682e4372603eb0f798321d228f39f98519ae9f45537d0ac1c58077dcd4f09f8bdfefd9b2e83429df481e76f1782ce604063a5b0ebf9d61410f23f339ed6be0c481b1ca87739cbe677bf12f1a94d3d5599b93b381af29b459ebde519291602e971363570c98ee9ed5d6aa5b8839bf73a06f24c4f265568b036c5ae65bb3273826523e95e59166907ad996d96f42e6b354fd793f85642ff216476d80df359829cf068f8608449fa3032cc2d87c72ee1d0fac0ff643287174a8c260c37659f09dacc254924f0b37eec4d42f477b8421fc93de0cf3067ebd965296d7849644a12305c0d70ebf6718afc7ad2f950a007ca53ca832781fbcb4e43de8885e492ab21e0dc5e0e16da16191ec3db4d5a05f92a5d2c3e79d0527f26370f24daf8e4e7b20d69646cd0f30774d29e45ba74f89a6dda8f779ec05b0e7cc4e65f69dc02587b8e53779368eda849359528d1eb495dd33baa5658940d51af8be82a4b7f1a7e1f1f1511cec52ea56b99c7cde55ea05adbde760262e1fd4beb3c0bb8516f050a099b06e4e75da29af597242fc746d42f7e5add204428bd35e4d2a06ccf4822b8d137ef863e5ac35a4c2246a95da45f5b3b9cded7d41fc93aeb98114ce0edfbcaaee4314ffa95c35cda0c8c4d62b8e721395a220182e809e2d3cf48fda10253e67ec56ee8db3455c33f41890cf6e08e6c188aa73bc396d945c1fca00c4752179a497ad7c5c56ef3511152bf27e0109a86554e7a781b4e5a4904c4c59994083ba0b1d4ad14a475b5ce841c2c017281eb54ddd0803b25a6df9e09b8e7340913afb5c0f659d82f28bd6a54cdd54e61960be12c75dd688b0c4ebd672d54ea4771f0046afabe8f8e7e98f960280f0afd7373ba1770b9ff0624fcfe5187f2ce4bb3adaa5398dd73"})

06:38:39 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x6c, 0x0, &(0x7f0000000340)=[@acquire={0x40046305, 0x3}, @acquire_done, @exit_looper, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0x0, &(0x7f00000003c0)="81"})

[ 1632.190359][T10566] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.3'.
06:38:39 executing program 1:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
waitid(0x0, 0x0, 0x0, 0x20000000, 0x0)

[ 1632.305256][T10569] binder: 10568:10569 unknown command -273754967
[ 1632.312008][T10569] binder: 10568:10569 ioctl c0306201 20000180 returned -22
06:38:40 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000002c0)})

06:38:40 executing program 3:
ioctl$KVM_CHECK_EXTENSION(0xffffffffffffffff, 0xae03, 0x3f)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf250600000008000300", @ANYRES32, @ANYBLOB='\f'], 0x30}}, 0x0)

06:38:40 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x24, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @decrefs], 0x0, 0x0, 0x0})

06:38:40 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x6c, 0x0, &(0x7f0000000340)=[@acquire={0x40046305, 0x3}, @acquire_done, @exit_looper, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000003c0)})

06:38:40 executing program 1:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
waitid(0x0, 0x0, 0x0, 0x20000000, 0x0)

[ 1632.826730][T10580] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.3'.
06:38:40 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000002c0)})

06:38:40 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf250600000008000300", @ANYRES32, @ANYBLOB='\f'], 0x30}}, 0x0)

06:38:40 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x110b, 0x2})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="a9d4aeef4eb3dd68e19152350fcbde45036308402fdb16", @ANYRES16=r0, @ANYRES16=r0], 0x0, 0x0, 0x0})
r1 = syz_open_dev$binderN(&(0x7f00000000c0), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000400)={0x8, 0x0, &(0x7f0000000380)=[@acquire={0x40046305, 0x1}], 0x6, 0x0, &(0x7f00000003c0)="1bcba96107ad"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x10, 0x0, &(0x7f0000000040)=[@decrefs={0x40046307, 0x1}, @acquire={0x40046305, 0x3}], 0x9, 0x0, &(0x7f0000000100)="f30011f11a347db798"})
r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$IPVS_CMD_ZERO(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x7c, r2, 0x4, 0x70bd28, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3ff}, @IPVS_CMD_ATTR_DAEMON={0x38, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @private1}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e22}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0xef}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DAEMON={0x28, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e21}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x20000000}, 0x20004840)

06:38:40 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x6c, 0x0, &(0x7f0000000340)=[@acquire={0x40046305, 0x3}, @acquire_done, @exit_looper, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000003c0)})

06:38:40 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x24, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @decrefs], 0x0, 0x0, 0x0})

06:38:41 executing program 1:
waitid(0x0, 0x0, 0x0, 0x20000000, 0x0)

06:38:41 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000002c0)})

[ 1633.496230][T10592] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.3'.
[ 1633.578718][T10597] binder: 10594:10597 unknown command -273754967
[ 1633.585357][T10597] binder: 10594:10597 ioctl c0306201 20000180 returned -22
06:38:41 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0x6c, 0x0, &(0x7f0000000340)=[@acquire={0x40046305, 0x3}, @acquire_done, @exit_looper, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000003c0)})

06:38:41 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf250600000008000300", @ANYRES32, @ANYBLOB='\f'], 0x30}}, 0x0)

06:38:41 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x24, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @decrefs], 0x0, 0x0, 0x0})

06:38:41 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
syz_open_dev$media(&(0x7f0000000140), 0x80, 0x4800)
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000080)={<r2=>0x0})
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f00000001c0)=0x5)
ioctl$DRM_IOCTL_UNLOCK(r1, 0x4008642b, &(0x7f00000000c0)={r2, 0x29})
r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000240), r1)
r4 = socket(0xa, 0x803, 0x7f)
syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r4)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r4, 0x6, 0x16, &(0x7f00000003c0)=[@window={0x3, 0x20, 0x3}], 0x1)
sendmsg$DEVLINK_CMD_SB_PORT_POOL_GET(r1, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2800000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x4c, r3, 0x10, 0x70bd27, 0x25dfdbfd, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0xd471}, {0x6, 0x11, 0x6cb}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000802}, 0x4000001)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000400), 0x24583, 0x0)
r5 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_PORT_POOL_GET(r6, &(0x7f0000000680)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000640)={&(0x7f0000000480)={0x190, r3, 0x8, 0x70bd2b, 0x25dfdbfb, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}, {0x8, 0xb, 0x3}, {0x6, 0x11, 0x7b57}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0x9}, {0x6, 0x11, 0x80}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x1}}, {0x8, 0xb, 0x7}, {0x6, 0x11, 0x8}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x2}}, {0x8, 0xb, 0x3}, {0x6, 0x11, 0x8}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}, {0x8, 0xb, 0x6}, {0x6, 0x11, 0x8}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}, {0x8, 0xb, 0x2}, {0x6, 0x11, 0x8}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0x100}, {0x6, 0x11, 0x800}}]}, 0x190}, 0x1, 0x0, 0x0, 0x448c4}, 0x1)
setsockopt$XDP_UMEM_FILL_RING(r5, 0x11b, 0x5, 0x0, 0x0)
ioctl$vim2m_VIDIOC_EXPBUF(r1, 0xc0405610, &(0x7f0000000380)={0x1, 0x3, 0x2, 0x4000, r5})

06:38:41 executing program 1:
waitid(0x0, 0x0, 0x0, 0x0, 0x0)

06:38:41 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x200, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86ba206193131b1cf46e59dc8c518c380ed9793f370ae8da49c0092cd1726257d73f52570191f5ba4f868b372a713ffb555f5cb9c80fbec9354c1dc632ba43fc554dc34c3e552eac551d208b0c798ca1ae9c75a3fc3d6c039a343f5597f8593416a4bfb734d63dba7634586b1f4578667624810b8aa4fc7907767b39ed553d1ff659ec928ce4c8e62c8b80ae6f3bc6ba99adb7e4cdfbce49785cc407e7f59ef2f2b0bb58d91b2119ebc2639bfad3b159673c60b24f82512823a6de589ec029adb3e149f2ebe17426cfeac48b92064b33cc59d3ae6a368807c021aca1ff29dfe1889382b730ee97d7d187f7f1bb97cfb296f20fbe2e1aeeb773a1d10da3592f15998825d5283c0fcfba7de857ae7268cad3732ab5dcd73448062fe9a365a91d0b67e0d7d785a895a6aa058904a054695c31b09c9c2c801865ca3cc8b0cb4b2ceb9819d3f62ed199f5c21fae71d029e163671022e5aaf3b25b42c3b55c30533630efb3c6a131fd56a612e2fa5703f1d3357573b8c87e04b46110ee5e7d66a5c4375c30382ac9d09963edd7f41785ac774bb459dd540e2c0a618b82dacc0b325870f03b8d1451c7aa47fe5b6a2c74101bc6ff67ba1af363ddeb04e4322d78b7864f43c"})

06:38:41 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
syz_open_dev$media(&(0x7f0000000140), 0x80, 0x4800)
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000080)={<r2=>0x0})
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f00000001c0)=0x5)
ioctl$DRM_IOCTL_UNLOCK(r1, 0x4008642b, &(0x7f00000000c0)={r2, 0x29})
r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000240), r1)
r4 = socket(0xa, 0x803, 0x7f)
syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r4)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r4, 0x6, 0x16, &(0x7f00000003c0)=[@window={0x3, 0x20, 0x3}], 0x1)
sendmsg$DEVLINK_CMD_SB_PORT_POOL_GET(r1, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2800000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x4c, r3, 0x10, 0x70bd27, 0x25dfdbfd, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0xd471}, {0x6, 0x11, 0x6cb}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000802}, 0x4000001)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000400), 0x24583, 0x0)
r5 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_PORT_POOL_GET(r6, &(0x7f0000000680)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000640)={&(0x7f0000000480)={0x190, r3, 0x8, 0x70bd2b, 0x25dfdbfb, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}, {0x8, 0xb, 0x3}, {0x6, 0x11, 0x7b57}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0x9}, {0x6, 0x11, 0x80}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x1}}, {0x8, 0xb, 0x7}, {0x6, 0x11, 0x8}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x2}}, {0x8, 0xb, 0x3}, {0x6, 0x11, 0x8}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}, {0x8, 0xb, 0x6}, {0x6, 0x11, 0x8}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}, {0x8, 0xb, 0x2}, {0x6, 0x11, 0x8}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0x100}, {0x6, 0x11, 0x800}}]}, 0x190}, 0x1, 0x0, 0x0, 0x448c4}, 0x1)
setsockopt$XDP_UMEM_FILL_RING(r5, 0x11b, 0x5, 0x0, 0x0)
ioctl$vim2m_VIDIOC_EXPBUF(r1, 0xc0405610, &(0x7f0000000380)={0x1, 0x3, 0x2, 0x4000, r5})

06:38:42 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x24, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @decrefs], 0x0, 0x0, &(0x7f00000002c0)})

06:38:42 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf250600000008000300", @ANYRES32, @ANYBLOB='\f'], 0x30}}, 0x0)

06:38:42 executing program 1:
gettid()
gettid()
waitid(0x0, 0x0, &(0x7f00000000c0), 0x20000000, 0x0)

06:38:42 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
syz_open_dev$media(&(0x7f0000000140), 0x80, 0x4800)
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000080)={<r2=>0x0})
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f00000001c0)=0x5)
ioctl$DRM_IOCTL_UNLOCK(r1, 0x4008642b, &(0x7f00000000c0)={r2, 0x29})
r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000240), r1)
r4 = socket(0xa, 0x803, 0x7f)
syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r4)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r4, 0x6, 0x16, &(0x7f00000003c0)=[@window={0x3, 0x20, 0x3}], 0x1)
sendmsg$DEVLINK_CMD_SB_PORT_POOL_GET(r1, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2800000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x4c, r3, 0x10, 0x70bd27, 0x25dfdbfd, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0xd471}, {0x6, 0x11, 0x6cb}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000802}, 0x4000001)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000400), 0x24583, 0x0)
r5 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_PORT_POOL_GET(r6, &(0x7f0000000680)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000640)={&(0x7f0000000480)={0x190, r3, 0x8, 0x70bd2b, 0x25dfdbfb, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}, {0x8, 0xb, 0x3}, {0x6, 0x11, 0x7b57}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0x9}, {0x6, 0x11, 0x80}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x1}}, {0x8, 0xb, 0x7}, {0x6, 0x11, 0x8}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x2}}, {0x8, 0xb, 0x3}, {0x6, 0x11, 0x8}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}, {0x8, 0xb, 0x6}, {0x6, 0x11, 0x8}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}, {0x8, 0xb, 0x2}, {0x6, 0x11, 0x8}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0x100}, {0x6, 0x11, 0x800}}]}, 0x190}, 0x1, 0x0, 0x0, 0x448c4}, 0x1)
setsockopt$XDP_UMEM_FILL_RING(r5, 0x11b, 0x5, 0x0, 0x0)
ioctl$vim2m_VIDIOC_EXPBUF(r1, 0xc0405610, &(0x7f0000000380)={0x1, 0x3, 0x2, 0x4000, r5})

06:38:42 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000002c0)})

06:38:42 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
syz_open_dev$media(&(0x7f0000000140), 0x80, 0x4800)
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000080)={<r2=>0x0})
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f00000001c0)=0x5)
ioctl$DRM_IOCTL_UNLOCK(r1, 0x4008642b, &(0x7f00000000c0)={r2, 0x29})
r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000240), r1)
r4 = socket(0xa, 0x803, 0x7f)
syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r4)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r4, 0x6, 0x16, &(0x7f00000003c0)=[@window={0x3, 0x20, 0x3}], 0x1)
sendmsg$DEVLINK_CMD_SB_PORT_POOL_GET(r1, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2800000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x4c, r3, 0x10, 0x70bd27, 0x25dfdbfd, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0xd471}, {0x6, 0x11, 0x6cb}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000802}, 0x4000001)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000400), 0x24583, 0x0)
r5 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_PORT_POOL_GET(r6, &(0x7f0000000680)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000640)={&(0x7f0000000480)={0x190, r3, 0x8, 0x70bd2b, 0x25dfdbfb, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}, {0x8, 0xb, 0x3}, {0x6, 0x11, 0x7b57}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0x9}, {0x6, 0x11, 0x80}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x1}}, {0x8, 0xb, 0x7}, {0x6, 0x11, 0x8}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x2}}, {0x8, 0xb, 0x3}, {0x6, 0x11, 0x8}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}, {0x8, 0xb, 0x6}, {0x6, 0x11, 0x8}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}, {0x8, 0xb, 0x2}, {0x6, 0x11, 0x8}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0x100}, {0x6, 0x11, 0x800}}]}, 0x190}, 0x1, 0x0, 0x0, 0x448c4}, 0x1)
setsockopt$XDP_UMEM_FILL_RING(r5, 0x11b, 0x5, 0x0, 0x0)
ioctl$vim2m_VIDIOC_EXPBUF(r1, 0xc0405610, &(0x7f0000000380)={0x1, 0x3, 0x2, 0x4000, r5})

06:38:42 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf250600000008000300", @ANYRES32, @ANYBLOB='\f'], 0x30}}, 0x0)

06:38:42 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x24, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @decrefs], 0x0, 0x0, &(0x7f00000002c0)})

06:38:42 executing program 1:
gettid()
gettid()
waitid(0x0, 0x0, &(0x7f00000000c0), 0x20000000, 0x0)

06:38:42 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
syz_open_dev$media(&(0x7f0000000140), 0x80, 0x4800)
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000080)={<r2=>0x0})
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f00000001c0)=0x5)
ioctl$DRM_IOCTL_UNLOCK(r1, 0x4008642b, &(0x7f00000000c0)={r2, 0x29})
r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000240), r1)
r4 = socket(0xa, 0x803, 0x7f)
syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r4)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r4, 0x6, 0x16, &(0x7f00000003c0)=[@window={0x3, 0x20, 0x3}], 0x1)
sendmsg$DEVLINK_CMD_SB_PORT_POOL_GET(r1, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2800000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x4c, r3, 0x10, 0x70bd27, 0x25dfdbfd, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0xd471}, {0x6, 0x11, 0x6cb}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000802}, 0x4000001)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000400), 0x24583, 0x0)
r5 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_PORT_POOL_GET(r6, &(0x7f0000000680)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000640)={&(0x7f0000000480)={0x190, r3, 0x8, 0x70bd2b, 0x25dfdbfb, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}, {0x8, 0xb, 0x3}, {0x6, 0x11, 0x7b57}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0x9}, {0x6, 0x11, 0x80}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x1}}, {0x8, 0xb, 0x7}, {0x6, 0x11, 0x8}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x2}}, {0x8, 0xb, 0x3}, {0x6, 0x11, 0x8}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}, {0x8, 0xb, 0x6}, {0x6, 0x11, 0x8}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}, {0x8, 0xb, 0x2}, {0x6, 0x11, 0x8}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0x100}, {0x6, 0x11, 0x800}}]}, 0x190}, 0x1, 0x0, 0x0, 0x448c4}, 0x1)
setsockopt$XDP_UMEM_FILL_RING(r5, 0x11b, 0x5, 0x0, 0x0)
ioctl$vim2m_VIDIOC_EXPBUF(r1, 0xc0405610, &(0x7f0000000380)={0x1, 0x3, 0x2, 0x4000, r5})

06:38:42 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000002c0)})

06:38:43 executing program 3:
socket$nl_generic(0x10, 0x3, 0x10)
r0 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="db1e29bd7000fbdbdf250600000008000300", @ANYRES32, @ANYBLOB='\f'], 0x30}}, 0x0)

06:38:43 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
syz_open_dev$media(&(0x7f0000000140), 0x80, 0x4800)
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000080)={<r2=>0x0})
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f00000001c0)=0x5)
ioctl$DRM_IOCTL_UNLOCK(r1, 0x4008642b, &(0x7f00000000c0)={r2, 0x29})
r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000240), r1)
r4 = socket(0xa, 0x803, 0x7f)
syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r4)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r4, 0x6, 0x16, &(0x7f00000003c0)=[@window={0x3, 0x20, 0x3}], 0x1)
sendmsg$DEVLINK_CMD_SB_PORT_POOL_GET(r1, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2800000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x4c, r3, 0x10, 0x70bd27, 0x25dfdbfd, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0xd471}, {0x6, 0x11, 0x6cb}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000802}, 0x4000001)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000400), 0x24583, 0x0)
r5 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_PORT_POOL_GET(r6, &(0x7f0000000680)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000640)={&(0x7f0000000480)={0x190, r3, 0x8, 0x70bd2b, 0x25dfdbfb, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}, {0x8, 0xb, 0x3}, {0x6, 0x11, 0x7b57}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0x9}, {0x6, 0x11, 0x80}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x1}}, {0x8, 0xb, 0x7}, {0x6, 0x11, 0x8}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x2}}, {0x8, 0xb, 0x3}, {0x6, 0x11, 0x8}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}, {0x8, 0xb, 0x6}, {0x6, 0x11, 0x8}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}, {0x8, 0xb, 0x2}, {0x6, 0x11, 0x8}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0x100}, {0x6, 0x11, 0x800}}]}, 0x190}, 0x1, 0x0, 0x0, 0x448c4}, 0x1)
setsockopt$XDP_UMEM_FILL_RING(r5, 0x11b, 0x5, 0x0, 0x0)
ioctl$vim2m_VIDIOC_EXPBUF(r1, 0xc0405610, &(0x7f0000000380)={0x1, 0x3, 0x2, 0x4000, r5})

06:38:43 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x24, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @decrefs], 0x0, 0x0, &(0x7f00000002c0)})

06:38:43 executing program 1:
gettid()
gettid()
waitid(0x0, 0x0, &(0x7f00000000c0), 0x20000000, 0x0)

06:38:43 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000002c0)})

06:38:43 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
syz_open_dev$media(&(0x7f0000000140), 0x80, 0x4800)
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000080)={<r2=>0x0})
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f00000001c0)=0x5)
ioctl$DRM_IOCTL_UNLOCK(r1, 0x4008642b, &(0x7f00000000c0)={r2, 0x29})
r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000240), r1)
r4 = socket(0xa, 0x803, 0x7f)
syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r4)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r4, 0x6, 0x16, &(0x7f00000003c0)=[@window={0x3, 0x20, 0x3}], 0x1)
sendmsg$DEVLINK_CMD_SB_PORT_POOL_GET(r1, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2800000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x4c, r3, 0x10, 0x70bd27, 0x25dfdbfd, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0xd471}, {0x6, 0x11, 0x6cb}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000802}, 0x4000001)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000400), 0x24583, 0x0)
r5 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_PORT_POOL_GET(r6, &(0x7f0000000680)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000640)={&(0x7f0000000480)={0x190, r3, 0x8, 0x70bd2b, 0x25dfdbfb, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}, {0x8, 0xb, 0x3}, {0x6, 0x11, 0x7b57}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0x9}, {0x6, 0x11, 0x80}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x1}}, {0x8, 0xb, 0x7}, {0x6, 0x11, 0x8}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x2}}, {0x8, 0xb, 0x3}, {0x6, 0x11, 0x8}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}, {0x8, 0xb, 0x6}, {0x6, 0x11, 0x8}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}, {0x8, 0xb, 0x2}, {0x6, 0x11, 0x8}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0x100}, {0x6, 0x11, 0x800}}]}, 0x190}, 0x1, 0x0, 0x0, 0x448c4}, 0x1)
setsockopt$XDP_UMEM_FILL_RING(r5, 0x11b, 0x5, 0x0, 0x0)

06:38:43 executing program 3:
socket$nl_generic(0x10, 0x3, 0x10)
r0 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="db1e29bd7000fbdbdf250600000008000300", @ANYRES32, @ANYBLOB='\f'], 0x30}}, 0x0)

06:38:43 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x24, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @decrefs], 0x800, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86ba206193131b1cf46e59dc8c518c380ed9793f370ae8da49c0092cd1726257d73f52570191f5ba4f868b372a713ffb555f5cb9c80fbec9354c1dc632ba43fc554dc34c3e552eac551d208b0c798ca1ae9c75a3fc3d6c039a343f5597f8593416a4bfb734d63dba7634586b1f4578667624810b8aa4fc7907767b39ed553d1ff659ec928ce4c8e62c8b80ae6f3bc6ba99adb7e4cdfbce49785cc407e7f59ef2f2b0bb58d91b2119ebc2639bfad3b159673c60b24f82512823a6de589ec029adb3e149f2ebe17426cfeac48b92064b33cc59d3ae6a368807c021aca1ff29dfe1889382b730ee97d7d187f7f1bb97cfb296f20fbe2e1aeeb773a1d10da3592f15998825d5283c0fcfba7de857ae7268cad3732ab5dcd73448062fe9a365a91d0b67e0d7d785a895a6aa058904a054695c31b09c9c2c801865ca3cc8b0cb4b2ceb9819d3f62ed199f5c21fae71d029e163671022e5aaf3b25b42c3b55c30533630efb3c6a131fd56a612e2fa5703f1d3357573b8c87e04b46110ee5e7d66a5c4375c30382ac9d09963edd7f41785ac774bb459dd540e2c0a618b82dacc0b325870f03b8d1451c7aa47fe5b6a2c74101bc6ff67ba1af363ddeb04e4322d78b7864f43c2eda43fd9c798b3e2c0c65d7fbb9ba5afb3b7c6406d1ae4da4941183f75b8475b7f92c0291cf7c8a9d44f629f8078e59eff8703e840c80e69d328eb73925a5cdbd57acb19618211ea117d7a8a1ed5de76ba3b2c128ec17beb65b9f17303b2ed51a226ae18167d3abc5979197bea0453519ed268c083b1b5eb85c9380eccc007151124d8170afa8382e39cff375f43c191964f502e39f722b444f7f36866782d8771c5f8b610a6b99c9041bdbc8b451a68e2fdbc2ad7a0762c1fdbd97659ba74d7daca6a63bf03f7ac2578ee96912996b8fa003a88a9cebffb9e36c1c9a8cc9977a61bb93cd85f7ebc0de74597e4071d65df7941bdcb347c2db0f214dd54326baf1eeef1211e542f5d4f5172e12dfc63c4de78593c52df0f3f1cbe1b8a9fb1f59242309c8f2699a66588a87ceefa0f660f304d8e8e7295448cb1cc350192833990f7d89225022c9a6205cdfcacccf996cd9e24fd1c419528f032a04d9437c2b72869961c90495ebc306707c04cb6d01cb1001c6d262fd69ed76e58a2e96d6297e608dfb100986549addd3150f7c163c206d33f3fb6de8e9c549086f61e5cf8cbf776ce8b6fedf4751b1be37a5c3339fb584d5e9d3d0e16d6a34ff5fadab7e335f230689641d171b5ff30b03042c28b6b1163f74a82d97930c05cf0c41b8229336aaf18d1d47e7bee5e7d7e50b33d0feccc6d411f6b881b2334083e3a8bc8d3bad4070176a853ee277684b4f3f812d9b624679ce3a5923f427dcab5f737288a3cabffa858e29030b70346925a82d6440bd2e6405ca6f0b21c713183ead55fea3af313920528d660f0beb935ec50c881eae3bbeb3c70100710dc9f7e8582ec00cc8461de0ec4b4f577f9b68020093fed727ae02fd689bb2e38f5817f3736050e3b9c53c0357a2df8807316c0e8336242f1977d1cb7f1d8a6cf1cc6c8a4f3521e3fa7719e58a148f068bdd20b1104f43b6f762292d10a3169dfdad50d668e1f109b9d7eeb76b3ba48d3302c5971d4df1b34d4c4a92929f3876d3bb868cefd02c9a08c364c1e557d5d0c246d5c28235f43cac9aa0f371bcba120235660e6b73b5a975e826607201241b7c385c5fab5c0e34c9dc1b33c4e48ca0a37525e2b4db287a180eed1f092a989db67f6b95c9850bf4326ac2a20f2a1403c553a085c035f7fbba1fe9f7d35066f6e2a68771bdeec7d401a6c654fc06d529ea1b0de033083343109c2ad1c5ad43f64502e026fa37f5fc59afcbb0a51a3c42484b7d21abfbb357fb4bb8cbefd135183b1adfe5e21456b0d7bd9d25eb81f7285424f5bc28ab69be3f9601f41ba2e7318c4dac37561ecf8dbddcc7ebaaa3671f0ab6e1faf58d7bb53d91c4f332a68ed9a36d2955a1d6e2bd19bb9dc11a69a49103188df42ef4767014da485b9c18f3d354a6d19608050c4d073bb7602fcd419b1acab536a852c2b4b3188257f250040cc3c06c0cd19f126a2d4bd2f930546e8f4f7c97090b2a906d57d0668050dc00ec93af78290fdd92da915883954ca1bea5a3858cad4dec18419e24f8e0eaf6e8f9ea9c38acb89033c4c28e30dfb054029a3766892f2e4a2a751572be31d93be94d92366a4c6260a3968a896b652be9a26bd3f162539883dbc0bb543559d9a825ac76b270254f0f3b70856051823afaf3fd2b54588d3be0b805e210def0b252900213e782bac9b1c917f9fd4ac8f51c13f4fa84360465172a97d3dabcb337f9fbe6bb72b8e18ef364a263408e2c8fe4891e31bb619db5f1b99b8256bef563f9f1acc37027112a53248fe7e5a6c8792685e5a0c13120cb2ae906c521214174bfd3cd783b7cc586eb09ba16dd4692fa08ed01b91496d4edc3a8cc421b023d34d4e2a1921513b457fddddebaa262f91f8953d3a7193b68fa3c779a9ef51a68ec227280eb78480ee34228c5db3f18699da509eb2f51aba41f6e39a9ade8efa2e1d5707fd293c5358c3c7ef35231a5831566db8dc2b8181e278bdbbca477a87590c48759eb3f862bd8a4770e2b7ef64484eeacea001737315a470bf68f6f5824d3a1f1d5a3b3c6157b03b5b9aca864dbf7877b7b1d20c8b6c2fdf5dab424ce1076391359f6daaa313c5b1384479f8a61ce733c4432389464dc414a60ee1b0c7efdc5fcc53811a144b10ca19159207baa775b2145d0b82d4fbc93116326"})

06:38:43 executing program 1:
gettid()
waitid(0x0, 0x0, &(0x7f00000000c0), 0x20000000, 0x0)

06:38:43 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
syz_open_dev$media(&(0x7f0000000140), 0x80, 0x4800)
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000080)={<r2=>0x0})
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f00000001c0)=0x5)
ioctl$DRM_IOCTL_UNLOCK(r1, 0x4008642b, &(0x7f00000000c0)={r2, 0x29})
r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000240), r1)
r4 = socket(0xa, 0x803, 0x7f)
syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r4)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r4, 0x6, 0x16, &(0x7f00000003c0)=[@window={0x3, 0x20, 0x3}], 0x1)
sendmsg$DEVLINK_CMD_SB_PORT_POOL_GET(r1, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2800000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x4c, r3, 0x10, 0x70bd27, 0x25dfdbfd, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0xd471}, {0x6, 0x11, 0x6cb}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000802}, 0x4000001)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000400), 0x24583, 0x0)
r5 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_PORT_POOL_GET(r6, &(0x7f0000000680)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000640)={&(0x7f0000000480)={0x190, r3, 0x8, 0x70bd2b, 0x25dfdbfb, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}, {0x8, 0xb, 0x3}, {0x6, 0x11, 0x7b57}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0x9}, {0x6, 0x11, 0x80}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x1}}, {0x8, 0xb, 0x7}, {0x6, 0x11, 0x8}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x2}}, {0x8, 0xb, 0x3}, {0x6, 0x11, 0x8}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}, {0x8, 0xb, 0x6}, {0x6, 0x11, 0x8}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}, {0x8, 0xb, 0x2}, {0x6, 0x11, 0x8}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0x100}, {0x6, 0x11, 0x800}}]}, 0x190}, 0x1, 0x0, 0x0, 0x448c4}, 0x1)
setsockopt$XDP_UMEM_FILL_RING(r5, 0x11b, 0x5, 0x0, 0x0)

06:38:44 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x100, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86ba206193131b1cf46e59dc8c518c380ed9793f370ae8da49c0092cd1726257d73f52570191f5ba4f868b372a713ffb555f5cb9c80fbec9354c1dc632ba43fc554dc34c3e552eac551d208b0c798ca1ae9c75a3fc3d6c039a343f5597f8593416a4bfb734d63dba7634586b1f4578667624810b8aa4fc7907767b39ed553d1ff659ec928ce4c8e62c8b80ae6f3bc6ba99adb7e4cdfbce49785cc407e7f59ef2f2b0bb58d91b2119ebc2639bfad3b159673c60b24f82512823a6de589ec029adb3e"})

06:38:44 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
syz_open_dev$media(&(0x7f0000000140), 0x80, 0x4800)
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000080)={<r2=>0x0})
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f00000001c0)=0x5)
ioctl$DRM_IOCTL_UNLOCK(r1, 0x4008642b, &(0x7f00000000c0)={r2, 0x29})
r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000240), r1)
r4 = socket(0xa, 0x803, 0x7f)
syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r4)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r4, 0x6, 0x16, &(0x7f00000003c0)=[@window={0x3, 0x20, 0x3}], 0x1)
sendmsg$DEVLINK_CMD_SB_PORT_POOL_GET(r1, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2800000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x4c, r3, 0x10, 0x70bd27, 0x25dfdbfd, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0xd471}, {0x6, 0x11, 0x6cb}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000802}, 0x4000001)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000400), 0x24583, 0x0)
openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_PORT_POOL_GET(r5, &(0x7f0000000680)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000640)={&(0x7f0000000480)={0x190, r3, 0x8, 0x70bd2b, 0x25dfdbfb, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}, {0x8, 0xb, 0x3}, {0x6, 0x11, 0x7b57}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0x9}, {0x6, 0x11, 0x80}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x1}}, {0x8, 0xb, 0x7}, {0x6, 0x11, 0x8}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x2}}, {0x8, 0xb, 0x3}, {0x6, 0x11, 0x8}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}, {0x8, 0xb, 0x6}, {0x6, 0x11, 0x8}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}, {0x8, 0xb, 0x2}, {0x6, 0x11, 0x8}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0x100}, {0x6, 0x11, 0x800}}]}, 0x190}, 0x1, 0x0, 0x0, 0x448c4}, 0x1)

06:38:44 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x24, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @decrefs], 0x0, 0x0, &(0x7f00000002c0)})

06:38:44 executing program 3:
socket$nl_generic(0x10, 0x3, 0x10)
r0 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="db1e29bd7000fbdbdf250600000008000300", @ANYRES32, @ANYBLOB='\f'], 0x30}}, 0x0)

06:38:44 executing program 1:
waitid(0x0, 0x0, &(0x7f00000000c0), 0x20000000, 0x0)

06:38:44 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
syz_open_dev$media(&(0x7f0000000140), 0x80, 0x4800)
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000080)={<r2=>0x0})
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f00000001c0)=0x5)
ioctl$DRM_IOCTL_UNLOCK(r1, 0x4008642b, &(0x7f00000000c0)={r2, 0x29})
r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000240), r1)
r4 = socket(0xa, 0x803, 0x7f)
syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r4)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r4, 0x6, 0x16, &(0x7f00000003c0)=[@window={0x3, 0x20, 0x3}], 0x1)
sendmsg$DEVLINK_CMD_SB_PORT_POOL_GET(r1, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2800000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x4c, r3, 0x10, 0x70bd27, 0x25dfdbfd, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0xd471}, {0x6, 0x11, 0x6cb}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000802}, 0x4000001)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000400), 0x24583, 0x0)
openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_PORT_POOL_GET(r5, &(0x7f0000000680)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000640)={&(0x7f0000000480)={0x190, r3, 0x8, 0x70bd2b, 0x25dfdbfb, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}, {0x8, 0xb, 0x3}, {0x6, 0x11, 0x7b57}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0x9}, {0x6, 0x11, 0x80}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x1}}, {0x8, 0xb, 0x7}, {0x6, 0x11, 0x8}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x2}}, {0x8, 0xb, 0x3}, {0x6, 0x11, 0x8}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}, {0x8, 0xb, 0x6}, {0x6, 0x11, 0x8}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}, {0x8, 0xb, 0x2}, {0x6, 0x11, 0x8}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0x100}, {0x6, 0x11, 0x800}}]}, 0x190}, 0x1, 0x0, 0x0, 0x448c4}, 0x1)

06:38:44 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000002c0)})

06:38:44 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
syz_open_dev$media(&(0x7f0000000140), 0x80, 0x4800)
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000080)={<r2=>0x0})
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f00000001c0)=0x5)
ioctl$DRM_IOCTL_UNLOCK(r1, 0x4008642b, &(0x7f00000000c0)={r2, 0x29})
r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000240), r1)
r4 = socket(0xa, 0x803, 0x7f)
syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r4)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r4, 0x6, 0x16, &(0x7f00000003c0)=[@window={0x3, 0x20, 0x3}], 0x1)
sendmsg$DEVLINK_CMD_SB_PORT_POOL_GET(r1, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2800000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x4c, r3, 0x10, 0x70bd27, 0x25dfdbfd, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0xd471}, {0x6, 0x11, 0x6cb}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000802}, 0x4000001)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000400), 0x24583, 0x0)
openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)

06:38:44 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x24, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @decrefs], 0x0, 0x0, &(0x7f00000002c0)})

06:38:45 executing program 1:
waitid(0x0, 0x0, 0x0, 0x20000000, 0x0)

06:38:45 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, 0x0, 0x0)

06:38:45 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
syz_open_dev$media(&(0x7f0000000140), 0x80, 0x4800)
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000080)={<r2=>0x0})
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f00000001c0)=0x5)
ioctl$DRM_IOCTL_UNLOCK(r1, 0x4008642b, &(0x7f00000000c0)={r2, 0x29})
r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000240), r1)
r4 = socket(0xa, 0x803, 0x7f)
syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r4)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r4, 0x6, 0x16, &(0x7f00000003c0)=[@window={0x3, 0x20, 0x3}], 0x1)
sendmsg$DEVLINK_CMD_SB_PORT_POOL_GET(r1, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2800000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x4c, r3, 0x10, 0x70bd27, 0x25dfdbfd, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0xd471}, {0x6, 0x11, 0x6cb}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000802}, 0x4000001)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000400), 0x24583, 0x0)
openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)

06:38:45 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000002c0)})

06:38:45 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
syz_open_dev$media(&(0x7f0000000140), 0x80, 0x4800)
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000080)={<r2=>0x0})
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f00000001c0)=0x5)
ioctl$DRM_IOCTL_UNLOCK(r1, 0x4008642b, &(0x7f00000000c0)={r2, 0x29})
r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000240), r1)
r4 = socket(0xa, 0x803, 0x7f)
syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r4)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r4, 0x6, 0x16, &(0x7f00000003c0)=[@window={0x3, 0x20, 0x3}], 0x1)
sendmsg$DEVLINK_CMD_SB_PORT_POOL_GET(r1, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2800000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x4c, r3, 0x10, 0x70bd27, 0x25dfdbfd, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0xd471}, {0x6, 0x11, 0x6cb}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000802}, 0x4000001)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000400), 0x24583, 0x0)
openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)

06:38:45 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x24, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @decrefs], 0x0, 0x0, &(0x7f00000002c0)})

06:38:45 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, 0x0, 0x0)

06:38:45 executing program 1:
waitid(0x0, 0x0, 0x0, 0x20000000, 0x0)

06:38:45 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
syz_open_dev$media(&(0x7f0000000140), 0x80, 0x4800)
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000080)={<r2=>0x0})
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f00000001c0)=0x5)
ioctl$DRM_IOCTL_UNLOCK(r1, 0x4008642b, &(0x7f00000000c0)={r2, 0x29})
r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000240), r1)
r4 = socket(0xa, 0x803, 0x7f)
syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r4)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r4, 0x6, 0x16, &(0x7f00000003c0)=[@window={0x3, 0x20, 0x3}], 0x1)
sendmsg$DEVLINK_CMD_SB_PORT_POOL_GET(r1, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2800000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x4c, r3, 0x10, 0x70bd27, 0x25dfdbfd, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0xd471}, {0x6, 0x11, 0x6cb}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000802}, 0x4000001)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000400), 0x24583, 0x0)
openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)

06:38:45 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000002c0)})

06:38:45 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
syz_open_dev$media(&(0x7f0000000140), 0x80, 0x4800)
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000080)={<r2=>0x0})
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f00000001c0)=0x5)
ioctl$DRM_IOCTL_UNLOCK(r1, 0x4008642b, &(0x7f00000000c0)={r2, 0x29})
r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000240), r1)
r4 = socket(0xa, 0x803, 0x7f)
syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r4)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r4, 0x6, 0x16, &(0x7f00000003c0)=[@window={0x3, 0x20, 0x3}], 0x1)
sendmsg$DEVLINK_CMD_SB_PORT_POOL_GET(r1, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2800000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x4c, r3, 0x10, 0x70bd27, 0x25dfdbfd, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0xd471}, {0x6, 0x11, 0x6cb}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000802}, 0x4000001)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000400), 0x24583, 0x0)

06:38:46 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x24, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @decrefs], 0x400, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86ba206193131b1cf46e59dc8c518c380ed9793f370ae8da49c0092cd1726257d73f52570191f5ba4f868b372a713ffb555f5cb9c80fbec9354c1dc632ba43fc554dc34c3e552eac551d208b0c798ca1ae9c75a3fc3d6c039a343f5597f8593416a4bfb734d63dba7634586b1f4578667624810b8aa4fc7907767b39ed553d1ff659ec928ce4c8e62c8b80ae6f3bc6ba99adb7e4cdfbce49785cc407e7f59ef2f2b0bb58d91b2119ebc2639bfad3b159673c60b24f82512823a6de589ec029adb3e149f2ebe17426cfeac48b92064b33cc59d3ae6a368807c021aca1ff29dfe1889382b730ee97d7d187f7f1bb97cfb296f20fbe2e1aeeb773a1d10da3592f15998825d5283c0fcfba7de857ae7268cad3732ab5dcd73448062fe9a365a91d0b67e0d7d785a895a6aa058904a054695c31b09c9c2c801865ca3cc8b0cb4b2ceb9819d3f62ed199f5c21fae71d029e163671022e5aaf3b25b42c3b55c30533630efb3c6a131fd56a612e2fa5703f1d3357573b8c87e04b46110ee5e7d66a5c4375c30382ac9d09963edd7f41785ac774bb459dd540e2c0a618b82dacc0b325870f03b8d1451c7aa47fe5b6a2c74101bc6ff67ba1af363ddeb04e4322d78b7864f43c2eda43fd9c798b3e2c0c65d7fbb9ba5afb3b7c6406d1ae4da4941183f75b8475b7f92c0291cf7c8a9d44f629f8078e59eff8703e840c80e69d328eb73925a5cdbd57acb19618211ea117d7a8a1ed5de76ba3b2c128ec17beb65b9f17303b2ed51a226ae18167d3abc5979197bea0453519ed268c083b1b5eb85c9380eccc007151124d8170afa8382e39cff375f43c191964f502e39f722b444f7f36866782d8771c5f8b610a6b99c9041bdbc8b451a68e2fdbc2ad7a0762c1fdbd97659ba74d7daca6a63bf03f7ac2578ee96912996b8fa003a88a9cebffb9e36c1c9a8cc9977a61bb93cd85f7ebc0de74597e4071d65df7941bdcb347c2db0f214dd54326baf1eeef1211e542f5d4f5172e12dfc63c4de78593c52df0f3f1cbe1b8a9fb1f59242309c8f2699a66588a87ceefa0f660f304d8e8e7295448cb1cc350192833990f7d89225022c9a6205cdfcacccf996cd9e24fd1c419528f032a04d9437c2b72869961c90495ebc306707c04cb6d01cb1001c6d262fd69ed76e58a2e96d6297e608dfb100986549addd3150f7c163c206d33f3fb6de8e9c549086f61e5cf8cbf776ce8b6fedf4751b1be37a5c3339fb584d5e9d3d0e16d6a34ff5fadab7e335f230689641d171b5ff30b03042c28b6b1163f74a82d97930c05cf0c41b8229336aaf18d1d47e7bee5e7d7e50b33d0feccc6d411f6b881b2334083e3a8bc8d3bad"})

06:38:46 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, 0x0, 0x0)

06:38:46 executing program 1:
waitid(0x0, 0x0, 0x0, 0x20000000, 0x0)

06:38:46 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x80, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86ba206193131b1cf46e59dc8c518c380ed9793f370ae8da49c0092cd1726257d73f52570191f5ba4f868b372a713ffb555f5cb9c80fbec9354c1dc632ba43fc554"})

06:38:46 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
syz_open_dev$media(&(0x7f0000000140), 0x80, 0x4800)
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000080)={<r2=>0x0})
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f00000001c0)=0x5)
ioctl$DRM_IOCTL_UNLOCK(r1, 0x4008642b, &(0x7f00000000c0)={r2, 0x29})
r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000240), r1)
r4 = socket(0xa, 0x803, 0x7f)
syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r4)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r4, 0x6, 0x16, &(0x7f00000003c0)=[@window={0x3, 0x20, 0x3}], 0x1)
sendmsg$DEVLINK_CMD_SB_PORT_POOL_GET(r1, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2800000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x4c, r3, 0x10, 0x70bd27, 0x25dfdbfd, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0xd471}, {0x6, 0x11, 0x6cb}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000802}, 0x4000001)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000400), 0x24583, 0x0)

06:38:46 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
syz_open_dev$media(&(0x7f0000000140), 0x80, 0x4800)
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000080)={<r2=>0x0})
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f00000001c0)=0x5)
ioctl$DRM_IOCTL_UNLOCK(r1, 0x4008642b, &(0x7f00000000c0)={r2, 0x29})
syz_genetlink_get_family_id$devlink(&(0x7f0000000240), r1)
r3 = socket(0xa, 0x803, 0x7f)
syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r3)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f00000003c0)=[@window={0x3, 0x20, 0x3}], 0x1)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000400), 0x24583, 0x0)

06:38:46 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x24, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @decrefs], 0x0, 0x0, &(0x7f00000002c0)})

06:38:46 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0)

06:38:46 executing program 1:
waitid(0x0, 0x0, &(0x7f00000000c0), 0x0, 0x0)

06:38:47 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000002c0)})

06:38:47 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
syz_open_dev$media(&(0x7f0000000140), 0x80, 0x4800)
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000080)={<r2=>0x0})
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f00000001c0)=0x5)
ioctl$DRM_IOCTL_UNLOCK(r1, 0x4008642b, &(0x7f00000000c0)={r2, 0x29})
r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000240), r1)
r4 = socket(0xa, 0x803, 0x7f)
syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r4)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r4, 0x6, 0x16, &(0x7f00000003c0)=[@window={0x3, 0x20, 0x3}], 0x1)
sendmsg$DEVLINK_CMD_SB_PORT_POOL_GET(r1, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2800000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x4c, r3, 0x10, 0x70bd27, 0x25dfdbfd, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0xd471}, {0x6, 0x11, 0x6cb}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000802}, 0x4000001)

06:38:47 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
syz_open_dev$media(&(0x7f0000000140), 0x80, 0x4800)
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000080)={<r2=>0x0})
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f00000001c0)=0x5)
ioctl$DRM_IOCTL_UNLOCK(r1, 0x4008642b, &(0x7f00000000c0)={r2, 0x29})
syz_genetlink_get_family_id$devlink(&(0x7f0000000240), r1)
r3 = socket(0xa, 0x803, 0x7f)
syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r3)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000400), 0x24583, 0x0)

06:38:47 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x24, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @decrefs], 0x0, 0x0, &(0x7f00000002c0)})

06:38:47 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0)

06:38:47 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
syz_open_dev$media(&(0x7f0000000140), 0x80, 0x4800)
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000080)={<r2=>0x0})
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f00000001c0)=0x5)
ioctl$DRM_IOCTL_UNLOCK(r1, 0x4008642b, &(0x7f00000000c0)={r2, 0x29})
r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000240), r1)
r4 = socket(0xa, 0x803, 0x7f)
syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r4)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r4, 0x6, 0x16, &(0x7f00000003c0)=[@window={0x3, 0x20, 0x3}], 0x1)
sendmsg$DEVLINK_CMD_SB_PORT_POOL_GET(r1, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2800000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x4c, r3, 0x10, 0x70bd27, 0x25dfdbfd, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0xd471}, {0x6, 0x11, 0x6cb}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000802}, 0x4000001)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000400), 0x24583, 0x0)
openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)

06:38:47 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000002c0)})

06:38:47 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
syz_open_dev$media(&(0x7f0000000140), 0x80, 0x4800)
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000080)={<r2=>0x0})
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f00000001c0)=0x5)
ioctl$DRM_IOCTL_UNLOCK(r1, 0x4008642b, &(0x7f00000000c0)={r2, 0x29})
syz_genetlink_get_family_id$devlink(&(0x7f0000000240), r1)
r3 = socket(0xa, 0x803, 0x7f)
syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r3)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f00000003c0)=[@window={0x3, 0x20, 0x3}], 0x1)

06:38:47 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
syz_open_dev$media(&(0x7f0000000140), 0x80, 0x4800)
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000080)={<r2=>0x0})
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f00000001c0)=0x5)
ioctl$DRM_IOCTL_UNLOCK(r1, 0x4008642b, &(0x7f00000000c0)={r2, 0x29})
syz_genetlink_get_family_id$devlink(&(0x7f0000000240), r1)
socket(0xa, 0x803, 0x7f)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000400), 0x24583, 0x0)

06:38:47 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x24, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @decrefs], 0x0, 0x0, &(0x7f00000002c0)})

06:38:47 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0)

06:38:47 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
syz_open_dev$media(&(0x7f0000000140), 0x80, 0x4800)
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000080)={<r2=>0x0})
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f00000001c0)=0x5)
ioctl$DRM_IOCTL_UNLOCK(r1, 0x4008642b, &(0x7f00000000c0)={r2, 0x29})
r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000240), r1)
r4 = socket(0xa, 0x803, 0x7f)
syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r4)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r4, 0x6, 0x16, &(0x7f00000003c0)=[@window={0x3, 0x20, 0x3}], 0x1)
sendmsg$DEVLINK_CMD_SB_PORT_POOL_GET(r1, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2800000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x4c, r3, 0x10, 0x70bd27, 0x25dfdbfd, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0xd471}, {0x6, 0x11, 0x6cb}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000802}, 0x4000001)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000400), 0x24583, 0x0)
openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)

06:38:48 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
syz_open_dev$media(&(0x7f0000000140), 0x80, 0x4800)
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000080)={<r2=>0x0})
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f00000001c0)=0x5)
ioctl$DRM_IOCTL_UNLOCK(r1, 0x4008642b, &(0x7f00000000c0)={r2, 0x29})
syz_genetlink_get_family_id$devlink(&(0x7f0000000240), r1)
r3 = socket(0xa, 0x803, 0x7f)
syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r3)

06:38:48 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000002c0)})

06:38:48 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
syz_open_dev$media(&(0x7f0000000140), 0x80, 0x4800)
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000080)={<r2=>0x0})
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f00000001c0)=0x5)
ioctl$DRM_IOCTL_UNLOCK(r1, 0x4008642b, &(0x7f00000000c0)={r2, 0x29})
syz_genetlink_get_family_id$devlink(&(0x7f0000000240), r1)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000400), 0x24583, 0x0)

06:38:48 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x24, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @decrefs], 0x200, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86ba206193131b1cf46e59dc8c518c380ed9793f370ae8da49c0092cd1726257d73f52570191f5ba4f868b372a713ffb555f5cb9c80fbec9354c1dc632ba43fc554dc34c3e552eac551d208b0c798ca1ae9c75a3fc3d6c039a343f5597f8593416a4bfb734d63dba7634586b1f4578667624810b8aa4fc7907767b39ed553d1ff659ec928ce4c8e62c8b80ae6f3bc6ba99adb7e4cdfbce49785cc407e7f59ef2f2b0bb58d91b2119ebc2639bfad3b159673c60b24f82512823a6de589ec029adb3e149f2ebe17426cfeac48b92064b33cc59d3ae6a368807c021aca1ff29dfe1889382b730ee97d7d187f7f1bb97cfb296f20fbe2e1aeeb773a1d10da3592f15998825d5283c0fcfba7de857ae7268cad3732ab5dcd73448062fe9a365a91d0b67e0d7d785a895a6aa058904a054695c31b09c9c2c801865ca3cc8b0cb4b2ceb9819d3f62ed199f5c21fae71d029e163671022e5aaf3b25b42c3b55c30533630efb3c6a131fd56a612e2fa5703f1d3357573b8c87e04b46110ee5e7d66a5c4375c30382ac9d09963edd7f41785ac774bb459dd540e2c0a618b82dacc0b325870f03b8d1451c7aa47fe5b6a2c74101bc6ff67ba1af363ddeb04e4322d78b7864f43c"})

06:38:48 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x30}}, 0x0)

06:38:48 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
syz_open_dev$media(&(0x7f0000000140), 0x80, 0x4800)
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000080)={<r2=>0x0})
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f00000001c0)=0x5)
ioctl$DRM_IOCTL_UNLOCK(r1, 0x4008642b, &(0x7f00000000c0)={r2, 0x29})
r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000240), r1)
r4 = socket(0xa, 0x803, 0x7f)
syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r4)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r4, 0x6, 0x16, &(0x7f00000003c0)=[@window={0x3, 0x20, 0x3}], 0x1)
sendmsg$DEVLINK_CMD_SB_PORT_POOL_GET(r1, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2800000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x4c, r3, 0x10, 0x70bd27, 0x25dfdbfd, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0xd471}, {0x6, 0x11, 0x6cb}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000802}, 0x4000001)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000400), 0x24583, 0x0)
openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)

06:38:48 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x40, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86b"})

06:38:49 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
syz_open_dev$media(&(0x7f0000000140), 0x80, 0x4800)
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000080)={<r2=>0x0})
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f00000001c0)=0x5)
ioctl$DRM_IOCTL_UNLOCK(r1, 0x4008642b, &(0x7f00000000c0)={r2, 0x29})
syz_genetlink_get_family_id$devlink(&(0x7f0000000240), r1)
socket(0xa, 0x803, 0x7f)

06:38:49 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
syz_open_dev$media(&(0x7f0000000140), 0x80, 0x4800)
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000080)={<r2=>0x0})
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f00000001c0)=0x5)
ioctl$DRM_IOCTL_UNLOCK(r1, 0x4008642b, &(0x7f00000000c0)={r2, 0x29})
openat$kvm(0xffffffffffffff9c, &(0x7f0000000400), 0x24583, 0x0)

06:38:49 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x24, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @decrefs], 0x0, 0x0, &(0x7f00000002c0)})

06:38:49 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x30}}, 0x0)

06:38:49 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000002c0)})

06:38:49 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x40, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86b"})

06:38:49 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
syz_open_dev$media(&(0x7f0000000140), 0x80, 0x4800)
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000080)={<r2=>0x0})
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f00000001c0)=0x5)
ioctl$DRM_IOCTL_UNLOCK(r1, 0x4008642b, &(0x7f00000000c0)={r2, 0x29})
syz_genetlink_get_family_id$devlink(&(0x7f0000000240), r1)

06:38:49 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x24, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @decrefs], 0x0, 0x0, &(0x7f00000002c0)})

06:38:49 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x30}}, 0x0)

06:38:49 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
syz_open_dev$media(&(0x7f0000000140), 0x80, 0x4800)
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000080))
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f00000001c0)=0x5)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000400), 0x24583, 0x0)

06:38:50 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000002c0)})

06:38:50 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x40, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86b"})

06:38:50 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf250600000008000300", @ANYRES32], 0x30}}, 0x0)

06:38:50 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
syz_open_dev$media(&(0x7f0000000140), 0x80, 0x4800)
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000080))
openat$kvm(0xffffffffffffff9c, &(0x7f0000000400), 0x24583, 0x0)

06:38:50 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
syz_open_dev$media(&(0x7f0000000140), 0x80, 0x4800)
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000080)={<r2=>0x0})
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f00000001c0)=0x5)
ioctl$DRM_IOCTL_UNLOCK(r1, 0x4008642b, &(0x7f00000000c0)={r2, 0x29})

06:38:50 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x24, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @decrefs], 0x0, 0x0, &(0x7f00000002c0)})

[ 1642.842256][T10800] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.3'.
06:38:50 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x60, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86ba206193131b1cf46e59dc8c518c380ed9793f370ae8da49c0092cd1726257d73"})

06:38:50 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000002c0)})

06:38:50 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x24, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @decrefs], 0x100, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86ba206193131b1cf46e59dc8c518c380ed9793f370ae8da49c0092cd1726257d73f52570191f5ba4f868b372a713ffb555f5cb9c80fbec9354c1dc632ba43fc554dc34c3e552eac551d208b0c798ca1ae9c75a3fc3d6c039a343f5597f8593416a4bfb734d63dba7634586b1f4578667624810b8aa4fc7907767b39ed553d1ff659ec928ce4c8e62c8b80ae6f3bc6ba99adb7e4cdfbce49785cc407e7f59ef2f2b0bb58d91b2119ebc2639bfad3b159673c60b24f82512823a6de589ec029adb3e"})

06:38:50 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
syz_open_dev$media(&(0x7f0000000140), 0x80, 0x4800)
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000080))
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f00000001c0)=0x5)

06:38:50 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
syz_open_dev$media(&(0x7f0000000140), 0x80, 0x4800)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000400), 0x24583, 0x0)

06:38:50 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf250600000008000300"], 0x30}}, 0x0)

06:38:51 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x40, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86b"})

06:38:51 executing program 1:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000002c0)})

[ 1643.522630][T10814] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.3'.
06:38:51 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x24, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @decrefs], 0x0, 0x0, &(0x7f00000002c0)})

06:38:51 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
syz_open_dev$media(&(0x7f0000000140), 0x80, 0x4800)
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000080))

06:38:51 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000400), 0x24583, 0x0)

06:38:51 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1], 0x30}}, 0x0)

06:38:51 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x40, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86b"})

06:38:51 executing program 1:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000002c0)})

06:38:51 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x24, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @decrefs], 0x0, 0x0, &(0x7f00000002c0)})

06:38:52 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1], 0x30}}, 0x0)

06:38:52 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
syz_open_dev$media(&(0x7f0000000140), 0x80, 0x4800)

06:38:52 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000400), 0x24583, 0x0)

06:38:52 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x40, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86b"})

06:38:52 executing program 1:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000002c0)})

06:38:52 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x24, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @decrefs], 0x0, 0x0, &(0x7f00000002c0)})

06:38:52 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
syz_open_dev$media(&(0x7f0000000140), 0x80, 0x4800)

06:38:52 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
openat$kvm(0xffffffffffffff9c, &(0x7f0000000400), 0x24583, 0x0)

06:38:52 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1], 0x30}}, 0x0)

06:38:52 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x50, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86ba206193131b1cf46e59dc8c518c380ed"})

06:38:52 executing program 1:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000002c0)})

06:38:53 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x24, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @decrefs], 0x80, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86ba206193131b1cf46e59dc8c518c380ed9793f370ae8da49c0092cd1726257d73f52570191f5ba4f868b372a713ffb555f5cb9c80fbec9354c1dc632ba43fc554"})

06:38:53 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
syz_open_dev$media(&(0x7f0000000140), 0x80, 0x4800)

06:38:53 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB], 0x30}}, 0x0)

06:38:53 executing program 0:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000400), 0x24583, 0x0)

06:38:53 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x40, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86b"})

06:38:53 executing program 1:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000002c0)})

06:38:53 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x24, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @decrefs], 0x0, 0x0, &(0x7f00000002c0)})

06:38:53 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB], 0x30}}, 0x0)

06:38:53 executing program 0:
openat$kvm(0xffffffffffffff9c, &(0x7f0000000400), 0x24583, 0x0)

06:38:53 executing program 2:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
syz_open_dev$media(&(0x7f0000000140), 0x80, 0x4800)

06:38:53 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x40, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86b"})

06:38:53 executing program 1:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000002c0)})

06:38:54 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x24, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @decrefs], 0x0, 0x0, &(0x7f00000002c0)})

06:38:54 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB], 0x30}}, 0x0)

06:38:54 executing program 0:
openat$kvm(0xffffffffffffff9c, 0x0, 0x24583, 0x0)

06:38:54 executing program 1:
syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000002c0)})

06:38:54 executing program 2:
syz_open_dev$media(&(0x7f0000000140), 0x80, 0x4800)

06:38:54 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x40, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86b"})

06:38:54 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x24, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @decrefs], 0x0, 0x0, &(0x7f00000002c0)})

06:38:54 executing program 0:
openat$kvm(0xffffffffffffff9c, 0x0, 0x24583, 0x0)

06:38:55 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86ba206193131b1cf46"})

06:38:55 executing program 2:
syz_open_dev$media(0x0, 0x80, 0x4800)

06:38:55 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf"], 0x30}}, 0x0)

06:38:55 executing program 1:
syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000002c0)})

06:38:55 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x24, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @decrefs], 0x40, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86b"})

06:38:55 executing program 0:
openat$kvm(0xffffffffffffff9c, 0x0, 0x24583, 0x0)

06:38:55 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86ba206193131b1cf46"})

06:38:55 executing program 2:
syz_open_dev$media(0x0, 0x80, 0x4800)

06:38:55 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf"], 0x30}}, 0x0)

06:38:55 executing program 1:
syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000002c0)})

06:38:55 executing program 0:
openat$kvm(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0)

06:38:56 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x24, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @decrefs], 0x0, 0x0, &(0x7f00000002c0)})

06:38:56 executing program 2:
syz_open_dev$media(0x0, 0x80, 0x4800)

06:38:56 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x48, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86ba206193131b1cf46"})

06:38:56 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf"], 0x30}}, 0x0)

06:38:56 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)

06:38:56 executing program 2:
syz_open_dev$media(&(0x7f0000000140), 0x0, 0x4800)

06:38:56 executing program 0:
openat$kvm(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0)

06:38:56 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x24, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @decrefs], 0x0, 0x0, &(0x7f00000002c0)})

[ 1648.953980][T10936] binder: 10935:10936 ioctl c0306201 0 returned -14
06:38:56 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf2506000000"], 0x30}}, 0x0)

06:38:56 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x4c, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86ba206193131b1cf46e59dc8c5"})

06:38:56 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)

06:38:57 executing program 2:
syz_open_dev$media(&(0x7f0000000140), 0x0, 0x0)

[ 1649.346968][T10945] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.3'.
06:38:57 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x24, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @decrefs], 0x0, 0x0, &(0x7f00000002c0)})

06:38:57 executing program 0:
openat$kvm(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0)

06:38:57 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf25"], 0x30}}, 0x0)

[ 1649.592194][T10949] binder: 10948:10949 ioctl c0306201 0 returned -14
06:38:57 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x4c, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86ba206193131b1cf46e59dc8c5"})

06:38:57 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)

06:38:57 executing program 2:
syz_open_dev$media(&(0x7f0000000140), 0x0, 0x0)

06:38:57 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x24, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @decrefs], 0x20, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856a"})

06:38:57 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x40, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86b"})

[ 1650.136251][T10962] binder: 10961:10962 ioctl c0306201 0 returned -14
06:38:57 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf25"], 0x30}}, 0x0)

06:38:57 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x4c, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86ba206193131b1cf46e59dc8c5"})

06:38:58 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)})

06:38:58 executing program 2:
syz_open_dev$media(&(0x7f0000000140), 0x0, 0x0)

06:38:58 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x24, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @decrefs], 0x0, 0x0, &(0x7f00000002c0)})

06:38:58 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x40, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86b"})

06:38:58 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf25"], 0x30}}, 0x0)

06:38:58 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x4e, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86ba206193131b1cf46e59dc8c518c3"})

06:38:58 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r2, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000440)={0x30, r3, 0xcd6ccc609280a2c3, 0x0, 0x0, {{}, {@void, @val={0xc, 0x99, {0x8, 0x2a}}}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x30}}, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x34, r3, 0x200, 0x70bd29, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0x707}, @NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x2}, @NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0x79}, @NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0x82e}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000)
r4 = syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$IPVS_CMD_ZERO(r1, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x78, r4, 0x4, 0x70bd26, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x5}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}]}, @IPVS_CMD_ATTR_SERVICE={0x44, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x1, 0x20}}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0xa}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x20, 0x2}}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e22}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x55}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x4d}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'nq\x00'}]}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e24}]}]}, 0x78}}, 0x1)
r5 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x2)
ioctl$BINDER_GET_NODE_INFO_FOR_REF(r5, 0xc018620c, &(0x7f00000000c0)={0x1})
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f0000000100)=0x3e5)
ioctl$vim2m_VIDIOC_STREAMOFF(0xffffffffffffffff, 0x40045612, &(0x7f0000000300)=0x3)

06:38:58 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)})

06:38:58 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x24, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @decrefs], 0x0, 0x0, &(0x7f00000002c0)})

06:38:58 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x40, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86b"})

06:38:59 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf250600"], 0x30}}, 0x0)

06:38:59 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x4e, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86ba206193131b1cf46e59dc8c518c3"})

[ 1651.396341][T10988] binder: 10986:10988 ioctl c018620c 200000c0 returned -1
06:38:59 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)})

[ 1651.663317][T10995] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.3'.
06:38:59 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r2, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000440)={0x30, r3, 0xcd6ccc609280a2c3, 0x0, 0x0, {{}, {@void, @val={0xc, 0x99, {0x8, 0x2a}}}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x30}}, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x34, r3, 0x200, 0x70bd29, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0x707}, @NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x2}, @NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0x79}, @NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0x82e}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000)
r4 = syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$IPVS_CMD_ZERO(r1, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x78, r4, 0x4, 0x70bd26, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x5}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}]}, @IPVS_CMD_ATTR_SERVICE={0x44, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x1, 0x20}}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0xa}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x20, 0x2}}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e22}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x55}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x4d}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'nq\x00'}]}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e24}]}]}, 0x78}}, 0x1)
r5 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x2)
ioctl$BINDER_GET_NODE_INFO_FOR_REF(r5, 0xc018620c, &(0x7f00000000c0)={0x1})
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f0000000100)=0x3e5)
ioctl$vim2m_VIDIOC_STREAMOFF(0xffffffffffffffff, 0x40045612, &(0x7f0000000300)=0x3)

06:38:59 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x24, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @decrefs], 0x0, 0x0, &(0x7f00000002c0)})

06:38:59 executing program 0:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x40, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86b"})

06:38:59 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf25"], 0x30}}, 0x0)

06:38:59 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x4e, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86ba206193131b1cf46e59dc8c518c3"})

[ 1652.078420][T11003] binder: 11002:11003 ioctl c018620c 200000c0 returned -1
06:38:59 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x1c, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}], 0x0, 0x0, &(0x7f00000002c0)})

06:39:00 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r2, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000440)={0x30, r3, 0xcd6ccc609280a2c3, 0x0, 0x0, {{}, {@void, @val={0xc, 0x99, {0x8, 0x2a}}}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x30}}, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x34, r3, 0x200, 0x70bd29, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0x707}, @NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x2}, @NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0x79}, @NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0x82e}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000)
r4 = syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$IPVS_CMD_ZERO(r1, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x78, r4, 0x4, 0x70bd26, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x5}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}]}, @IPVS_CMD_ATTR_SERVICE={0x44, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x1, 0x20}}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0xa}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x20, 0x2}}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e22}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x55}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x4d}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'nq\x00'}]}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e24}]}]}, 0x78}}, 0x1)
r5 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x2)
ioctl$BINDER_GET_NODE_INFO_FOR_REF(r5, 0xc018620c, &(0x7f00000000c0)={0x1})
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f0000000100)=0x3e5)
ioctl$vim2m_VIDIOC_STREAMOFF(0xffffffffffffffff, 0x40045612, &(0x7f0000000300)=0x3)

06:39:00 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x24, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @decrefs], 0x10, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e75"})

06:39:00 executing program 0:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x40, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86b"})

06:39:00 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf25"], 0x30}}, 0x0)

06:39:00 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x4f, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86ba206193131b1cf46e59dc8c518c380"})

06:39:00 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x1c, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}], 0x0, 0x0, &(0x7f00000002c0)})

[ 1652.771266][T11018] binder: 11015:11018 ioctl c018620c 200000c0 returned -1
06:39:00 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r2, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000440)={0x30, r3, 0xcd6ccc609280a2c3, 0x0, 0x0, {{}, {@void, @val={0xc, 0x99, {0x8, 0x2a}}}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x30}}, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x34, r3, 0x200, 0x70bd29, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0x707}, @NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x2}, @NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0x79}, @NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0x82e}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000)
r4 = syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$IPVS_CMD_ZERO(r1, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x78, r4, 0x4, 0x70bd26, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x5}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}]}, @IPVS_CMD_ATTR_SERVICE={0x44, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x1, 0x20}}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0xa}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x20, 0x2}}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e22}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x55}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x4d}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'nq\x00'}]}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e24}]}]}, 0x78}}, 0x1)
r5 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x2)
ioctl$BINDER_GET_NODE_INFO_FOR_REF(r5, 0xc018620c, &(0x7f00000000c0)={0x1})
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f0000000100)=0x3e5)

06:39:00 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x24, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @decrefs], 0x0, 0x0, &(0x7f00000002c0)})

06:39:00 executing program 0:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x40, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86b"})

06:39:00 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf25"], 0x30}}, 0x0)

06:39:00 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x4f, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86ba206193131b1cf46e59dc8c518c380"})

[ 1653.276694][T11030] binder: 11028:11030 ioctl c018620c 200000c0 returned -1
06:39:00 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x1c, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}], 0x0, 0x0, &(0x7f00000002c0)})

06:39:01 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x24, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @decrefs], 0x0, 0x0, &(0x7f00000002c0)})

06:39:01 executing program 0:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x40, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86b"})

06:39:01 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r2, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000440)={0x30, r3, 0xcd6ccc609280a2c3, 0x0, 0x0, {{}, {@void, @val={0xc, 0x99, {0x8, 0x2a}}}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x30}}, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x34, r3, 0x200, 0x70bd29, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0x707}, @NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x2}, @NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0x79}, @NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0x82e}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000)
r4 = syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$IPVS_CMD_ZERO(r1, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x78, r4, 0x4, 0x70bd26, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x5}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}]}, @IPVS_CMD_ATTR_SERVICE={0x44, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x1, 0x20}}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0xa}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x20, 0x2}}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e22}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x55}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x4d}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'nq\x00'}]}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e24}]}]}, 0x78}}, 0x1)
r5 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x2)
ioctl$BINDER_GET_NODE_INFO_FOR_REF(r5, 0xc018620c, &(0x7f00000000c0)={0x1})

06:39:01 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf2506"], 0x30}}, 0x0)

06:39:01 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x4f, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86ba206193131b1cf46e59dc8c518c380"})

06:39:01 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000002c0)})

06:39:01 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x24, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @decrefs], 0x0, 0x0, &(0x7f00000002c0)})

[ 1654.045124][T11047] binder: 11046:11047 ioctl c018620c 200000c0 returned -1
[ 1654.052651][T11049] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.3'.
06:39:01 executing program 0:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x40, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86b"})

06:39:02 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf25"], 0x30}}, 0x0)

06:39:02 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r2, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000440)={0x30, r3, 0xcd6ccc609280a2c3, 0x0, 0x0, {{}, {@void, @val={0xc, 0x99, {0x8, 0x2a}}}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x30}}, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x34, r3, 0x200, 0x70bd29, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0x707}, @NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x2}, @NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0x79}, @NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0x82e}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000)
r4 = syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$IPVS_CMD_ZERO(r1, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x78, r4, 0x4, 0x70bd26, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x5}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}]}, @IPVS_CMD_ATTR_SERVICE={0x44, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x1, 0x20}}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0xa}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x20, 0x2}}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e22}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x55}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x4d}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'nq\x00'}]}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e24}]}]}, 0x78}}, 0x1)
syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x2)

06:39:02 executing program 4:
ioctl$KVM_CHECK_EXTENSION(0xffffffffffffffff, 0xae03, 0x3f)
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_TRAP_GET(r1, &(0x7f0000000740)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000700)={&(0x7f0000000600)={0x100, 0x0, 0x2, 0x70bd27, 0x25dfdbff, {}, [{@pci={{0x8}, {0x11}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}]}, 0x100}}, 0x28001)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r1, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
socket$phonet_pipe(0x23, 0x5, 0x2)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r2, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
r3 = socket(0x4, 0x1, 0x5)
sendmsg$IPVS_CMD_GET_INFO(r3, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x68, 0x0, 0x100, 0x70bd29, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8}, @IPVS_CMD_ATTR_DAEMON={0x44, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e22}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x4}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'geneve1\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xfffffffd}]}, 0x68}, 0x1, 0x0, 0x0, 0x50}, 0xc5)
sendmsg$IPVS_CMD_NEW_DEST(r2, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f0000000540)=ANY=[@ANYBLOB="240045040299d9a1be747a3cbd22b65bd841f8f4be5469eebf38b9450d9d3003bf64577db886e8caccab364bf7a6e6eecdcf7f4fa11cc3421199dc4d330a50", @ANYRES16=0x0, @ANYBLOB="04000cfd018006000e004e21000004000280"], 0x24}, 0x1, 0x0, 0x0, 0xc040}, 0x10000004)
sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), r1)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="db1e29bd7000fbdbdf250600000008000300", @ANYRES32, @ANYBLOB='\f'], 0x30}}, 0x0)

06:39:02 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000002c0)})

06:39:02 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x24, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @decrefs], 0x8, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e"})

06:39:02 executing program 0:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x40, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86b"})

06:39:02 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r2, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000440)={0x30, r3, 0xcd6ccc609280a2c3, 0x0, 0x0, {{}, {@void, @val={0xc, 0x99, {0x8, 0x2a}}}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x30}}, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x34, r3, 0x200, 0x70bd29, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0x707}, @NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x2}, @NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0x79}, @NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0x82e}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000)
r4 = syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$IPVS_CMD_ZERO(r1, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x78, r4, 0x4, 0x70bd26, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x5}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}]}, @IPVS_CMD_ATTR_SERVICE={0x44, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x1, 0x20}}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0xa}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x20, 0x2}}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e22}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x55}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x4d}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'nq\x00'}]}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e24}]}]}, 0x78}}, 0x1)

[ 1654.827646][T11065] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'.
06:39:02 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf25"], 0x30}}, 0x0)

06:39:02 executing program 4:
ioctl$KVM_CHECK_EXTENSION(0xffffffffffffffff, 0xae03, 0x3f)
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_TRAP_GET(r1, &(0x7f0000000740)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000700)={&(0x7f0000000600)={0x100, 0x0, 0x2, 0x70bd27, 0x25dfdbff, {}, [{@pci={{0x8}, {0x11}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}]}, 0x100}}, 0x28001)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r1, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
socket$phonet_pipe(0x23, 0x5, 0x2)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r2, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
r3 = socket(0x4, 0x1, 0x5)
sendmsg$IPVS_CMD_GET_INFO(r3, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x68, 0x0, 0x100, 0x70bd29, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8}, @IPVS_CMD_ATTR_DAEMON={0x44, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e22}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x4}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'geneve1\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xfffffffd}]}, 0x68}, 0x1, 0x0, 0x0, 0x50}, 0xc5)
sendmsg$IPVS_CMD_NEW_DEST(r2, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f0000000540)=ANY=[@ANYBLOB="240045040299d9a1be747a3cbd22b65bd841f8f4be5469eebf38b9450d9d3003bf64577db886e8caccab364bf7a6e6eecdcf7f4fa11cc3421199dc4d330a50", @ANYRES16=0x0, @ANYBLOB="04000cfd018006000e004e21000004000280"], 0x24}, 0x1, 0x0, 0x0, 0xc040}, 0x10000004)
sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), r1)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="db1e29bd7000fbdbdf250600000008000300", @ANYRES32, @ANYBLOB='\f'], 0x30}}, 0x0)

06:39:02 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000002c0)})

06:39:02 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x24, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @decrefs], 0x0, 0x0, &(0x7f00000002c0)})

06:39:02 executing program 0:
syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x40, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86b"})

06:39:03 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r2, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000440)={0x30, r3, 0xcd6ccc609280a2c3, 0x0, 0x0, {{}, {@void, @val={0xc, 0x99, {0x8, 0x2a}}}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x30}}, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x34, r3, 0x200, 0x70bd29, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0x707}, @NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x2}, @NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0x79}, @NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0x82e}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000)
syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0), 0xffffffffffffffff)

[ 1655.532063][T11080] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'.
06:39:03 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf25"], 0x30}}, 0x0)

06:39:03 executing program 0:
syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x40, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86b"})

06:39:03 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x60, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000002c0)})

06:39:03 executing program 4:
ioctl$KVM_CHECK_EXTENSION(0xffffffffffffffff, 0xae03, 0x3f)
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_TRAP_GET(r1, &(0x7f0000000740)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000700)={&(0x7f0000000600)={0x100, 0x0, 0x2, 0x70bd27, 0x25dfdbff, {}, [{@pci={{0x8}, {0x11}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}]}, 0x100}}, 0x28001)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r1, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
socket$phonet_pipe(0x23, 0x5, 0x2)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r2, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
r3 = socket(0x4, 0x1, 0x5)
sendmsg$IPVS_CMD_GET_INFO(r3, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x68, 0x0, 0x100, 0x70bd29, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8}, @IPVS_CMD_ATTR_DAEMON={0x44, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e22}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x4}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'geneve1\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xfffffffd}]}, 0x68}, 0x1, 0x0, 0x0, 0x50}, 0xc5)
sendmsg$IPVS_CMD_NEW_DEST(r2, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f0000000540)=ANY=[@ANYBLOB="240045040299d9a1be747a3cbd22b65bd841f8f4be5469eebf38b9450d9d3003bf64577db886e8caccab364bf7a6e6eecdcf7f4fa11cc3421199dc4d330a50", @ANYRES16=0x0, @ANYBLOB="04000cfd018006000e004e21000004000280"], 0x24}, 0x1, 0x0, 0x0, 0xc040}, 0x10000004)
sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), r1)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="db1e29bd7000fbdbdf250600000008000300", @ANYRES32, @ANYBLOB='\f'], 0x30}}, 0x0)

06:39:03 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x24, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @decrefs], 0x0, 0x0, &(0x7f00000002c0)})

06:39:03 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r2, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000440)={0x30, r3, 0xcd6ccc609280a2c3, 0x0, 0x0, {{}, {@void, @val={0xc, 0x99, {0x8, 0x2a}}}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x30}}, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x34, r3, 0x200, 0x70bd29, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0x707}, @NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x2}, @NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0x79}, @NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0x82e}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000)

06:39:03 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYBLOB="db1e29bd7000fbdbdf2506"], 0x30}}, 0x0)

[ 1656.264171][T11104] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'.
06:39:04 executing program 0:
syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x40, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86b"})

06:39:04 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x60, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000002c0)})

06:39:04 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x24, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @decrefs], 0x0, 0x0, &(0x7f00000002c0)})

06:39:04 executing program 4:
ioctl$KVM_CHECK_EXTENSION(0xffffffffffffffff, 0xae03, 0x3f)
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_TRAP_GET(r1, &(0x7f0000000740)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000700)={&(0x7f0000000600)={0x100, 0x0, 0x2, 0x70bd27, 0x25dfdbff, {}, [{@pci={{0x8}, {0x11}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}]}, 0x100}}, 0x28001)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r1, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
socket$phonet_pipe(0x23, 0x5, 0x2)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r2, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
r3 = socket(0x4, 0x1, 0x5)
sendmsg$IPVS_CMD_GET_INFO(r3, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x68, 0x0, 0x100, 0x70bd29, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8}, @IPVS_CMD_ATTR_DAEMON={0x44, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e22}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x4}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'geneve1\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xfffffffd}]}, 0x68}, 0x1, 0x0, 0x0, 0x50}, 0xc5)
sendmsg$IPVS_CMD_NEW_DEST(r2, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f0000000540)=ANY=[@ANYBLOB="240045040299d9a1be747a3cbd22b65bd841f8f4be5469eebf38b9450d9d3003bf64577db886e8caccab364bf7a6e6eecdcf7f4fa11cc3421199dc4d330a50", @ANYRES16=0x0, @ANYBLOB="04000cfd018006000e004e21000004000280"], 0x24}, 0x1, 0x0, 0x0, 0xc040}, 0x10000004)
sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), r1)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$NL80211_CMD_SET_INTERFACE(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16, @ANYBLOB="db1e29bd7000fbdbdf250600000008000300", @ANYRES32, @ANYBLOB='\f'], 0x30}}, 0x0)

06:39:04 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
socket$nl_generic(0x10, 0x3, 0x10)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000440)={0x30, r2, 0xcd6ccc609280a2c3, 0x0, 0x0, {{}, {@void, @val={0xc, 0x99, {0x8, 0x2a}}}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x30}}, 0x0)

06:39:04 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYBLOB="db1e29bd7000fbdbdf2506"], 0x30}}, 0x0)

06:39:04 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)

06:39:04 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x60, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000002c0)})

06:39:04 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
socket$nl_generic(0x10, 0x3, 0x10)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000440)={0x30, 0x0, 0xcd6ccc609280a2c3, 0x0, 0x0, {{}, {@void, @val={0xc, 0x99, {0x8, 0x2a}}}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x30}}, 0x0)

06:39:04 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x24, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @decrefs], 0x4, 0x0, &(0x7f00000002c0)="27e2f0bf"})

06:39:04 executing program 4:
ioctl$KVM_CHECK_EXTENSION(0xffffffffffffffff, 0xae03, 0x3f)
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_TRAP_GET(r1, &(0x7f0000000740)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000700)={&(0x7f0000000600)={0x100, 0x0, 0x2, 0x70bd27, 0x25dfdbff, {}, [{@pci={{0x8}, {0x11}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}]}, 0x100}}, 0x28001)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r1, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
socket$phonet_pipe(0x23, 0x5, 0x2)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r2, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
r3 = socket(0x4, 0x1, 0x5)
sendmsg$IPVS_CMD_GET_INFO(r3, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x68, 0x0, 0x100, 0x70bd29, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8}, @IPVS_CMD_ATTR_DAEMON={0x44, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e22}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x4}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'geneve1\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xfffffffd}]}, 0x68}, 0x1, 0x0, 0x0, 0x50}, 0xc5)
sendmsg$IPVS_CMD_NEW_DEST(r2, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f0000000540)=ANY=[@ANYBLOB="240045040299d9a1be747a3cbd22b65bd841f8f4be5469eebf38b9450d9d3003bf64577db886e8caccab364bf7a6e6eecdcf7f4fa11cc3421199dc4d330a50", @ANYRES16=0x0, @ANYBLOB="04000cfd018006000e004e21000004000280"], 0x24}, 0x1, 0x0, 0x0, 0xc040}, 0x10000004)
sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), r1)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$NL80211_CMD_SET_INTERFACE(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16, @ANYBLOB="db1e29bd7000fbdbdf250600000008000300", @ANYRES32, @ANYBLOB='\f'], 0x30}}, 0x0)

[ 1657.222310][T11126] binder: 11124:11126 ioctl c0306201 0 returned -14
06:39:04 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYBLOB="db1e29bd7000fbdbdf2506"], 0x30}}, 0x0)

06:39:05 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)

06:39:05 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000002c0)})

06:39:05 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x24, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @decrefs], 0x0, 0x0, &(0x7f00000002c0)})

06:39:05 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
socket$nl_generic(0x10, 0x3, 0x10)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000440)={0x30, 0x0, 0xcd6ccc609280a2c3, 0x0, 0x0, {{}, {@void, @val={0xc, 0x99, {0x8, 0x2a}}}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x30}}, 0x0)

[ 1657.795516][T11142] binder: 11140:11142 ioctl c0306201 0 returned -14
06:39:05 executing program 4:
ioctl$KVM_CHECK_EXTENSION(0xffffffffffffffff, 0xae03, 0x3f)
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_TRAP_GET(r1, &(0x7f0000000740)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000700)={&(0x7f0000000600)={0x100, 0x0, 0x2, 0x70bd27, 0x25dfdbff, {}, [{@pci={{0x8}, {0x11}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}]}, 0x100}}, 0x28001)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r1, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
socket$phonet_pipe(0x23, 0x5, 0x2)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r2, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
r3 = socket(0x4, 0x1, 0x5)
sendmsg$IPVS_CMD_GET_INFO(r3, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x68, 0x0, 0x100, 0x70bd29, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8}, @IPVS_CMD_ATTR_DAEMON={0x44, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e22}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x4}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'geneve1\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xfffffffd}]}, 0x68}, 0x1, 0x0, 0x0, 0x50}, 0xc5)
sendmsg$IPVS_CMD_NEW_DEST(r2, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f0000000540)=ANY=[@ANYBLOB="240045040299d9a1be747a3cbd22b65bd841f8f4be5469eebf38b9450d9d3003bf64577db886e8caccab364bf7a6e6eecdcf7f4fa11cc3421199dc4d330a50", @ANYRES16=0x0, @ANYBLOB="04000cfd018006000e004e21000004000280"], 0x24}, 0x1, 0x0, 0x0, 0xc040}, 0x10000004)
sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), r1)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$NL80211_CMD_SET_INTERFACE(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16, @ANYBLOB="db1e29bd7000fbdbdf250600000008000300", @ANYRES32, @ANYBLOB='\f'], 0x30}}, 0x0)

06:39:05 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16, @ANYBLOB="db1e29bd7000fbdbdf2506"], 0x30}}, 0x0)

06:39:05 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)

06:39:05 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000002c0)})

06:39:06 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
socket$nl_generic(0x10, 0x3, 0x10)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000440)={0x30, 0x0, 0xcd6ccc609280a2c3, 0x0, 0x0, {{}, {@void, @val={0xc, 0x99, {0x8, 0x2a}}}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x30}}, 0x0)

06:39:06 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x24, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @decrefs], 0x0, 0x0, &(0x7f00000002c0)})

[ 1658.394324][T11157] binder: 11155:11157 ioctl c0306201 0 returned -14
06:39:06 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16, @ANYBLOB="db1e29bd7000fbdbdf2506"], 0x30}}, 0x0)

06:39:06 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x0, 0x0, 0x0, 0x40, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86b"})

06:39:06 executing program 4:
ioctl$KVM_CHECK_EXTENSION(0xffffffffffffffff, 0xae03, 0x3f)
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_TRAP_GET(r1, &(0x7f0000000740)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000700)={&(0x7f0000000600)={0x100, 0x0, 0x2, 0x70bd27, 0x25dfdbff, {}, [{@pci={{0x8}, {0x11}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}]}, 0x100}}, 0x28001)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r1, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
socket$phonet_pipe(0x23, 0x5, 0x2)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r2, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
r3 = socket(0x4, 0x1, 0x5)
sendmsg$IPVS_CMD_GET_INFO(r3, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x68, 0x0, 0x100, 0x70bd29, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8}, @IPVS_CMD_ATTR_DAEMON={0x44, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e22}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x4}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'geneve1\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xfffffffd}]}, 0x68}, 0x1, 0x0, 0x0, 0x50}, 0xc5)
sendmsg$IPVS_CMD_NEW_DEST(r2, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f0000000540)=ANY=[@ANYBLOB="240045040299d9a1be747a3cbd22b65bd841f8f4be5469eebf38b9450d9d3003bf64577db886e8caccab364bf7a6e6eecdcf7f4fa11cc3421199dc4d330a50", @ANYRES16=0x0, @ANYBLOB="04000cfd018006000e004e21000004000280"], 0x24}, 0x1, 0x0, 0x0, 0xc040}, 0x10000004)
sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), r1)
r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="db1e29bd7000fbdbdf250600000008000300", @ANYRES32, @ANYBLOB='\f'], 0x30}}, 0x0)

06:39:06 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000002c0)})

06:39:06 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000440)={0x30, r1, 0xcd6ccc609280a2c3, 0x0, 0x0, {{}, {@void, @val={0xc, 0x99, {0x8, 0x2a}}}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x30}}, 0x0)

06:39:06 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x24, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @decrefs], 0x0, 0x0, &(0x7f00000002c0)})

06:39:06 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16, @ANYBLOB="db1e29bd7000fbdbdf2506"], 0x30}}, 0x0)

06:39:06 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x0, 0x0, 0x0, 0x40, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86b"})

06:39:06 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x58, 0x0, &(0x7f0000000240)=[@enter_looper, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000002c0)})

06:39:06 executing program 4:
ioctl$KVM_CHECK_EXTENSION(0xffffffffffffffff, 0xae03, 0x3f)
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_TRAP_GET(r1, &(0x7f0000000740)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000700)={&(0x7f0000000600)={0x100, 0x0, 0x2, 0x70bd27, 0x25dfdbff, {}, [{@pci={{0x8}, {0x11}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}]}, 0x100}}, 0x28001)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r1, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
socket$phonet_pipe(0x23, 0x5, 0x2)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r2, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
r3 = socket(0x4, 0x1, 0x5)
sendmsg$IPVS_CMD_GET_INFO(r3, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x68, 0x0, 0x100, 0x70bd29, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8}, @IPVS_CMD_ATTR_DAEMON={0x44, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e22}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x4}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'geneve1\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xfffffffd}]}, 0x68}, 0x1, 0x0, 0x0, 0x50}, 0xc5)
sendmsg$IPVS_CMD_NEW_DEST(r2, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f0000000540)=ANY=[@ANYBLOB="240045040299d9a1be747a3cbd22b65bd841f8f4be5469eebf38b9450d9d3003bf64577db886e8caccab364bf7a6e6eecdcf7f4fa11cc3421199dc4d330a50", @ANYRES16=0x0, @ANYBLOB="04000cfd018006000e004e21000004000280"], 0x24}, 0x1, 0x0, 0x0, 0xc040}, 0x10000004)
sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), r1)
r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="db1e29bd7000fbdbdf250600000008000300", @ANYRES32, @ANYBLOB='\f'], 0x30}}, 0x0)

06:39:07 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000440)={0x30, r1, 0xcd6ccc609280a2c3, 0x0, 0x0, {{}, {@void, @val={0xc, 0x99, {0x8, 0x2a}}}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x30}}, 0x0)

06:39:07 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x24, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @decrefs], 0x2, 0x0, &(0x7f00000002c0)="27e2"})

06:39:07 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf2506"], 0x30}}, 0x0)

06:39:07 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x58, 0x0, &(0x7f0000000240)=[@enter_looper, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000002c0)})

06:39:07 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x0, 0x0, 0x0, 0x40, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86b"})

06:39:07 executing program 4:
ioctl$KVM_CHECK_EXTENSION(0xffffffffffffffff, 0xae03, 0x3f)
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_TRAP_GET(r1, &(0x7f0000000740)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000700)={&(0x7f0000000600)={0x100, 0x0, 0x2, 0x70bd27, 0x25dfdbff, {}, [{@pci={{0x8}, {0x11}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}]}, 0x100}}, 0x28001)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r1, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
socket$phonet_pipe(0x23, 0x5, 0x2)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r2, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
r3 = socket(0x4, 0x1, 0x5)
sendmsg$IPVS_CMD_GET_INFO(r3, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x68, 0x0, 0x100, 0x70bd29, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8}, @IPVS_CMD_ATTR_DAEMON={0x44, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e22}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x4}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'geneve1\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xfffffffd}]}, 0x68}, 0x1, 0x0, 0x0, 0x50}, 0xc5)
sendmsg$IPVS_CMD_NEW_DEST(r2, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f0000000540)=ANY=[@ANYBLOB="240045040299d9a1be747a3cbd22b65bd841f8f4be5469eebf38b9450d9d3003bf64577db886e8caccab364bf7a6e6eecdcf7f4fa11cc3421199dc4d330a50", @ANYRES16=0x0, @ANYBLOB="04000cfd018006000e004e21000004000280"], 0x24}, 0x1, 0x0, 0x0, 0xc040}, 0x10000004)
sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), r1)
r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="db1e29bd7000fbdbdf250600000008000300", @ANYRES32, @ANYBLOB='\f'], 0x30}}, 0x0)

06:39:07 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000440)={0x30, r1, 0xcd6ccc609280a2c3, 0x0, 0x0, {{}, {@void, @val={0xc, 0x99, {0x8, 0x2a}}}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x30}}, 0x0)

06:39:07 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x24, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @decrefs], 0x0, 0x0, &(0x7f00000002c0)})

06:39:07 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf2506"], 0x30}}, 0x0)

06:39:08 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x58, 0x0, &(0x7f0000000240)=[@enter_looper, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000002c0)})

06:39:08 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x1c, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}], 0x40, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86b"})

06:39:08 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000440)={0x30, r2, 0xcd6ccc609280a2c3, 0x0, 0x0, {{}, {@void, @val={0xc, 0x99, {0x8, 0x2a}}}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x30}}, 0x0)

06:39:08 executing program 4:
ioctl$KVM_CHECK_EXTENSION(0xffffffffffffffff, 0xae03, 0x3f)
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_TRAP_GET(r1, &(0x7f0000000740)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000700)={&(0x7f0000000600)={0x100, 0x0, 0x2, 0x70bd27, 0x25dfdbff, {}, [{@pci={{0x8}, {0x11}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}]}, 0x100}}, 0x28001)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r1, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
socket$phonet_pipe(0x23, 0x5, 0x2)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r2, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
r3 = socket(0x4, 0x1, 0x5)
sendmsg$IPVS_CMD_GET_INFO(r3, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x68, 0x0, 0x100, 0x70bd29, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8}, @IPVS_CMD_ATTR_DAEMON={0x44, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e22}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x4}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'geneve1\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xfffffffd}]}, 0x68}, 0x1, 0x0, 0x0, 0x50}, 0xc5)
sendmsg$IPVS_CMD_NEW_DEST(r2, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f0000000540)=ANY=[@ANYBLOB="240045040299d9a1be747a3cbd22b65bd841f8f4be5469eebf38b9450d9d3003bf64577db886e8caccab364bf7a6e6eecdcf7f4fa11cc3421199dc4d330a50", @ANYRES16=0x0, @ANYBLOB="04000cfd018006000e004e21000004000280"], 0x24}, 0x1, 0x0, 0x0, 0xc040}, 0x10000004)
sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="db1e29bd7000fbdbdf250600000008000300", @ANYRES32, @ANYBLOB='\f'], 0x30}}, 0x0)

06:39:08 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf2506"], 0x30}}, 0x0)

06:39:08 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x24, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @decrefs], 0x0, 0x0, &(0x7f00000002c0)})

06:39:08 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x64, 0x0, &(0x7f0000000240)=[@request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000002c0)})

[ 1661.117027][T11221] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'.
06:39:08 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x1c, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}], 0x40, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86b"})

06:39:08 executing program 2:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r0, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000440)={0x30, r1, 0xcd6ccc609280a2c3, 0x0, 0x0, {{}, {@void, @val={0xc, 0x99, {0x8, 0x2a}}}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x30}}, 0x0)

06:39:09 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB, @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf2506"], 0x30}}, 0x0)

06:39:09 executing program 4:
ioctl$KVM_CHECK_EXTENSION(0xffffffffffffffff, 0xae03, 0x3f)
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_TRAP_GET(r1, &(0x7f0000000740)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000700)={&(0x7f0000000600)={0x100, 0x0, 0x2, 0x70bd27, 0x25dfdbff, {}, [{@pci={{0x8}, {0x11}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}]}, 0x100}}, 0x28001)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r1, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
socket$phonet_pipe(0x23, 0x5, 0x2)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r2, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
r3 = socket(0x4, 0x1, 0x5)
sendmsg$IPVS_CMD_GET_INFO(r3, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x68, 0x0, 0x100, 0x70bd29, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8}, @IPVS_CMD_ATTR_DAEMON={0x44, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e22}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x4}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'geneve1\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xfffffffd}]}, 0x68}, 0x1, 0x0, 0x0, 0x50}, 0xc5)
sendmsg$IPVS_CMD_NEW_DEST(r2, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f0000000540)=ANY=[@ANYBLOB="240045040299d9a1be747a3cbd22b65bd841f8f4be5469eebf38b9450d9d3003bf64577db886e8caccab364bf7a6e6eecdcf7f4fa11cc3421199dc4d330a50", @ANYRES16=0x0, @ANYBLOB="04000cfd018006000e004e21000004000280"], 0x24}, 0x1, 0x0, 0x0, 0xc040}, 0x10000004)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="db1e29bd7000fbdbdf250600000008000300", @ANYRES32, @ANYBLOB='\f'], 0x30}}, 0x0)

06:39:09 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x24, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @decrefs], 0x0, 0x0, &(0x7f00000002c0)})

06:39:09 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x64, 0x0, &(0x7f0000000240)=[@request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000002c0)})

06:39:09 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x1c, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}], 0x40, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86b"})

06:39:09 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r0, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000440)={0x30, r1, 0xcd6ccc609280a2c3, 0x0, 0x0, {{}, {@void, @val={0xc, 0x99, {0x8, 0x2a}}}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x30}}, 0x0)

[ 1661.872980][T11242] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'.
06:39:09 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x64, 0x0, &(0x7f0000000240)=[@request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000002c0)})

06:39:09 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB, @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf2506"], 0x30}}, 0x0)

06:39:09 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x24, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @decrefs], 0x1, 0x0, &(0x7f00000002c0)='\''})

06:39:09 executing program 4:
ioctl$KVM_CHECK_EXTENSION(0xffffffffffffffff, 0xae03, 0x3f)
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_TRAP_GET(r1, &(0x7f0000000740)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000700)={&(0x7f0000000600)={0x100, 0x0, 0x2, 0x70bd27, 0x25dfdbff, {}, [{@pci={{0x8}, {0x11}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}]}, 0x100}}, 0x28001)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r1, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
socket$phonet_pipe(0x23, 0x5, 0x2)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r2, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
r3 = socket(0x4, 0x1, 0x5)
sendmsg$IPVS_CMD_GET_INFO(r3, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x68, 0x0, 0x100, 0x70bd29, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8}, @IPVS_CMD_ATTR_DAEMON={0x44, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e22}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x4}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'geneve1\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xfffffffd}]}, 0x68}, 0x1, 0x0, 0x0, 0x50}, 0xc5)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="db1e29bd7000fbdbdf250600000008000300", @ANYRES32, @ANYBLOB='\f'], 0x30}}, 0x0)

06:39:10 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x40, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86b"})

06:39:10 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r0, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000440)={0x30, r1, 0xcd6ccc609280a2c3, 0x0, 0x0, {{}, {@void, @val={0xc, 0x99, {0x8, 0x2a}}}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x30}}, 0x0)

[ 1662.562520][T11261] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'.
06:39:10 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB, @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf2506"], 0x30}}, 0x0)

06:39:10 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x24, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @decrefs], 0x0, 0x0, &(0x7f00000002c0)})

06:39:10 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

06:39:10 executing program 4:
ioctl$KVM_CHECK_EXTENSION(0xffffffffffffffff, 0xae03, 0x3f)
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_TRAP_GET(r1, &(0x7f0000000740)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000700)={&(0x7f0000000600)={0x100, 0x0, 0x2, 0x70bd27, 0x25dfdbff, {}, [{@pci={{0x8}, {0x11}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}]}, 0x100}}, 0x28001)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r1, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
socket$phonet_pipe(0x23, 0x5, 0x2)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r2, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
socket(0x4, 0x1, 0x5)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="db1e29bd7000fbdbdf250600000008000300", @ANYRES32, @ANYBLOB='\f'], 0x30}}, 0x0)

06:39:10 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x40, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86b"})

06:39:10 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r0, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000440)={0x30, r1, 0xcd6ccc609280a2c3, 0x0, 0x0, {{}, {@void, @val={0xc, 0x99, {0x8, 0x2a}}}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x30}}, 0x0)

06:39:10 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00', @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf2506"], 0x30}}, 0x0)

06:39:10 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x24, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @decrefs], 0x0, 0x0, &(0x7f00000002c0)})

06:39:10 executing program 1:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, 0x0, 0x0)
socketpair(0x22, 0x3, 0x3, &(0x7f0000001940)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f0000001a40)={&(0x7f0000001980)=""/152, 0x218000, 0x1800, 0x800, 0x1}, 0x20)
sendmsg$xdp(r0, &(0x7f0000000480)={&(0x7f0000000140)={0x2c, 0x1, 0x0, 0xa}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000340)="6d5e81230c6b025946bc8ab7f6cd909365a7c52bacb55daf72e1be186b2119f7b71d120ab1302cb72789eee099bd6c2ca662137767af746baf18fe584ada6f2de1533d774aa5cd21c15bfb7b4660f430750488999c69b91343f3865de1a979b130a2123f161886ad46ab07b3cfdbbf095f50f78c53bdb81dd4bf0317", 0x7c}, {&(0x7f00000003c0)}, {&(0x7f0000000400)="0d63f9ee4f05e6c30d1205c2f055aad8d9f882d0173117b7362994c7beb01bf052dc60ebebafd35a2c9a025ec6c679fc7c6631aba124216e2fec16a8415750", 0x3f}], 0x3, 0x0, 0x0, 0x4000005}, 0x40000)
getsockopt$XDP_MMAP_OFFSETS(0xffffffffffffffff, 0x11b, 0x1, &(0x7f00000002c0), &(0x7f0000000040)=0x80)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x50, 0x0, &(0x7f0000000240)=[@exit_looper, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x1, 0x1, 0x3}, @fda={0x66646185, 0x5, 0x0, 0xa}, @ptr={0x70742a85, 0x2, &(0x7f0000000080)=""/35, 0x23, 0x2, 0x37}}, &(0x7f00000000c0)={0x0, 0x20, 0x40}}, 0x40}], 0x0, 0x0, 0x0})

[ 1663.324237][T11277] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'.
06:39:11 executing program 4:
ioctl$KVM_CHECK_EXTENSION(0xffffffffffffffff, 0xae03, 0x3f)
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_TRAP_GET(r1, &(0x7f0000000740)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000700)={&(0x7f0000000600)={0x100, 0x0, 0x2, 0x70bd27, 0x25dfdbff, {}, [{@pci={{0x8}, {0x11}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}]}, 0x100}}, 0x28001)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r1, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
socket$phonet_pipe(0x23, 0x5, 0x2)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r2, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="db1e29bd7000fbdbdf250600000008000300", @ANYRES32, @ANYBLOB='\f'], 0x30}}, 0x0)

06:39:11 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r0, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000440)={0x30, r1, 0xcd6ccc609280a2c3, 0x0, 0x0, {{}, {@void, @val={0xc, 0x99, {0x8, 0x2a}}}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x30}}, 0x0)

06:39:11 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x40, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86b"})

06:39:11 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00', @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf2506"], 0x30}}, 0x0)

06:39:11 executing program 1:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, 0x0, 0x0)
socketpair(0x22, 0x3, 0x3, &(0x7f0000001940)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f0000001a40)={&(0x7f0000001980)=""/152, 0x218000, 0x1800, 0x800, 0x1}, 0x20)
sendmsg$xdp(r0, &(0x7f0000000480)={&(0x7f0000000140)={0x2c, 0x1, 0x0, 0xa}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000340)="6d5e81230c6b025946bc8ab7f6cd909365a7c52bacb55daf72e1be186b2119f7b71d120ab1302cb72789eee099bd6c2ca662137767af746baf18fe584ada6f2de1533d774aa5cd21c15bfb7b4660f430750488999c69b91343f3865de1a979b130a2123f161886ad46ab07b3cfdbbf095f50f78c53bdb81dd4bf0317", 0x7c}, {&(0x7f00000003c0)}, {&(0x7f0000000400)="0d63f9ee4f05e6c30d1205c2f055aad8d9f882d0173117b7362994c7beb01bf052dc60ebebafd35a2c9a025ec6c679fc7c6631aba124216e2fec16a8415750", 0x3f}], 0x3, 0x0, 0x0, 0x4000005}, 0x40000)
getsockopt$XDP_MMAP_OFFSETS(0xffffffffffffffff, 0x11b, 0x1, &(0x7f00000002c0), &(0x7f0000000040)=0x80)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x50, 0x0, &(0x7f0000000240)=[@exit_looper, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x1, 0x1, 0x3}, @fda={0x66646185, 0x5, 0x0, 0xa}, @ptr={0x70742a85, 0x2, &(0x7f0000000080)=""/35, 0x23, 0x2, 0x37}}, &(0x7f00000000c0)={0x0, 0x20, 0x40}}, 0x40}], 0x0, 0x0, 0x0})

06:39:11 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x24, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @decrefs], 0x0, 0x0, &(0x7f00000002c0)})

[ 1663.965713][T11290] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'.
06:39:11 executing program 2:
socket$nl_generic(0x10, 0x3, 0x10)
r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000440)={0x30, r0, 0xcd6ccc609280a2c3, 0x0, 0x0, {{}, {@void, @val={0xc, 0x99, {0x8, 0x2a}}}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x30}}, 0x0)

06:39:11 executing program 4:
ioctl$KVM_CHECK_EXTENSION(0xffffffffffffffff, 0xae03, 0x3f)
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_TRAP_GET(r1, &(0x7f0000000740)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000700)={&(0x7f0000000600)={0x100, 0x0, 0x2, 0x70bd27, 0x25dfdbff, {}, [{@pci={{0x8}, {0x11}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}]}, 0x100}}, 0x28001)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r1, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
socket$phonet_pipe(0x23, 0x5, 0x2)
socket$nl_generic(0x10, 0x3, 0x10)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="db1e29bd7000fbdbdf250600000008000300", @ANYRES32, @ANYBLOB='\f'], 0x30}}, 0x0)

06:39:11 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x60, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x40, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86b"})

06:39:12 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00', @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf2506"], 0x30}}, 0x0)

06:39:12 executing program 5:
keyctl$restrict_keyring(0x1d, 0xfffffffffffffffb, &(0x7f0000000080)='rxrpc\x00', &(0x7f00000000c0)='/dev/binder#\x00')
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="03630840", @ANYRES64=0x0, @ANYBLOB="0d094f4242f79743ed21d5a1e0cef39d0000"], 0x0, 0x0, 0x0})

06:39:12 executing program 1:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, 0x0, 0x0)
socketpair(0x22, 0x3, 0x3, &(0x7f0000001940)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f0000001a40)={&(0x7f0000001980)=""/152, 0x218000, 0x1800, 0x800, 0x1}, 0x20)
sendmsg$xdp(r0, &(0x7f0000000480)={&(0x7f0000000140)={0x2c, 0x1, 0x0, 0xa}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000340)="6d5e81230c6b025946bc8ab7f6cd909365a7c52bacb55daf72e1be186b2119f7b71d120ab1302cb72789eee099bd6c2ca662137767af746baf18fe584ada6f2de1533d774aa5cd21c15bfb7b4660f430750488999c69b91343f3865de1a979b130a2123f161886ad46ab07b3cfdbbf095f50f78c53bdb81dd4bf0317", 0x7c}, {&(0x7f00000003c0)}, {&(0x7f0000000400)="0d63f9ee4f05e6c30d1205c2f055aad8d9f882d0173117b7362994c7beb01bf052dc60ebebafd35a2c9a025ec6c679fc7c6631aba124216e2fec16a8415750", 0x3f}], 0x3, 0x0, 0x0, 0x4000005}, 0x40000)
getsockopt$XDP_MMAP_OFFSETS(0xffffffffffffffff, 0x11b, 0x1, &(0x7f00000002c0), &(0x7f0000000040)=0x80)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x50, 0x0, &(0x7f0000000240)=[@exit_looper, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x1, 0x1, 0x3}, @fda={0x66646185, 0x5, 0x0, 0xa}, @ptr={0x70742a85, 0x2, &(0x7f0000000080)=""/35, 0x23, 0x2, 0x37}}, &(0x7f00000000c0)={0x0, 0x20, 0x40}}, 0x40}], 0x0, 0x0, 0x0})

[ 1664.563892][T11304] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 1664.651650][T11309] binder: 11306:11309 unknown command 1112475917
[ 1664.658134][T11309] binder: 11306:11309 ioctl c0306201 20000180 returned -22
06:39:12 executing program 2:
socket$nl_generic(0x10, 0x3, 0x10)
r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000440)={0x30, r0, 0xcd6ccc609280a2c3, 0x0, 0x0, {{}, {@void, @val={0xc, 0x99, {0x8, 0x2a}}}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x30}}, 0x0)

06:39:12 executing program 4:
ioctl$KVM_CHECK_EXTENSION(0xffffffffffffffff, 0xae03, 0x3f)
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_TRAP_GET(r1, &(0x7f0000000740)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000700)={&(0x7f0000000600)={0x100, 0x0, 0x2, 0x70bd27, 0x25dfdbff, {}, [{@pci={{0x8}, {0x11}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}]}, 0x100}}, 0x28001)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r1, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
socket$phonet_pipe(0x23, 0x5, 0x2)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="db1e29bd7000fbdbdf250600000008000300", @ANYRES32, @ANYBLOB='\f'], 0x30}}, 0x0)

06:39:12 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x60, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x40, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86b"})

06:39:12 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00', @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf2506"], 0x30}}, 0x0)

06:39:12 executing program 5:
keyctl$restrict_keyring(0x1d, 0xfffffffffffffffb, &(0x7f0000000080)='rxrpc\x00', &(0x7f00000000c0)='/dev/binder#\x00')
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="03630840", @ANYRES64=0x0, @ANYBLOB="0d094f4242f79743ed21d5a1e0cef39d0000"], 0x0, 0x0, 0x0})

06:39:12 executing program 1:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, 0x0, 0x0)
socketpair(0x22, 0x3, 0x3, &(0x7f0000001940)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f0000001a40)={&(0x7f0000001980)=""/152, 0x218000, 0x1800, 0x800, 0x1}, 0x20)
sendmsg$xdp(r0, &(0x7f0000000480)={&(0x7f0000000140)={0x2c, 0x1, 0x0, 0xa}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000340)="6d5e81230c6b025946bc8ab7f6cd909365a7c52bacb55daf72e1be186b2119f7b71d120ab1302cb72789eee099bd6c2ca662137767af746baf18fe584ada6f2de1533d774aa5cd21c15bfb7b4660f430750488999c69b91343f3865de1a979b130a2123f161886ad46ab07b3cfdbbf095f50f78c53bdb81dd4bf0317", 0x7c}, {&(0x7f00000003c0)}, {&(0x7f0000000400)="0d63f9ee4f05e6c30d1205c2f055aad8d9f882d0173117b7362994c7beb01bf052dc60ebebafd35a2c9a025ec6c679fc7c6631aba124216e2fec16a8415750", 0x3f}], 0x3, 0x0, 0x0, 0x4000005}, 0x40000)
getsockopt$XDP_MMAP_OFFSETS(0xffffffffffffffff, 0x11b, 0x1, &(0x7f00000002c0), &(0x7f0000000040)=0x80)

[ 1665.167673][T11318] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 1665.266622][T11323] binder: 11319:11323 unknown command 1112475917
[ 1665.273754][T11323] binder: 11319:11323 ioctl c0306201 20000180 returned -22
06:39:13 executing program 2:
socket$nl_generic(0x10, 0x3, 0x10)
r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000440)={0x30, r0, 0xcd6ccc609280a2c3, 0x0, 0x0, {{}, {@void, @val={0xc, 0x99, {0x8, 0x2a}}}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x30}}, 0x0)

06:39:13 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00', @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf2506"], 0x30}}, 0x0)

06:39:13 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x60, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x40, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86b"})

06:39:13 executing program 4:
ioctl$KVM_CHECK_EXTENSION(0xffffffffffffffff, 0xae03, 0x3f)
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_TRAP_GET(r1, &(0x7f0000000740)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000700)={&(0x7f0000000600)={0x100, 0x0, 0x2, 0x70bd27, 0x25dfdbff, {}, [{@pci={{0x8}, {0x11}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}]}, 0x100}}, 0x28001)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r1, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="db1e29bd7000fbdbdf250600000008000300", @ANYRES32, @ANYBLOB='\f'], 0x30}}, 0x0)

06:39:13 executing program 5:
keyctl$restrict_keyring(0x1d, 0xfffffffffffffffb, &(0x7f0000000080)='rxrpc\x00', &(0x7f00000000c0)='/dev/binder#\x00')
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="03630840", @ANYRES64=0x0, @ANYBLOB="0d094f4242f79743ed21d5a1e0cef39d0000"], 0x0, 0x0, 0x0})

06:39:13 executing program 1:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, 0x0, 0x0)
socketpair(0x22, 0x3, 0x3, &(0x7f0000001940)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f0000001a40)={&(0x7f0000001980)=""/152, 0x218000, 0x1800, 0x800, 0x1}, 0x20)
sendmsg$xdp(r0, &(0x7f0000000480)={&(0x7f0000000140)={0x2c, 0x1, 0x0, 0xa}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000340)="6d5e81230c6b025946bc8ab7f6cd909365a7c52bacb55daf72e1be186b2119f7b71d120ab1302cb72789eee099bd6c2ca662137767af746baf18fe584ada6f2de1533d774aa5cd21c15bfb7b4660f430750488999c69b91343f3865de1a979b130a2123f161886ad46ab07b3cfdbbf095f50f78c53bdb81dd4bf0317", 0x7c}, {&(0x7f00000003c0)}, {&(0x7f0000000400)="0d63f9ee4f05e6c30d1205c2f055aad8d9f882d0173117b7362994c7beb01bf052dc60ebebafd35a2c9a025ec6c679fc7c6631aba124216e2fec16a8415750", 0x3f}], 0x3, 0x0, 0x0, 0x4000005}, 0x40000)

[ 1665.815920][T11333] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'.
06:39:13 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00', @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf2506"], 0x30}}, 0x0)

06:39:13 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r0, 0x0, 0x0)

06:39:13 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x40, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86b"})

[ 1666.049055][T11336] binder: 11334:11336 unknown command 1112475917
[ 1666.055934][T11336] binder: 11334:11336 ioctl c0306201 20000180 returned -22
06:39:13 executing program 4:
ioctl$KVM_CHECK_EXTENSION(0xffffffffffffffff, 0xae03, 0x3f)
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_TRAP_GET(r1, &(0x7f0000000740)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000700)={&(0x7f0000000600)={0x100, 0x0, 0x2, 0x70bd27, 0x25dfdbff, {}, [{@pci={{0x8}, {0x11}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}]}, 0x100}}, 0x28001)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="db1e29bd7000fbdbdf250600000008000300", @ANYRES32, @ANYBLOB='\f'], 0x30}}, 0x0)

06:39:14 executing program 5:
keyctl$restrict_keyring(0x1d, 0xfffffffffffffffb, &(0x7f0000000080)='rxrpc\x00', &(0x7f00000000c0)='/dev/binder#\x00')
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)

06:39:14 executing program 1:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, 0x0, 0x0)
socketpair(0x22, 0x3, 0x3, &(0x7f0000001940)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f0000001a40)={&(0x7f0000001980)=""/152, 0x218000, 0x1800, 0x800, 0x1}, 0x20)

[ 1666.493717][T11346] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'.
06:39:14 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r1 = socket(0x9, 0x6, 0x0)
sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="01002bbd7000fddbdf2505000000080004000600000008000500070000000800060000000080"], 0x2c}, 0x1, 0x0, 0x0, 0x1}, 0x4044)
sendmsg$DEVLINK_CMD_SB_OCC_SNAPSHOT(r1, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x38, 0x0, 0x300, 0x70bd2b, 0x25dfdbfd, {}, [{@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x3}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40}, 0x4004)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x1, 0x2})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0)
ioctl$SNDCTL_TMR_CONTINUE(r2, 0x5404)

06:39:14 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x40, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86b"})

06:39:14 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r0, 0x0, 0x0)

06:39:14 executing program 4:
ioctl$KVM_CHECK_EXTENSION(0xffffffffffffffff, 0xae03, 0x3f)
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
socket$nl_generic(0x10, 0x3, 0x10)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="db1e29bd7000fbdbdf250600000008000300", @ANYRES32, @ANYBLOB='\f'], 0x30}}, 0x0)

06:39:14 executing program 5:
keyctl$restrict_keyring(0x1d, 0xfffffffffffffffb, &(0x7f0000000080)='rxrpc\x00', &(0x7f00000000c0)='/dev/binder#\x00')

06:39:14 executing program 1:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, 0x0, 0x0)
socketpair(0x22, 0x3, 0x3, &(0x7f0000001940))

06:39:14 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r1 = socket(0x9, 0x6, 0x0)
sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="01002bbd7000fddbdf2505000000080004000600000008000500070000000800060000000080"], 0x2c}, 0x1, 0x0, 0x0, 0x1}, 0x4044)
sendmsg$DEVLINK_CMD_SB_OCC_SNAPSHOT(r1, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x38, 0x0, 0x300, 0x70bd2b, 0x25dfdbfd, {}, [{@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x3}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40}, 0x4004)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x1, 0x2})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0)
ioctl$SNDCTL_TMR_CONTINUE(r2, 0x5404)

06:39:14 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r0, 0x0, 0x0)

[ 1667.162449][T11360] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'.
06:39:14 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x40, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86b"})

06:39:15 executing program 4:
ioctl$KVM_CHECK_EXTENSION(0xffffffffffffffff, 0xae03, 0x3f)
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="db1e29bd7000fbdbdf250600000008000300", @ANYRES32, @ANYBLOB='\f'], 0x30}}, 0x0)

06:39:15 executing program 5:
keyctl$restrict_keyring(0x1d, 0xfffffffffffffffb, 0x0, &(0x7f00000000c0)='/dev/binder#\x00')

06:39:15 executing program 1:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
socketpair(0x22, 0x3, 0x3, &(0x7f0000001940))

06:39:15 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r1 = socket(0x9, 0x6, 0x0)
sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="01002bbd7000fddbdf2505000000080004000600000008000500070000000800060000000080"], 0x2c}, 0x1, 0x0, 0x0, 0x1}, 0x4044)
sendmsg$DEVLINK_CMD_SB_OCC_SNAPSHOT(r1, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x38, 0x0, 0x300, 0x70bd2b, 0x25dfdbfd, {}, [{@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x3}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40}, 0x4004)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x1, 0x2})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0)
ioctl$SNDCTL_TMR_CONTINUE(r2, 0x5404)

06:39:15 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)={0x30, r1, 0xcd6ccc609280a2c3, 0x0, 0x0, {{}, {@void, @val={0xc, 0x99, {0x8, 0x2a}}}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x30}}, 0x0)

[ 1667.817020][T11374] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'.
06:39:15 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x58, 0x0, &(0x7f0000000240)=[@enter_looper, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x40, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86b"})

06:39:15 executing program 1:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
socketpair(0x22, 0x3, 0x3, &(0x7f0000001940))

06:39:15 executing program 4:
ioctl$KVM_CHECK_EXTENSION(0xffffffffffffffff, 0xae03, 0x3f)
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf250600000008000300", @ANYRES32, @ANYBLOB='\f'], 0x30}}, 0x0)

06:39:15 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r1 = socket(0x9, 0x6, 0x0)
sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="01002bbd7000fddbdf2505000000080004000600000008000500070000000800060000000080"], 0x2c}, 0x1, 0x0, 0x0, 0x1}, 0x4044)
sendmsg$DEVLINK_CMD_SB_OCC_SNAPSHOT(r1, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x38, 0x0, 0x300, 0x70bd2b, 0x25dfdbfd, {}, [{@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x3}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40}, 0x4004)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x1, 0x2})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404)

06:39:15 executing program 5:
keyctl$restrict_keyring(0x1d, 0xfffffffffffffffb, 0x0, &(0x7f00000000c0)='/dev/binder#\x00')

06:39:15 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r0, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0)

06:39:16 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x58, 0x0, &(0x7f0000000240)=[@enter_looper, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x40, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86b"})

[ 1668.505374][T11390] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'.
06:39:16 executing program 1:
socketpair(0x22, 0x3, 0x3, &(0x7f0000001940))

06:39:16 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r1 = socket(0x9, 0x6, 0x0)
sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="01002bbd7000fddbdf2505000000080004000600000008000500070000000800060000000080"], 0x2c}, 0x1, 0x0, 0x0, 0x1}, 0x4044)
sendmsg$DEVLINK_CMD_SB_OCC_SNAPSHOT(r1, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x38, 0x0, 0x300, 0x70bd2b, 0x25dfdbfd, {}, [{@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x3}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40}, 0x4004)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x1, 0x2})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404)

06:39:16 executing program 5:
keyctl$restrict_keyring(0x1d, 0xfffffffffffffffb, 0x0, &(0x7f00000000c0)='/dev/binder#\x00')

06:39:16 executing program 4:
ioctl$KVM_CHECK_EXTENSION(0xffffffffffffffff, 0xae03, 0x3f)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf250600000008000300", @ANYRES32, @ANYBLOB='\f'], 0x30}}, 0x0)

06:39:16 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r0, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0)

06:39:16 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x58, 0x0, &(0x7f0000000240)=[@enter_looper, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x40, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86b"})

[ 1669.155912][T11405] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'.
06:39:16 executing program 1:
socketpair(0x0, 0x3, 0x3, &(0x7f0000001940))

06:39:16 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r1 = socket(0x9, 0x6, 0x0)
sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="01002bbd7000fddbdf2505000000080004000600000008000500070000000800060000000080"], 0x2c}, 0x1, 0x0, 0x0, 0x1}, 0x4044)
sendmsg$DEVLINK_CMD_SB_OCC_SNAPSHOT(r1, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x38, 0x0, 0x300, 0x70bd2b, 0x25dfdbfd, {}, [{@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x3}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40}, 0x4004)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x1, 0x2})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404)

06:39:17 executing program 5:
keyctl$restrict_keyring(0x1d, 0xfffffffffffffffb, &(0x7f0000000080)='rxrpc\x00', 0x0)

06:39:17 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf250600000008000300", @ANYRES32, @ANYBLOB='\f'], 0x30}}, 0x0)

06:39:17 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r0, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0)

06:39:17 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x64, 0x0, &(0x7f0000000240)=[@request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x40, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86b"})

06:39:17 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r1 = socket(0x9, 0x6, 0x0)
sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="01002bbd7000fddbdf2505000000080004000600000008000500070000000800060000000080"], 0x2c}, 0x1, 0x0, 0x0, 0x1}, 0x4044)
sendmsg$DEVLINK_CMD_SB_OCC_SNAPSHOT(r1, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x38, 0x0, 0x300, 0x70bd2b, 0x25dfdbfd, {}, [{@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x3}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40}, 0x4004)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x1, 0x2})
r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0)
ioctl$SNDCTL_TMR_CONTINUE(r2, 0x5404)

[ 1669.821910][T11422] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'.
06:39:17 executing program 1:
socketpair(0x0, 0x3, 0x3, &(0x7f0000001940))

06:39:17 executing program 5:
keyctl$restrict_keyring(0x1d, 0xfffffffffffffffb, &(0x7f0000000080)='rxrpc\x00', 0x0)

06:39:17 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0)

06:39:17 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf250600000008000300", @ANYRES32, @ANYBLOB='\f'], 0x30}}, 0x0)

06:39:17 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x64, 0x0, &(0x7f0000000240)=[@request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x40, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86b"})

06:39:18 executing program 3:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r0 = socket(0x9, 0x6, 0x0)
sendmsg$IPVS_CMD_NEW_DEST(r0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="01002bbd7000fddbdf2505000000080004000600000008000500070000000800060000000080"], 0x2c}, 0x1, 0x0, 0x0, 0x1}, 0x4044)
sendmsg$DEVLINK_CMD_SB_OCC_SNAPSHOT(r0, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x38, 0x0, 0x300, 0x70bd2b, 0x25dfdbfd, {}, [{@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x3}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40}, 0x4004)
r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0)
ioctl$SNDCTL_TMR_CONTINUE(r1, 0x5404)

06:39:18 executing program 1:
socketpair(0x0, 0x3, 0x3, &(0x7f0000001940))

06:39:18 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0)

06:39:18 executing program 5:
keyctl$restrict_keyring(0x1d, 0xfffffffffffffffb, &(0x7f0000000080)='rxrpc\x00', 0x0)

06:39:18 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf250600000008000300", @ANYRES32, @ANYBLOB='\f'], 0x30}}, 0x0)

06:39:18 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x64, 0x0, &(0x7f0000000240)=[@request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x40, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86b"})

06:39:18 executing program 3:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r0 = socket(0x9, 0x6, 0x0)
sendmsg$IPVS_CMD_NEW_DEST(r0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="01002bbd7000fddbdf2505000000080004000600000008000500070000000800060000000080"], 0x2c}, 0x1, 0x0, 0x0, 0x1}, 0x4044)
r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0)
ioctl$SNDCTL_TMR_CONTINUE(r1, 0x5404)

06:39:18 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0)

06:39:18 executing program 1:
socketpair(0x22, 0x0, 0x3, &(0x7f0000001940))

06:39:18 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r1 = socket(0x9, 0x6, 0x0)
sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="01002bbd7000fddbdf2505000000080004000600000008000500070000000800060000000080"], 0x2c}, 0x1, 0x0, 0x0, 0x1}, 0x4044)
sendmsg$DEVLINK_CMD_SB_OCC_SNAPSHOT(r1, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x38, 0x0, 0x300, 0x70bd2b, 0x25dfdbfd, {}, [{@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x3}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40}, 0x4004)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x1, 0x2})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0)
ioctl$SNDCTL_TMR_CONTINUE(r2, 0x5404)

06:39:19 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

06:39:19 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf250600000008000300", @ANYRES32, @ANYBLOB='\f'], 0x30}}, 0x0)

06:39:19 executing program 3:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
socket(0x9, 0x6, 0x0)
r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0)
ioctl$SNDCTL_TMR_CONTINUE(r0, 0x5404)

06:39:19 executing program 1:
socketpair(0x22, 0x0, 0x0, &(0x7f0000001940))

06:39:19 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)={0x30, 0x0, 0xcd6ccc609280a2c3, 0x0, 0x0, {{}, {@void, @val={0xc, 0x99, {0x8, 0x2a}}}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x30}}, 0x0)

06:39:19 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

06:39:19 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r1 = socket(0x9, 0x6, 0x0)
sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="01002bbd7000fddbdf2505000000080004000600000008000500070000000800060000000080"], 0x2c}, 0x1, 0x0, 0x0, 0x1}, 0x4044)
sendmsg$DEVLINK_CMD_SB_OCC_SNAPSHOT(r1, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x38, 0x0, 0x300, 0x70bd2b, 0x25dfdbfd, {}, [{@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x3}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40}, 0x4004)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x1, 0x2})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0)
ioctl$SNDCTL_TMR_CONTINUE(r2, 0x5404)

06:39:19 executing program 4:
socket$nl_generic(0x10, 0x3, 0x10)
r0 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="db1e29bd7000fbdbdf250600000008000300", @ANYRES32, @ANYBLOB='\f'], 0x30}}, 0x0)

06:39:19 executing program 3:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0)
ioctl$SNDCTL_TMR_CONTINUE(r0, 0x5404)

06:39:20 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)={0x30, 0x0, 0xcd6ccc609280a2c3, 0x0, 0x0, {{}, {@void, @val={0xc, 0x99, {0x8, 0x2a}}}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x30}}, 0x0)

06:39:20 executing program 1:
socketpair(0x22, 0x0, 0x0, &(0x7f0000001940))

06:39:20 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

06:39:20 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r1 = socket(0x9, 0x6, 0x0)
sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="01002bbd7000fddbdf2505000000080004000600000008000500070000000800060000000080"], 0x2c}, 0x1, 0x0, 0x0, 0x1}, 0x4044)
sendmsg$DEVLINK_CMD_SB_OCC_SNAPSHOT(r1, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x38, 0x0, 0x300, 0x70bd2b, 0x25dfdbfd, {}, [{@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x3}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40}, 0x4004)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x1, 0x2})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0)
ioctl$SNDCTL_TMR_CONTINUE(r2, 0x5404)

06:39:20 executing program 4:
socket$nl_generic(0x10, 0x3, 0x10)
r0 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="db1e29bd7000fbdbdf250600000008000300", @ANYRES32, @ANYBLOB='\f'], 0x30}}, 0x0)

06:39:20 executing program 3:
r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0)
ioctl$SNDCTL_TMR_CONTINUE(r0, 0x5404)

06:39:20 executing program 1:
socketpair(0x22, 0x0, 0x0, &(0x7f0000001940))

06:39:20 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)={0x30, 0x0, 0xcd6ccc609280a2c3, 0x0, 0x0, {{}, {@void, @val={0xc, 0x99, {0x8, 0x2a}}}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x30}}, 0x0)

06:39:20 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000002c0)})

06:39:20 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r1 = socket(0x9, 0x6, 0x0)
sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="01002bbd7000fddbdf2505000000080004000600000008000500070000000800060000000080"], 0x2c}, 0x1, 0x0, 0x0, 0x1}, 0x4044)
sendmsg$DEVLINK_CMD_SB_OCC_SNAPSHOT(r1, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x38, 0x0, 0x300, 0x70bd2b, 0x25dfdbfd, {}, [{@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x3}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40}, 0x4004)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x1, 0x2})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0)

06:39:20 executing program 4:
socket$nl_generic(0x10, 0x3, 0x10)
r0 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="db1e29bd7000fbdbdf250600000008000300", @ANYRES32, @ANYBLOB='\f'], 0x30}}, 0x0)

06:39:20 executing program 3:
r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x2, 0x0)
ioctl$SNDCTL_TMR_CONTINUE(r0, 0x5404)

06:39:21 executing program 1:
socketpair(0x22, 0x0, 0x3, 0x0)

06:39:21 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000002c0)})

06:39:21 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)={0x30, r1, 0x0, 0x0, 0x0, {{}, {@void, @val={0xc, 0x99, {0x8, 0x2a}}}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x30}}, 0x0)

06:39:21 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r1 = socket(0x9, 0x6, 0x0)
sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="01002bbd7000fddbdf2505000000080004000600000008000500070000000800060000000080"], 0x2c}, 0x1, 0x0, 0x0, 0x1}, 0x4044)
sendmsg$DEVLINK_CMD_SB_OCC_SNAPSHOT(r1, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x38, 0x0, 0x300, 0x70bd2b, 0x25dfdbfd, {}, [{@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x3}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40}, 0x4004)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x1, 0x2})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:39:21 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, 0x0, 0x0)

06:39:21 executing program 3:
r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x2, 0x0)
ioctl$SNDCTL_TMR_CONTINUE(r0, 0x5404)

06:39:21 executing program 1:
socketpair(0x22, 0x0, 0x3, 0x0)

06:39:21 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000002c0)})

06:39:21 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)={0x30, r1, 0x0, 0x0, 0x0, {{}, {@void, @val={0xc, 0x99, {0x8, 0x2a}}}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x30}}, 0x0)

06:39:21 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, 0x0, 0x0)

06:39:21 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r1 = socket(0x9, 0x6, 0x0)
sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="01002bbd7000fddbdf2505000000080004000600000008000500070000000800060000000080"], 0x2c}, 0x1, 0x0, 0x0, 0x1}, 0x4044)
sendmsg$DEVLINK_CMD_SB_OCC_SNAPSHOT(r1, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x38, 0x0, 0x300, 0x70bd2b, 0x25dfdbfd, {}, [{@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x3}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40}, 0x4004)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:39:22 executing program 3:
r0 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x2, 0x0)
ioctl$SNDCTL_TMR_CONTINUE(r0, 0x5404)

06:39:22 executing program 1:
socketpair(0x22, 0x0, 0x3, 0x0)

06:39:22 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x20, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856a"})

06:39:22 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)={0x30, r1, 0x0, 0x0, 0x0, {{}, {@void, @val={0xc, 0x99, {0x8, 0x2a}}}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x30}}, 0x0)

06:39:22 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, 0x0, 0x0)

06:39:22 executing program 3:
r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0)
ioctl$SNDCTL_TMR_CONTINUE(r0, 0x5404)

06:39:22 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r1 = socket(0x9, 0x6, 0x0)
sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="01002bbd7000fddbdf2505000000080004000600000008000500070000000800060000000080"], 0x2c}, 0x1, 0x0, 0x0, 0x1}, 0x4044)
sendmsg$DEVLINK_CMD_SB_OCC_SNAPSHOT(r1, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x38, 0x0, 0x300, 0x70bd2b, 0x25dfdbfd, {}, [{@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x3}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40}, 0x4004)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:39:22 executing program 1:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0)
ioctl$SNDCTL_TMR_CONTINUE(r0, 0x5404)

06:39:23 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000002c0)})

06:39:23 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)={0x30, r1, 0xcd6ccc609280a2c3, 0x0, 0x0, {{}, {@void, @val={0xc, 0x99, {0x0, 0x2a}}}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x30}}, 0x0)

06:39:23 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0)

06:39:23 executing program 3:
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0)
ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404)

06:39:23 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r1 = socket(0x9, 0x6, 0x0)
sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="01002bbd7000fddbdf2505000000080004000600000008000500070000000800060000000080"], 0x2c}, 0x1, 0x0, 0x0, 0x1}, 0x4044)
sendmsg$DEVLINK_CMD_SB_OCC_SNAPSHOT(r1, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x38, 0x0, 0x300, 0x70bd2b, 0x25dfdbfd, {}, [{@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x3}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40}, 0x4004)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:39:23 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r1 = gettid()
sched_rr_get_interval(r1, &(0x7f0000000800))
syz_open_procfs$namespace(r1, &(0x7f0000000000)='ns/net\x00')
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x58, 0x0, &(0x7f00000001c0)=[@reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f00000000c0)={@fda={0x66646185, 0x8, 0x0, 0x2f}, @ptr={0x70742a85, 0x74e, &(0x7f0000000040)=""/126, 0x7e, 0x1, 0x12}, @flat=@handle={0x73682a85, 0x2000}}, &(0x7f0000000140)={0x0, 0x20, 0x48}}}, @acquire_done={0x40106309, 0x1}], 0x0, 0x0, 0x0})

06:39:23 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0)

06:39:23 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)={0x30, r1, 0xcd6ccc609280a2c3, 0x0, 0x0, {{}, {@void, @val={0xc}}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x30}}, 0x0)

06:39:23 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000002c0)})

06:39:23 executing program 3:
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0)
ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404)

06:39:23 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r1 = socket(0x9, 0x6, 0x0)
sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="01002bbd7000fddbdf2505000000080004000600000008000500070000000800060000000080"], 0x2c}, 0x1, 0x0, 0x0, 0x1}, 0x4044)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x1, 0x2})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:39:24 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0)

06:39:24 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000002c0)})

06:39:24 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)={0x28, r1, 0xcd6ccc609280a2c3, 0x0, 0x0, {{}, {@void, @val={0xc}}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6}]}, 0x28}}, 0x0)

06:39:24 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r1 = gettid()
sched_rr_get_interval(r1, &(0x7f0000000800))
syz_open_procfs$namespace(r1, &(0x7f0000000000)='ns/net\x00')
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x58, 0x0, &(0x7f00000001c0)=[@reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f00000000c0)={@fda={0x66646185, 0x8, 0x0, 0x2f}, @ptr={0x70742a85, 0x74e, &(0x7f0000000040)=""/126, 0x7e, 0x1, 0x12}, @flat=@handle={0x73682a85, 0x2000}}, &(0x7f0000000140)={0x0, 0x20, 0x48}}}, @acquire_done={0x40106309, 0x1}], 0x0, 0x0, 0x0})

06:39:24 executing program 3:
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0)
ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404)

06:39:24 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
socket(0x9, 0x6, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x1, 0x2})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:39:24 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)={0x20, r1, 0xcd6ccc609280a2c3, 0x0, 0x0, {{}, {@void, @val={0xc}}}}, 0x20}}, 0x0)

06:39:24 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x10, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e75"})

06:39:24 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x30}}, 0x0)

06:39:24 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r1 = gettid()
sched_rr_get_interval(r1, &(0x7f0000000800))
syz_open_procfs$namespace(r1, &(0x7f0000000000)='ns/net\x00')
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x58, 0x0, &(0x7f00000001c0)=[@reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f00000000c0)={@fda={0x66646185, 0x8, 0x0, 0x2f}, @ptr={0x70742a85, 0x74e, &(0x7f0000000040)=""/126, 0x7e, 0x1, 0x12}, @flat=@handle={0x73682a85, 0x2000}}, &(0x7f0000000140)={0x0, 0x20, 0x48}}}, @acquire_done={0x40106309, 0x1}], 0x0, 0x0, 0x0})

[ 1677.215183][ T3126] ieee802154 phy0 wpan0: encryption failed: -22
[ 1677.221810][ T3126] ieee802154 phy1 wpan1: encryption failed: -22
06:39:25 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r1 = gettid()
sched_rr_get_interval(r1, &(0x7f0000000800))
syz_open_procfs$namespace(r1, &(0x7f0000000000)='ns/net\x00')
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x58, 0x0, &(0x7f00000001c0)=[@reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f00000000c0)={@fda={0x66646185, 0x8, 0x0, 0x2f}, @ptr={0x70742a85, 0x74e, &(0x7f0000000040)=""/126, 0x7e, 0x1, 0x12}, @flat=@handle={0x73682a85, 0x2000}}, &(0x7f0000000140)={0x0, 0x20, 0x48}}}, @acquire_done={0x40106309, 0x1}], 0x0, 0x0, 0x0})

06:39:25 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x1, 0x2})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:39:25 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000012c0)={0x70, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death={0x400c630e, 0x1}, @increfs={0x40046304, 0x3}, @decrefs={0x40046307, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f00000001c0)={@fda={0x66646185, 0x7, 0x1, 0x11}, @ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/5, 0x5, 0x0, 0x3c}, @ptr={0x70742a85, 0x1, &(0x7f0000000100)=""/54, 0x36, 0x0, 0x4}}, &(0x7f0000000140)={0x0, 0x20, 0x48}}, 0x40}], 0x1000, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e2a6398f761630e757f9bdfa914adb2c0f417040235e7856aad360883bfa8ad21dc8b6c43e7c1426d6098c6b6a0f685d3ce2355971983c86ba206193131b1cf46e59dc8c518c380ed9793f370ae8da49c0092cd1726257d73f52570191f5ba4f868b372a713ffb555f5cb9c80fbec9354c1dc632ba43fc554dc34c3e552eac551d208b0c798ca1ae9c75a3fc3d6c039a343f5597f8593416a4bfb734d63dba7634586b1f4578667624810b8aa4fc7907767b39ed553d1ff659ec928ce4c8e62c8b80ae6f3bc6ba99adb7e4cdfbce49785cc407e7f59ef2f2b0bb58d91b2119ebc2639bfad3b159673c60b24f82512823a6de589ec029adb3e149f2ebe17426cfeac48b92064b33cc59d3ae6a368807c021aca1ff29dfe1889382b730ee97d7d187f7f1bb97cfb296f20fbe2e1aeeb773a1d10da3592f15998825d5283c0fcfba7de857ae7268cad3732ab5dcd73448062fe9a365a91d0b67e0d7d785a895a6aa058904a054695c31b09c9c2c801865ca3cc8b0cb4b2ceb9819d3f62ed199f5c21fae71d029e163671022e5aaf3b25b42c3b55c30533630efb3c6a131fd56a612e2fa5703f1d3357573b8c87e04b46110ee5e7d66a5c4375c30382ac9d09963edd7f41785ac774bb459dd540e2c0a618b82dacc0b325870f03b8d1451c7aa47fe5b6a2c74101bc6ff67ba1af363ddeb04e4322d78b7864f43c2eda43fd9c798b3e2c0c65d7fbb9ba5afb3b7c6406d1ae4da4941183f75b8475b7f92c0291cf7c8a9d44f629f8078e59eff8703e840c80e69d328eb73925a5cdbd57acb19618211ea117d7a8a1ed5de76ba3b2c128ec17beb65b9f17303b2ed51a226ae18167d3abc5979197bea0453519ed268c083b1b5eb85c9380eccc007151124d8170afa8382e39cff375f43c191964f502e39f722b444f7f36866782d8771c5f8b610a6b99c9041bdbc8b451a68e2fdbc2ad7a0762c1fdbd97659ba74d7daca6a63bf03f7ac2578ee96912996b8fa003a88a9cebffb9e36c1c9a8cc9977a61bb93cd85f7ebc0de74597e4071d65df7941bdcb347c2db0f214dd54326baf1eeef1211e542f5d4f5172e12dfc63c4de78593c52df0f3f1cbe1b8a9fb1f59242309c8f2699a66588a87ceefa0f660f304d8e8e7295448cb1cc350192833990f7d89225022c9a6205cdfcacccf996cd9e24fd1c419528f032a04d9437c2b72869961c90495ebc306707c04cb6d01cb1001c6d262fd69ed76e58a2e96d6297e608dfb100986549addd3150f7c163c206d33f3fb6de8e9c549086f61e5cf8cbf776ce8b6fedf4751b1be37a5c3339fb584d5e9d3d0e16d6a34ff5fadab7e335f230689641d171b5ff30b03042c28b6b1163f74a82d97930c05cf0c41b8229336aaf18d1d47e7bee5e7d7e50b33d0feccc6d411f6b881b2334083e3a8bc8d3bad4070176a853ee277684b4f3f812d9b624679ce3a5923f427dcab5f737288a3cabffa858e29030b70346925a82d6440bd2e6405ca6f0b21c713183ead55fea3af313920528d660f0beb935ec50c881eae3bbeb3c70100710dc9f7e8582ec00cc8461de0ec4b4f577f9b68020093fed727ae02fd689bb2e38f5817f3736050e3b9c53c0357a2df8807316c0e8336242f1977d1cb7f1d8a6cf1cc6c8a4f3521e3fa7719e58a148f068bdd20b1104f43b6f762292d10a3169dfdad50d668e1f109b9d7eeb76b3ba48d3302c5971d4df1b34d4c4a92929f3876d3bb868cefd02c9a08c364c1e557d5d0c246d5c28235f43cac9aa0f371bcba120235660e6b73b5a975e826607201241b7c385c5fab5c0e34c9dc1b33c4e48ca0a37525e2b4db287a180eed1f092a989db67f6b95c9850bf4326ac2a20f2a1403c553a085c035f7fbba1fe9f7d35066f6e2a68771bdeec7d401a6c654fc06d529ea1b0de033083343109c2ad1c5ad43f64502e026fa37f5fc59afcbb0a51a3c42484b7d21abfbb357fb4bb8cbefd135183b1adfe5e21456b0d7bd9d25eb81f7285424f5bc28ab69be3f9601f41ba2e7318c4dac37561ecf8dbddcc7ebaaa3671f0ab6e1faf58d7bb53d91c4f332a68ed9a36d2955a1d6e2bd19bb9dc11a69a49103188df42ef4767014da485b9c18f3d354a6d19608050c4d073bb7602fcd419b1acab536a852c2b4b3188257f250040cc3c06c0cd19f126a2d4bd2f930546e8f4f7c97090b2a906d57d0668050dc00ec93af78290fdd92da915883954ca1bea5a3858cad4dec18419e24f8e0eaf6e8f9ea9c38acb89033c4c28e30dfb054029a3766892f2e4a2a751572be31d93be94d92366a4c6260a3968a896b652be9a26bd3f162539883dbc0bb543559d9a825ac76b270254f0f3b70856051823afaf3fd2b54588d3be0b805e210def0b252900213e782bac9b1c917f9fd4ac8f51c13f4fa84360465172a97d3dabcb337f9fbe6bb72b8e18ef364a263408e2c8fe4891e31bb619db5f1b99b8256bef563f9f1acc37027112a53248fe7e5a6c8792685e5a0c13120cb2ae906c521214174bfd3cd783b7cc586eb09ba16dd4692fa08ed01b91496d4edc3a8cc421b023d34d4e2a1921513b457fddddebaa262f91f8953d3a7193b68fa3c779a9ef51a68ec227280eb78480ee34228c5db3f18699da509eb2f51aba41f6e39a9ade8efa2e1d5707fd293c5358c3c7ef35231a5831566db8dc2b8181e278bdbbca477a87590c48759eb3f862bd8a4770e2b7ef64484eeacea001737315a470bf68f6f5824d3a1f1d5a3b3c6157b03b5b9aca864dbf7877b7b1d20c8b6c2fdf5dab424ce1076391359f6daaa313c5b1384479f8a61ce733c4432389464dc414a60ee1b0c7efdc5fcc53811a144b10ca19159207baa775b2145d0b82d4fbc93116326e8d9c26a605812324cf8883f9bb7a7e28c0dcce5dbdedd835a36715201a1464bdad0783888e2916fe36a38aad080c287e0dd1ca6d966e5ba200941a8cd6df2b902feff11135ca87a79b0446e07897fd6555549352ebd8d4ba0aff161a5f6dcdd5d960abaa1b2cdab9b5d7c4332d967f480e21ff75064bffb6a9dd15f1ca9d6c4b9b1f65f16536f3d3be128fbba656c14270cf5174e692bde77ecd317f1e61632245fe13b6de7968739c4f0c18e0ccd85bf4e0979d63b283b2de3f460a579ca2b6ad93e16e1d50eb1886d2a1666937f631f89f9fa18a4e74a582e43b4181ccfd87df8640af31fb3f6a35de47318b1d0c13f9e4679f1c32819919edd25691284a237102efc085d342d5273f60186ab0b6071b1cfdf7e54529669515e9f69338b819f4044c6e0c299503c3cc464b7a40587da07605cc2a6134cd1801f29646b031846d6411598862a56e1313494cc5d54d85fca772697f8fc69ac997b6e570d4fa0f796ca0809fb36c9c76535dd6a5f0db924f09013a8a26be2426f4a3fecfe1b83f6bd16f4d9f2f7d40e1ef4ce3dfb647827b2d180b3e9fb8978a3dc64735403612e90f9178ace54a32786cf1640b6c1554b8dfc87455817e832dde45ffb37bab5746230dee9550ebb01626f31de99cbfcd1eeefa5f16e97c6caa795b6f12237f70c9419bd81718f27d08406e72b26474ecfc27c52b6de20cb2dd4b82c7e0e413f196471e86ac666dcdfa71ae0da22be2c071208b678837b55f50835f3f6605f2f2f822708f3d74b2c419a8db9b3ee7a2a0c000eb80225f4d1e5a01805af179220935805255987df25ee15322ccbf5c42393f04d9c36de56e38331edc7a630843cb22235d77ea92b496134d81725fef0dcaec37ca5e7e77e91ff38b8377eb0abe88a9c2919f539124f4c7a1a1bc0ae85fc601364f05bbfac17de50c7c13b2fb4667726c4e5dc5b647439bd11e3eef22a59b778c527d5181af55319e7750c1d941feb55489d391203b245af211638632b3a9894598042a8507858d2c28cdbb55d84adc84e05f961acd3a7f2a24f1b5e375f0401ac6727ad500713a49bf7cd41596badb1fde93a4d65598f1e9546384c93018e22dd4724930294bfd407c059a54e29064528e98b863503c2201f9c8676c47eb8297c40adda21a45b854ea5d682c7f823700a02d8b61b972fc91431b780d9d2bfdad2f6e882a170c4cb3a9b3e4f97fc34c2ec56fa6b0ba95679327373b190f5ed8102b32cd040949abfd4424ab1808f1df3895d678037bbcdc49d6fdb833885efeaf9ecc00986e3d06ca47e86c3c6cbd3a228fd7785158d4812e5941f8f071431ee4c5bddd9c4100db52b69f13d9322ef8181cf230ce1e15b88f651d51ad6b8107c69f040a5f5462290ef0d1454e622f8af8833733a7d5f974ca0ff873f2e85367f4801eff4ea2577845716a31fc066effe1936367c50788de3badcae8f97a4f9a938434151359836747d917df2010863bf00c69d324e03f72e05e65a25a21f17f6eb1a58234cffaa57d611bebe6ed013d2e7feb13d01f128616c7acc1dd097ba9fc2c0e0f881496be7f59240f9c0f23630c23cbc4f5f8017deab15befd7c9e0e3c7865d975c001b28c6d29d4d2e1c078158af58a78fd822f28788731c5db8c902bab8c825c521d5be6ca4d876ea4cbdef41053739f2e74f802986f744be65abb203e5fdbcd6898be36da8cc4a3ccb93666c6cb0409232545e6cc5168e21942e66c2668b6a29de01a13bf7402800261553a955f2a52f441c13cacb0bc9a5047355c9fe4f21f515bb05f0edc2e3ba5a5abfa64255c536823e289674508ce7877deb526ee4e5071a4917558c7f942af83fa4246725545037b48578ab5f4a92c9a9cbd40436fedaba7d6b9bbe09bb8a950e765fce47b04f6f4f24da6f270f61e72d1c03a0eab02441596c4593abc25897e48b889fd0e46511167012d2eded4fa4e151378e6cfbfe41e551f9f05bb0d2682e4372603eb0f798321d228f39f98519ae9f45537d0ac1c58077dcd4f09f8bdfefd9b2e83429df481e76f1782ce604063a5b0ebf9d61410f23f339ed6be0c481b1ca87739cbe677bf12f1a94d3d5599b93b381af29b459ebde519291602e971363570c98ee9ed5d6aa5b8839bf73a06f24c4f265568b036c5ae65bb3273826523e95e59166907ad996d96f42e6b354fd793f85642ff216476d80df359829cf068f8608449fa3032cc2d87c72ee1d0fac0ff643287174a8c260c37659f09dacc254924f0b37eec4d42f477b8421fc93de0cf3067ebd965296d7849644a12305c0d70ebf6718afc7ad2f950a007ca53ca832781fbcb4e43de8885e492ab21e0dc5e0e16da16191ec3db4d5a05f92a5d2c3e79d0527f26370f24daf8e4e7b20d69646cd0f30774d29e45ba74f89a6dda8f779ec05b0e7cc4e65f69dc02587b8e53779368eda849359528d1eb495dd33baa5658940d51af8be82a4b7f1a7e1f1f1511cec52ea56b99c7cde55ea05adbde760262e1fd4beb3c0bb8516f050a099b06e4e75da29af597242fc746d42f7e5add204428bd35e4d2a06ccf4822b8d137ef863e5ac35a4c2246a95da45f5b3b9cded7d41fc93aeb98114ce0edfbcaaee4314ffa95c35cda0c8c4d62b8e721395a220182e809e2d3cf48fda10253e67ec56ee8db3455c33f41890cf6e08e6c188aa73bc396d945c1fca00c4752179a497ad7c5c56ef3511152bf27e0109a86554e7a781b4e5a4904c4c59994083ba0b1d4ad14a475b5ce841c2c017281eb54ddd0803b25a6df9e09b8e7340913afb5c0f659d82f28bd6a54cdd54e61960be12c75dd688b0c4ebd672d54ea4771f0046afabe8f8e7e98f960280f0afd7373ba1770b9ff0624fcfe5187f2ce4bb3adaa5398dd73"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:39:25 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000002c0)})

06:39:25 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x30}}, 0x0)

06:39:25 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r1 = gettid()
sched_rr_get_interval(r1, &(0x7f0000000800))
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x58, 0x0, &(0x7f00000001c0)=[@reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f00000000c0)={@fda={0x66646185, 0x8, 0x0, 0x2f}, @ptr={0x70742a85, 0x74e, &(0x7f0000000040)=""/126, 0x7e, 0x1, 0x12}, @flat=@handle={0x73682a85, 0x2000}}, &(0x7f0000000140)={0x0, 0x20, 0x48}}}, @acquire_done={0x40106309, 0x1}], 0x0, 0x0, 0x0})

06:39:25 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r1 = gettid()
sched_rr_get_interval(r1, &(0x7f0000000800))
syz_open_procfs$namespace(r1, &(0x7f0000000000)='ns/net\x00')
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x58, 0x0, &(0x7f00000001c0)=[@reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f00000000c0)={@fda={0x66646185, 0x8, 0x0, 0x2f}, @ptr={0x70742a85, 0x74e, &(0x7f0000000040)=""/126, 0x7e, 0x1, 0x12}, @flat=@handle={0x73682a85, 0x2000}}, &(0x7f0000000140)={0x0, 0x20, 0x48}}}, @acquire_done={0x40106309, 0x1}], 0x0, 0x0, 0x0})

06:39:25 executing program 5:
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x1, 0x2})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:39:25 executing program 2:
r0 = socket(0xa, 0x803, 0x7f)
syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r0)
ioctl$sock_ipv6_tunnel_SIOCADD6RD(0xffffffffffffffff, 0x89f9, &(0x7f0000000100)={'ip6tnl0\x00', &(0x7f0000000080)={'syztnl0\x00', <r1=>0x0, 0x2f, 0x2, 0x40, 0x9, 0x4, @rand_addr=' \x01\x00', @ipv4={'\x00', '\xff\xff', @multicast2}, 0x8, 0xe82, 0x2, 0x9}})
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', r1, 0x29, 0x3f, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})
r2 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="03630840", @ANYRES64=0x0, @ANYBLOB="0d3d57969c12ac02630000"], 0x0, 0x0, 0x0})
ioctl$FBIOGETCMAP(0xffffffffffffffff, 0x4604, &(0x7f0000000340)={0xfffffff9, 0x7, &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000280)=[0x0, 0x0], &(0x7f00000002c0)=[0x0], &(0x7f0000000300)=[0x0, 0x0, 0x0, 0x0, 0x0]})
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r3, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), r3)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
r6 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000200)={'wlan1\x00', <r7=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="db1e29bd7000fbdbdf250600000008000300", @ANYRES32=r7, @ANYBLOB='\f'], 0x30}}, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r3, &(0x7f0000000680)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000640)={&(0x7f00000005c0)={0x64, r4, 0x800, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0x601}, @NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x1}, @NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x1}, @NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0xa9c}, @NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x1}, @NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0xc10099399c5ec206}, @NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x2}, @NL80211_ATTR_CRIT_PROT_ID={0x6}, @NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0xd5a}]}, 0x64}, 0x1, 0x0, 0x0, 0x40000}, 0x840)
sendmsg$NL80211_CMD_SET_CQM(r3, &(0x7f0000000500)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000004c0)={&(0x7f00000003c0)={0xd4, 0x0, 0x800, 0x70bd2a, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x9, 0x5f}}}}, [@NL80211_ATTR_CQM={0x38, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_TXE_RATE={0x8, 0x5, 0x29}, @NL80211_ATTR_CQM_RSSI_THOLD={0x14, 0x1, [0x400, 0x3, 0x0, 0x100]}, @NL80211_ATTR_CQM_RSSI_LEVEL={0x8, 0x9, 0x7}, @NL80211_ATTR_CQM_RSSI_LEVEL={0x8, 0x9, 0x3f}, @NL80211_ATTR_CQM_RSSI_LEVEL={0x8, 0x9, 0x6}]}, @NL80211_ATTR_CQM={0xc, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_RSSI_LEVEL={0x8, 0x9, 0x101}]}, @NL80211_ATTR_CQM={0xc, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT={0x8, 0x3, 0x80}]}, @NL80211_ATTR_CQM={0x14, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT={0x8, 0x3, 0x900}, @NL80211_ATTR_CQM_TXE_INTVL={0x8, 0x7, 0x5d5}]}, @NL80211_ATTR_CQM={0x50, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_RSSI_HYST={0x8, 0x2, 0x9}, @NL80211_ATTR_CQM_RSSI_THOLD={0x14, 0x1, [0x6, 0x6, 0x9, 0x3]}, @NL80211_ATTR_CQM_TXE_RATE={0x8, 0x5, 0x24}, @NL80211_ATTR_CQM_TXE_INTVL={0x8, 0x7, 0x5e}, @NL80211_ATTR_CQM_RSSI_HYST={0x8, 0x2, 0x1000}, @NL80211_ATTR_CQM_TXE_INTVL={0x8, 0x7, 0x690}, @NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT={0x8, 0x3, 0x7}, @NL80211_ATTR_CQM_TXE_INTVL={0x8, 0x7, 0x226}]}]}, 0xd4}, 0x1, 0x0, 0x0, 0x5}, 0x4008870)

06:39:25 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000002c0)})

06:39:25 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x30}}, 0x0)

[ 1678.450092][T11616] binder: 11614:11616 unknown command -1772667635
[ 1678.458539][T11616] binder: 11614:11616 ioctl c0306201 20000180 returned -22
06:39:26 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
gettid()
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x58, 0x0, &(0x7f00000001c0)=[@reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f00000000c0)={@fda={0x66646185, 0x8, 0x0, 0x2f}, @ptr={0x70742a85, 0x74e, &(0x7f0000000040)=""/126, 0x7e, 0x1, 0x12}, @flat=@handle={0x73682a85, 0x2000}}, &(0x7f0000000140)={0x0, 0x20, 0x48}}}, @acquire_done={0x40106309, 0x1}], 0x0, 0x0, 0x0})

[ 1678.525230][T11616] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.2'.
06:39:26 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r1 = gettid()
sched_rr_get_interval(r1, &(0x7f0000000800))
syz_open_procfs$namespace(r1, &(0x7f0000000000)='ns/net\x00')
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x58, 0x0, &(0x7f00000001c0)=[@reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f00000000c0)={@fda={0x66646185, 0x8, 0x0, 0x2f}, @ptr={0x70742a85, 0x74e, &(0x7f0000000040)=""/126, 0x7e, 0x1, 0x12}, @flat=@handle={0x73682a85, 0x2000}}, &(0x7f0000000140)={0x0, 0x20, 0x48}}}, @acquire_done={0x40106309, 0x1}], 0x0, 0x0, 0x0})

06:39:26 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf250600000008000300", @ANYRES32], 0x30}}, 0x0)

06:39:26 executing program 5:
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x1, 0x2})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:39:26 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000002c0)})

06:39:26 executing program 2:
r0 = socket(0xa, 0x803, 0x7f)
syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r0)
ioctl$sock_ipv6_tunnel_SIOCADD6RD(0xffffffffffffffff, 0x89f9, &(0x7f0000000100)={'ip6tnl0\x00', &(0x7f0000000080)={'syztnl0\x00', <r1=>0x0, 0x2f, 0x2, 0x40, 0x9, 0x4, @rand_addr=' \x01\x00', @ipv4={'\x00', '\xff\xff', @multicast2}, 0x8, 0xe82, 0x2, 0x9}})
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', r1, 0x29, 0x3f, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})
r2 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="03630840", @ANYRES64=0x0, @ANYBLOB="0d3d57969c12ac02630000"], 0x0, 0x0, 0x0})
ioctl$FBIOGETCMAP(0xffffffffffffffff, 0x4604, &(0x7f0000000340)={0xfffffff9, 0x7, &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000280)=[0x0, 0x0], &(0x7f00000002c0)=[0x0], &(0x7f0000000300)=[0x0, 0x0, 0x0, 0x0, 0x0]})
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r3, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), r3)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
r6 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000200)={'wlan1\x00', <r7=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="db1e29bd7000fbdbdf250600000008000300", @ANYRES32=r7, @ANYBLOB='\f'], 0x30}}, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r3, &(0x7f0000000680)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000640)={&(0x7f00000005c0)={0x64, r4, 0x800, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0x601}, @NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x1}, @NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x1}, @NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0xa9c}, @NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x1}, @NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0xc10099399c5ec206}, @NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x2}, @NL80211_ATTR_CRIT_PROT_ID={0x6}, @NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0xd5a}]}, 0x64}, 0x1, 0x0, 0x0, 0x40000}, 0x840)
sendmsg$NL80211_CMD_SET_CQM(r3, &(0x7f0000000500)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000004c0)={&(0x7f00000003c0)={0xd4, 0x0, 0x800, 0x70bd2a, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x9, 0x5f}}}}, [@NL80211_ATTR_CQM={0x38, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_TXE_RATE={0x8, 0x5, 0x29}, @NL80211_ATTR_CQM_RSSI_THOLD={0x14, 0x1, [0x400, 0x3, 0x0, 0x100]}, @NL80211_ATTR_CQM_RSSI_LEVEL={0x8, 0x9, 0x7}, @NL80211_ATTR_CQM_RSSI_LEVEL={0x8, 0x9, 0x3f}, @NL80211_ATTR_CQM_RSSI_LEVEL={0x8, 0x9, 0x6}]}, @NL80211_ATTR_CQM={0xc, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_RSSI_LEVEL={0x8, 0x9, 0x101}]}, @NL80211_ATTR_CQM={0xc, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT={0x8, 0x3, 0x80}]}, @NL80211_ATTR_CQM={0x14, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT={0x8, 0x3, 0x900}, @NL80211_ATTR_CQM_TXE_INTVL={0x8, 0x7, 0x5d5}]}, @NL80211_ATTR_CQM={0x50, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_RSSI_HYST={0x8, 0x2, 0x9}, @NL80211_ATTR_CQM_RSSI_THOLD={0x14, 0x1, [0x6, 0x6, 0x9, 0x3]}, @NL80211_ATTR_CQM_TXE_RATE={0x8, 0x5, 0x24}, @NL80211_ATTR_CQM_TXE_INTVL={0x8, 0x7, 0x5e}, @NL80211_ATTR_CQM_RSSI_HYST={0x8, 0x2, 0x1000}, @NL80211_ATTR_CQM_TXE_INTVL={0x8, 0x7, 0x690}, @NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT={0x8, 0x3, 0x7}, @NL80211_ATTR_CQM_TXE_INTVL={0x8, 0x7, 0x226}]}]}, 0xd4}, 0x1, 0x0, 0x0, 0x5}, 0x4008870)

[ 1679.004207][T11628] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.4'.
06:39:26 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x58, 0x0, &(0x7f00000001c0)=[@reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f00000000c0)={@fda={0x66646185, 0x8, 0x0, 0x2f}, @ptr={0x70742a85, 0x74e, &(0x7f0000000040)=""/126, 0x7e, 0x1, 0x12}, @flat=@handle={0x73682a85, 0x2000}}, &(0x7f0000000140)={0x0, 0x20, 0x48}}}, @acquire_done={0x40106309, 0x1}], 0x0, 0x0, 0x0})

[ 1679.063528][T11631] binder: 11629:11631 unknown command -1772667635
[ 1679.072059][T11631] binder: 11629:11631 ioctl c0306201 20000180 returned -22
[ 1679.123931][T11631] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.2'.
06:39:26 executing program 3:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r0 = gettid()
sched_rr_get_interval(r0, &(0x7f0000000800))
syz_open_procfs$namespace(r0, &(0x7f0000000000)='ns/net\x00')

06:39:27 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x8, 0x0, &(0x7f00000002c0)="27e2f0bf84b3f48e"})

06:39:27 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf250600000008000300"], 0x30}}, 0x0)

06:39:27 executing program 5:
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x1, 0x2})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:39:27 executing program 2:
r0 = socket(0xa, 0x803, 0x7f)
syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r0)
ioctl$sock_ipv6_tunnel_SIOCADD6RD(0xffffffffffffffff, 0x89f9, &(0x7f0000000100)={'ip6tnl0\x00', &(0x7f0000000080)={'syztnl0\x00', <r1=>0x0, 0x2f, 0x2, 0x40, 0x9, 0x4, @rand_addr=' \x01\x00', @ipv4={'\x00', '\xff\xff', @multicast2}, 0x8, 0xe82, 0x2, 0x9}})
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', r1, 0x29, 0x3f, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})
r2 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="03630840", @ANYRES64=0x0, @ANYBLOB="0d3d57969c12ac02630000"], 0x0, 0x0, 0x0})
ioctl$FBIOGETCMAP(0xffffffffffffffff, 0x4604, &(0x7f0000000340)={0xfffffff9, 0x7, &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000280)=[0x0, 0x0], &(0x7f00000002c0)=[0x0], &(0x7f0000000300)=[0x0, 0x0, 0x0, 0x0, 0x0]})
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r3, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), r3)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
r6 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000200)={'wlan1\x00', <r7=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="db1e29bd7000fbdbdf250600000008000300", @ANYRES32=r7, @ANYBLOB='\f'], 0x30}}, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r3, &(0x7f0000000680)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000640)={&(0x7f00000005c0)={0x64, r4, 0x800, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0x601}, @NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x1}, @NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x1}, @NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0xa9c}, @NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x1}, @NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0xc10099399c5ec206}, @NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x2}, @NL80211_ATTR_CRIT_PROT_ID={0x6}, @NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0xd5a}]}, 0x64}, 0x1, 0x0, 0x0, 0x40000}, 0x840)
sendmsg$NL80211_CMD_SET_CQM(r3, &(0x7f0000000500)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000004c0)={&(0x7f00000003c0)={0xd4, 0x0, 0x800, 0x70bd2a, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x9, 0x5f}}}}, [@NL80211_ATTR_CQM={0x38, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_TXE_RATE={0x8, 0x5, 0x29}, @NL80211_ATTR_CQM_RSSI_THOLD={0x14, 0x1, [0x400, 0x3, 0x0, 0x100]}, @NL80211_ATTR_CQM_RSSI_LEVEL={0x8, 0x9, 0x7}, @NL80211_ATTR_CQM_RSSI_LEVEL={0x8, 0x9, 0x3f}, @NL80211_ATTR_CQM_RSSI_LEVEL={0x8, 0x9, 0x6}]}, @NL80211_ATTR_CQM={0xc, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_RSSI_LEVEL={0x8, 0x9, 0x101}]}, @NL80211_ATTR_CQM={0xc, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT={0x8, 0x3, 0x80}]}, @NL80211_ATTR_CQM={0x14, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT={0x8, 0x3, 0x900}, @NL80211_ATTR_CQM_TXE_INTVL={0x8, 0x7, 0x5d5}]}, @NL80211_ATTR_CQM={0x50, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_RSSI_HYST={0x8, 0x2, 0x9}, @NL80211_ATTR_CQM_RSSI_THOLD={0x14, 0x1, [0x6, 0x6, 0x9, 0x3]}, @NL80211_ATTR_CQM_TXE_RATE={0x8, 0x5, 0x24}, @NL80211_ATTR_CQM_TXE_INTVL={0x8, 0x7, 0x5e}, @NL80211_ATTR_CQM_RSSI_HYST={0x8, 0x2, 0x1000}, @NL80211_ATTR_CQM_TXE_INTVL={0x8, 0x7, 0x690}, @NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT={0x8, 0x3, 0x7}, @NL80211_ATTR_CQM_TXE_INTVL={0x8, 0x7, 0x226}]}]}, 0xd4}, 0x1, 0x0, 0x0, 0x5}, 0x4008870)

06:39:27 executing program 1:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x58, 0x0, &(0x7f00000001c0)=[@reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f00000000c0)={@fda={0x66646185, 0x8, 0x0, 0x2f}, @ptr={0x70742a85, 0x74e, &(0x7f0000000040)=""/126, 0x7e, 0x1, 0x12}, @flat=@handle={0x73682a85, 0x2000}}, &(0x7f0000000140)={0x0, 0x20, 0x48}}}, @acquire_done={0x40106309, 0x1}], 0x0, 0x0, 0x0})

[ 1679.661432][T11642] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.4'.
06:39:27 executing program 3:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r0 = gettid()
sched_rr_get_interval(r0, &(0x7f0000000800))

[ 1679.741564][T11646] binder: 11644:11646 unknown command -1772667635
[ 1679.748163][T11646] binder: 11644:11646 ioctl c0306201 20000180 returned -22
[ 1679.829778][T11648] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.2'.
06:39:27 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000002c0)})

06:39:27 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1], 0x30}}, 0x0)

06:39:27 executing program 5:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x1, 0x2})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:39:27 executing program 2:
r0 = socket(0xa, 0x803, 0x7f)
syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r0)
ioctl$sock_ipv6_tunnel_SIOCADD6RD(0xffffffffffffffff, 0x89f9, &(0x7f0000000100)={'ip6tnl0\x00', &(0x7f0000000080)={'syztnl0\x00', <r1=>0x0, 0x2f, 0x2, 0x40, 0x9, 0x4, @rand_addr=' \x01\x00', @ipv4={'\x00', '\xff\xff', @multicast2}, 0x8, 0xe82, 0x2, 0x9}})
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', r1, 0x29, 0x3f, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})
r2 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="03630840", @ANYRES64=0x0, @ANYBLOB="0d3d57969c12ac02630000"], 0x0, 0x0, 0x0})
ioctl$FBIOGETCMAP(0xffffffffffffffff, 0x4604, &(0x7f0000000340)={0xfffffff9, 0x7, &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000280)=[0x0, 0x0], &(0x7f00000002c0)=[0x0], &(0x7f0000000300)=[0x0, 0x0, 0x0, 0x0, 0x0]})
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r3, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), r3)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
r6 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000200)={'wlan1\x00', <r7=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="db1e29bd7000fbdbdf250600000008000300", @ANYRES32=r7, @ANYBLOB='\f'], 0x30}}, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r3, &(0x7f0000000680)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000640)={&(0x7f00000005c0)={0x64, r4, 0x800, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0x601}, @NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x1}, @NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x1}, @NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0xa9c}, @NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x1}, @NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0xc10099399c5ec206}, @NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x2}, @NL80211_ATTR_CRIT_PROT_ID={0x6}, @NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0xd5a}]}, 0x64}, 0x1, 0x0, 0x0, 0x40000}, 0x840)

06:39:27 executing program 1:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x58, 0x0, &(0x7f00000001c0)=[@reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f00000000c0)={@fda={0x66646185, 0x8, 0x0, 0x2f}, @ptr={0x70742a85, 0x74e, &(0x7f0000000040)=""/126, 0x7e, 0x1, 0x12}, @flat=@handle={0x73682a85, 0x2000}}, &(0x7f0000000140)={0x0, 0x20, 0x48}}}, @acquire_done={0x40106309, 0x1}], 0x0, 0x0, 0x0})

06:39:28 executing program 3:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
sched_rr_get_interval(0x0, &(0x7f0000000800))

06:39:28 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1], 0x30}}, 0x0)

06:39:28 executing program 5:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x1, 0x2})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

[ 1680.513713][T11661] binder: 11659:11661 unknown command -1772667635
[ 1680.520592][T11661] binder: 11659:11661 ioctl c0306201 20000180 returned -22
06:39:28 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000002c0)})

[ 1680.612368][T11661] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.2'.
06:39:28 executing program 2:
r0 = socket(0xa, 0x803, 0x7f)
syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r0)
ioctl$sock_ipv6_tunnel_SIOCADD6RD(0xffffffffffffffff, 0x89f9, &(0x7f0000000100)={'ip6tnl0\x00', &(0x7f0000000080)={'syztnl0\x00', <r1=>0x0, 0x2f, 0x2, 0x40, 0x9, 0x4, @rand_addr=' \x01\x00', @ipv4={'\x00', '\xff\xff', @multicast2}, 0x8, 0xe82, 0x2, 0x9}})
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', r1, 0x29, 0x3f, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})
r2 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="03630840", @ANYRES64=0x0, @ANYBLOB="0d3d57969c12ac02630000"], 0x0, 0x0, 0x0})
ioctl$FBIOGETCMAP(0xffffffffffffffff, 0x4604, &(0x7f0000000340)={0xfffffff9, 0x7, &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000280)=[0x0, 0x0], &(0x7f00000002c0)=[0x0], &(0x7f0000000300)=[0x0, 0x0, 0x0, 0x0, 0x0]})
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r3, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), r3)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000200)={'wlan1\x00', <r6=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="db1e29bd7000fbdbdf250600000008000300", @ANYRES32=r6, @ANYBLOB='\f'], 0x30}}, 0x0)

06:39:28 executing program 1:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x58, 0x0, &(0x7f00000001c0)=[@reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f00000000c0)={@fda={0x66646185, 0x8, 0x0, 0x2f}, @ptr={0x70742a85, 0x74e, &(0x7f0000000040)=""/126, 0x7e, 0x1, 0x12}, @flat=@handle={0x73682a85, 0x2000}}, &(0x7f0000000140)={0x0, 0x20, 0x48}}}, @acquire_done={0x40106309, 0x1}], 0x0, 0x0, 0x0})

06:39:28 executing program 3:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
sched_rr_get_interval(0x0, &(0x7f0000000800))

06:39:28 executing program 5:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x1, 0x2})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:39:28 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000002c0)})

06:39:28 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1], 0x30}}, 0x0)

[ 1681.175475][T11674] binder: 11673:11674 unknown command -1772667635
[ 1681.182356][T11674] binder: 11673:11674 ioctl c0306201 20000180 returned -22
[ 1681.227660][T11674] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.2'.
06:39:29 executing program 1:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x58, 0x0, &(0x7f00000001c0)=[@reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f00000000c0)={@fda={0x66646185, 0x8, 0x0, 0x2f}, @ptr={0x70742a85, 0x74e, &(0x7f0000000040)=""/126, 0x7e, 0x1, 0x12}, @flat=@handle={0x73682a85, 0x2000}}, &(0x7f0000000140)={0x0, 0x20, 0x48}}}, @acquire_done={0x40106309, 0x1}], 0x0, 0x0, 0x0})

06:39:29 executing program 2:
r0 = socket(0xa, 0x803, 0x7f)
syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r0)
ioctl$sock_ipv6_tunnel_SIOCADD6RD(0xffffffffffffffff, 0x89f9, &(0x7f0000000100)={'ip6tnl0\x00', &(0x7f0000000080)={'syztnl0\x00', <r1=>0x0, 0x2f, 0x2, 0x40, 0x9, 0x4, @rand_addr=' \x01\x00', @ipv4={'\x00', '\xff\xff', @multicast2}, 0x8, 0xe82, 0x2, 0x9}})
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', r1, 0x29, 0x3f, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})
r2 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="03630840", @ANYRES64=0x0, @ANYBLOB="0d3d57969c12ac02630000"], 0x0, 0x0, 0x0})
ioctl$FBIOGETCMAP(0xffffffffffffffff, 0x4604, &(0x7f0000000340)={0xfffffff9, 0x7, &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000280)=[0x0, 0x0], &(0x7f00000002c0)=[0x0], &(0x7f0000000300)=[0x0, 0x0, 0x0, 0x0, 0x0]})
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r3, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), r3)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000200)={'wlan1\x00'})

06:39:29 executing program 3:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
sched_rr_get_interval(0x0, &(0x7f0000000800))

06:39:29 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x1, 0x2})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:39:29 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x4, 0x0, &(0x7f00000002c0)="27e2f0bf"})

06:39:29 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB], 0x30}}, 0x0)

[ 1681.816102][T11689] binder: 11687:11689 unknown command -1772667635
[ 1681.823028][T11689] binder: 11687:11689 ioctl c0306201 20000180 returned -22
06:39:29 executing program 1:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x58, 0x0, &(0x7f00000001c0)=[@reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f00000000c0)={@fda={0x66646185, 0x8, 0x0, 0x2f}, @ptr={0x70742a85, 0x74e, &(0x7f0000000040)=""/126, 0x7e, 0x1, 0x12}, @flat=@handle={0x73682a85, 0x2000}}, &(0x7f0000000140)={0x0, 0x20, 0x48}}}, @acquire_done={0x40106309, 0x1}], 0x0, 0x0, 0x0})

06:39:29 executing program 3:
r0 = gettid()
sched_rr_get_interval(r0, &(0x7f0000000800))

06:39:29 executing program 2:
r0 = socket(0xa, 0x803, 0x7f)
syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r0)
ioctl$sock_ipv6_tunnel_SIOCADD6RD(0xffffffffffffffff, 0x89f9, &(0x7f0000000100)={'ip6tnl0\x00', &(0x7f0000000080)={'syztnl0\x00', <r1=>0x0, 0x2f, 0x2, 0x40, 0x9, 0x4, @rand_addr=' \x01\x00', @ipv4={'\x00', '\xff\xff', @multicast2}, 0x8, 0xe82, 0x2, 0x9}})
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', r1, 0x29, 0x3f, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})
r2 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="03630840", @ANYRES64=0x0, @ANYBLOB="0d3d57969c12ac02630000"], 0x0, 0x0, 0x0})
ioctl$FBIOGETCMAP(0xffffffffffffffff, 0x4604, &(0x7f0000000340)={0xfffffff9, 0x7, &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000280)=[0x0, 0x0], &(0x7f00000002c0)=[0x0], &(0x7f0000000300)=[0x0, 0x0, 0x0, 0x0, 0x0]})
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r3, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), r3)
socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)

06:39:29 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000002c0)})

06:39:30 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB], 0x30}}, 0x0)

06:39:30 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x1, 0x2})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

[ 1682.449152][T11704] binder: 11702:11704 unknown command -1772667635
[ 1682.456211][T11704] binder: 11702:11704 ioctl c0306201 20000180 returned -22
06:39:30 executing program 1:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x58, 0x0, &(0x7f00000001c0)=[@reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f00000000c0)={@fda={0x66646185, 0x8, 0x0, 0x2f}, @ptr={0x70742a85, 0x74e, &(0x7f0000000040)=""/126, 0x7e, 0x1, 0x12}, @flat=@handle={0x73682a85, 0x2000}}, &(0x7f0000000140)={0x0, 0x20, 0x48}}}, @acquire_done={0x40106309, 0x1}], 0x0, 0x0, 0x0})

06:39:30 executing program 3:
gettid()
sched_rr_get_interval(0x0, &(0x7f0000000800))

06:39:30 executing program 2:
r0 = socket(0xa, 0x803, 0x7f)
syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r0)
ioctl$sock_ipv6_tunnel_SIOCADD6RD(0xffffffffffffffff, 0x89f9, &(0x7f0000000100)={'ip6tnl0\x00', &(0x7f0000000080)={'syztnl0\x00', <r1=>0x0, 0x2f, 0x2, 0x40, 0x9, 0x4, @rand_addr=' \x01\x00', @ipv4={'\x00', '\xff\xff', @multicast2}, 0x8, 0xe82, 0x2, 0x9}})
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', r1, 0x29, 0x3f, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})
r2 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="03630840", @ANYRES64=0x0, @ANYBLOB="0d3d57969c12ac02630000"], 0x0, 0x0, 0x0})
ioctl$FBIOGETCMAP(0xffffffffffffffff, 0x4604, &(0x7f0000000340)={0xfffffff9, 0x7, &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000280)=[0x0, 0x0], &(0x7f00000002c0)=[0x0], &(0x7f0000000300)=[0x0, 0x0, 0x0, 0x0, 0x0]})
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r3, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), r3)
socket$nl_generic(0x10, 0x3, 0x10)

06:39:30 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x1, 0x2})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:39:30 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB], 0x30}}, 0x0)

06:39:30 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000002c0)})

06:39:30 executing program 3:
gettid()
sched_rr_get_interval(0x0, &(0x7f0000000800))

[ 1683.091341][T11718] binder: 11717:11718 unknown command -1772667635
[ 1683.097910][T11718] binder: 11717:11718 ioctl c0306201 20000180 returned -22
06:39:30 executing program 1:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x58, 0x0, &(0x7f00000001c0)=[@reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f00000000c0)={@fda={0x66646185, 0x8, 0x0, 0x2f}, @ptr={0x70742a85, 0x74e, &(0x7f0000000040)=""/126, 0x7e, 0x1, 0x12}, @flat=@handle={0x73682a85, 0x2000}}, &(0x7f0000000140)={0x0, 0x20, 0x48}}}, @acquire_done={0x40106309, 0x1}], 0x0, 0x0, 0x0})

06:39:31 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:39:31 executing program 2:
r0 = socket(0xa, 0x803, 0x7f)
syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r0)
ioctl$sock_ipv6_tunnel_SIOCADD6RD(0xffffffffffffffff, 0x89f9, &(0x7f0000000100)={'ip6tnl0\x00', &(0x7f0000000080)={'syztnl0\x00', <r1=>0x0, 0x2f, 0x2, 0x40, 0x9, 0x4, @rand_addr=' \x01\x00', @ipv4={'\x00', '\xff\xff', @multicast2}, 0x8, 0xe82, 0x2, 0x9}})
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', r1, 0x29, 0x3f, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})
r2 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="03630840", @ANYRES64=0x0, @ANYBLOB="0d3d57969c12ac02630000"], 0x0, 0x0, 0x0})
ioctl$FBIOGETCMAP(0xffffffffffffffff, 0x4604, &(0x7f0000000340)={0xfffffff9, 0x7, &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000280)=[0x0, 0x0], &(0x7f00000002c0)=[0x0], &(0x7f0000000300)=[0x0, 0x0, 0x0, 0x0, 0x0]})
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r3, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), r3)

06:39:31 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, &(0x7f00000002c0)})

06:39:31 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf"], 0x30}}, 0x0)

06:39:31 executing program 3:
gettid()
sched_rr_get_interval(0x0, &(0x7f0000000800))

[ 1683.712729][T11734] binder: 11731:11734 ioctl 4018620d 0 returned -22
[ 1683.761950][T11737] binder: 11733:11737 unknown command -1772667635
[ 1683.768547][T11737] binder: 11733:11737 ioctl c0306201 20000180 returned -22
06:39:31 executing program 1:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x58, 0x0, &(0x7f00000001c0)=[@reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f00000000c0)={@fda={0x66646185, 0x8, 0x0, 0x2f}, @ptr={0x70742a85, 0x74e, &(0x7f0000000040)=""/126, 0x7e, 0x1, 0x12}, @flat=@handle={0x73682a85, 0x2000}}, &(0x7f0000000140)={0x0, 0x20, 0x48}}}, @acquire_done={0x40106309, 0x1}], 0x0, 0x0, 0x0})

06:39:31 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:39:31 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, &(0x7f00000002c0)="27e2"})

06:39:31 executing program 2:
r0 = socket(0xa, 0x803, 0x7f)
syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r0)
ioctl$sock_ipv6_tunnel_SIOCADD6RD(0xffffffffffffffff, 0x89f9, &(0x7f0000000100)={'ip6tnl0\x00', &(0x7f0000000080)={'syztnl0\x00', <r1=>0x0, 0x2f, 0x2, 0x40, 0x9, 0x4, @rand_addr=' \x01\x00', @ipv4={'\x00', '\xff\xff', @multicast2}, 0x8, 0xe82, 0x2, 0x9}})
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', r1, 0x29, 0x3f, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})
r2 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="03630840", @ANYRES64=0x0, @ANYBLOB="0d3d57969c12ac02630000"], 0x0, 0x0, 0x0})
ioctl$FBIOGETCMAP(0xffffffffffffffff, 0x4604, &(0x7f0000000340)={0xfffffff9, 0x7, &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000280)=[0x0, 0x0], &(0x7f00000002c0)=[0x0], &(0x7f0000000300)=[0x0, 0x0, 0x0, 0x0, 0x0]})
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r3, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)

06:39:31 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf"], 0x30}}, 0x0)

06:39:32 executing program 3:
r0 = gettid()
sched_rr_get_interval(r0, 0x0)

[ 1684.331066][T11748] binder: 11745:11748 ioctl 4018620d 0 returned -22
06:39:32 executing program 1:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x58, 0x0, &(0x7f00000001c0)=[@reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f00000000c0)={@fda={0x66646185, 0x8, 0x0, 0x2f}, @ptr={0x70742a85, 0x74e, &(0x7f0000000040)=""/126, 0x7e, 0x1, 0x12}, @flat=@handle={0x73682a85, 0x2000}}, &(0x7f0000000140)={0x0, 0x20, 0x48}}}, @acquire_done={0x40106309, 0x1}], 0x0, 0x0, 0x0})

[ 1684.406576][T11749] binder: 11747:11749 unknown command -1772667635
[ 1684.413294][T11749] binder: 11747:11749 ioctl c0306201 20000180 returned -22
06:39:32 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:39:32 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, &(0x7f00000002c0)="27e2"})

06:39:32 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf"], 0x30}}, 0x0)

06:39:32 executing program 2:
r0 = socket(0xa, 0x803, 0x7f)
syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r0)
ioctl$sock_ipv6_tunnel_SIOCADD6RD(0xffffffffffffffff, 0x89f9, &(0x7f0000000100)={'ip6tnl0\x00', &(0x7f0000000080)={'syztnl0\x00', <r1=>0x0, 0x2f, 0x2, 0x40, 0x9, 0x4, @rand_addr=' \x01\x00', @ipv4={'\x00', '\xff\xff', @multicast2}, 0x8, 0xe82, 0x2, 0x9}})
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', r1, 0x29, 0x3f, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})
r2 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="03630840", @ANYRES64=0x0, @ANYBLOB="0d3d57969c12ac02630000"], 0x0, 0x0, 0x0})
ioctl$FBIOGETCMAP(0xffffffffffffffff, 0x4604, &(0x7f0000000340)={0xfffffff9, 0x7, &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000280)=[0x0, 0x0], &(0x7f00000002c0)=[0x0], &(0x7f0000000300)=[0x0, 0x0, 0x0, 0x0, 0x0]})
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r3, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)

06:39:32 executing program 3:
r0 = gettid()
sched_rr_get_interval(r0, 0x0)

06:39:32 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)

[ 1684.996387][T11762] binder: 11759:11762 ioctl 4018620d 0 returned -22
[ 1685.115350][T11766] binder: 11764:11766 unknown command -1772667635
[ 1685.122169][T11766] binder: 11764:11766 ioctl c0306201 20000180 returned -22
06:39:32 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:39:32 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, &(0x7f00000002c0)="27e2"})

06:39:32 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf2506000000"], 0x30}}, 0x0)

[ 1685.333360][T11772] binder: 11770:11772 ioctl c0306201 0 returned -14
06:39:33 executing program 2:
r0 = socket(0xa, 0x803, 0x7f)
syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r0)
ioctl$sock_ipv6_tunnel_SIOCADD6RD(0xffffffffffffffff, 0x89f9, &(0x7f0000000100)={'ip6tnl0\x00', &(0x7f0000000080)={'syztnl0\x00', <r1=>0x0, 0x2f, 0x2, 0x40, 0x9, 0x4, @rand_addr=' \x01\x00', @ipv4={'\x00', '\xff\xff', @multicast2}, 0x8, 0xe82, 0x2, 0x9}})
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', r1, 0x29, 0x3f, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})
r2 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="03630840", @ANYRES64=0x0, @ANYBLOB="0d3d57969c12ac02630000"], 0x0, 0x0, 0x0})
ioctl$FBIOGETCMAP(0xffffffffffffffff, 0x4604, &(0x7f0000000340)={0xfffffff9, 0x7, &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000280)=[0x0, 0x0], &(0x7f00000002c0)=[0x0], &(0x7f0000000300)=[0x0, 0x0, 0x0, 0x0, 0x0]})
socket$nl_generic(0x10, 0x3, 0x10)

06:39:33 executing program 3:
r0 = gettid()
sched_rr_get_interval(r0, 0x0)

[ 1685.531110][T11776] binder: 11774:11776 ioctl 4018620d 0 returned -22
06:39:33 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)

[ 1685.696384][T11779] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.4'.
06:39:33 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x3, 0x0, &(0x7f00000002c0)="27e2f0"})

[ 1685.782317][T11781] binder: 11780:11781 unknown command -1772667635
[ 1685.788977][T11781] binder: 11780:11781 ioctl c0306201 20000180 returned -22
06:39:33 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)

[ 1685.940122][T11786] binder: 11784:11786 ioctl c0306201 0 returned -14
06:39:33 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf25"], 0x30}}, 0x0)

06:39:33 executing program 3:
r0 = socket(0xa, 0x803, 0x7f)
syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r0)
ioctl$sock_ipv6_tunnel_SIOCADD6RD(0xffffffffffffffff, 0x89f9, &(0x7f0000000100)={'ip6tnl0\x00', &(0x7f0000000080)={'syztnl0\x00', <r1=>0x0, 0x2f, 0x2, 0x40, 0x9, 0x4, @rand_addr=' \x01\x00', @ipv4={'\x00', '\xff\xff', @multicast2}, 0x8, 0xe82, 0x2, 0x9}})
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', r1, 0x29, 0x3f, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})
r2 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="03630840", @ANYRES64=0x0, @ANYBLOB="0d3d57969c12ac02630000"], 0x0, 0x0, 0x0})
ioctl$FBIOGETCMAP(0xffffffffffffffff, 0x4604, &(0x7f0000000340)={0xfffffff9, 0x7, &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000280)=[0x0, 0x0], &(0x7f00000002c0)=[0x0], &(0x7f0000000300)=[0x0, 0x0, 0x0, 0x0, 0x0]})
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r3, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), r3)

06:39:33 executing program 2:
r0 = socket(0xa, 0x803, 0x7f)
syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r0)
ioctl$sock_ipv6_tunnel_SIOCADD6RD(0xffffffffffffffff, 0x89f9, &(0x7f0000000100)={'ip6tnl0\x00', &(0x7f0000000080)={'syztnl0\x00', <r1=>0x0, 0x2f, 0x2, 0x40, 0x9, 0x4, @rand_addr=' \x01\x00', @ipv4={'\x00', '\xff\xff', @multicast2}, 0x8, 0xe82, 0x2, 0x9}})
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', r1, 0x29, 0x3f, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})
r2 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="03630840", @ANYRES64=0x0, @ANYBLOB="0d3d57969c12ac02630000"], 0x0, 0x0, 0x0})
ioctl$FBIOGETCMAP(0xffffffffffffffff, 0x4604, &(0x7f0000000340)={0xfffffff9, 0x7, &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000280)=[0x0, 0x0], &(0x7f00000002c0)=[0x0], &(0x7f0000000300)=[0x0, 0x0, 0x0, 0x0, 0x0]})

[ 1686.161276][T11791] binder: 11789:11791 ioctl 4018620d 0 returned -22
[ 1686.176472][T11791] binder: 11789:11791 ioctl c0306201 0 returned -14
06:39:33 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)

06:39:34 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x3, 0x0, &(0x7f00000002c0)="27e2f0"})

06:39:34 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf25"], 0x30}}, 0x0)

[ 1686.456119][T11795] binder: 11794:11795 unknown command -1772667635
[ 1686.462949][T11795] binder: 11794:11795 ioctl c0306201 20000180 returned -22
06:39:34 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)

[ 1686.552991][T11798] binder: 11796:11798 ioctl c0306201 0 returned -14
06:39:34 executing program 2:
r0 = socket(0xa, 0x803, 0x7f)
syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r0)
ioctl$sock_ipv6_tunnel_SIOCADD6RD(0xffffffffffffffff, 0x89f9, &(0x7f0000000100)={'ip6tnl0\x00', &(0x7f0000000080)={'syztnl0\x00', <r1=>0x0, 0x2f, 0x2, 0x40, 0x9, 0x4, @rand_addr=' \x01\x00', @ipv4={'\x00', '\xff\xff', @multicast2}, 0x8, 0xe82, 0x2, 0x9}})
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', r1, 0x29, 0x3f, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})
r2 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="03630840", @ANYRES64=0x0, @ANYBLOB="0d3d57969c12ac02630000"], 0x0, 0x0, 0x0})

06:39:34 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

[ 1686.839635][T11805] binder: 11804:11805 ioctl 4018620d 0 returned -22
06:39:34 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf25"], 0x30}}, 0x0)

[ 1686.882454][T11805] binder: 11804:11805 ioctl c0306201 0 returned -14
06:39:34 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x68, 0x0, &(0x7f0000000240)=[@enter_looper, @request_death, @increfs={0x40046304, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x3, 0x0, &(0x7f00000002c0)="27e2f0"})

[ 1686.973215][T11807] binder: 11806:11807 unknown command -1772667635
[ 1686.979783][T11807] binder: 11806:11807 ioctl c0306201 20000180 returned -22
06:39:34 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)

06:39:34 executing program 2:
r0 = socket(0xa, 0x803, 0x7f)
syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r0)
ioctl$sock_ipv6_tunnel_SIOCADD6RD(0xffffffffffffffff, 0x89f9, &(0x7f0000000100)={'ip6tnl0\x00', &(0x7f0000000080)={'syztnl0\x00', <r1=>0x0, 0x2f, 0x2, 0x40, 0x9, 0x4, @rand_addr=' \x01\x00', @ipv4={'\x00', '\xff\xff', @multicast2}, 0x8, 0xe82, 0x2, 0x9}})
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', r1, 0x29, 0x3f, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)

[ 1687.655880][T11821] binder: 11820:11821 unknown command -1772667635
[ 1687.662689][T11821] binder: 11820:11821 ioctl c0306201 20000180 returned -22
06:39:35 executing program 3:
r0 = socket(0xa, 0x803, 0x7f)
syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r0)
ioctl$sock_ipv6_tunnel_SIOCADD6RD(0xffffffffffffffff, 0x89f9, &(0x7f0000000100)={'ip6tnl0\x00', &(0x7f0000000080)={'syztnl0\x00', <r1=>0x0, 0x2f, 0x2, 0x40, 0x9, 0x4, @rand_addr=' \x01\x00', @ipv4={'\x00', '\xff\xff', @multicast2}, 0x8, 0xe82, 0x2, 0x9}})
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', r1, 0x29, 0x3f, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})
r2 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="03630840", @ANYRES64=0x0, @ANYBLOB="0d3d57969c12ac02630000"], 0x0, 0x0, 0x0})
ioctl$FBIOGETCMAP(0xffffffffffffffff, 0x4604, &(0x7f0000000340)={0xfffffff9, 0x7, &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000280)=[0x0, 0x0], &(0x7f00000002c0)=[0x0], &(0x7f0000000300)=[0x0, 0x0, 0x0, 0x0, 0x0]})
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r3, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), r3)

06:39:35 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

06:39:35 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf250600"], 0x30}}, 0x0)

06:39:35 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:39:35 executing program 2:
r0 = socket(0xa, 0x803, 0x7f)
syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r0)
ioctl$sock_ipv6_tunnel_SIOCADD6RD(0xffffffffffffffff, 0x89f9, &(0x7f0000000100)={'ip6tnl0\x00', &(0x7f0000000080)={'syztnl0\x00', <r1=>0x0, 0x2f, 0x2, 0x40, 0x9, 0x4, @rand_addr=' \x01\x00', @ipv4={'\x00', '\xff\xff', @multicast2}, 0x8, 0xe82, 0x2, 0x9}})
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', r1, 0x29, 0x3f, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})

06:39:35 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

[ 1687.912291][T11826] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.4'.
[ 1687.914772][T11829] binder: 11827:11829 ioctl 4018620d 0 returned -22
[ 1687.987704][T11833] binder: 11828:11833 ioctl 4018620d 0 returned -22
[ 1688.139641][T11837] binder: 11835:11837 unknown command -1772667635
[ 1688.146402][T11837] binder: 11835:11837 ioctl c0306201 20000180 returned -22
06:39:35 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

06:39:35 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:39:35 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf25"], 0x30}}, 0x0)

06:39:36 executing program 0:
r0 = socket(0xa, 0x803, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCADD6RD(r0, 0x89f9, &(0x7f0000000780)={'sit0\x00', 0x0})

06:39:36 executing program 2:
r0 = socket(0xa, 0x803, 0x7f)
syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r0)
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x29, 0x3f, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})

06:39:36 executing program 3:
r0 = socket(0xa, 0x803, 0x7f)
syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r0)
ioctl$sock_ipv6_tunnel_SIOCADD6RD(0xffffffffffffffff, 0x89f9, &(0x7f0000000100)={'ip6tnl0\x00', &(0x7f0000000080)={'syztnl0\x00', <r1=>0x0, 0x2f, 0x2, 0x40, 0x9, 0x4, @rand_addr=' \x01\x00', @ipv4={'\x00', '\xff\xff', @multicast2}, 0x8, 0xe82, 0x2, 0x9}})
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', r1, 0x29, 0x3f, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})
r2 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="03630840", @ANYRES64=0x0, @ANYBLOB="0d3d57969c12ac02630000"], 0x0, 0x0, 0x0})
ioctl$FBIOGETCMAP(0xffffffffffffffff, 0x4604, &(0x7f0000000340)={0xfffffff9, 0x7, &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000280)=[0x0, 0x0], &(0x7f00000002c0)=[0x0], &(0x7f0000000300)=[0x0, 0x0, 0x0, 0x0, 0x0]})
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r3, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), r3)

06:39:36 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf25"], 0x30}}, 0x0)

06:39:36 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="03630851", @ANYRES64=0x0, @ANYBLOB='\rc\x00\x00'], 0x0, 0x0, 0x0})

[ 1688.817651][T11852] binder: 11851:11852 unknown command -1772667635
[ 1688.824449][T11852] binder: 11851:11852 ioctl c0306201 20000180 returned -22
06:39:36 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f00000001c0)=[@reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f00000000c0)={@fda={0x66646185, 0x8, 0x0, 0x2f}, @ptr={0x70742a85, 0x74e, &(0x7f0000000040)=""/126, 0x7e, 0x1, 0x12}, @flat=@handle={0x73682a85, 0x2000}}, &(0x7f0000000140)={0x0, 0x20, 0x48}}}], 0x0, 0x0, 0x0})

06:39:36 executing program 2:
r0 = socket(0xa, 0x803, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x29, 0x3f, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})

06:39:36 executing program 0:
r0 = socket(0xa, 0x803, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCADD6RD(r0, 0x89f9, &(0x7f0000000780)={'sit0\x00', 0x0})

06:39:36 executing program 3:
r0 = socket(0xa, 0x803, 0x7f)
syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r0)
ioctl$sock_ipv6_tunnel_SIOCADD6RD(0xffffffffffffffff, 0x89f9, &(0x7f0000000100)={'ip6tnl0\x00', &(0x7f0000000080)={'syztnl0\x00', <r1=>0x0, 0x2f, 0x2, 0x40, 0x9, 0x4, @rand_addr=' \x01\x00', @ipv4={'\x00', '\xff\xff', @multicast2}, 0x8, 0xe82, 0x2, 0x9}})
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', r1, 0x29, 0x3f, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})
r2 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="03630840", @ANYRES64=0x0, @ANYBLOB="0d3d57969c12ac02630000"], 0x0, 0x0, 0x0})
ioctl$FBIOGETCMAP(0xffffffffffffffff, 0x4604, &(0x7f0000000340)={0xfffffff9, 0x7, &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000280)=[0x0, 0x0], &(0x7f00000002c0)=[0x0], &(0x7f0000000300)=[0x0, 0x0, 0x0, 0x0, 0x0]})
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r3, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)

[ 1689.195927][T11862] binder: 11857:11862 unknown command 1359504131
[ 1689.202775][T11862] binder: 11857:11862 ioctl c0306201 20000180 returned -22
06:39:36 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf25"], 0x30}}, 0x0)

06:39:37 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f00000001c0)=[@reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f00000000c0)={@fda={0x66646185, 0x8, 0x0, 0x2f}, @ptr={0x70742a85, 0x74e, &(0x7f0000000040)=""/126, 0x7e, 0x1, 0x12}, @flat=@handle={0x73682a85, 0x2000}}, &(0x7f0000000140)={0x0, 0x20, 0x48}}}], 0x0, 0x0, 0x0})

06:39:37 executing program 2:
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(0xffffffffffffffff, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x29, 0x3f, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})

[ 1689.495604][T11866] binder: 11865:11866 unknown command -1772667635
[ 1689.502346][T11866] binder: 11865:11866 ioctl c0306201 20000180 returned -22
06:39:37 executing program 0:
r0 = socket(0xa, 0x803, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCADD6RD(r0, 0x89f9, &(0x7f0000000780)={'sit0\x00', 0x0})

06:39:37 executing program 5:
ioctl$vim2m_VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000280)={0x1, 0x0, 0x4, 0x40, 0x6cc27415, {0x0, 0x2710}, {0x2, 0xc, 0x80, 0x2, 0x20, 0xf9, '1*:('}, 0x4, 0x2, @offset=0x6, 0x6bd})
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x50, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@flat=@weak_handle={0x77682a85, 0x1, 0x2}, @ptr={0x70742a85, 0x0, &(0x7f0000000080)=""/169, 0xa9, 0x2, 0x4}, @ptr={0x70742a85, 0x5, &(0x7f0000000140)=""/40, 0x28, 0x1, 0x26}}, &(0x7f0000000240)={0x0, 0x18, 0x40}}, 0x40}, @exit_looper], 0x0, 0x0, 0x0})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)={0x1})

06:39:37 executing program 3:
r0 = socket(0xa, 0x803, 0x7f)
syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r0)
ioctl$sock_ipv6_tunnel_SIOCADD6RD(0xffffffffffffffff, 0x89f9, &(0x7f0000000100)={'ip6tnl0\x00', &(0x7f0000000080)={'syztnl0\x00', <r1=>0x0, 0x2f, 0x2, 0x40, 0x9, 0x4, @rand_addr=' \x01\x00', @ipv4={'\x00', '\xff\xff', @multicast2}, 0x8, 0xe82, 0x2, 0x9}})
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', r1, 0x29, 0x3f, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})
r2 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="03630840", @ANYRES64=0x0, @ANYBLOB="0d3d57969c12ac02630000"], 0x0, 0x0, 0x0})
ioctl$FBIOGETCMAP(0xffffffffffffffff, 0x4604, &(0x7f0000000340)={0xfffffff9, 0x7, &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000280)=[0x0, 0x0], &(0x7f00000002c0)=[0x0], &(0x7f0000000300)=[0x0, 0x0, 0x0, 0x0, 0x0]})
r3 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r3, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)

06:39:37 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf2506"], 0x30}}, 0x0)

06:39:37 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x44, 0x0, &(0x7f00000001c0)=[@reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f00000000c0)={@fda={0x66646185, 0x8, 0x0, 0x2f}, @ptr={0x70742a85, 0x74e, &(0x7f0000000040)=""/126, 0x7e, 0x1, 0x12}, @flat=@handle={0x73682a85, 0x2000}}, &(0x7f0000000140)={0x0, 0x20, 0x48}}}], 0x0, 0x0, 0x0})

06:39:37 executing program 0:
ioctl$sock_ipv6_tunnel_SIOCADD6RD(0xffffffffffffffff, 0x89f9, &(0x7f0000000780)={'sit0\x00', 0x0})

06:39:37 executing program 2:
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(0xffffffffffffffff, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x29, 0x3f, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})

[ 1690.104247][T11880] binder: 11878:11880 unknown command -1772667635
[ 1690.111309][T11880] binder: 11878:11880 ioctl c0306201 20000180 returned -22
06:39:37 executing program 5:
ioctl$vim2m_VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000280)={0x1, 0x0, 0x4, 0x40, 0x6cc27415, {0x0, 0x2710}, {0x2, 0xc, 0x80, 0x2, 0x20, 0xf9, '1*:('}, 0x4, 0x2, @offset=0x6, 0x6bd})
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x50, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@flat=@weak_handle={0x77682a85, 0x1, 0x2}, @ptr={0x70742a85, 0x0, &(0x7f0000000080)=""/169, 0xa9, 0x2, 0x4}, @ptr={0x70742a85, 0x5, &(0x7f0000000140)=""/40, 0x28, 0x1, 0x26}}, &(0x7f0000000240)={0x0, 0x18, 0x40}}, 0x40}, @exit_looper], 0x0, 0x0, 0x0})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)={0x1})

[ 1690.237932][T11882] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.4'.
06:39:38 executing program 3:
r0 = socket(0xa, 0x803, 0x7f)
syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r0)
ioctl$sock_ipv6_tunnel_SIOCADD6RD(0xffffffffffffffff, 0x89f9, &(0x7f0000000100)={'ip6tnl0\x00', &(0x7f0000000080)={'syztnl0\x00', <r1=>0x0, 0x2f, 0x2, 0x40, 0x9, 0x4, @rand_addr=' \x01\x00', @ipv4={'\x00', '\xff\xff', @multicast2}, 0x8, 0xe82, 0x2, 0x9}})
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', r1, 0x29, 0x3f, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})
r2 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="03630840", @ANYRES64=0x0, @ANYBLOB="0d3d57969c12ac02630000"], 0x0, 0x0, 0x0})
ioctl$FBIOGETCMAP(0xffffffffffffffff, 0x4604, &(0x7f0000000340)={0xfffffff9, 0x7, &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000280)=[0x0, 0x0], &(0x7f00000002c0)=[0x0], &(0x7f0000000300)=[0x0, 0x0, 0x0, 0x0, 0x0]})
socket$nl_generic(0x10, 0x3, 0x10)

06:39:38 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf25"], 0x30}}, 0x0)

06:39:38 executing program 0:
ioctl$sock_ipv6_tunnel_SIOCADD6RD(0xffffffffffffffff, 0x89f9, &(0x7f0000000780)={'sit0\x00', 0x0})

06:39:38 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x58, 0x0, &(0x7f00000001c0)=[@reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f00000000c0)={@fda={0x66646185, 0x8, 0x0, 0x2f}, @ptr={0x70742a85, 0x74e, &(0x7f0000000040)=""/126, 0x7e, 0x1, 0x12}, @flat=@handle={0x73682a85, 0x2000}}, &(0x7f0000000140)={0x0, 0x20, 0x48}}}, @acquire_done], 0x0, 0x0, 0x0})

06:39:38 executing program 2:
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(0xffffffffffffffff, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x29, 0x3f, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})

[ 1690.694980][T11893] binder: 11891:11893 unknown command -1772667635
[ 1690.701835][T11893] binder: 11891:11893 ioctl c0306201 20000180 returned -22
06:39:38 executing program 5:
ioctl$vim2m_VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000280)={0x1, 0x0, 0x4, 0x40, 0x6cc27415, {0x0, 0x2710}, {0x2, 0xc, 0x80, 0x2, 0x20, 0xf9, '1*:('}, 0x4, 0x2, @offset=0x6, 0x6bd})
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x50, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@flat=@weak_handle={0x77682a85, 0x1, 0x2}, @ptr={0x70742a85, 0x0, &(0x7f0000000080)=""/169, 0xa9, 0x2, 0x4}, @ptr={0x70742a85, 0x5, &(0x7f0000000140)=""/40, 0x28, 0x1, 0x26}}, &(0x7f0000000240)={0x0, 0x18, 0x40}}, 0x40}, @exit_looper], 0x0, 0x0, 0x0})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)={0x1})

06:39:38 executing program 3:
r0 = socket(0xa, 0x803, 0x7f)
syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r0)
ioctl$sock_ipv6_tunnel_SIOCADD6RD(0xffffffffffffffff, 0x89f9, &(0x7f0000000100)={'ip6tnl0\x00', &(0x7f0000000080)={'syztnl0\x00', <r1=>0x0, 0x2f, 0x2, 0x40, 0x9, 0x4, @rand_addr=' \x01\x00', @ipv4={'\x00', '\xff\xff', @multicast2}, 0x8, 0xe82, 0x2, 0x9}})
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', r1, 0x29, 0x3f, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})
r2 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="03630840", @ANYRES64=0x0, @ANYBLOB="0d3d57969c12ac02630000"], 0x0, 0x0, 0x0})
ioctl$FBIOGETCMAP(0xffffffffffffffff, 0x4604, &(0x7f0000000340)={0xfffffff9, 0x7, &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000280)=[0x0, 0x0], &(0x7f00000002c0)=[0x0], &(0x7f0000000300)=[0x0, 0x0, 0x0, 0x0, 0x0]})

06:39:38 executing program 0:
ioctl$sock_ipv6_tunnel_SIOCADD6RD(0xffffffffffffffff, 0x89f9, &(0x7f0000000780)={'sit0\x00', 0x0})

06:39:38 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf25"], 0x30}}, 0x0)

06:39:38 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f00000001c0)=[@acquire_done], 0x0, 0x0, 0x0})

06:39:38 executing program 2:
r0 = socket(0x0, 0x803, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x29, 0x3f, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})

[ 1691.272617][T11906] binder: 11905:11906 unknown command -1772667635
[ 1691.279194][T11906] binder: 11905:11906 ioctl c0306201 20000180 returned -22
06:39:39 executing program 5:
ioctl$vim2m_VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000280)={0x1, 0x0, 0x4, 0x40, 0x6cc27415, {0x0, 0x2710}, {0x2, 0xc, 0x80, 0x2, 0x20, 0xf9, '1*:('}, 0x4, 0x2, @offset=0x6, 0x6bd})
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x50, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@flat=@weak_handle={0x77682a85, 0x1, 0x2}, @ptr={0x70742a85, 0x0, &(0x7f0000000080)=""/169, 0xa9, 0x2, 0x4}, @ptr={0x70742a85, 0x5, &(0x7f0000000140)=""/40, 0x28, 0x1, 0x26}}, &(0x7f0000000240)={0x0, 0x18, 0x40}}, 0x40}, @exit_looper], 0x0, 0x0, 0x0})

06:39:39 executing program 3:
r0 = socket(0xa, 0x803, 0x7f)
syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r0)
ioctl$sock_ipv6_tunnel_SIOCADD6RD(0xffffffffffffffff, 0x89f9, &(0x7f0000000100)={'ip6tnl0\x00', &(0x7f0000000080)={'syztnl0\x00', <r1=>0x0, 0x2f, 0x2, 0x40, 0x9, 0x4, @rand_addr=' \x01\x00', @ipv4={'\x00', '\xff\xff', @multicast2}, 0x8, 0xe82, 0x2, 0x9}})
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', r1, 0x29, 0x3f, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})
r2 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="03630840", @ANYRES64=0x0, @ANYBLOB="0d3d57969c12ac02630000"], 0x0, 0x0, 0x0})

06:39:39 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf25"], 0x30}}, 0x0)

06:39:39 executing program 0:
r0 = socket(0x0, 0x803, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCADD6RD(r0, 0x89f9, &(0x7f0000000780)={'sit0\x00', 0x0})

06:39:39 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f00000001c0)=[@acquire_done], 0x0, 0x0, 0x0})

06:39:39 executing program 2:
r0 = socket(0x0, 0x803, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x29, 0x3f, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})

06:39:39 executing program 5:
ioctl$vim2m_VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000280)={0x1, 0x0, 0x4, 0x40, 0x6cc27415, {0x0, 0x2710}, {0x2, 0xc, 0x80, 0x2, 0x20, 0xf9, '1*:('}, 0x4, 0x2, @offset=0x6, 0x6bd})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x50, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@flat=@weak_handle={0x77682a85, 0x1, 0x2}, @ptr={0x70742a85, 0x0, &(0x7f0000000080)=""/169, 0xa9, 0x2, 0x4}, @ptr={0x70742a85, 0x5, &(0x7f0000000140)=""/40, 0x28, 0x1, 0x26}}, &(0x7f0000000240)={0x0, 0x18, 0x40}}, 0x40}, @exit_looper], 0x0, 0x0, 0x0})

[ 1691.988475][T11923] binder: 11921:11923 unknown command -1772667635
[ 1691.995872][T11923] binder: 11921:11923 ioctl c0306201 20000180 returned -22
06:39:39 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYBLOB="db1e29bd7000fbdbdf2506"], 0x30}}, 0x0)

06:39:40 executing program 3:
r0 = socket(0xa, 0x803, 0x7f)
syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r0)
ioctl$sock_ipv6_tunnel_SIOCADD6RD(0xffffffffffffffff, 0x89f9, &(0x7f0000000100)={'ip6tnl0\x00', &(0x7f0000000080)={'syztnl0\x00', <r1=>0x0, 0x2f, 0x2, 0x40, 0x9, 0x4, @rand_addr=' \x01\x00', @ipv4={'\x00', '\xff\xff', @multicast2}, 0x8, 0xe82, 0x2, 0x9}})
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', r1, 0x29, 0x3f, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)

06:39:40 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f00000001c0)=[@acquire_done], 0x0, 0x0, 0x0})

06:39:40 executing program 0:
r0 = socket(0x0, 0x803, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCADD6RD(r0, 0x89f9, &(0x7f0000000780)={'sit0\x00', 0x0})

06:39:40 executing program 5:
ioctl$vim2m_VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000280)={0x1, 0x0, 0x4, 0x40, 0x6cc27415, {0x0, 0x2710}, {0x2, 0xc, 0x80, 0x2, 0x20, 0xf9, '1*:('}, 0x4, 0x2, @offset=0x6, 0x6bd})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x50, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@flat=@weak_handle={0x77682a85, 0x1, 0x2}, @ptr={0x70742a85, 0x0, &(0x7f0000000080)=""/169, 0xa9, 0x2, 0x4}, @ptr={0x70742a85, 0x5, &(0x7f0000000140)=""/40, 0x28, 0x1, 0x26}}, &(0x7f0000000240)={0x0, 0x18, 0x40}}, 0x40}, @exit_looper], 0x0, 0x0, 0x0})

06:39:40 executing program 2:
r0 = socket(0x0, 0x803, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x29, 0x3f, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})

06:39:40 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYBLOB="db1e29bd7000fbdbdf2506"], 0x30}}, 0x0)

06:39:40 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x58, 0x0, &(0x7f00000001c0)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f00000000c0)={@fda={0x66646185, 0x8, 0x0, 0x2f}, @ptr={0x70742a85, 0x74e, &(0x7f0000000040)=""/126, 0x7e, 0x1, 0x12}, @flat=@handle={0x73682a85, 0x2000}}, &(0x7f0000000140)={0x0, 0x20, 0x48}}}, @acquire_done], 0x0, 0x0, 0x0})

06:39:40 executing program 3:
r0 = socket(0xa, 0x803, 0x7f)
syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r0)
ioctl$sock_ipv6_tunnel_SIOCADD6RD(0xffffffffffffffff, 0x89f9, &(0x7f0000000100)={'ip6tnl0\x00', &(0x7f0000000080)={'syztnl0\x00', <r1=>0x0, 0x2f, 0x2, 0x40, 0x9, 0x4, @rand_addr=' \x01\x00', @ipv4={'\x00', '\xff\xff', @multicast2}, 0x8, 0xe82, 0x2, 0x9}})
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', r1, 0x29, 0x3f, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})

06:39:40 executing program 0:
r0 = socket(0x0, 0x803, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCADD6RD(r0, 0x89f9, &(0x7f0000000780)={'sit0\x00', 0x0})

06:39:40 executing program 5:
ioctl$vim2m_VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000280)={0x1, 0x0, 0x4, 0x40, 0x6cc27415, {0x0, 0x2710}, {0x2, 0xc, 0x80, 0x2, 0x20, 0xf9, '1*:('}, 0x4, 0x2, @offset=0x6, 0x6bd})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x50, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@flat=@weak_handle={0x77682a85, 0x1, 0x2}, @ptr={0x70742a85, 0x0, &(0x7f0000000080)=""/169, 0xa9, 0x2, 0x4}, @ptr={0x70742a85, 0x5, &(0x7f0000000140)=""/40, 0x28, 0x1, 0x26}}, &(0x7f0000000240)={0x0, 0x18, 0x40}}, 0x40}, @exit_looper], 0x0, 0x0, 0x0})

06:39:40 executing program 2:
r0 = socket(0xa, 0x0, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x29, 0x3f, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})

06:39:41 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYBLOB="db1e29bd7000fbdbdf2506"], 0x30}}, 0x0)

06:39:41 executing program 3:
r0 = socket(0xa, 0x803, 0x7f)
syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r0)
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x29, 0x3f, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})

06:39:41 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x58, 0x0, &(0x7f00000001c0)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000140)}}, @acquire_done], 0x0, 0x0, 0x0})

06:39:41 executing program 0:
r0 = socket(0xa, 0x0, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCADD6RD(r0, 0x89f9, &(0x7f0000000780)={'sit0\x00', 0x0})

06:39:41 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x50, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@flat=@weak_handle={0x77682a85, 0x1, 0x2}, @ptr={0x70742a85, 0x0, &(0x7f0000000080)=""/169, 0xa9, 0x2, 0x4}, @ptr={0x70742a85, 0x5, &(0x7f0000000140)=""/40, 0x28, 0x1, 0x26}}, &(0x7f0000000240)={0x0, 0x18, 0x40}}, 0x40}, @exit_looper], 0x0, 0x0, 0x0})

06:39:41 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16, @ANYBLOB="db1e29bd7000fbdbdf2506"], 0x30}}, 0x0)

06:39:41 executing program 3:
r0 = socket(0xa, 0x803, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x29, 0x3f, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})

06:39:41 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x58, 0x0, &(0x7f00000001c0)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @acquire_done], 0x0, 0x0, 0x0})

06:39:41 executing program 2:
r0 = socket(0xa, 0x0, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x29, 0x3f, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})

06:39:42 executing program 5:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x50, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@flat=@weak_handle={0x77682a85, 0x1, 0x2}, @ptr={0x70742a85, 0x0, &(0x7f0000000080)=""/169, 0xa9, 0x2, 0x4}, @ptr={0x70742a85, 0x5, &(0x7f0000000140)=""/40, 0x28, 0x1, 0x26}}, &(0x7f0000000240)={0x0, 0x18, 0x40}}, 0x40}, @exit_looper], 0x0, 0x0, 0x0})

06:39:42 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16, @ANYBLOB="db1e29bd7000fbdbdf2506"], 0x30}}, 0x0)

06:39:42 executing program 0:
r0 = socket(0xa, 0x0, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCADD6RD(r0, 0x89f9, &(0x7f0000000780)={'sit0\x00', 0x0})

06:39:42 executing program 3:
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(0xffffffffffffffff, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x29, 0x3f, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})

06:39:42 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_GET_NODE_INFO_FOR_REF(r0, 0xc018620c, &(0x7f0000000080)={0x3})

06:39:42 executing program 5:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x50, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@flat=@weak_handle={0x77682a85, 0x1, 0x2}, @ptr={0x70742a85, 0x0, &(0x7f0000000080)=""/169, 0xa9, 0x2, 0x4}, @ptr={0x70742a85, 0x5, &(0x7f0000000140)=""/40, 0x28, 0x1, 0x26}}, &(0x7f0000000240)={0x0, 0x18, 0x40}}, 0x40}, @exit_looper], 0x0, 0x0, 0x0})

06:39:42 executing program 2:
r0 = socket(0xa, 0x0, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x29, 0x3f, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})

06:39:42 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16, @ANYBLOB="db1e29bd7000fbdbdf2506"], 0x30}}, 0x0)

[ 1695.127479][T12011] binder: 12010:12011 ioctl c018620c 20000080 returned -1
06:39:42 executing program 0:
r0 = socket(0xa, 0x0, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCADD6RD(r0, 0x89f9, &(0x7f0000000780)={'sit0\x00', 0x0})

06:39:42 executing program 3:
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(0xffffffffffffffff, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x29, 0x3f, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})

06:39:43 executing program 1:
r0 = openat$zero(0xffffffffffffff9c, &(0x7f00000000c0), 0x8000, 0x0)
ioctl$DRM_IOCTL_SET_SAREA_CTX(r0, 0x4010641c, &(0x7f0000000140)={0x0, &(0x7f00000002c0)=""/167})
r1 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080), 0x501000, 0x0)
ioctl$BINDER_THREAD_EXIT(r2, 0x40046208, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="03630840ece318cde969dfb51da96765eb498a2346fbd5547c2bb0480600f345c13be77d43ef65802f67e97b191e2e52200965", @ANYRES64=0x0, @ANYBLOB="0563044001000000"], 0x0, 0x0, 0x0})
r3 = syz_open_dev$vim2m(&(0x7f0000000040), 0x7ff, 0x2)
clock_gettime(0x0, &(0x7f0000000100)={<r4=>0x0, <r5=>0x0})
r6 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r6, 0x11b, 0x5, 0x0, 0x0)
r7 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r7, 0x11b, 0x5, 0x0, 0x0)
ioctl$vim2m_VIDIOC_QBUF(r3, 0xc058560f, &(0x7f00000001c0)={0x9, 0x3, 0x4, 0x8, 0x0, {r4, r5/1000+60000}, {0x4, 0x2, 0xe8, 0x1c, 0x2, 0xcf, "d450fd5b"}, 0x1, 0x1, @fd=r6, 0x7, 0x0, r7})

06:39:43 executing program 5:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x50, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@flat=@weak_handle={0x77682a85, 0x1, 0x2}, @ptr={0x70742a85, 0x0, &(0x7f0000000080)=""/169, 0xa9, 0x2, 0x4}, @ptr={0x70742a85, 0x5, &(0x7f0000000140)=""/40, 0x28, 0x1, 0x26}}, &(0x7f0000000240)={0x0, 0x18, 0x40}}, 0x40}, @exit_looper], 0x0, 0x0, 0x0})

06:39:43 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf2506"], 0x30}}, 0x0)

06:39:43 executing program 2:
r0 = socket(0xa, 0x803, 0x0)
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x29, 0x3f, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})

[ 1695.847809][T12031] binder: 12029:12031 unknown command 1701292317
[ 1695.854684][T12031] binder: 12029:12031 ioctl c0306201 20000180 returned -22
06:39:43 executing program 0:
r0 = socket(0xa, 0x803, 0x0)
ioctl$sock_ipv6_tunnel_SIOCADD6RD(r0, 0x89f9, &(0x7f0000000780)={'sit0\x00', 0x0})

06:39:43 executing program 3:
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(0xffffffffffffffff, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x29, 0x3f, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})

06:39:43 executing program 5:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x50, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@flat=@weak_handle={0x77682a85, 0x1, 0x2}, @ptr={0x70742a85, 0x0, &(0x7f0000000080)=""/169, 0xa9, 0x2, 0x4}, @ptr={0x70742a85, 0x5, &(0x7f0000000140)=""/40, 0x28, 0x1, 0x26}}, &(0x7f0000000240)={0x0, 0x18, 0x40}}, 0x40}, @exit_looper], 0x0, 0x0, 0x0})

06:39:43 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf2506"], 0x30}}, 0x0)

06:39:43 executing program 1:
r0 = openat$zero(0xffffffffffffff9c, &(0x7f00000000c0), 0x8000, 0x0)
ioctl$DRM_IOCTL_SET_SAREA_CTX(r0, 0x4010641c, &(0x7f0000000140)={0x0, &(0x7f00000002c0)=""/167})
r1 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080), 0x501000, 0x0)
ioctl$BINDER_THREAD_EXIT(r2, 0x40046208, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="03630840ece318cde969dfb51da96765eb498a2346fbd5547c2bb0480600f345c13be77d43ef65802f67e97b191e2e52200965", @ANYRES64=0x0, @ANYBLOB="0563044001000000"], 0x0, 0x0, 0x0})
r3 = syz_open_dev$vim2m(&(0x7f0000000040), 0x7ff, 0x2)
clock_gettime(0x0, &(0x7f0000000100)={<r4=>0x0, <r5=>0x0})
r6 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r6, 0x11b, 0x5, 0x0, 0x0)
r7 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r7, 0x11b, 0x5, 0x0, 0x0)
ioctl$vim2m_VIDIOC_QBUF(r3, 0xc058560f, &(0x7f00000001c0)={0x9, 0x3, 0x4, 0x8, 0x0, {r4, r5/1000+60000}, {0x4, 0x2, 0xe8, 0x1c, 0x2, 0xcf, "d450fd5b"}, 0x1, 0x1, @fd=r6, 0x7, 0x0, r7})

[ 1696.521310][T12053] binder: 12051:12053 unknown command 1701292317
[ 1696.527790][T12053] binder: 12051:12053 ioctl c0306201 20000180 returned -22
06:39:44 executing program 3:
r0 = socket(0x0, 0x803, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x29, 0x3f, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})

06:39:44 executing program 5:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x50, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@flat=@weak_handle={0x77682a85, 0x1, 0x2}, @ptr={0x70742a85, 0x0, &(0x7f0000000080)=""/169, 0xa9, 0x2, 0x4}, @ptr={0x70742a85, 0x5, &(0x7f0000000140)=""/40, 0x28, 0x1, 0x26}}, &(0x7f0000000240)={0x0, 0x18, 0x40}}, 0x40}, @exit_looper], 0x0, 0x0, 0x0})

06:39:44 executing program 2:
r0 = socket(0xa, 0x803, 0x0)
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x29, 0x3f, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})

06:39:44 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf2506"], 0x30}}, 0x0)

06:39:44 executing program 0:
r0 = socket(0xa, 0x803, 0x0)
ioctl$sock_ipv6_tunnel_SIOCADD6RD(r0, 0x89f9, &(0x7f0000000780)={'sit0\x00', 0x0})

06:39:44 executing program 1:
r0 = openat$zero(0xffffffffffffff9c, &(0x7f00000000c0), 0x8000, 0x0)
ioctl$DRM_IOCTL_SET_SAREA_CTX(r0, 0x4010641c, &(0x7f0000000140)={0x0, &(0x7f00000002c0)=""/167})
r1 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080), 0x501000, 0x0)
ioctl$BINDER_THREAD_EXIT(r2, 0x40046208, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="03630840ece318cde969dfb51da96765eb498a2346fbd5547c2bb0480600f345c13be77d43ef65802f67e97b191e2e52200965", @ANYRES64=0x0, @ANYBLOB="0563044001000000"], 0x0, 0x0, 0x0})
r3 = syz_open_dev$vim2m(&(0x7f0000000040), 0x7ff, 0x2)
clock_gettime(0x0, &(0x7f0000000100)={<r4=>0x0, <r5=>0x0})
r6 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r6, 0x11b, 0x5, 0x0, 0x0)
r7 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r7, 0x11b, 0x5, 0x0, 0x0)
ioctl$vim2m_VIDIOC_QBUF(r3, 0xc058560f, &(0x7f00000001c0)={0x9, 0x3, 0x4, 0x8, 0x0, {r4, r5/1000+60000}, {0x4, 0x2, 0xe8, 0x1c, 0x2, 0xcf, "d450fd5b"}, 0x1, 0x1, @fd=r6, 0x7, 0x0, r7})

06:39:44 executing program 3:
r0 = socket(0x0, 0x803, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x29, 0x3f, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})

06:39:45 executing program 2:
r0 = socket(0xa, 0x803, 0x0)
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x29, 0x3f, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})

06:39:45 executing program 5:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x50, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@flat=@weak_handle={0x77682a85, 0x1, 0x2}, @ptr={0x70742a85, 0x0, &(0x7f0000000080)=""/169, 0xa9, 0x2, 0x4}, @ptr={0x70742a85, 0x5, &(0x7f0000000140)=""/40, 0x28, 0x1, 0x26}}, &(0x7f0000000240)={0x0, 0x18, 0x40}}, 0x40}, @exit_looper], 0x0, 0x0, 0x0})

[ 1697.371830][T12076] binder: 12074:12076 unknown command 1701292317
[ 1697.378772][T12076] binder: 12074:12076 ioctl c0306201 20000180 returned -22
06:39:45 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB, @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf2506"], 0x30}}, 0x0)

06:39:45 executing program 0:
r0 = socket(0xa, 0x803, 0x0)
ioctl$sock_ipv6_tunnel_SIOCADD6RD(r0, 0x89f9, &(0x7f0000000780)={'sit0\x00', 0x0})

06:39:45 executing program 1:
r0 = openat$zero(0xffffffffffffff9c, &(0x7f00000000c0), 0x8000, 0x0)
ioctl$DRM_IOCTL_SET_SAREA_CTX(r0, 0x4010641c, &(0x7f0000000140)={0x0, &(0x7f00000002c0)=""/167})
r1 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080), 0x501000, 0x0)
ioctl$BINDER_THREAD_EXIT(r2, 0x40046208, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="03630840ece318cde969dfb51da96765eb498a2346fbd5547c2bb0480600f345c13be77d43ef65802f67e97b191e2e52200965", @ANYRES64=0x0, @ANYBLOB="0563044001000000"], 0x0, 0x0, 0x0})
r3 = syz_open_dev$vim2m(&(0x7f0000000040), 0x7ff, 0x2)
clock_gettime(0x0, &(0x7f0000000100)={<r4=>0x0, <r5=>0x0})
r6 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r6, 0x11b, 0x5, 0x0, 0x0)
r7 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$vim2m_VIDIOC_QBUF(r3, 0xc058560f, &(0x7f00000001c0)={0x9, 0x3, 0x4, 0x8, 0x0, {r4, r5/1000+60000}, {0x4, 0x2, 0xe8, 0x1c, 0x2, 0xcf, "d450fd5b"}, 0x1, 0x1, @fd=r6, 0x7, 0x0, r7})

06:39:45 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)

06:39:45 executing program 3:
r0 = socket(0x0, 0x803, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x29, 0x3f, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})

[ 1697.991455][T12096] binder: 12095:12096 unknown command 1701292317
[ 1697.998369][T12096] binder: 12095:12096 ioctl c0306201 20000180 returned -22
06:39:45 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB, @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf2506"], 0x30}}, 0x0)

06:39:45 executing program 2:
socket(0xa, 0x803, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(0xffffffffffffffff, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x29, 0x3f, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})

[ 1698.259295][T12102] binder: 12100:12102 ioctl c0306201 0 returned -14
06:39:46 executing program 0:
socket(0xa, 0x803, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCADD6RD(0xffffffffffffffff, 0x89f9, &(0x7f0000000780)={'sit0\x00', 0x0})

06:39:46 executing program 1:
r0 = openat$zero(0xffffffffffffff9c, &(0x7f00000000c0), 0x8000, 0x0)
ioctl$DRM_IOCTL_SET_SAREA_CTX(r0, 0x4010641c, &(0x7f0000000140)={0x0, &(0x7f00000002c0)=""/167})
r1 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080), 0x501000, 0x0)
ioctl$BINDER_THREAD_EXIT(r2, 0x40046208, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="03630840ece318cde969dfb51da96765eb498a2346fbd5547c2bb0480600f345c13be77d43ef65802f67e97b191e2e52200965", @ANYRES64=0x0, @ANYBLOB="0563044001000000"], 0x0, 0x0, 0x0})
r3 = syz_open_dev$vim2m(&(0x7f0000000040), 0x7ff, 0x2)
clock_gettime(0x0, &(0x7f0000000100)={<r4=>0x0, <r5=>0x0})
r6 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r6, 0x11b, 0x5, 0x0, 0x0)
ioctl$vim2m_VIDIOC_QBUF(r3, 0xc058560f, &(0x7f00000001c0)={0x9, 0x3, 0x4, 0x8, 0x0, {r4, r5/1000+60000}, {0x4, 0x2, 0xe8, 0x1c, 0x2, 0xcf, "d450fd5b"}, 0x1, 0x1, @fd=r6, 0x7})

06:39:46 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)

06:39:46 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB, @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf2506"], 0x30}}, 0x0)

06:39:46 executing program 3:
r0 = socket(0xa, 0x0, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x29, 0x3f, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})

06:39:46 executing program 2:
socket(0xa, 0x803, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(0xffffffffffffffff, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x29, 0x3f, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})

[ 1698.678487][T12113] binder: 12111:12113 unknown command 1701292317
[ 1698.685130][T12113] binder: 12111:12113 ioctl c0306201 20000180 returned -22
06:39:46 executing program 0:
socket(0xa, 0x803, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCADD6RD(0xffffffffffffffff, 0x89f9, &(0x7f0000000780)={'sit0\x00', 0x0})

[ 1698.896625][T12119] binder: 12116:12119 ioctl c0306201 0 returned -14
06:39:46 executing program 1:
r0 = openat$zero(0xffffffffffffff9c, &(0x7f00000000c0), 0x8000, 0x0)
ioctl$DRM_IOCTL_SET_SAREA_CTX(r0, 0x4010641c, &(0x7f0000000140)={0x0, &(0x7f00000002c0)=""/167})
r1 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080), 0x501000, 0x0)
ioctl$BINDER_THREAD_EXIT(r2, 0x40046208, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="03630840ece318cde969dfb51da96765eb498a2346fbd5547c2bb0480600f345c13be77d43ef65802f67e97b191e2e52200965", @ANYRES64=0x0, @ANYBLOB="0563044001000000"], 0x0, 0x0, 0x0})
r3 = syz_open_dev$vim2m(&(0x7f0000000040), 0x7ff, 0x2)
clock_gettime(0x0, &(0x7f0000000100)={<r4=>0x0, <r5=>0x0})
r6 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$vim2m_VIDIOC_QBUF(r3, 0xc058560f, &(0x7f00000001c0)={0x9, 0x3, 0x4, 0x8, 0x0, {r4, r5/1000+60000}, {0x4, 0x2, 0xe8, 0x1c, 0x2, 0xcf, "d450fd5b"}, 0x1, 0x1, @fd=r6, 0x7})

06:39:46 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00', @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf2506"], 0x30}}, 0x0)

06:39:46 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)

06:39:46 executing program 2:
socket(0xa, 0x803, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(0xffffffffffffffff, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x29, 0x3f, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})

[ 1699.394980][T12130] binder: 12129:12130 unknown command 1701292317
[ 1699.401974][T12130] binder: 12129:12130 ioctl c0306201 20000180 returned -22
06:39:47 executing program 0:
socket(0xa, 0x803, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCADD6RD(0xffffffffffffffff, 0x89f9, &(0x7f0000000780)={'sit0\x00', 0x0})

06:39:47 executing program 3:
r0 = socket(0xa, 0x0, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x29, 0x3f, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})

06:39:47 executing program 1:
r0 = openat$zero(0xffffffffffffff9c, &(0x7f00000000c0), 0x8000, 0x0)
ioctl$DRM_IOCTL_SET_SAREA_CTX(r0, 0x4010641c, &(0x7f0000000140)={0x0, &(0x7f00000002c0)=""/167})
r1 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080), 0x501000, 0x0)
ioctl$BINDER_THREAD_EXIT(r2, 0x40046208, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="03630840ece318cde969dfb51da96765eb498a2346fbd5547c2bb0480600f345c13be77d43ef65802f67e97b191e2e52200965", @ANYRES64=0x0, @ANYBLOB="0563044001000000"], 0x0, 0x0, 0x0})
r3 = syz_open_dev$vim2m(&(0x7f0000000040), 0x7ff, 0x2)
clock_gettime(0x0, &(0x7f0000000100)={<r4=>0x0, <r5=>0x0})
ioctl$vim2m_VIDIOC_QBUF(r3, 0xc058560f, &(0x7f00000001c0)={0x9, 0x3, 0x4, 0x8, 0x0, {r4, r5/1000+60000}, {0x4, 0x2, 0xe8, 0x1c, 0x2, 0xcf, "d450fd5b"}, 0x1, 0x1, @fd, 0x7})

06:39:47 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00', @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf2506"], 0x30}}, 0x0)

06:39:47 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

06:39:47 executing program 2:
r0 = socket(0xa, 0x803, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, 0x0)

[ 1699.983463][T12148] binder: 12146:12148 unknown command 1701292317
[ 1699.990074][T12148] binder: 12146:12148 ioctl c0306201 20000180 returned -22
06:39:47 executing program 0:
r0 = socket(0xa, 0x803, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCADD6RD(r0, 0x89f9, 0x0)

06:39:47 executing program 3:
r0 = socket(0xa, 0x0, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x29, 0x3f, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})

06:39:47 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00', @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf2506"], 0x30}}, 0x0)

06:39:47 executing program 1:
r0 = openat$zero(0xffffffffffffff9c, &(0x7f00000000c0), 0x8000, 0x0)
ioctl$DRM_IOCTL_SET_SAREA_CTX(r0, 0x4010641c, &(0x7f0000000140)={0x0, &(0x7f00000002c0)=""/167})
r1 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080), 0x501000, 0x0)
ioctl$BINDER_THREAD_EXIT(r2, 0x40046208, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="03630840ece318cde969dfb51da96765eb498a2346fbd5547c2bb0480600f345c13be77d43ef65802f67e97b191e2e52200965", @ANYRES64=0x0, @ANYBLOB="0563044001000000"], 0x0, 0x0, 0x0})
r3 = syz_open_dev$vim2m(&(0x7f0000000040), 0x7ff, 0x2)
ioctl$vim2m_VIDIOC_QBUF(r3, 0xc058560f, &(0x7f00000001c0)={0x9, 0x3, 0x4, 0x8, 0x0, {}, {0x4, 0x2, 0xe8, 0x1c, 0x2, 0xcf, "d450fd5b"}, 0x1, 0x1, @fd, 0x7})

06:39:48 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

06:39:48 executing program 2:
r0 = socket(0xa, 0x803, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, 0x0)

[ 1700.644261][T12164] binder: 12162:12164 unknown command 1701292317
[ 1700.651066][T12164] binder: 12162:12164 ioctl c0306201 20000180 returned -22
06:39:48 executing program 0:
r0 = socket(0xa, 0x803, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCADD6RD(r0, 0x89f9, 0x0)

06:39:48 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00', @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf2506"], 0x30}}, 0x0)

06:39:48 executing program 1:
r0 = openat$zero(0xffffffffffffff9c, &(0x7f00000000c0), 0x8000, 0x0)
ioctl$DRM_IOCTL_SET_SAREA_CTX(r0, 0x4010641c, &(0x7f0000000140)={0x0, &(0x7f00000002c0)=""/167})
r1 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080), 0x501000, 0x0)
ioctl$BINDER_THREAD_EXIT(r2, 0x40046208, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="03630840ece318cde969dfb51da96765eb498a2346fbd5547c2bb0480600f345c13be77d43ef65802f67e97b191e2e52200965", @ANYRES64=0x0, @ANYBLOB="0563044001000000"], 0x0, 0x0, 0x0})
ioctl$vim2m_VIDIOC_QBUF(0xffffffffffffffff, 0xc058560f, &(0x7f00000001c0)={0x9, 0x3, 0x4, 0x8, 0x0, {}, {0x4, 0x2, 0xe8, 0x1c, 0x2, 0xcf, "d450fd5b"}, 0x1, 0x1, @fd, 0x7})

06:39:48 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

06:39:48 executing program 3:
r0 = socket(0xa, 0x803, 0x0)
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x29, 0x3f, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})

06:39:48 executing program 2:
r0 = socket(0xa, 0x803, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, 0x0)

06:39:48 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00', @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf2506"], 0x30}}, 0x0)

06:39:48 executing program 0:
r0 = socket(0xa, 0x803, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCADD6RD(r0, 0x89f9, 0x0)

[ 1701.300873][T12176] binder: 12175:12176 unknown command 1701292317
[ 1701.307360][T12176] binder: 12175:12176 ioctl c0306201 20000180 returned -22
06:39:49 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@flat=@weak_handle={0x77682a85, 0x1, 0x2}, @ptr={0x70742a85, 0x0, &(0x7f0000000080)=""/169, 0xa9, 0x2, 0x4}, @ptr={0x70742a85, 0x5, &(0x7f0000000140)=""/40, 0x28, 0x1, 0x26}}, &(0x7f0000000240)={0x0, 0x18, 0x40}}, 0x40}], 0x0, 0x0, 0x0})

06:39:49 executing program 1:
r0 = openat$zero(0xffffffffffffff9c, &(0x7f00000000c0), 0x8000, 0x0)
ioctl$DRM_IOCTL_SET_SAREA_CTX(r0, 0x4010641c, &(0x7f0000000140)={0x0, &(0x7f00000002c0)=""/167})
r1 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080), 0x501000, 0x0)
ioctl$BINDER_THREAD_EXIT(r2, 0x40046208, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="03630840ece318cde969dfb51da96765eb498a2346fbd5547c2bb0480600f345c13be77d43ef65802f67e97b191e2e52200965", @ANYRES64=0x0, @ANYBLOB="0563044001000000"], 0x0, 0x0, 0x0})
ioctl$vim2m_VIDIOC_QBUF(0xffffffffffffffff, 0xc058560f, &(0x7f00000001c0)={0x9, 0x3, 0x4, 0x8, 0x0, {}, {0x4, 0x2, 0xe8, 0x1c, 0x2, 0xcf, "d450fd5b"}, 0x1, 0x1, @fd, 0x7})

06:39:49 executing program 2:
r0 = socket(0xa, 0x803, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', 0x0})

06:39:49 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00', @ANYRES16=r1, @ANYBLOB="db1e29bd7000fbdbdf2506"], 0x30}}, 0x0)

06:39:49 executing program 3:
r0 = socket(0xa, 0x803, 0x0)
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x29, 0x3f, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})

06:39:49 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_GET_NODE_INFO_FOR_REF(r0, 0xc018620c, &(0x7f0000000080)={0x3})

[ 1702.073703][T12197] binder: 12193:12197 unknown command 1701292317
[ 1702.080367][T12197] binder: 12193:12197 ioctl c0306201 20000180 returned -22
06:39:49 executing program 2:
r0 = socket(0xa, 0x803, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', 0x0})

06:39:49 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@flat=@weak_handle={0x77682a85, 0x1, 0x2}, @ptr={0x70742a85, 0x0, &(0x7f0000000080)=""/169, 0xa9, 0x2, 0x4}, @ptr={0x70742a85, 0x5, &(0x7f0000000140)=""/40, 0x28, 0x1, 0x26}}, &(0x7f0000000240)={0x0, 0x18, 0x40}}, 0x40}], 0x0, 0x0, 0x0})

[ 1702.304749][T12205] binder: 12203:12205 ioctl c018620c 20000080 returned -22
06:39:50 executing program 1:
r0 = openat$zero(0xffffffffffffff9c, &(0x7f00000000c0), 0x8000, 0x0)
ioctl$DRM_IOCTL_SET_SAREA_CTX(r0, 0x4010641c, &(0x7f0000000140)={0x0, &(0x7f00000002c0)=""/167})
r1 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080), 0x501000, 0x0)
ioctl$BINDER_THREAD_EXIT(r2, 0x40046208, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x14, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="03630840ece318cde969dfb51da96765eb498a2346fbd5547c2bb0480600f345c13be77d43ef65802f67e97b191e2e52200965", @ANYRES64=0x0, @ANYBLOB="0563044001000000"], 0x0, 0x0, 0x0})
ioctl$vim2m_VIDIOC_QBUF(0xffffffffffffffff, 0xc058560f, &(0x7f00000001c0)={0x9, 0x3, 0x4, 0x8, 0x0, {}, {0x4, 0x2, 0xe8, 0x1c, 0x2, 0xcf, "d450fd5b"}, 0x1, 0x1, @fd, 0x7})

06:39:50 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_QUERYBUF(r1, 0xc0585609, &(0x7f0000000180)={0x0, 0x0, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "56850780"}})
ioctl$vim2m_VIDIOC_ENUM_FMT(r1, 0xc0405602, &(0x7f00000000c0)={0x2, 0x2, 0x2, "3c0a6d51c9e13895daefdd36340da9bf00280441eeb9983a920642d33a92f380", 0xb5315258})
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_GET_NODE_INFO_FOR_REF(r0, 0xc018620c, &(0x7f0000000080)={0x3})

06:39:50 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000080)={0x1})

06:39:50 executing program 3:
r0 = socket(0xa, 0x803, 0x0)
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x29, 0x3f, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})

[ 1702.769710][T12214] binder: 12212:12214 unknown command 1701292317
[ 1702.776501][T12214] binder: 12212:12214 ioctl c0306201 20000180 returned -22
06:39:50 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@flat=@weak_handle={0x77682a85, 0x1, 0x2}, @ptr={0x70742a85, 0x0, &(0x7f0000000080)=""/169, 0xa9, 0x2, 0x4}, @ptr={0x70742a85, 0x5, &(0x7f0000000140)=""/40, 0x28, 0x1, 0x26}}, &(0x7f0000000240)={0x0, 0x18, 0x40}}, 0x40}], 0x0, 0x0, 0x0})

06:39:50 executing program 2:
r0 = socket(0xa, 0x803, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', 0x0})

[ 1702.855313][T12215] binder: 12213:12215 ioctl c018620c 20000080 returned -22
06:39:50 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_QUERYBUF(r1, 0xc0585609, &(0x7f0000000180)={0x0, 0x0, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "56850780"}})
ioctl$vim2m_VIDIOC_ENUM_FMT(r1, 0xc0405602, &(0x7f00000000c0)={0x2, 0x2, 0x2, "3c0a6d51c9e13895daefdd36340da9bf00280441eeb9983a920642d33a92f380", 0xb5315258})
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_GET_NODE_INFO_FOR_REF(r0, 0xc018620c, &(0x7f0000000080)={0x3})

06:39:50 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000080)={0x1})

06:39:50 executing program 1:
r0 = openat$zero(0xffffffffffffff9c, &(0x7f00000000c0), 0x8000, 0x0)
ioctl$DRM_IOCTL_SET_SAREA_CTX(r0, 0x4010641c, &(0x7f0000000140)={0x0, &(0x7f00000002c0)=""/167})
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080), 0x501000, 0x0)
ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0)
r2 = syz_open_dev$vim2m(&(0x7f0000000040), 0x7ff, 0x2)
ioctl$vim2m_VIDIOC_QBUF(r2, 0xc058560f, &(0x7f00000001c0)={0x9, 0x3, 0x4, 0x8, 0x0, {}, {0x4, 0x2, 0xe8, 0x1c, 0x2, 0xcf, "d450fd5b"}, 0x1, 0x1, @fd, 0x7})

06:39:51 executing program 2:
r0 = socket(0xa, 0x803, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x0, 0x3f, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})

06:39:51 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4, 0x0, &(0x7f0000000300)=[@exit_looper], 0x0, 0x0, 0x0})

[ 1703.461366][T12232] binder: 12229:12232 ioctl c018620c 20000080 returned -22
06:39:51 executing program 3:
socket(0xa, 0x803, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(0xffffffffffffffff, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x29, 0x3f, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})

06:39:51 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_QUERYBUF(r1, 0xc0585609, &(0x7f0000000180)={0x0, 0x0, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "56850780"}})
ioctl$vim2m_VIDIOC_ENUM_FMT(r1, 0xc0405602, &(0x7f00000000c0)={0x2, 0x2, 0x2, "3c0a6d51c9e13895daefdd36340da9bf00280441eeb9983a920642d33a92f380", 0xb5315258})
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_GET_NODE_INFO_FOR_REF(r0, 0xc018620c, &(0x7f0000000080)={0x3})

06:39:51 executing program 1:
r0 = openat$zero(0xffffffffffffff9c, &(0x7f00000000c0), 0x8000, 0x0)
ioctl$DRM_IOCTL_SET_SAREA_CTX(r0, 0x4010641c, &(0x7f0000000140)={0x0, &(0x7f00000002c0)=""/167})
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
openat$zero(0xffffffffffffff9c, &(0x7f0000000080), 0x501000, 0x0)
r1 = syz_open_dev$vim2m(&(0x7f0000000040), 0x7ff, 0x2)
ioctl$vim2m_VIDIOC_QBUF(r1, 0xc058560f, &(0x7f00000001c0)={0x9, 0x3, 0x4, 0x8, 0x0, {}, {0x4, 0x2, 0xe8, 0x1c, 0x2, 0xcf, "d450fd5b"}, 0x1, 0x1, @fd, 0x7})

06:39:51 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000080)={0x1})

06:39:51 executing program 2:
r0 = socket(0xa, 0x803, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x0, 0x0, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})

06:39:51 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4, 0x0, &(0x7f0000000300)=[@exit_looper], 0x0, 0x0, 0x0})

06:39:51 executing program 3:
socket(0xa, 0x803, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(0xffffffffffffffff, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x29, 0x3f, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})

[ 1704.062795][T12244] binder: 12241:12244 ioctl c018620c 20000080 returned -22
06:39:51 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000080)={0x1})

06:39:52 executing program 1:
r0 = openat$zero(0xffffffffffffff9c, &(0x7f00000000c0), 0x8000, 0x0)
ioctl$DRM_IOCTL_SET_SAREA_CTX(r0, 0x4010641c, &(0x7f0000000140)={0x0, &(0x7f00000002c0)=""/167})
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_open_dev$vim2m(&(0x7f0000000040), 0x7ff, 0x2)
ioctl$vim2m_VIDIOC_QBUF(r1, 0xc058560f, &(0x7f00000001c0)={0x9, 0x3, 0x4, 0x8, 0x0, {}, {0x4, 0x2, 0xe8, 0x1c, 0x2, 0xcf, "d450fd5b"}, 0x1, 0x1, @fd, 0x7})

06:39:52 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_QUERYBUF(r1, 0xc0585609, &(0x7f0000000180)={0x0, 0x0, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "56850780"}})
ioctl$vim2m_VIDIOC_ENUM_FMT(r1, 0xc0405602, &(0x7f00000000c0)={0x2, 0x2, 0x2, "3c0a6d51c9e13895daefdd36340da9bf00280441eeb9983a920642d33a92f380", 0xb5315258})
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)

06:39:52 executing program 2:
r0 = socket(0xa, 0x803, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x0, 0x0, 0x0, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})

06:39:52 executing program 3:
socket(0xa, 0x803, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(0xffffffffffffffff, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x29, 0x3f, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})

06:39:52 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4, 0x0, &(0x7f0000000300)=[@exit_looper], 0x0, 0x0, 0x0})

06:39:52 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000080)={0x1})

06:39:52 executing program 1:
r0 = openat$zero(0xffffffffffffff9c, &(0x7f00000000c0), 0x8000, 0x0)
ioctl$DRM_IOCTL_SET_SAREA_CTX(r0, 0x4010641c, &(0x7f0000000140)={0x0, &(0x7f00000002c0)=""/167})
r1 = syz_open_dev$vim2m(&(0x7f0000000040), 0x7ff, 0x2)
ioctl$vim2m_VIDIOC_QBUF(r1, 0xc058560f, &(0x7f00000001c0)={0x9, 0x3, 0x4, 0x8, 0x0, {}, {0x4, 0x2, 0xe8, 0x1c, 0x2, 0xcf, "d450fd5b"}, 0x1, 0x1, @fd, 0x7})

06:39:52 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_QUERYBUF(r1, 0xc0585609, &(0x7f0000000180)={0x0, 0x0, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "56850780"}})
ioctl$vim2m_VIDIOC_ENUM_FMT(r1, 0xc0405602, &(0x7f00000000c0)={0x2, 0x2, 0x2, "3c0a6d51c9e13895daefdd36340da9bf00280441eeb9983a920642d33a92f380", 0xb5315258})

06:39:52 executing program 2:
r0 = socket(0xa, 0x803, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x0, 0x0, 0x0, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})

06:39:52 executing program 3:
r0 = socket(0xa, 0x803, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, 0x0)

06:39:52 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x50, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@flat=@weak_handle={0x77682a85, 0x1, 0x2}, @ptr={0x70742a85, 0x0, &(0x7f0000000080)=""/169, 0xa9, 0x2, 0x4}, @ptr={0x70742a85, 0x5, &(0x7f0000000140)=""/40, 0x28, 0x1, 0x26}}, &(0x7f0000000240)={0x0, 0x18, 0x40}}, 0x40}, @exit_looper], 0x0, 0x0, 0x0})

06:39:53 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000080)={0x1})

06:39:53 executing program 1:
openat$zero(0xffffffffffffff9c, &(0x7f00000000c0), 0x8000, 0x0)
r0 = syz_open_dev$vim2m(&(0x7f0000000040), 0x7ff, 0x2)
ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f00000001c0)={0x9, 0x3, 0x4, 0x8, 0x0, {}, {0x4, 0x2, 0xe8, 0x1c, 0x2, 0xcf, "d450fd5b"}, 0x1, 0x1, @fd, 0x7})

06:39:53 executing program 2:
r0 = socket(0xa, 0x803, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x0, 0x0, 0x0, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})

06:39:53 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r1 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_ENUM_FMT(r1, 0xc0405602, &(0x7f00000000c0)={0x2, 0x2, 0x2, "3c0a6d51c9e13895daefdd36340da9bf00280441eeb9983a920642d33a92f380", 0xb5315258})

06:39:53 executing program 3:
r0 = socket(0xa, 0x803, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, 0x0)

06:39:53 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x50, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f00000001c0)={@flat=@weak_handle={0x77682a85, 0x1, 0x2}, @ptr={0x70742a85, 0x0, &(0x7f0000000080)=""/169, 0xa9, 0x2, 0x4}, @ptr={0x70742a85, 0x5, &(0x7f0000000140)=""/40, 0x28, 0x1, 0x26}}, &(0x7f0000000240)={0x0, 0x18, 0x40}}, 0x40}, @exit_looper], 0x0, 0x0, 0x0})

06:39:53 executing program 0:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000080)={0x1})

06:39:53 executing program 1:
r0 = syz_open_dev$vim2m(&(0x7f0000000040), 0x7ff, 0x2)
ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f00000001c0)={0x9, 0x3, 0x4, 0x8, 0x0, {}, {0x4, 0x2, 0xe8, 0x1c, 0x2, 0xcf, "d450fd5b"}, 0x1, 0x1, @fd, 0x7})

06:39:53 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
ioctl$vim2m_VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405602, &(0x7f00000000c0)={0x2, 0x2, 0x2, "3c0a6d51c9e13895daefdd36340da9bf00280441eeb9983a920642d33a92f380", 0xb5315258})

06:39:53 executing program 2:
r0 = socket(0xa, 0x803, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x0, 0x0, 0xf8, 0x0, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})

06:39:53 executing program 3:
r0 = socket(0xa, 0x803, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, 0x0)

06:39:53 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x50, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000240)}, 0x40}, @exit_looper], 0x0, 0x0, 0x0})

06:39:54 executing program 0:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000080)={0x1})

06:39:54 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
ioctl$vim2m_VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405602, &(0x7f00000000c0)={0x2, 0x2, 0x2, "3c0a6d51c9e13895daefdd36340da9bf00280441eeb9983a920642d33a92f380", 0xb5315258})

06:39:54 executing program 2:
r0 = socket(0xa, 0x803, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x0, 0x0, 0xf8, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})

06:39:54 executing program 1:
r0 = syz_open_dev$vim2m(0x0, 0x7ff, 0x2)
ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f00000001c0)={0x9, 0x3, 0x4, 0x8, 0x0, {}, {0x4, 0x2, 0xe8, 0x1c, 0x2, 0xcf, "d450fd5b"}, 0x1, 0x1, @fd, 0x7})

06:39:54 executing program 3:
r0 = socket(0xa, 0x803, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', 0x0})

06:39:54 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x50, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40}, @exit_looper], 0x0, 0x0, 0x0})

06:39:54 executing program 0:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000080)={0x1})

06:39:54 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
ioctl$vim2m_VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405602, &(0x7f00000000c0)={0x2, 0x2, 0x2, "3c0a6d51c9e13895daefdd36340da9bf00280441eeb9983a920642d33a92f380", 0xb5315258})

06:39:55 executing program 2:
r0 = socket(0xa, 0x803, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x0, 0x0, 0xf8, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x0, 0x80}})

06:39:55 executing program 3:
r0 = socket(0xa, 0x803, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', 0x0})

06:39:55 executing program 1:
r0 = syz_open_dev$vim2m(0x0, 0x7ff, 0x2)
ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f00000001c0)={0x9, 0x3, 0x4, 0x8, 0x0, {}, {0x4, 0x2, 0xe8, 0x1c, 0x2, 0xcf, "d450fd5b"}, 0x1, 0x1, @fd, 0x7})

06:39:55 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x50, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, @exit_looper], 0x0, 0x0, 0x0})

06:39:55 executing program 4:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r0 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f00000000c0)={0x2, 0x2, 0x2, "3c0a6d51c9e13895daefdd36340da9bf00280441eeb9983a920642d33a92f380", 0xb5315258})

06:39:55 executing program 0:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000080)={0x1})

06:39:55 executing program 5:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000400)={0x24, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="0f630c400000000000d929d11f927f937b98cf01f27415000000000000000c6e000007630440020000000763044002000000e4ff0faf454e970b348787c58caf26d8d32ec14562b42d8403d21d72654e7c6fe702525c348516d7f1cde1f45ff028e6ad2a20f6069c90fe"], 0x2f, 0x0, &(0x7f00000003c0)="d44d1c88fdf9bb9c510184f0b72257acbc8cd1f39f22a315ade890322da62489755f6abbb0af13152085ba457f4c05"})
r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000200), r0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x9, &(0x7f0000000240)='netdevsim', <r3=>0x0}, 0x30)
bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000002c0)={r3}, 0x4)
r4 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_QUERYBUF(r4, 0xc0585609, &(0x7f0000000180)={0x0, 0x0, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "56850780"}})
ioctl$vim2m_VIDIOC_DQBUF(r4, 0xc0585611, &(0x7f0000000580)={0x7, 0x0, 0x4, 0x4000, 0x1000, {}, {0x0, 0x0, 0xfa, 0x9, 0x4, 0x3, "c0fcb596"}, 0x2, 0x1, @userptr=0xc8})
syz_genetlink_get_family_id$devlink(&(0x7f0000000440), r2)
sendmsg$DEVLINK_CMD_PORT_UNSPLIT(r0, &(0x7f0000000380)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)={0xfc, r1, 0x7ff, 0x70bd2a, 0x25dfdbff, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x2}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}}]}, 0xfc}, 0x1, 0x0, 0x0, 0x8015}, 0x4008014)
sendmsg$NL80211_CMD_GET_SCAN(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x20, 0x0, 0x10, 0x70bd25, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x6, 0x41}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x2000004}, 0x80)

06:39:55 executing program 2:
r0 = socket(0xa, 0x803, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x0, 0x0, 0xf8, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}, @remote}})

06:39:55 executing program 1:
r0 = syz_open_dev$vim2m(0x0, 0x7ff, 0x2)
ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f00000001c0)={0x9, 0x3, 0x4, 0x8, 0x0, {}, {0x4, 0x2, 0xe8, 0x1c, 0x2, 0xcf, "d450fd5b"}, 0x1, 0x1, @fd, 0x7})

06:39:55 executing program 3:
r0 = socket(0xa, 0x803, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', 0x0})

06:39:56 executing program 4:
r0 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f00000000c0)={0x2, 0x2, 0x2, "3c0a6d51c9e13895daefdd36340da9bf00280441eeb9983a920642d33a92f380", 0xb5315258})

06:39:56 executing program 0:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000080)={0x1})

06:39:56 executing program 5:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000400)={0x24, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="0f630c400000000000d929d11f927f937b98cf01f27415000000000000000c6e000007630440020000000763044002000000e4ff0faf454e970b348787c58caf26d8d32ec14562b42d8403d21d72654e7c6fe702525c348516d7f1cde1f45ff028e6ad2a20f6069c90fe"], 0x2f, 0x0, &(0x7f00000003c0)="d44d1c88fdf9bb9c510184f0b72257acbc8cd1f39f22a315ade890322da62489755f6abbb0af13152085ba457f4c05"})
r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000200), r0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x9, &(0x7f0000000240)='netdevsim', <r3=>0x0}, 0x30)
bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000002c0)={r3}, 0x4)
r4 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_QUERYBUF(r4, 0xc0585609, &(0x7f0000000180)={0x0, 0x0, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "56850780"}})
ioctl$vim2m_VIDIOC_DQBUF(r4, 0xc0585611, &(0x7f0000000580)={0x7, 0x0, 0x4, 0x4000, 0x1000, {}, {0x0, 0x0, 0xfa, 0x9, 0x4, 0x3, "c0fcb596"}, 0x2, 0x1, @userptr=0xc8})
syz_genetlink_get_family_id$devlink(&(0x7f0000000440), r2)
sendmsg$DEVLINK_CMD_PORT_UNSPLIT(r0, &(0x7f0000000380)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)={0xfc, r1, 0x7ff, 0x70bd2a, 0x25dfdbff, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x2}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}}]}, 0xfc}, 0x1, 0x0, 0x0, 0x8015}, 0x4008014)
sendmsg$NL80211_CMD_GET_SCAN(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x20, 0x0, 0x10, 0x70bd25, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x6, 0x41}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x2000004}, 0x80)

06:39:56 executing program 2:
socketpair(0x22, 0x1, 0x2, &(0x7f0000000000))
socketpair(0x2, 0xa, 0x81, &(0x7f00000015c0))
r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040), 0x12d100, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, 0x0, 0x0)
ioctl$SNDCTL_TMR_CONTINUE(r0, 0x5404)

06:39:56 executing program 3:
r0 = socket(0xa, 0x803, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x0, 0x3f, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})

06:39:56 executing program 1:
r0 = syz_open_dev$vim2m(&(0x7f0000000040), 0x0, 0x2)
ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f00000001c0)={0x9, 0x3, 0x4, 0x8, 0x0, {}, {0x4, 0x2, 0xe8, 0x1c, 0x2, 0xcf, "d450fd5b"}, 0x1, 0x1, @fd, 0x7})

06:39:56 executing program 0:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000080)={0x1})

06:39:56 executing program 4:
r0 = syz_open_dev$vim2m(0x0, 0x0, 0x2)
ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f00000000c0)={0x2, 0x2, 0x2, "3c0a6d51c9e13895daefdd36340da9bf00280441eeb9983a920642d33a92f380", 0xb5315258})

06:39:56 executing program 2:
socketpair(0x22, 0x1, 0x2, &(0x7f0000000000))
socketpair(0x2, 0xa, 0x81, &(0x7f00000015c0))
r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040), 0x12d100, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, 0x0, 0x0)
ioctl$SNDCTL_TMR_CONTINUE(r0, 0x5404)

06:39:56 executing program 5:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000400)={0x24, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="0f630c400000000000d929d11f927f937b98cf01f27415000000000000000c6e000007630440020000000763044002000000e4ff0faf454e970b348787c58caf26d8d32ec14562b42d8403d21d72654e7c6fe702525c348516d7f1cde1f45ff028e6ad2a20f6069c90fe"], 0x2f, 0x0, &(0x7f00000003c0)="d44d1c88fdf9bb9c510184f0b72257acbc8cd1f39f22a315ade890322da62489755f6abbb0af13152085ba457f4c05"})
r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000200), r0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x9, &(0x7f0000000240)='netdevsim', <r3=>0x0}, 0x30)
bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000002c0)={r3}, 0x4)
r4 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_QUERYBUF(r4, 0xc0585609, &(0x7f0000000180)={0x0, 0x0, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "56850780"}})
ioctl$vim2m_VIDIOC_DQBUF(r4, 0xc0585611, &(0x7f0000000580)={0x7, 0x0, 0x4, 0x4000, 0x1000, {}, {0x0, 0x0, 0xfa, 0x9, 0x4, 0x3, "c0fcb596"}, 0x2, 0x1, @userptr=0xc8})
syz_genetlink_get_family_id$devlink(&(0x7f0000000440), r2)
sendmsg$DEVLINK_CMD_PORT_UNSPLIT(r0, &(0x7f0000000380)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)={0xfc, r1, 0x7ff, 0x70bd2a, 0x25dfdbff, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x2}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}}]}, 0xfc}, 0x1, 0x0, 0x0, 0x8015}, 0x4008014)
sendmsg$NL80211_CMD_GET_SCAN(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x20, 0x0, 0x10, 0x70bd25, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x6, 0x41}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x2000004}, 0x80)

06:39:56 executing program 3:
r0 = socket(0xa, 0x803, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x0, 0x0, 0xf8, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})

06:39:56 executing program 1:
r0 = syz_open_dev$vim2m(&(0x7f0000000040), 0x0, 0x2)
ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f00000001c0)={0x9, 0x3, 0x4, 0x8, 0x0, {}, {0x4, 0x2, 0xe8, 0x1c, 0x2, 0xcf, "d450fd5b"}, 0x1, 0x1, @fd, 0x7})

06:39:57 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000080)={0x1})

06:39:57 executing program 4:
r0 = syz_open_dev$vim2m(0x0, 0x0, 0x2)
ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f00000000c0)={0x2, 0x2, 0x2, "3c0a6d51c9e13895daefdd36340da9bf00280441eeb9983a920642d33a92f380", 0xb5315258})

06:39:57 executing program 3:
r0 = socket(0xa, 0x803, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x0, 0x0, 0x0, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})

06:39:57 executing program 5:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000400)={0x24, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="0f630c400000000000d929d11f927f937b98cf01f27415000000000000000c6e000007630440020000000763044002000000e4ff0faf454e970b348787c58caf26d8d32ec14562b42d8403d21d72654e7c6fe702525c348516d7f1cde1f45ff028e6ad2a20f6069c90fe"], 0x2f, 0x0, &(0x7f00000003c0)="d44d1c88fdf9bb9c510184f0b72257acbc8cd1f39f22a315ade890322da62489755f6abbb0af13152085ba457f4c05"})
r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000200), r0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x9, &(0x7f0000000240)='netdevsim', <r3=>0x0}, 0x30)
bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000002c0)={r3}, 0x4)
r4 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_QUERYBUF(r4, 0xc0585609, &(0x7f0000000180)={0x0, 0x0, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "56850780"}})
ioctl$vim2m_VIDIOC_DQBUF(r4, 0xc0585611, &(0x7f0000000580)={0x7, 0x0, 0x4, 0x4000, 0x1000, {}, {0x0, 0x0, 0xfa, 0x9, 0x4, 0x3, "c0fcb596"}, 0x2, 0x1, @userptr=0xc8})
syz_genetlink_get_family_id$devlink(&(0x7f0000000440), r2)
sendmsg$DEVLINK_CMD_PORT_UNSPLIT(r0, &(0x7f0000000380)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)={0xfc, r1, 0x7ff, 0x70bd2a, 0x25dfdbff, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x2}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}}]}, 0xfc}, 0x1, 0x0, 0x0, 0x8015}, 0x4008014)

06:39:57 executing program 2:
socketpair(0x22, 0x1, 0x2, &(0x7f0000000000))
socketpair(0x2, 0xa, 0x81, &(0x7f00000015c0))
r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040), 0x12d100, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, 0x0, 0x0)
ioctl$SNDCTL_TMR_CONTINUE(r0, 0x5404)

06:39:57 executing program 1:
r0 = syz_open_dev$vim2m(&(0x7f0000000040), 0x0, 0x2)
ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f00000001c0)={0x9, 0x3, 0x4, 0x8, 0x0, {}, {0x4, 0x2, 0xe8, 0x1c, 0x2, 0xcf, "d450fd5b"}, 0x1, 0x1, @fd, 0x7})

06:39:57 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000080)={0x1})

06:39:57 executing program 4:
r0 = syz_open_dev$vim2m(0x0, 0x0, 0x2)
ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f00000000c0)={0x2, 0x2, 0x2, "3c0a6d51c9e13895daefdd36340da9bf00280441eeb9983a920642d33a92f380", 0xb5315258})

06:39:57 executing program 5:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000400)={0x24, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="0f630c400000000000d929d11f927f937b98cf01f27415000000000000000c6e000007630440020000000763044002000000e4ff0faf454e970b348787c58caf26d8d32ec14562b42d8403d21d72654e7c6fe702525c348516d7f1cde1f45ff028e6ad2a20f6069c90fe"], 0x2f, 0x0, &(0x7f00000003c0)="d44d1c88fdf9bb9c510184f0b72257acbc8cd1f39f22a315ade890322da62489755f6abbb0af13152085ba457f4c05"})
syz_genetlink_get_family_id$devlink(&(0x7f0000000200), r0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x9, &(0x7f0000000240)='netdevsim', <r2=>0x0}, 0x30)
bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000002c0)={r2}, 0x4)
r3 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_QUERYBUF(r3, 0xc0585609, &(0x7f0000000180)={0x0, 0x0, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "56850780"}})
ioctl$vim2m_VIDIOC_DQBUF(r3, 0xc0585611, &(0x7f0000000580)={0x7, 0x0, 0x4, 0x4000, 0x1000, {}, {0x0, 0x0, 0xfa, 0x9, 0x4, 0x3, "c0fcb596"}, 0x2, 0x1, @userptr=0xc8})
syz_genetlink_get_family_id$devlink(&(0x7f0000000440), r1)

06:39:57 executing program 3:
r0 = socket(0xa, 0x803, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x0, 0x0, 0x0, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})

06:39:58 executing program 2:
socketpair(0x22, 0x1, 0x2, &(0x7f0000000000))
socketpair(0x2, 0xa, 0x81, &(0x7f00000015c0))
r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040), 0x12d100, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, 0x0, 0x0)

06:39:58 executing program 1:
syz_open_dev$vim2m(&(0x7f0000000040), 0x7ff, 0x2)
ioctl$vim2m_VIDIOC_QBUF(0xffffffffffffffff, 0xc058560f, &(0x7f00000001c0)={0x9, 0x3, 0x4, 0x8, 0x0, {}, {0x4, 0x2, 0xe8, 0x1c, 0x2, 0xcf, "d450fd5b"}, 0x1, 0x1, @fd, 0x7})

06:39:58 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000080)={0x1})

06:39:58 executing program 4:
syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405602, &(0x7f00000000c0)={0x2, 0x2, 0x2, "3c0a6d51c9e13895daefdd36340da9bf00280441eeb9983a920642d33a92f380", 0xb5315258})

06:39:58 executing program 5:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000400)={0x24, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="0f630c400000000000d929d11f927f937b98cf01f27415000000000000000c6e000007630440020000000763044002000000e4ff0faf454e970b348787c58caf26d8d32ec14562b42d8403d21d72654e7c6fe702525c348516d7f1cde1f45ff028e6ad2a20f6069c90fe"], 0x2f, 0x0, &(0x7f00000003c0)="d44d1c88fdf9bb9c510184f0b72257acbc8cd1f39f22a315ade890322da62489755f6abbb0af13152085ba457f4c05"})
syz_genetlink_get_family_id$devlink(&(0x7f0000000200), r0)
socket$nl_generic(0x10, 0x3, 0x10)
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x9, &(0x7f0000000240)='netdevsim', <r1=>0x0}, 0x30)
bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000002c0)={r1}, 0x4)
r2 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_QUERYBUF(r2, 0xc0585609, &(0x7f0000000180)={0x0, 0x0, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "56850780"}})
ioctl$vim2m_VIDIOC_DQBUF(r2, 0xc0585611, &(0x7f0000000580)={0x7, 0x0, 0x4, 0x4000, 0x1000, {}, {0x0, 0x0, 0xfa, 0x9, 0x4, 0x3, "c0fcb596"}, 0x2, 0x1, @userptr=0xc8})

06:39:58 executing program 3:
r0 = socket(0xa, 0x803, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x0, 0x0, 0x0, 0x5f75, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})

06:39:58 executing program 2:
socketpair(0x22, 0x1, 0x2, &(0x7f0000000000))
socketpair(0x2, 0xa, 0x81, &(0x7f00000015c0))
openat$zero(0xffffffffffffff9c, &(0x7f0000000040), 0x12d100, 0x0)

06:39:58 executing program 1:
syz_open_dev$vim2m(&(0x7f0000000040), 0x7ff, 0x2)
ioctl$vim2m_VIDIOC_QBUF(0xffffffffffffffff, 0xc058560f, &(0x7f00000001c0)={0x9, 0x3, 0x4, 0x8, 0x0, {}, {0x4, 0x2, 0xe8, 0x1c, 0x2, 0xcf, "d450fd5b"}, 0x1, 0x1, @fd, 0x7})

06:39:58 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000080)={0x1})

06:39:58 executing program 4:
syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405602, &(0x7f00000000c0)={0x2, 0x2, 0x2, "3c0a6d51c9e13895daefdd36340da9bf00280441eeb9983a920642d33a92f380", 0xb5315258})

06:39:58 executing program 5:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000400)={0x24, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="0f630c400000000000d929d11f927f937b98cf01f27415000000000000000c6e000007630440020000000763044002000000e4ff0faf454e970b348787c58caf26d8d32ec14562b42d8403d21d72654e7c6fe702525c348516d7f1cde1f45ff028e6ad2a20f6069c90fe"], 0x2f, 0x0, &(0x7f00000003c0)="d44d1c88fdf9bb9c510184f0b72257acbc8cd1f39f22a315ade890322da62489755f6abbb0af13152085ba457f4c05"})
syz_genetlink_get_family_id$devlink(&(0x7f0000000200), r0)
socket$nl_generic(0x10, 0x3, 0x10)
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x9, &(0x7f0000000240)='netdevsim', <r1=>0x0}, 0x30)
bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000002c0)={r1}, 0x4)
r2 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_QUERYBUF(r2, 0xc0585609, &(0x7f0000000180)={0x0, 0x0, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "56850780"}})

06:39:59 executing program 3:
r0 = socket(0xa, 0x803, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x0, 0x0, 0xf8, 0x0, 0x60, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})

[ 1711.489124][T12411] binder: 12409:12411 ioctl c0306201 0 returned -14
06:39:59 executing program 1:
syz_open_dev$vim2m(&(0x7f0000000040), 0x7ff, 0x2)
ioctl$vim2m_VIDIOC_QBUF(0xffffffffffffffff, 0xc058560f, &(0x7f00000001c0)={0x9, 0x3, 0x4, 0x8, 0x0, {}, {0x4, 0x2, 0xe8, 0x1c, 0x2, 0xcf, "d450fd5b"}, 0x1, 0x1, @fd, 0x7})

06:39:59 executing program 2:
socketpair(0x22, 0x1, 0x2, &(0x7f0000000000))
socketpair(0x2, 0xa, 0x81, &(0x7f00000015c0))

06:39:59 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000080)={0x1})

06:39:59 executing program 4:
syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405602, &(0x7f00000000c0)={0x2, 0x2, 0x2, "3c0a6d51c9e13895daefdd36340da9bf00280441eeb9983a920642d33a92f380", 0xb5315258})

06:39:59 executing program 3:
r0 = socket(0xa, 0x803, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x0, 0x0, 0xf8, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x80, 0x80}})

06:39:59 executing program 5:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000400)={0x24, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="0f630c400000000000d929d11f927f937b98cf01f27415000000000000000c6e000007630440020000000763044002000000e4ff0faf454e970b348787c58caf26d8d32ec14562b42d8403d21d72654e7c6fe702525c348516d7f1cde1f45ff028e6ad2a20f6069c90fe"], 0x2f, 0x0, &(0x7f00000003c0)="d44d1c88fdf9bb9c510184f0b72257acbc8cd1f39f22a315ade890322da62489755f6abbb0af13152085ba457f4c05"})
syz_genetlink_get_family_id$devlink(&(0x7f0000000200), r0)
socket$nl_generic(0x10, 0x3, 0x10)
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x9, &(0x7f0000000240)='netdevsim', <r1=>0x0}, 0x30)
bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000002c0)={r1}, 0x4)
syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)

[ 1712.028492][T12424] binder: 12423:12424 ioctl c0306201 0 returned -14
06:39:59 executing program 2:
socketpair(0x22, 0x1, 0x2, &(0x7f0000000000))

06:39:59 executing program 1:
r0 = syz_open_dev$vim2m(&(0x7f0000000040), 0x7ff, 0x2)
ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, 0x0)

06:39:59 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000080)={0x1})

06:40:00 executing program 4:
r0 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, 0x0)

06:40:00 executing program 3:
r0 = socket(0xa, 0x803, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x0, 0x0, 0xf8, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}, @remote, 0x0, 0x80}})

06:40:00 executing program 5:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000400)={0x24, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="0f630c400000000000d929d11f927f937b98cf01f27415000000000000000c6e000007630440020000000763044002000000e4ff0faf454e970b348787c58caf26d8d32ec14562b42d8403d21d72654e7c6fe702525c348516d7f1cde1f45ff028e6ad2a20f6069c90fe"], 0x2f, 0x0, &(0x7f00000003c0)="d44d1c88fdf9bb9c510184f0b72257acbc8cd1f39f22a315ade890322da62489755f6abbb0af13152085ba457f4c05"})
syz_genetlink_get_family_id$devlink(&(0x7f0000000200), r0)
socket$nl_generic(0x10, 0x3, 0x10)
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x9, &(0x7f0000000240)='netdevsim', <r1=>0x0}, 0x30)
bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000002c0)={r1}, 0x4)

06:40:00 executing program 2:
socketpair(0x0, 0x1, 0x2, &(0x7f0000000000))

[ 1712.636862][T12439] binder: 12437:12439 ioctl c0306201 0 returned -14
06:40:00 executing program 1:
r0 = syz_open_dev$vim2m(&(0x7f0000000040), 0x7ff, 0x2)
ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, 0x0)

06:40:00 executing program 4:
r0 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, 0x0)

06:40:00 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000080)={0x1})

06:40:00 executing program 3:
r0 = socket(0xa, 0x803, 0x7f)
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000140)={'sit0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x0, 0x0, 0xf8, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}, @remote}})

06:40:00 executing program 5:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000400)={0x24, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="0f630c400000000000d929d11f927f937b98cf01f27415000000000000000c6e000007630440020000000763044002000000e4ff0faf454e970b348787c58caf26d8d32ec14562b42d8403d21d72654e7c6fe702525c348516d7f1cde1f45ff028e6ad2a20f6069c90fe"], 0x2f, 0x0, &(0x7f00000003c0)="d44d1c88fdf9bb9c510184f0b72257acbc8cd1f39f22a315ade890322da62489755f6abbb0af13152085ba457f4c05"})
syz_genetlink_get_family_id$devlink(&(0x7f0000000200), r0)
socket$nl_generic(0x10, 0x3, 0x10)
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x9, &(0x7f0000000240)='netdevsim'}, 0x30)

06:40:00 executing program 1:
r0 = syz_open_dev$vim2m(&(0x7f0000000040), 0x7ff, 0x2)
ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, 0x0)

[ 1713.291450][T12456] binder: 12453:12456 ioctl c0306201 0 returned -14
06:40:01 executing program 2:
socketpair(0x0, 0x1, 0x2, &(0x7f0000000000))

06:40:01 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0)

06:40:01 executing program 4:
r0 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, 0x0)

06:40:01 executing program 3:
r0 = gettid()
gettid()
sched_rr_get_interval(r0, &(0x7f0000000800))
capget(&(0x7f0000000000)={0x20080522, r0}, &(0x7f0000000040)={0x3, 0x7, 0x9, 0x0, 0x2c, 0x3669})
socketpair(0x2, 0xa, 0x81, &(0x7f00000015c0))
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x11, r1, 0xfffffffffffffffb)

06:40:01 executing program 5:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000400)={0x24, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="0f630c400000000000d929d11f927f937b98cf01f27415000000000000000c6e000007630440020000000763044002000000e4ff0faf454e970b348787c58caf26d8d32ec14562b42d8403d21d72654e7c6fe702525c348516d7f1cde1f45ff028e6ad2a20f6069c90fe"], 0x2f, 0x0, &(0x7f00000003c0)="d44d1c88fdf9bb9c510184f0b72257acbc8cd1f39f22a315ade890322da62489755f6abbb0af13152085ba457f4c05"})
syz_genetlink_get_family_id$devlink(&(0x7f0000000200), r0)
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x9, &(0x7f0000000240)='netdevsim'}, 0x30)

[ 1713.893547][T12468] binder: 12465:12468 ioctl c018620b 0 returned -14
06:40:01 executing program 1:
r0 = syz_open_dev$vim2m(&(0x7f0000000040), 0x7ff, 0x2)
ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f00000001c0)={0x0, 0x3, 0x4, 0x8, 0x0, {}, {0x4, 0x2, 0xe8, 0x1c, 0x2, 0xcf, "d450fd5b"}, 0x1, 0x1, @fd, 0x7})

06:40:01 executing program 2:
socketpair(0x0, 0x1, 0x2, &(0x7f0000000000))

06:40:01 executing program 4:
r0 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f00000000c0)={0x0, 0x2, 0x2, "3c0a6d51c9e13895daefdd36340da9bf00280441eeb9983a920642d33a92f380", 0xb5315258})

06:40:01 executing program 3:
r0 = gettid()
gettid()
sched_rr_get_interval(r0, &(0x7f0000000800))
capget(&(0x7f0000000000)={0x20080522, r0}, &(0x7f0000000040)={0x3, 0x7, 0x9, 0x0, 0x2c, 0x3669})
socketpair(0x2, 0xa, 0x81, &(0x7f00000015c0))
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x11, r1, 0xfffffffffffffffb)

06:40:01 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0)

06:40:02 executing program 5:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
socket$nl_generic(0x10, 0x3, 0x10)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000400)={0x24, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="0f630c400000000000d929d11f927f937b98cf01f27415000000000000000c6e000007630440020000000763044002000000e4ff0faf454e970b348787c58caf26d8d32ec14562b42d8403d21d72654e7c6fe702525c348516d7f1cde1f45ff028e6ad2a20f6069c90fe"], 0x2f, 0x0, &(0x7f00000003c0)="d44d1c88fdf9bb9c510184f0b72257acbc8cd1f39f22a315ade890322da62489755f6abbb0af13152085ba457f4c05"})
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x9, &(0x7f0000000240)='netdevsim'}, 0x30)

[ 1714.556361][T12486] binder: 12485:12486 ioctl c0306201 0 returned -14
06:40:02 executing program 1:
r0 = syz_open_dev$vim2m(&(0x7f0000000040), 0x7ff, 0x2)
ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f00000001c0)={0x0, 0x0, 0x4, 0x8, 0x0, {}, {0x4, 0x2, 0xe8, 0x1c, 0x2, 0xcf, "d450fd5b"}, 0x1, 0x1, @fd, 0x7})

[ 1714.598155][T12486] binder: 12485:12486 ioctl c018620b 0 returned -14
06:40:02 executing program 4:
r0 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f00000000c0)={0x0, 0x2, 0x2, "3c0a6d51c9e13895daefdd36340da9bf00280441eeb9983a920642d33a92f380", 0xb5315258})

06:40:02 executing program 2:
socketpair(0x22, 0x0, 0x2, &(0x7f0000000000))

06:40:02 executing program 3:
r0 = gettid()
gettid()
sched_rr_get_interval(r0, &(0x7f0000000800))
capget(&(0x7f0000000000)={0x20080522, r0}, &(0x7f0000000040)={0x3, 0x7, 0x9, 0x0, 0x2c, 0x3669})
socketpair(0x2, 0xa, 0x81, &(0x7f00000015c0))
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x11, r1, 0xfffffffffffffffb)

06:40:02 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0)

06:40:02 executing program 5:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
socket$nl_generic(0x10, 0x3, 0x10)
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x9, &(0x7f0000000240)='netdevsim'}, 0x30)

06:40:02 executing program 1:
r0 = syz_open_dev$vim2m(&(0x7f0000000040), 0x7ff, 0x2)
ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f00000001c0)={0x0, 0x0, 0x4, 0x8, 0x0, {}, {0x4, 0x2, 0xe8, 0x1c, 0x2, 0xcf, "d450fd5b"}, 0x1, 0x1, @fd, 0x7})

06:40:02 executing program 2:
socketpair(0x22, 0x0, 0x0, &(0x7f0000000000))

06:40:02 executing program 4:
r0 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f00000000c0)={0x0, 0x0, 0x2, "3c0a6d51c9e13895daefdd36340da9bf00280441eeb9983a920642d33a92f380", 0xb5315258})

[ 1715.297727][T12501] binder: 12499:12501 ioctl c0306201 0 returned -14
[ 1715.344788][T12501] binder: 12499:12501 ioctl c018620b 0 returned -14
06:40:03 executing program 3:
r0 = gettid()
gettid()
sched_rr_get_interval(r0, &(0x7f0000000800))
capget(&(0x7f0000000000)={0x20080522, r0}, &(0x7f0000000040)={0x3, 0x7, 0x9, 0x0, 0x2c, 0x3669})
socketpair(0x2, 0xa, 0x81, &(0x7f00000015c0))
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)

06:40:03 executing program 5:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x9, &(0x7f0000000240)='netdevsim'}, 0x30)

06:40:03 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000080))

06:40:03 executing program 1:
r0 = syz_open_dev$vim2m(&(0x7f0000000040), 0x7ff, 0x2)
ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f00000001c0)={0x0, 0x0, 0x4, 0x8, 0x0, {}, {0x4, 0x2, 0xe8, 0x1c, 0x2, 0xcf, "d450fd5b"}, 0x1, 0x1, @fd, 0x7})

06:40:03 executing program 2:
socketpair(0x22, 0x0, 0x0, &(0x7f0000000000))

06:40:03 executing program 4:
r0 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f00000000c0)={0x0, 0x0, 0x2, "3c0a6d51c9e13895daefdd36340da9bf00280441eeb9983a920642d33a92f380", 0xb5315258})

06:40:03 executing program 3:
r0 = gettid()
gettid()
sched_rr_get_interval(r0, &(0x7f0000000800))
capget(&(0x7f0000000000)={0x20080522, r0}, &(0x7f0000000040)={0x3, 0x7, 0x9, 0x0, 0x2c, 0x3669})
socketpair(0x2, 0xa, 0x81, &(0x7f00000015c0))
openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)

[ 1716.011729][T12517] binder: 12514:12517 ioctl c0306201 0 returned -14
06:40:03 executing program 5:
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x9, &(0x7f0000000240)='netdevsim'}, 0x30)

06:40:03 executing program 1:
r0 = syz_open_dev$vim2m(&(0x7f0000000040), 0x7ff, 0x2)
ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f00000001c0)={0x0, 0x3, 0x4, 0x0, 0x0, {}, {0x4, 0x2, 0xe8, 0x1c, 0x2, 0xcf, "d450fd5b"}, 0x1, 0x1, @fd, 0x7})

06:40:03 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000080))

06:40:04 executing program 2:
socketpair(0x22, 0x0, 0x0, &(0x7f0000000000))

06:40:04 executing program 4:
r0 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f00000000c0)={0x0, 0x0, 0x2, "3c0a6d51c9e13895daefdd36340da9bf00280441eeb9983a920642d33a92f380", 0xb5315258})

06:40:04 executing program 3:
r0 = gettid()
gettid()
sched_rr_get_interval(r0, &(0x7f0000000800))
capget(&(0x7f0000000000)={0x20080522, r0}, &(0x7f0000000040)={0x3, 0x7, 0x9, 0x0, 0x2c, 0x3669})
socketpair(0x2, 0xa, 0x81, &(0x7f00000015c0))

[ 1716.586271][T12531] binder: 12528:12531 ioctl c0306201 0 returned -14
06:40:04 executing program 1:
r0 = syz_open_dev$vim2m(&(0x7f0000000040), 0x7ff, 0x2)
ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f00000001c0)={0x0, 0x3, 0x4, 0x0, 0x0, {}, {0x0, 0x2, 0xe8, 0x1c, 0x2, 0xcf, "d450fd5b"}, 0x1, 0x1, @fd, 0x7})

06:40:04 executing program 5:
bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0)

06:40:04 executing program 0:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000400)={0x24, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="0f630c400000000000d929d11f927f937b98cf01f27415000000000000000c6e000007630440020000000763044002000000e4ff0faf454e970b348787c58caf26d8d32ec14562b42d8403d21d72654e7c6fe702525c348516d7f1cde1f45ff028e6ad2a20f6069c90fe"], 0x2f, 0x0, &(0x7f00000003c0)="d44d1c88fdf9bb9c510184f0b72257acbc8cd1f39f22a315ade890322da62489755f6abbb0af13152085ba457f4c05"})
syz_genetlink_get_family_id$devlink(&(0x7f0000000200), r0)
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x9, &(0x7f0000000240)='netdevsim'}, 0x30)

06:40:04 executing program 2:
socketpair(0x22, 0x0, 0x2, 0x0)

06:40:04 executing program 4:
r0 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f00000000c0)={0x0, 0x2, 0x0, "3c0a6d51c9e13895daefdd36340da9bf00280441eeb9983a920642d33a92f380", 0xb5315258})

06:40:04 executing program 3:
r0 = gettid()
gettid()
sched_rr_get_interval(r0, &(0x7f0000000800))
capget(&(0x7f0000000000)={0x20080522, r0}, &(0x7f0000000040)={0x3, 0x7, 0x9, 0x0, 0x2c, 0x3669})

06:40:04 executing program 1:
r0 = syz_open_dev$vim2m(&(0x7f0000000040), 0x7ff, 0x2)
ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f00000001c0)={0x0, 0x3, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0xe8, 0x1c, 0x2, 0xcf, "d450fd5b"}, 0x1, 0x1, @fd, 0x7})

06:40:04 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0x500, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:05 executing program 0:
socketpair(0x2, 0xa, 0x81, &(0x7f00000015c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r2, &(0x7f0000000100)={&(0x7f00000003c0), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r3, 0xcd6ccc609280a2c3, 0x0, 0x0, {{}, {@void, @void}}, [@NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x3}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x24}}, 0x0)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r5 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_QUERYBUF(r5, 0xc0585609, &(0x7f0000000180)={0x0, 0x0, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "56850780"}})
ioctl$vim2m_VIDIOC_QBUF(r5, 0xc058560f, &(0x7f0000000340)={0x7, 0x3, 0x4, 0xe000, 0x1d, {0x0, 0xea60}, {0x2, 0x8, 0x1f, 0x2, 0x6, 0x40, "3ea5d688"}, 0xdbd, 0x4, @offset=0x200, 0xebfb})
setsockopt$XDP_UMEM_FILL_RING(r4, 0x11b, 0x5, 0x0, 0x0)
ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000300)={0xaa, 0x20})
r6 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r6, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r6, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r1)
r8 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r8, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r8, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
sendmsg$NL80211_CMD_GET_MESH_CONFIG(r8, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000400)={&(0x7f00000001c0)={0x20, r7, 0x10, 0x70bd2b, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x0, 0x18}}}}, ["", ""]}, 0x20}, 0x1, 0x0, 0x0, 0xc040}, 0x0)
sendmsg$NL80211_CMD_SET_CQM(r0, &(0x7f0000000280)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x58, r3, 0x200, 0x70bd29, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0xe0, 0x48}}}}, [@NL80211_ATTR_CQM={0x14, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_TXE_PKTS={0x8, 0x6, 0x4235}, @NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT={0x8, 0x3, 0x6}]}, @NL80211_ATTR_CQM={0x24, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT={0x8, 0x3, 0x8}, @NL80211_ATTR_CQM_TXE_PKTS={0x8}, @NL80211_ATTR_CQM_TXE_INTVL={0x8, 0x7, 0x2b1}, @NL80211_ATTR_CQM_TXE_PKTS={0x8, 0x6, 0x1000}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x4000081}, 0x400c8cc)

06:40:05 executing program 2:
socketpair(0x22, 0x0, 0x2, 0x0)

06:40:05 executing program 4:
r0 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f00000000c0)={0x0, 0x2, 0x0, "3c0a6d51c9e13895daefdd36340da9bf00280441eeb9983a920642d33a92f380"})

06:40:05 executing program 1:
r0 = syz_open_dev$vim2m(&(0x7f0000000040), 0x7ff, 0x2)
ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f00000001c0)={0x0, 0x3, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x1c, 0x2, 0xcf, "d450fd5b"}, 0x1, 0x1, @fd, 0x7})

06:40:05 executing program 3:
r0 = gettid()
gettid()
capget(&(0x7f0000000000)={0x20080522, r0}, &(0x7f0000000040)={0x3, 0x7, 0x9, 0x0, 0x2c, 0x3669})

06:40:05 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0xb, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:05 executing program 4:
bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000080)={0x2, <r0=>0x0}, 0x8)
bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000000c0)={r0}, 0x4)
setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, &(0x7f0000000000)=0x1000800, 0x4)
ioctl$vim2m_VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000100)={0x8, 0x2, 0x4, 0x20, 0x100, {0x77359400}, {0x2, 0x27764c60e940b3b, 0x5, 0x7, 0x81, 0x81, "ddc58f43"}, 0x4, 0x4, @offset, 0x2})
socketpair(0x2, 0xa, 0x81, &(0x7f00000015c0))
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000040))

06:40:05 executing program 2:
socketpair(0x22, 0x0, 0x2, 0x0)

06:40:05 executing program 0:
socketpair(0x2, 0xa, 0x81, &(0x7f00000015c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r2, &(0x7f0000000100)={&(0x7f00000003c0), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r3, 0xcd6ccc609280a2c3, 0x0, 0x0, {{}, {@void, @void}}, [@NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x3}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x24}}, 0x0)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r5 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_QUERYBUF(r5, 0xc0585609, &(0x7f0000000180)={0x0, 0x0, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "56850780"}})
ioctl$vim2m_VIDIOC_QBUF(r5, 0xc058560f, &(0x7f0000000340)={0x7, 0x3, 0x4, 0xe000, 0x1d, {0x0, 0xea60}, {0x2, 0x8, 0x1f, 0x2, 0x6, 0x40, "3ea5d688"}, 0xdbd, 0x4, @offset=0x200, 0xebfb})
setsockopt$XDP_UMEM_FILL_RING(r4, 0x11b, 0x5, 0x0, 0x0)
ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000300)={0xaa, 0x20})
r6 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r6, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r6, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r1)
r8 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r8, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r8, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
sendmsg$NL80211_CMD_GET_MESH_CONFIG(r8, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000400)={&(0x7f00000001c0)={0x20, r7, 0x10, 0x70bd2b, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x0, 0x18}}}}, ["", ""]}, 0x20}, 0x1, 0x0, 0x0, 0xc040}, 0x0)
sendmsg$NL80211_CMD_SET_CQM(r0, &(0x7f0000000280)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x58, r3, 0x200, 0x70bd29, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0xe0, 0x48}}}}, [@NL80211_ATTR_CQM={0x14, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_TXE_PKTS={0x8, 0x6, 0x4235}, @NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT={0x8, 0x3, 0x6}]}, @NL80211_ATTR_CQM={0x24, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT={0x8, 0x3, 0x8}, @NL80211_ATTR_CQM_TXE_PKTS={0x8}, @NL80211_ATTR_CQM_TXE_INTVL={0x8, 0x7, 0x2b1}, @NL80211_ATTR_CQM_TXE_PKTS={0x8, 0x6, 0x1000}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x4000081}, 0x400c8cc)

06:40:05 executing program 1:
r0 = syz_open_dev$vim2m(&(0x7f0000000040), 0x7ff, 0x2)
ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f00000001c0)={0x0, 0x3, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x2, 0xcf, "d450fd5b"}, 0x1, 0x1, @fd, 0x7})

[ 1718.302690][T12567] binder: 12566:12567 unknown command 6491392
[ 1718.308970][T12567] binder: 12566:12567 ioctl c0306201 20000180 returned -22
06:40:06 executing program 3:
r0 = gettid()
capget(&(0x7f0000000000)={0x20080522, r0}, &(0x7f0000000040)={0x3, 0x7, 0x9, 0x0, 0x2c, 0x3669})

06:40:06 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0xb, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:06 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x4020940d, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

06:40:06 executing program 4:
bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000080)={0x2, <r0=>0x0}, 0x8)
bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000000c0)={r0}, 0x4)
setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, &(0x7f0000000000)=0x1000800, 0x4)
ioctl$vim2m_VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000100)={0x8, 0x2, 0x4, 0x20, 0x100, {0x77359400}, {0x2, 0x27764c60e940b3b, 0x5, 0x7, 0x81, 0x81, "ddc58f43"}, 0x4, 0x4, @offset, 0x2})
socketpair(0x2, 0xa, 0x81, &(0x7f00000015c0))
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000040))

06:40:06 executing program 0:
socketpair(0x2, 0xa, 0x81, &(0x7f00000015c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r2, &(0x7f0000000100)={&(0x7f00000003c0), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r3, 0xcd6ccc609280a2c3, 0x0, 0x0, {{}, {@void, @void}}, [@NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x3}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x24}}, 0x0)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r5 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_QUERYBUF(r5, 0xc0585609, &(0x7f0000000180)={0x0, 0x0, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "56850780"}})
ioctl$vim2m_VIDIOC_QBUF(r5, 0xc058560f, &(0x7f0000000340)={0x7, 0x3, 0x4, 0xe000, 0x1d, {0x0, 0xea60}, {0x2, 0x8, 0x1f, 0x2, 0x6, 0x40, "3ea5d688"}, 0xdbd, 0x4, @offset=0x200, 0xebfb})
setsockopt$XDP_UMEM_FILL_RING(r4, 0x11b, 0x5, 0x0, 0x0)
ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000300)={0xaa, 0x20})
r6 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r6, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r6, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r1)
r8 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r8, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r8, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
sendmsg$NL80211_CMD_GET_MESH_CONFIG(r8, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000400)={&(0x7f00000001c0)={0x20, r7, 0x10, 0x70bd2b, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x0, 0x18}}}}, ["", ""]}, 0x20}, 0x1, 0x0, 0x0, 0xc040}, 0x0)
sendmsg$NL80211_CMD_SET_CQM(r0, &(0x7f0000000280)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x58, r3, 0x200, 0x70bd29, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0xe0, 0x48}}}}, [@NL80211_ATTR_CQM={0x14, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_TXE_PKTS={0x8, 0x6, 0x4235}, @NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT={0x8, 0x3, 0x6}]}, @NL80211_ATTR_CQM={0x24, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT={0x8, 0x3, 0x8}, @NL80211_ATTR_CQM_TXE_PKTS={0x8}, @NL80211_ATTR_CQM_TXE_INTVL={0x8, 0x7, 0x2b1}, @NL80211_ATTR_CQM_TXE_PKTS={0x8, 0x6, 0x1000}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x4000081}, 0x400c8cc)

06:40:06 executing program 1:
r0 = syz_open_dev$vim2m(&(0x7f0000000040), 0x7ff, 0x2)
ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f00000001c0)={0x0, 0x3, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xcf, "d450fd5b"}, 0x1, 0x1, @fd, 0x7})

06:40:06 executing program 3:
capget(&(0x7f0000000000)={0x20080522}, &(0x7f0000000040)={0x3, 0x7, 0x9, 0x0, 0x2c, 0x3669})

[ 1719.050990][T12582] binder: 12579:12582 unknown command 6491392
[ 1719.057293][T12582] binder: 12579:12582 ioctl c0306201 20000180 returned -22
06:40:06 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x4020940d, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

06:40:07 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0xb, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:07 executing program 4:
bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000080)={0x2, <r0=>0x0}, 0x8)
bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000000c0)={r0}, 0x4)
setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, &(0x7f0000000000)=0x1000800, 0x4)
ioctl$vim2m_VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000100)={0x8, 0x2, 0x4, 0x20, 0x100, {0x77359400}, {0x2, 0x27764c60e940b3b, 0x5, 0x7, 0x81, 0x81, "ddc58f43"}, 0x4, 0x4, @offset, 0x2})
socketpair(0x2, 0xa, 0x81, &(0x7f00000015c0))
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000040))

06:40:07 executing program 0:
socketpair(0x2, 0xa, 0x81, &(0x7f00000015c0)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000100)={&(0x7f00000003c0), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r2, 0xcd6ccc609280a2c3, 0x0, 0x0, {{}, {@void, @void}}, [@NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x3}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x24}}, 0x0)
r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r4 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_QUERYBUF(r4, 0xc0585609, &(0x7f0000000180)={0x0, 0x0, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "56850780"}})
ioctl$vim2m_VIDIOC_QBUF(r4, 0xc058560f, &(0x7f0000000340)={0x7, 0x3, 0x4, 0xe000, 0x1d, {0x0, 0xea60}, {0x2, 0x8, 0x1f, 0x2, 0x6, 0x40, "3ea5d688"}, 0xdbd, 0x4, @offset=0x200, 0xebfb})
setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, 0x0, 0x0)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000300)={0xaa, 0x20})
r5 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r5, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r5, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r0)
r7 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r7, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r7, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
sendmsg$NL80211_CMD_GET_MESH_CONFIG(r7, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000400)={&(0x7f00000001c0)={0x20, r6, 0x10, 0x70bd2b, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x0, 0x18}}}}, ["", ""]}, 0x20}, 0x1, 0x0, 0x0, 0xc040}, 0x0)

06:40:07 executing program 1:
r0 = syz_open_dev$vim2m(&(0x7f0000000040), 0x7ff, 0x2)
ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f00000001c0)={0x0, 0x3, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "d450fd5b"}, 0x1, 0x1, @fd, 0x7})

06:40:07 executing program 3:
capget(&(0x7f0000000000)={0x20080522}, &(0x7f0000000040)={0x3, 0x7, 0x9, 0x0, 0x2c, 0x3669})

[ 1719.722300][T12597] binder: 12595:12597 unknown command 6491392
[ 1719.728526][T12597] binder: 12595:12597 ioctl c0306201 20000180 returned -22
06:40:07 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x4020940d, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

06:40:07 executing program 4:
bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000080)={0x2, <r0=>0x0}, 0x8)
bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000000c0)={r0}, 0x4)
setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, &(0x7f0000000000)=0x1000800, 0x4)
ioctl$vim2m_VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000100)={0x8, 0x2, 0x4, 0x20, 0x100, {0x77359400}, {0x2, 0x27764c60e940b3b, 0x5, 0x7, 0x81, 0x81, "ddc58f43"}, 0x4, 0x4, @offset, 0x2})
socketpair(0x2, 0xa, 0x81, &(0x7f00000015c0))

06:40:07 executing program 5:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x10, 0xb, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:07 executing program 0:
socketpair(0x2, 0xa, 0x81, &(0x7f00000015c0)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000100)={&(0x7f00000003c0), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r2, 0xcd6ccc609280a2c3, 0x0, 0x0, {{}, {@void, @void}}, [@NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x3}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x24}}, 0x0)
r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r4 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_QUERYBUF(r4, 0xc0585609, &(0x7f0000000180)={0x0, 0x0, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "56850780"}})
ioctl$vim2m_VIDIOC_QBUF(r4, 0xc058560f, &(0x7f0000000340)={0x7, 0x3, 0x4, 0xe000, 0x1d, {0x0, 0xea60}, {0x2, 0x8, 0x1f, 0x2, 0x6, 0x40, "3ea5d688"}, 0xdbd, 0x4, @offset=0x200, 0xebfb})
setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, 0x0, 0x0)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000300)={0xaa, 0x20})
r5 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r5, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r5, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r0)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r6, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r6, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)

06:40:07 executing program 1:
r0 = syz_open_dev$vim2m(&(0x7f0000000040), 0x7ff, 0x2)
ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f00000001c0)={0x0, 0x3, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "d450fd5b"}, 0x0, 0x1, @fd, 0x7})

06:40:07 executing program 3:
capget(&(0x7f0000000000)={0x20080522}, &(0x7f0000000040)={0x3, 0x7, 0x9, 0x0, 0x2c, 0x3669})

06:40:08 executing program 2:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x4020940d, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

06:40:08 executing program 4:
bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000080)={0x2, <r0=>0x0}, 0x8)
bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000000c0)={r0}, 0x4)
setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, &(0x7f0000000000)=0x1000800, 0x4)
ioctl$vim2m_VIDIOC_PREPARE_BUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000100)={0x8, 0x2, 0x4, 0x20, 0x100, {0x77359400}, {0x2, 0x27764c60e940b3b, 0x5, 0x7, 0x81, 0x81, "ddc58f43"}, 0x4, 0x4, @offset, 0x2})

06:40:08 executing program 5:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x10, 0xb, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:08 executing program 1:
r0 = syz_open_dev$vim2m(&(0x7f0000000040), 0x7ff, 0x2)
ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f00000001c0)={0x0, 0x3, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "d450fd5b"}, 0x0, 0x0, @fd, 0x7})

06:40:08 executing program 3:
gettid()
capget(0x0, &(0x7f0000000040)={0x3, 0x7, 0x9, 0x0, 0x2c, 0x3669})

06:40:08 executing program 0:
socketpair(0x2, 0xa, 0x81, &(0x7f00000015c0)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000100)={&(0x7f00000003c0), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r2, 0xcd6ccc609280a2c3, 0x0, 0x0, {{}, {@void, @void}}, [@NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x3}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x24}}, 0x0)
r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r4 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_QUERYBUF(r4, 0xc0585609, &(0x7f0000000180)={0x0, 0x0, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "56850780"}})
ioctl$vim2m_VIDIOC_QBUF(r4, 0xc058560f, &(0x7f0000000340)={0x7, 0x3, 0x4, 0xe000, 0x1d, {0x0, 0xea60}, {0x2, 0x8, 0x1f, 0x2, 0x6, 0x40, "3ea5d688"}, 0xdbd, 0x4, @offset=0x200, 0xebfb})
setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, 0x0, 0x0)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000300)={0xaa, 0x20})
r5 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r5, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r5, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r0)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r6, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)

06:40:08 executing program 2:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x4020940d, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

06:40:08 executing program 4:
bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000080)={0x2, <r0=>0x0}, 0x8)
bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000000c0)={r0}, 0x4)
setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, &(0x7f0000000000)=0x1000800, 0x4)

06:40:08 executing program 5:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x10, 0xb, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:08 executing program 1:
r0 = syz_open_dev$vim2m(&(0x7f0000000040), 0x7ff, 0x2)
ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f00000001c0)={0x0, 0x3, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "d450fd5b"}, 0x0, 0x0, @fd})

06:40:09 executing program 3:
gettid()
capget(0x0, &(0x7f0000000040)={0x3, 0x7, 0x9, 0x0, 0x2c, 0x3669})

06:40:09 executing program 0:
socketpair(0x2, 0xa, 0x81, &(0x7f00000015c0)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000100)={&(0x7f00000003c0), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r2, 0xcd6ccc609280a2c3, 0x0, 0x0, {{}, {@void, @void}}, [@NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x3}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x24}}, 0x0)
r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r4 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_QUERYBUF(r4, 0xc0585609, &(0x7f0000000180)={0x0, 0x0, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "56850780"}})
ioctl$vim2m_VIDIOC_QBUF(r4, 0xc058560f, &(0x7f0000000340)={0x7, 0x3, 0x4, 0xe000, 0x1d, {0x0, 0xea60}, {0x2, 0x8, 0x1f, 0x2, 0x6, 0x40, "3ea5d688"}, 0xdbd, 0x4, @offset=0x200, 0xebfb})
setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, 0x0, 0x0)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000300)={0xaa, 0x20})
r5 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r5, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r5, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r0)
socket$nl_generic(0x10, 0x3, 0x10)

06:40:09 executing program 2:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x4020940d, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

06:40:09 executing program 4:
bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000080)={0x2, <r0=>0x0}, 0x8)
bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000000c0)={r0}, 0x4)

06:40:09 executing program 5:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0xb, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:09 executing program 1:
gettid()
capget(0x0, &(0x7f0000000040)={0x3, 0x7, 0x9, 0x0, 0x2c, 0x3669})

06:40:09 executing program 3:
gettid()
capget(0x0, &(0x7f0000000040)={0x3, 0x7, 0x9, 0x0, 0x2c, 0x3669})

06:40:09 executing program 2:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x4020940d, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

06:40:09 executing program 0:
socketpair(0x2, 0xa, 0x81, &(0x7f00000015c0)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000100)={&(0x7f00000003c0), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r2, 0xcd6ccc609280a2c3, 0x0, 0x0, {{}, {@void, @void}}, [@NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x3}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x24}}, 0x0)
r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r4 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_QUERYBUF(r4, 0xc0585609, &(0x7f0000000180)={0x0, 0x0, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "56850780"}})
ioctl$vim2m_VIDIOC_QBUF(r4, 0xc058560f, &(0x7f0000000340)={0x7, 0x3, 0x4, 0xe000, 0x1d, {0x0, 0xea60}, {0x2, 0x8, 0x1f, 0x2, 0x6, 0x40, "3ea5d688"}, 0xdbd, 0x4, @offset=0x200, 0xebfb})
setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, 0x0, 0x0)
ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000300)={0xaa, 0x20})
r5 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r5, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r5, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r0)

06:40:09 executing program 5:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0xb, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:09 executing program 4:
bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000000c0), 0x4)

06:40:10 executing program 1:
gettid()
capget(0x0, &(0x7f0000000040)={0x3, 0x7, 0x9, 0x0, 0x2c, 0x3669})

06:40:10 executing program 3:
r0 = gettid()
capget(&(0x7f0000000000)={0x0, r0}, &(0x7f0000000040)={0x3, 0x7, 0x9, 0x0, 0x2c, 0x3669})

06:40:10 executing program 2:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x4020940d, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

06:40:10 executing program 5:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x10, 0xb, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:10 executing program 0:
socketpair(0x2, 0xa, 0x81, &(0x7f00000015c0))
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r0, &(0x7f0000000100)={&(0x7f00000003c0), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r1, 0xcd6ccc609280a2c3, 0x0, 0x0, {{}, {@void, @void}}, [@NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x3}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x24}}, 0x0)
r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r3 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_QUERYBUF(r3, 0xc0585609, &(0x7f0000000180)={0x0, 0x0, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "56850780"}})
ioctl$vim2m_VIDIOC_QBUF(r3, 0xc058560f, &(0x7f0000000340)={0x7, 0x3, 0x4, 0xe000, 0x1d, {0x0, 0xea60}, {0x2, 0x8, 0x1f, 0x2, 0x6, 0x40, "3ea5d688"}, 0xdbd, 0x4, @offset=0x200, 0xebfb})
setsockopt$XDP_UMEM_FILL_RING(r2, 0x11b, 0x5, 0x0, 0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000300)={0xaa, 0x20})
r4 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r4, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r4, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)

06:40:10 executing program 4:
bpf$BPF_PROG_GET_FD_BY_ID(0xd, 0x0, 0x0)

06:40:10 executing program 1:
gettid()
capget(0x0, &(0x7f0000000040)={0x3, 0x7, 0x9, 0x0, 0x2c, 0x3669})

06:40:10 executing program 3:
r0 = gettid()
capget(&(0x7f0000000000)={0x0, r0}, &(0x7f0000000040)={0x3, 0x7, 0x9, 0x0, 0x2c, 0x3669})

06:40:10 executing program 2:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x4020940d, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

06:40:11 executing program 5:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x10, 0xb, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:11 executing program 4:
r0 = gettid()
capget(&(0x7f0000000000)={0x0, r0}, &(0x7f0000000040)={0x3, 0x7, 0x9, 0x0, 0x2c, 0x3669})

06:40:11 executing program 0:
socketpair(0x2, 0xa, 0x81, &(0x7f00000015c0))
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r0, &(0x7f0000000100)={&(0x7f00000003c0), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r1, 0xcd6ccc609280a2c3, 0x0, 0x0, {{}, {@void, @void}}, [@NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x3}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x24}}, 0x0)
r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r3 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_QUERYBUF(r3, 0xc0585609, &(0x7f0000000180)={0x0, 0x0, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "56850780"}})
ioctl$vim2m_VIDIOC_QBUF(r3, 0xc058560f, &(0x7f0000000340)={0x7, 0x3, 0x4, 0xe000, 0x1d, {0x0, 0xea60}, {0x2, 0x8, 0x1f, 0x2, 0x6, 0x40, "3ea5d688"}, 0xdbd, 0x4, @offset=0x200, 0xebfb})
setsockopt$XDP_UMEM_FILL_RING(r2, 0x11b, 0x5, 0x0, 0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000300)={0xaa, 0x20})
r4 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r4, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)

06:40:11 executing program 1:
capget(0x0, &(0x7f0000000040)={0x3, 0x7, 0x9, 0x0, 0x2c, 0x3669})

06:40:11 executing program 3:
r0 = gettid()
capget(&(0x7f0000000000)={0x0, r0}, &(0x7f0000000040)={0x3, 0x7, 0x9, 0x0, 0x2c, 0x3669})

06:40:11 executing program 2:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x4020940d, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

06:40:11 executing program 4:
r0 = gettid()
capget(&(0x7f0000000000)={0x0, r0}, &(0x7f0000000040)={0x3, 0x7, 0x9, 0x0, 0x2c, 0x3669})

06:40:11 executing program 5:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x10, 0xb, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:11 executing program 1:
capget(0x0, 0x0)

06:40:11 executing program 3:
gettid()
capget(&(0x7f0000000000)={0x20080522}, &(0x7f0000000040)={0x3, 0x7, 0x9, 0x0, 0x2c, 0x3669})

06:40:11 executing program 0:
socketpair(0x2, 0xa, 0x81, &(0x7f00000015c0))
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r0, &(0x7f0000000100)={&(0x7f00000003c0), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r1, 0xcd6ccc609280a2c3, 0x0, 0x0, {{}, {@void, @void}}, [@NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x3}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x24}}, 0x0)
r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r3 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_QUERYBUF(r3, 0xc0585609, &(0x7f0000000180)={0x0, 0x0, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "56850780"}})
ioctl$vim2m_VIDIOC_QBUF(r3, 0xc058560f, &(0x7f0000000340)={0x7, 0x3, 0x4, 0xe000, 0x1d, {0x0, 0xea60}, {0x2, 0x8, 0x1f, 0x2, 0x6, 0x40, "3ea5d688"}, 0xdbd, 0x4, @offset=0x200, 0xebfb})
setsockopt$XDP_UMEM_FILL_RING(r2, 0x11b, 0x5, 0x0, 0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000300)={0xaa, 0x20})
socket$nl_generic(0x10, 0x3, 0x10)

06:40:11 executing program 2:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x4020940d, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

06:40:12 executing program 5:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x10, 0xb, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:12 executing program 4:
r0 = gettid()
capget(&(0x7f0000000000)={0x0, r0}, &(0x7f0000000040)={0x3, 0x7, 0x9, 0x0, 0x2c, 0x3669})

06:40:12 executing program 1:
capget(&(0x7f0000000000)={0x20080522}, &(0x7f0000000040)={0x3, 0x7, 0x9, 0x0, 0x2c, 0x3669})

06:40:12 executing program 3:
gettid()
capget(&(0x7f0000000000)={0x20080522}, &(0x7f0000000040)={0x3, 0x7, 0x9, 0x0, 0x2c, 0x3669})

06:40:12 executing program 2:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x4020940d, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

06:40:12 executing program 0:
socketpair(0x2, 0xa, 0x81, &(0x7f00000015c0))
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r0, &(0x7f0000000100)={&(0x7f00000003c0), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r1, 0xcd6ccc609280a2c3, 0x0, 0x0, {{}, {@void, @void}}, [@NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x3}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x24}}, 0x0)
r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r3 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_QUERYBUF(r3, 0xc0585609, &(0x7f0000000180)={0x0, 0x0, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "56850780"}})
ioctl$vim2m_VIDIOC_QBUF(r3, 0xc058560f, &(0x7f0000000340)={0x7, 0x3, 0x4, 0xe000, 0x1d, {0x0, 0xea60}, {0x2, 0x8, 0x1f, 0x2, 0x6, 0x40, "3ea5d688"}, 0xdbd, 0x4, @offset=0x200, 0xebfb})
setsockopt$XDP_UMEM_FILL_RING(r2, 0x11b, 0x5, 0x0, 0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000300)={0xaa, 0x20})

06:40:12 executing program 4:
capget(&(0x7f0000000000), &(0x7f0000000040)={0x3, 0x7, 0x9, 0x0, 0x2c, 0x3669})

06:40:12 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)

06:40:12 executing program 1:
capget(&(0x7f0000000000)={0x20080522}, &(0x7f0000000040)={0x3, 0x7, 0x9, 0x0, 0x2c, 0x3669})

06:40:12 executing program 3:
gettid()
capget(&(0x7f0000000000)={0x20080522}, &(0x7f0000000040)={0x3, 0x7, 0x9, 0x0, 0x2c, 0x3669})

[ 1725.413829][T12724] binder: 12722:12724 ioctl c0306201 0 returned -14
06:40:13 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x4020940d, 0x0)

06:40:13 executing program 0:
socketpair(0x2, 0xa, 0x81, &(0x7f00000015c0))
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r0, &(0x7f0000000100)={&(0x7f00000003c0), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r1, 0xcd6ccc609280a2c3, 0x0, 0x0, {{}, {@void, @void}}, [@NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x3}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x24}}, 0x0)
r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r3 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_QUERYBUF(r3, 0xc0585609, &(0x7f0000000180)={0x0, 0x0, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "56850780"}})
ioctl$vim2m_VIDIOC_QBUF(r3, 0xc058560f, &(0x7f0000000340)={0x7, 0x3, 0x4, 0xe000, 0x1d, {0x0, 0xea60}, {0x2, 0x8, 0x1f, 0x2, 0x6, 0x40, "3ea5d688"}, 0xdbd, 0x4, @offset=0x200, 0xebfb})
setsockopt$XDP_UMEM_FILL_RING(r2, 0x11b, 0x5, 0x0, 0x0)

06:40:13 executing program 4:
capget(0x0, &(0x7f0000000040)={0x3, 0x7, 0x9, 0x0, 0x2c, 0x3669})

06:40:13 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)

06:40:13 executing program 1:
capget(&(0x7f0000000000)={0x20080522}, &(0x7f0000000040)={0x3, 0x7, 0x9, 0x0, 0x2c, 0x3669})

06:40:13 executing program 3:
r0 = gettid()
capget(&(0x7f0000000000)={0x20080522, r0}, 0x0)

[ 1726.033191][T12740] binder: 12737:12740 ioctl c0306201 0 returned -14
06:40:13 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x4020940d, 0x0)

06:40:13 executing program 1:
capget(0x0, &(0x7f0000000040)={0x3, 0x7, 0x9, 0x0, 0x2c, 0x3669})

06:40:13 executing program 0:
socketpair(0x2, 0xa, 0x81, &(0x7f00000015c0))
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r0, &(0x7f0000000100)={&(0x7f00000003c0), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r1, 0xcd6ccc609280a2c3, 0x0, 0x0, {{}, {@void, @void}}, [@NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x3}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x24}}, 0x0)
openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r2 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_QUERYBUF(r2, 0xc0585609, &(0x7f0000000180)={0x0, 0x0, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "56850780"}})
ioctl$vim2m_VIDIOC_QBUF(r2, 0xc058560f, &(0x7f0000000340)={0x7, 0x3, 0x4, 0xe000, 0x1d, {0x0, 0xea60}, {0x2, 0x8, 0x1f, 0x2, 0x6, 0x40, "3ea5d688"}, 0xdbd, 0x4, @offset=0x200, 0xebfb})

06:40:13 executing program 4:
capget(0x0, &(0x7f0000000040)={0x3, 0x7, 0x9, 0x0, 0x2c, 0x3669})

06:40:14 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)

06:40:14 executing program 3:
r0 = gettid()
capget(&(0x7f0000000000)={0x20080522, r0}, 0x0)

[ 1726.677823][T12754] binder: 12752:12754 ioctl c0306201 0 returned -14
06:40:14 executing program 2:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x4020940d, 0x0)

06:40:14 executing program 1:
capget(0x0, &(0x7f0000000040)={0x3, 0x7, 0x9, 0x0, 0x2c, 0x3669})

06:40:14 executing program 4:
capget(0x0, &(0x7f0000000040)={0x3, 0x7, 0x9, 0x0, 0x2c, 0x3669})

06:40:14 executing program 0:
socketpair(0x2, 0xa, 0x81, &(0x7f00000015c0))
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r0, &(0x7f0000000100)={&(0x7f00000003c0), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r1, 0xcd6ccc609280a2c3, 0x0, 0x0, {{}, {@void, @void}}, [@NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x3}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x24}}, 0x0)
openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r2 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_QBUF(r2, 0xc058560f, &(0x7f0000000340)={0x7, 0x3, 0x4, 0xe000, 0x1d, {0x0, 0xea60}, {0x2, 0x8, 0x1f, 0x2, 0x6, 0x40, "3ea5d688"}, 0xdbd, 0x4, @offset=0x200, 0xebfb})

06:40:14 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x0, 0xb, 0x0, 0x0, 0x0, 0x0})

06:40:14 executing program 3:
r0 = gettid()
capget(&(0x7f0000000000)={0x20080522, r0}, 0x0)

06:40:14 executing program 1:
capget(0x0, &(0x7f0000000040)={0x3, 0x7, 0x9, 0x0, 0x2c, 0x3669})

06:40:15 executing program 2:
r0 = gettid()
capget(&(0x7f0000000000)={0x20080522, r0}, 0x0)

06:40:15 executing program 4:
capget(&(0x7f0000000000), 0x0)

06:40:15 executing program 0:
socketpair(0x2, 0xa, 0x81, &(0x7f00000015c0))
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r0, &(0x7f0000000100)={&(0x7f00000003c0), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r1, 0xcd6ccc609280a2c3, 0x0, 0x0, {{}, {@void, @void}}, [@NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x3}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x24}}, 0x0)
openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$vim2m_VIDIOC_QBUF(0xffffffffffffffff, 0xc058560f, &(0x7f0000000340)={0x7, 0x3, 0x4, 0xe000, 0x1d, {0x0, 0xea60}, {0x2, 0x8, 0x1f, 0x2, 0x6, 0x40, "3ea5d688"}, 0xdbd, 0x4, @offset=0x200, 0xebfb})

06:40:15 executing program 3:
r0 = gettid()
capget(&(0x7f0000000000)={0x20080522, r0}, &(0x7f0000000040)={0x0, 0x7, 0x9, 0x0, 0x2c, 0x3669})

06:40:15 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x0, 0xb, 0x0, 0x0, 0x0, 0x0})

06:40:15 executing program 1:
capget(&(0x7f0000000000), &(0x7f0000000040)={0x3, 0x7, 0x9, 0x0, 0x2c, 0x3669})

06:40:15 executing program 2:
r0 = gettid()
capget(&(0x7f0000000000)={0x20080522, r0}, 0x0)

06:40:15 executing program 4:
capget(&(0x7f0000000000), 0x0)

06:40:15 executing program 0:
socketpair(0x2, 0xa, 0x81, &(0x7f00000015c0))
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r0, &(0x7f0000000100)={&(0x7f00000003c0), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r1, 0xcd6ccc609280a2c3, 0x0, 0x0, {{}, {@void, @void}}, [@NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x3}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x24}}, 0x0)
openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$vim2m_VIDIOC_QBUF(0xffffffffffffffff, 0xc058560f, &(0x7f0000000340)={0x7, 0x3, 0x4, 0xe000, 0x1d, {0x0, 0xea60}, {0x2, 0x8, 0x1f, 0x2, 0x6, 0x40, "3ea5d688"}, 0xdbd, 0x4, @offset=0x200, 0xebfb})

06:40:15 executing program 3:
r0 = gettid()
capget(&(0x7f0000000000)={0x20080522, r0}, &(0x7f0000000040)={0x0, 0x0, 0x9, 0x0, 0x2c, 0x3669})

06:40:15 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x0, 0xb, 0x0, 0x0, 0x0, 0x0})

06:40:15 executing program 1:
capget(&(0x7f0000000000), &(0x7f0000000040)={0x3, 0x7, 0x9, 0x0, 0x2c, 0x3669})

06:40:16 executing program 2:
r0 = gettid()
capget(&(0x7f0000000000)={0x20080522, r0}, 0x0)

06:40:16 executing program 4:
capget(&(0x7f0000000000), 0x0)

06:40:16 executing program 0:
socketpair(0x2, 0xa, 0x81, &(0x7f00000015c0))
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r0, &(0x7f0000000100)={&(0x7f00000003c0), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r1, 0xcd6ccc609280a2c3, 0x0, 0x0, {{}, {@void, @void}}, [@NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x3}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x24}}, 0x0)
openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$vim2m_VIDIOC_QBUF(0xffffffffffffffff, 0xc058560f, &(0x7f0000000340)={0x7, 0x3, 0x4, 0xe000, 0x1d, {0x0, 0xea60}, {0x2, 0x8, 0x1f, 0x2, 0x6, 0x40, "3ea5d688"}, 0xdbd, 0x4, @offset=0x200, 0xebfb})

06:40:16 executing program 3:
r0 = gettid()
capget(&(0x7f0000000000)={0x20080522, r0}, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x2c, 0x3669})

06:40:16 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0xc, 0xb, &(0x7f0000000040)=[@free_buffer], 0x0, 0x0, 0x0})

06:40:16 executing program 1:
capget(&(0x7f0000000000), &(0x7f0000000040)={0x3, 0x7, 0x9, 0x0, 0x2c, 0x3669})

06:40:16 executing program 2:
capget(&(0x7f0000000000)={0x20080522}, 0x0)

06:40:16 executing program 4:
capget(&(0x7f0000000000), 0x0)

[ 1729.084563][T12809] binder: 12806:12809 unknown command 0
[ 1729.090422][T12809] binder: 12806:12809 ioctl c0306201 20000180 returned -22
06:40:16 executing program 0:
socketpair(0x2, 0xa, 0x81, &(0x7f00000015c0))
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r0, &(0x7f0000000100)={&(0x7f00000003c0), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r1, 0xcd6ccc609280a2c3, 0x0, 0x0, {{}, {@void, @void}}, [@NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x3}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x24}}, 0x0)
r2 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_QBUF(r2, 0xc058560f, &(0x7f0000000340)={0x7, 0x3, 0x4, 0xe000, 0x1d, {0x0, 0xea60}, {0x2, 0x8, 0x1f, 0x2, 0x6, 0x40, "3ea5d688"}, 0xdbd, 0x4, @offset=0x200, 0xebfb})

06:40:16 executing program 3:
r0 = gettid()
capget(&(0x7f0000000000)={0x20080522, r0}, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x3669})

06:40:16 executing program 1:
capget(&(0x7f0000000000)={0x20080522}, 0x0)

06:40:17 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0xc, 0xb, &(0x7f0000000040)=[@free_buffer], 0x0, 0x0, 0x0})

06:40:17 executing program 4:
capget(0x0, 0x0)

06:40:17 executing program 2:
capget(0x0, 0x0)

06:40:17 executing program 3:
r0 = gettid()
capget(&(0x7f0000000000)={0x20080522, r0}, &(0x7f0000000040))

06:40:17 executing program 0:
socketpair(0x2, 0xa, 0x81, &(0x7f00000015c0))
socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
r0 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000340)={0x7, 0x3, 0x4, 0xe000, 0x1d, {0x0, 0xea60}, {0x2, 0x8, 0x1f, 0x2, 0x6, 0x40, "3ea5d688"}, 0xdbd, 0x4, @offset=0x200, 0xebfb})

[ 1729.707544][T12822] binder: 12821:12822 unknown command 0
[ 1729.713570][T12822] binder: 12821:12822 ioctl c0306201 20000180 returned -22
06:40:17 executing program 1:
capget(&(0x7f0000000000)={0x20080522}, 0x0)

06:40:17 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0xc, 0xb, &(0x7f0000000040)=[@free_buffer], 0x0, 0x0, 0x0})

06:40:17 executing program 4:
capget(0x0, 0x0)

06:40:17 executing program 2:
capget(0x0, 0x0)

06:40:17 executing program 3:
socketpair(0x2, 0xa, 0x81, &(0x7f00000015c0)={<r0=>0xffffffffffffffff})
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x48200, 0x0)
ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0x0)
recvmsg$can_bcm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000001600)=""/4096, 0x1000}, {&(0x7f0000000040)=""/6, 0x6}, {&(0x7f0000000080)=""/104, 0x68}, {&(0x7f0000000100)=""/62, 0x3e}, {&(0x7f0000000140)}, {&(0x7f0000002600)=""/4096, 0x1000}, {&(0x7f0000000180)=""/226, 0xe2}], 0x7}, 0x2021)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$inet6_mreq(r2, 0x29, 0x15, &(0x7f0000000680)={@dev}, &(0x7f00000006c0)=0x14)

06:40:18 executing program 1:
capget(&(0x7f0000000000)={0x20080522}, 0x0)

06:40:18 executing program 0:
socketpair(0x2, 0xa, 0x81, &(0x7f00000015c0))
socket$nl_generic(0x10, 0x3, 0x10)
r0 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000340)={0x7, 0x3, 0x4, 0xe000, 0x1d, {0x0, 0xea60}, {0x2, 0x8, 0x1f, 0x2, 0x6, 0x40, "3ea5d688"}, 0xdbd, 0x4, @offset=0x200, 0xebfb})

[ 1730.452063][T12835] binder: 12834:12835 unknown command 0
[ 1730.457750][T12835] binder: 12834:12835 ioctl c0306201 20000180 returned -22
06:40:18 executing program 4:
capget(0x0, 0x0)

06:40:18 executing program 2:
capget(0x0, 0x0)

06:40:18 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4, 0xb, &(0x7f0000000040)=[@exit_looper], 0x0, 0x0, 0x0})

06:40:18 executing program 3:
socketpair(0x2, 0xa, 0x81, &(0x7f00000015c0)={<r0=>0xffffffffffffffff})
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x48200, 0x0)
ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0x0)
recvmsg$can_bcm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000001600)=""/4096, 0x1000}, {&(0x7f0000000040)=""/6, 0x6}, {&(0x7f0000000080)=""/104, 0x68}, {&(0x7f0000000100)=""/62, 0x3e}, {&(0x7f0000000140)}, {&(0x7f0000002600)=""/4096, 0x1000}, {&(0x7f0000000180)=""/226, 0xe2}], 0x7}, 0x2021)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$inet6_mreq(r2, 0x29, 0x15, &(0x7f0000000680)={@dev}, &(0x7f00000006c0)=0x14)

06:40:18 executing program 1:
capget(&(0x7f0000000000)={0x20080522}, &(0x7f0000000040)={0x0, 0x7, 0x9, 0x0, 0x2c, 0x3669})

06:40:18 executing program 0:
socketpair(0x2, 0xa, 0x81, &(0x7f00000015c0))
r0 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000340)={0x7, 0x3, 0x4, 0xe000, 0x1d, {0x0, 0xea60}, {0x2, 0x8, 0x1f, 0x2, 0x6, 0x40, "3ea5d688"}, 0xdbd, 0x4, @offset=0x200, 0xebfb})

06:40:18 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x4020940d, 0x0)

06:40:18 executing program 2:
capget(&(0x7f0000000000), 0x0)

06:40:19 executing program 3:
socketpair(0x2, 0xa, 0x81, &(0x7f00000015c0)={<r0=>0xffffffffffffffff})
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x48200, 0x0)
ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0x0)
recvmsg$can_bcm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000001600)=""/4096, 0x1000}, {&(0x7f0000000040)=""/6, 0x6}, {&(0x7f0000000080)=""/104, 0x68}, {&(0x7f0000000100)=""/62, 0x3e}, {&(0x7f0000000140)}, {&(0x7f0000002600)=""/4096, 0x1000}, {&(0x7f0000000180)=""/226, 0xe2}], 0x7}, 0x2021)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$inet6_mreq(r2, 0x29, 0x15, &(0x7f0000000680)={@dev}, &(0x7f00000006c0)=0x14)

06:40:19 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4, 0xb, &(0x7f0000000040)=[@exit_looper], 0x0, 0x0, 0x0})

06:40:19 executing program 1:
capget(&(0x7f0000000000)={0x20080522}, &(0x7f0000000040)={0x0, 0x0, 0x9, 0x0, 0x2c, 0x3669})

06:40:19 executing program 0:
r0 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000340)={0x7, 0x3, 0x4, 0xe000, 0x1d, {0x0, 0xea60}, {0x2, 0x8, 0x1f, 0x2, 0x6, 0x40, "3ea5d688"}, 0xdbd, 0x4, @offset=0x200, 0xebfb})

06:40:19 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x4020940d, 0x0)

06:40:19 executing program 2:
capget(&(0x7f0000000000), 0x0)

06:40:19 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4, 0xb, &(0x7f0000000040)=[@exit_looper], 0x0, 0x0, 0x0})

06:40:19 executing program 3:
socketpair(0x2, 0xa, 0x81, &(0x7f00000015c0)={<r0=>0xffffffffffffffff})
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x48200, 0x0)
ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0x0)
recvmsg$can_bcm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000001600)=""/4096, 0x1000}, {&(0x7f0000000040)=""/6, 0x6}, {&(0x7f0000000080)=""/104, 0x68}, {&(0x7f0000000100)=""/62, 0x3e}, {&(0x7f0000000140)}, {&(0x7f0000002600)=""/4096, 0x1000}, {&(0x7f0000000180)=""/226, 0xe2}], 0x7}, 0x2021)
getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x15, &(0x7f0000000680)={@dev}, &(0x7f00000006c0)=0x14)

06:40:19 executing program 1:
capget(&(0x7f0000000000)={0x20080522}, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x2c, 0x3669})

06:40:19 executing program 0:
r0 = syz_open_dev$vim2m(0x0, 0x0, 0x2)
ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000340)={0x7, 0x3, 0x4, 0xe000, 0x1d, {0x0, 0xea60}, {0x2, 0x8, 0x1f, 0x2, 0x6, 0x40, "3ea5d688"}, 0xdbd, 0x4, @offset=0x200, 0xebfb})

06:40:19 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x4020940d, 0x0)

06:40:19 executing program 2:
capget(&(0x7f0000000000), 0x0)

06:40:20 executing program 1:
capget(&(0x7f0000000000)={0x20080522}, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x3669})

06:40:20 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x610000, 0x0)
ioctl$KVM_GET_API_VERSION(r0, 0xae00, 0x0)
openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x4000, 0x0)
socketpair(0x6, 0x5, 0x81, &(0x7f0000000000))

06:40:20 executing program 3:
socketpair(0x2, 0xa, 0x81, &(0x7f00000015c0)={<r0=>0xffffffffffffffff})
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x48200, 0x0)
ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0x0)
recvmsg$can_bcm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000001600)=""/4096, 0x1000}, {&(0x7f0000000040)=""/6, 0x6}, {&(0x7f0000000080)=""/104, 0x68}, {&(0x7f0000000100)=""/62, 0x3e}, {&(0x7f0000000140)}, {&(0x7f0000002600)=""/4096, 0x1000}, {&(0x7f0000000180)=""/226, 0xe2}], 0x7}, 0x2021)
getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x15, &(0x7f0000000680)={@dev}, &(0x7f00000006c0)=0x14)

06:40:20 executing program 0:
r0 = syz_open_dev$vim2m(0x0, 0x0, 0x2)
ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000340)={0x7, 0x3, 0x4, 0xe000, 0x1d, {0x0, 0xea60}, {0x2, 0x8, 0x1f, 0x2, 0x6, 0x40, "3ea5d688"}, 0xdbd, 0x4, @offset=0x200, 0xebfb})

06:40:20 executing program 4:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x4020940d, 0x0)

06:40:20 executing program 2:
r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x3f, 0x2)
ioctl$vim2m_VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000080)={0x8, 0x3, 0x4, 0x1000, 0x8, {}, {0x3, 0xd, 0xf8, 0x7f, 0xff, 0x2, "571e2078"}, 0x6, 0x4, @planes=&(0x7f0000000040)={0xcc2d, 0x8, @userptr=0x7, 0x77}, 0x100})
socketpair(0x2, 0xa, 0x81, &(0x7f00000015c0))
socket$kcm(0x29, 0x5, 0x0)

06:40:20 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x610000, 0x0)
ioctl$KVM_GET_API_VERSION(r0, 0xae00, 0x0)
openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x4000, 0x0)
socketpair(0x6, 0x5, 0x81, &(0x7f0000000000))

06:40:20 executing program 0:
r0 = syz_open_dev$vim2m(0x0, 0x0, 0x2)
ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000340)={0x7, 0x3, 0x4, 0xe000, 0x1d, {0x0, 0xea60}, {0x2, 0x8, 0x1f, 0x2, 0x6, 0x40, "3ea5d688"}, 0xdbd, 0x4, @offset=0x200, 0xebfb})

06:40:20 executing program 1:
capget(&(0x7f0000000000)={0x20080522}, &(0x7f0000000040))

06:40:20 executing program 3:
socketpair(0x2, 0xa, 0x81, &(0x7f00000015c0)={<r0=>0xffffffffffffffff})
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x48200, 0x0)
ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0x0)
recvmsg$can_bcm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000001600)=""/4096, 0x1000}, {&(0x7f0000000040)=""/6, 0x6}, {&(0x7f0000000080)=""/104, 0x68}, {&(0x7f0000000100)=""/62, 0x3e}, {&(0x7f0000000140)}, {&(0x7f0000002600)=""/4096, 0x1000}, {&(0x7f0000000180)=""/226, 0xe2}], 0x7}, 0x2021)
getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x15, &(0x7f0000000680)={@dev}, &(0x7f00000006c0)=0x14)

06:40:21 executing program 4:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x4020940d, 0x0)

06:40:21 executing program 2:
r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x3f, 0x2)
ioctl$vim2m_VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000080)={0x8, 0x3, 0x4, 0x1000, 0x8, {}, {0x3, 0xd, 0xf8, 0x7f, 0xff, 0x2, "571e2078"}, 0x6, 0x4, @planes=&(0x7f0000000040)={0xcc2d, 0x8, @userptr=0x7, 0x77}, 0x100})
socketpair(0x2, 0xa, 0x81, &(0x7f00000015c0))
socket$kcm(0x29, 0x5, 0x0)

06:40:21 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x40049409, 0x0)

06:40:21 executing program 0:
syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_QBUF(0xffffffffffffffff, 0xc058560f, &(0x7f0000000340)={0x7, 0x3, 0x4, 0xe000, 0x1d, {0x0, 0xea60}, {0x2, 0x8, 0x1f, 0x2, 0x6, 0x40, "3ea5d688"}, 0xdbd, 0x4, @offset=0x200, 0xebfb})

06:40:21 executing program 3:
socketpair(0x2, 0xa, 0x81, &(0x7f00000015c0))
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x48200, 0x0)
ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0x0)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$inet6_mreq(r1, 0x29, 0x15, &(0x7f0000000680)={@dev}, &(0x7f00000006c0)=0x14)

06:40:21 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x610000, 0x0)
ioctl$KVM_GET_API_VERSION(r0, 0xae00, 0x0)
openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x4000, 0x0)
socketpair(0x6, 0x5, 0x81, &(0x7f0000000000))

06:40:21 executing program 4:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x4020940d, 0x0)

06:40:21 executing program 2:
r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x3f, 0x2)
ioctl$vim2m_VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000080)={0x8, 0x3, 0x4, 0x1000, 0x8, {}, {0x3, 0xd, 0xf8, 0x7f, 0xff, 0x2, "571e2078"}, 0x6, 0x4, @planes=&(0x7f0000000040)={0xcc2d, 0x8, @userptr=0x7, 0x77}, 0x100})
socketpair(0x2, 0xa, 0x81, &(0x7f00000015c0))
socket$kcm(0x29, 0x5, 0x0)

06:40:21 executing program 0:
syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_QBUF(0xffffffffffffffff, 0xc058560f, &(0x7f0000000340)={0x7, 0x3, 0x4, 0xe000, 0x1d, {0x0, 0xea60}, {0x2, 0x8, 0x1f, 0x2, 0x6, 0x40, "3ea5d688"}, 0xdbd, 0x4, @offset=0x200, 0xebfb})

06:40:21 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x40049409, 0x0)

06:40:21 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x610000, 0x0)
ioctl$KVM_GET_API_VERSION(r0, 0xae00, 0x0)
openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x4000, 0x0)

06:40:22 executing program 3:
socketpair(0x2, 0xa, 0x81, &(0x7f00000015c0))
openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x48200, 0x0)
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$inet6_mreq(r0, 0x29, 0x15, &(0x7f0000000680)={@dev}, &(0x7f00000006c0)=0x14)

06:40:22 executing program 4:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x4020940d, 0x0)

06:40:22 executing program 2:
r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x3f, 0x2)
ioctl$vim2m_VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000080)={0x8, 0x3, 0x4, 0x1000, 0x8, {}, {0x3, 0xd, 0xf8, 0x7f, 0xff, 0x2, "571e2078"}, 0x6, 0x4, @planes=&(0x7f0000000040)={0xcc2d, 0x8, @userptr=0x7, 0x77}, 0x100})
socketpair(0x2, 0xa, 0x81, &(0x7f00000015c0))

06:40:22 executing program 0:
syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_QBUF(0xffffffffffffffff, 0xc058560f, &(0x7f0000000340)={0x7, 0x3, 0x4, 0xe000, 0x1d, {0x0, 0xea60}, {0x2, 0x8, 0x1f, 0x2, 0x6, 0x40, "3ea5d688"}, 0xdbd, 0x4, @offset=0x200, 0xebfb})

06:40:22 executing program 5:
openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x610000, 0x0)
openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x4000, 0x0)

06:40:22 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc020660b, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:22 executing program 3:
socketpair(0x2, 0xa, 0x81, &(0x7f00000015c0))
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$inet6_mreq(r0, 0x29, 0x15, &(0x7f0000000680)={@dev}, &(0x7f00000006c0)=0x14)

06:40:22 executing program 4:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x4020940d, 0x0)

06:40:23 executing program 0:
r0 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, 0x0)

06:40:23 executing program 5:
openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x4000, 0x0)

06:40:23 executing program 3:
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$inet6_mreq(r0, 0x29, 0x15, &(0x7f0000000680)={@dev}, &(0x7f00000006c0)=0x14)

06:40:23 executing program 2:
r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x3f, 0x2)
ioctl$vim2m_VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000080)={0x8, 0x3, 0x4, 0x1000, 0x8, {}, {0x3, 0xd, 0xf8, 0x7f, 0xff, 0x2, "571e2078"}, 0x6, 0x4, @planes=&(0x7f0000000040)={0xcc2d, 0x8, @userptr=0x7, 0x77}, 0x100})
socketpair(0x2, 0xa, 0x81, &(0x7f00000015c0))

06:40:23 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc020660b, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:23 executing program 4:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x4020940d, 0x0)

06:40:23 executing program 3:
socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x15, &(0x7f0000000680)={@dev}, &(0x7f00000006c0)=0x14)

06:40:23 executing program 5:
openat$fb0(0xffffffffffffff9c, 0x0, 0x4000, 0x0)

06:40:23 executing program 0:
r0 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, 0x0)

06:40:23 executing program 2:
r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x3f, 0x2)
ioctl$vim2m_VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000080)={0x8, 0x3, 0x4, 0x1000, 0x8, {}, {0x3, 0xd, 0xf8, 0x7f, 0xff, 0x2, "571e2078"}, 0x6, 0x4, @planes=&(0x7f0000000040)={0xcc2d, 0x8, @userptr=0x7, 0x77}, 0x100})

06:40:23 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc020660b, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:23 executing program 4:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x4020940d, 0x0)

06:40:24 executing program 3:
socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x15, &(0x7f0000000680)={@dev}, &(0x7f00000006c0)=0x14)

06:40:24 executing program 5:
openat$fb0(0xffffffffffffff9c, 0x0, 0x4000, 0x0)

06:40:24 executing program 1:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc020660b, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:24 executing program 0:
r0 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, 0x0)

06:40:24 executing program 2:
ioctl$vim2m_VIDIOC_DQBUF(0xffffffffffffffff, 0xc0585611, &(0x7f0000000080)={0x8, 0x3, 0x4, 0x1000, 0x8, {}, {0x3, 0xd, 0xf8, 0x7f, 0xff, 0x2, "571e2078"}, 0x6, 0x4, @planes=&(0x7f0000000040)={0xcc2d, 0x8, @userptr=0x7, 0x77}, 0x100})

06:40:24 executing program 4:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x4020940d, 0x0)

06:40:24 executing program 3:
socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x15, &(0x7f0000000680)={@dev}, &(0x7f00000006c0)=0x14)

06:40:24 executing program 0:
r0 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000340)={0x0, 0x3, 0x4, 0xe000, 0x1d, {0x0, 0xea60}, {0x2, 0x8, 0x1f, 0x2, 0x6, 0x40, "3ea5d688"}, 0xdbd, 0x4, @offset=0x200, 0xebfb})

06:40:24 executing program 5:
openat$fb0(0xffffffffffffff9c, 0x0, 0x4000, 0x0)

06:40:24 executing program 1:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc020660b, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:24 executing program 4:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x4020940d, 0x0)

06:40:24 executing program 2:
ioctl$vim2m_VIDIOC_DQBUF(0xffffffffffffffff, 0xc0585611, &(0x7f0000000080)={0x8, 0x3, 0x4, 0x1000, 0x8, {}, {0x3, 0xd, 0xf8, 0x7f, 0xff, 0x2, "571e2078"}, 0x6, 0x4, @planes=&(0x7f0000000040)={0xcc2d, 0x8, @userptr=0x7, 0x77}, 0x100})

06:40:25 executing program 3:
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$inet6_mreq(r0, 0x29, 0x0, &(0x7f0000000680)={@dev}, &(0x7f00000006c0)=0x14)

06:40:25 executing program 5:
openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)

06:40:25 executing program 0:
r0 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000340)={0x0, 0x0, 0x4, 0xe000, 0x1d, {0x0, 0xea60}, {0x2, 0x8, 0x1f, 0x2, 0x6, 0x40, "3ea5d688"}, 0xdbd, 0x4, @offset=0x200, 0xebfb})

06:40:25 executing program 1:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc020660b, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:25 executing program 2:
ioctl$vim2m_VIDIOC_DQBUF(0xffffffffffffffff, 0xc0585611, &(0x7f0000000080)={0x8, 0x3, 0x4, 0x1000, 0x8, {}, {0x3, 0xd, 0xf8, 0x7f, 0xff, 0x2, "571e2078"}, 0x6, 0x4, @planes=&(0x7f0000000040)={0xcc2d, 0x8, @userptr=0x7, 0x77}, 0x100})

06:40:25 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0189436, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:25 executing program 3:
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$inet6_mreq(r0, 0x29, 0x0, 0x0, &(0x7f00000006c0))

06:40:25 executing program 5:
openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)

06:40:25 executing program 0:
r0 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000340)={0x0, 0x0, 0x4, 0xe000, 0x1d, {0x0, 0xea60}, {0x2, 0x8, 0x1f, 0x2, 0x6, 0x40, "3ea5d688"}, 0xdbd, 0x4, @offset=0x200, 0xebfb})

06:40:25 executing program 1:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc020660b, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:26 executing program 2:
r0 = syz_open_dev$vim2m(0x0, 0x3f, 0x2)
ioctl$vim2m_VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000080)={0x8, 0x3, 0x4, 0x1000, 0x8, {}, {0x3, 0xd, 0xf8, 0x7f, 0xff, 0x2, "571e2078"}, 0x6, 0x4, @planes=&(0x7f0000000040)={0xcc2d, 0x8, @userptr=0x7, 0x77}, 0x100})

06:40:26 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0189436, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:26 executing program 3:
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$inet6_mreq(r0, 0x29, 0x0, 0x0, 0x0)

[ 1738.654275][ T3126] ieee802154 phy0 wpan0: encryption failed: -22
[ 1738.661016][ T3126] ieee802154 phy1 wpan1: encryption failed: -22
06:40:26 executing program 0:
r0 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000340)={0x0, 0x0, 0x4, 0xe000, 0x1d, {0x0, 0xea60}, {0x2, 0x8, 0x1f, 0x2, 0x6, 0x40, "3ea5d688"}, 0xdbd, 0x4, @offset=0x200, 0xebfb})

06:40:26 executing program 5:
openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)

06:40:26 executing program 1:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc020660b, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:26 executing program 2:
r0 = syz_open_dev$vim2m(0x0, 0x3f, 0x2)
ioctl$vim2m_VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000080)={0x8, 0x3, 0x4, 0x1000, 0x8, {}, {0x3, 0xd, 0xf8, 0x7f, 0xff, 0x2, "571e2078"}, 0x6, 0x4, @planes=&(0x7f0000000040)={0xcc2d, 0x8, @userptr=0x7, 0x77}, 0x100})

06:40:26 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0189436, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:26 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:27 executing program 1:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc020660b, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:27 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0046209, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

[ 1739.368756][T13046] binder: 13045:13046 ioctl c018620c 20000180 returned -22
06:40:27 executing program 0:
r0 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000340)={0x0, 0x3, 0x4, 0x0, 0x1d, {0x0, 0xea60}, {0x2, 0x8, 0x1f, 0x2, 0x6, 0x40, "3ea5d688"}, 0xdbd, 0x4, @offset=0x200, 0xebfb})

06:40:27 executing program 2:
r0 = syz_open_dev$vim2m(0x0, 0x3f, 0x2)
ioctl$vim2m_VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000080)={0x8, 0x3, 0x4, 0x1000, 0x8, {}, {0x3, 0xd, 0xf8, 0x7f, 0xff, 0x2, "571e2078"}, 0x6, 0x4, @planes=&(0x7f0000000040)={0xcc2d, 0x8, @userptr=0x7, 0x77}, 0x100})

06:40:27 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:27 executing program 2:
r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x0, 0x2)
ioctl$vim2m_VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000080)={0x8, 0x3, 0x4, 0x1000, 0x8, {}, {0x3, 0xd, 0xf8, 0x7f, 0xff, 0x2, "571e2078"}, 0x6, 0x4, @planes=&(0x7f0000000040)={0xcc2d, 0x8, @userptr=0x7, 0x77}, 0x100})

06:40:27 executing program 1:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc020660b, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:27 executing program 0:
r0 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000340)={0x0, 0x3, 0x4, 0x0, 0x0, {0x0, 0xea60}, {0x2, 0x8, 0x1f, 0x2, 0x6, 0x40, "3ea5d688"}, 0xdbd, 0x4, @offset=0x200, 0xebfb})

[ 1739.875289][T13056] binder: 13055:13056 ioctl c018620c 20000180 returned -22
06:40:27 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0046209, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:27 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

[ 1740.378752][T13067] binder: 13066:13067 ioctl c018620c 20000180 returned -22
06:40:28 executing program 4:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0189436, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:28 executing program 2:
r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x0, 0x2)
ioctl$vim2m_VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000080)={0x8, 0x3, 0x4, 0x1000, 0x8, {}, {0x3, 0xd, 0xf8, 0x7f, 0xff, 0x2, "571e2078"}, 0x6, 0x4, @planes=&(0x7f0000000040)={0xcc2d, 0x8, @userptr=0x7, 0x77}, 0x100})

06:40:28 executing program 1:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc020660b, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:28 executing program 0:
r0 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000340)={0x0, 0x3, 0x4, 0x0, 0x0, {0x0, 0xea60}, {0x0, 0x8, 0x1f, 0x2, 0x6, 0x40, "3ea5d688"}, 0xdbd, 0x4, @offset=0x200, 0xebfb})

06:40:28 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0046209, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:28 executing program 3:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc018620c, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:28 executing program 1:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc020660b, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:28 executing program 2:
r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x0, 0x2)
ioctl$vim2m_VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000080)={0x8, 0x3, 0x4, 0x1000, 0x8, {}, {0x3, 0xd, 0xf8, 0x7f, 0xff, 0x2, "571e2078"}, 0x6, 0x4, @planes=&(0x7f0000000040)={0xcc2d, 0x8, @userptr=0x7, 0x77}, 0x100})

06:40:28 executing program 3:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc018620c, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:28 executing program 5:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0046209, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:28 executing program 0:
r0 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000340)={0x0, 0x3, 0x4, 0x0, 0x0, {0x0, 0xea60}, {0x0, 0x0, 0x1f, 0x2, 0x6, 0x40, "3ea5d688"}, 0xdbd, 0x4, @offset=0x200, 0xebfb})

06:40:28 executing program 4:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0189436, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:29 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc020660b, 0x0)

06:40:29 executing program 3:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc018620c, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:29 executing program 5:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0046209, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:29 executing program 2:
syz_open_dev$vim2m(&(0x7f0000000000), 0x3f, 0x2)
ioctl$vim2m_VIDIOC_DQBUF(0xffffffffffffffff, 0xc0585611, &(0x7f0000000080)={0x8, 0x3, 0x4, 0x1000, 0x8, {}, {0x3, 0xd, 0xf8, 0x7f, 0xff, 0x2, "571e2078"}, 0x6, 0x4, @planes=&(0x7f0000000040)={0xcc2d, 0x8, @userptr=0x7, 0x77}, 0x100})

06:40:29 executing program 0:
r0 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000340)={0x0, 0x3, 0x4, 0x0, 0x0, {0x0, 0xea60}, {0x0, 0x0, 0x0, 0x2, 0x6, 0x40, "3ea5d688"}, 0xdbd, 0x4, @offset=0x200, 0xebfb})

06:40:29 executing program 4:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0189436, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:29 executing program 1:
socketpair(0x9, 0xb, 0x3943, &(0x7f0000000000))

06:40:29 executing program 3:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:29 executing program 5:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0046209, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:29 executing program 2:
syz_open_dev$vim2m(&(0x7f0000000000), 0x3f, 0x2)
ioctl$vim2m_VIDIOC_DQBUF(0xffffffffffffffff, 0xc0585611, &(0x7f0000000080)={0x8, 0x3, 0x4, 0x1000, 0x8, {}, {0x3, 0xd, 0xf8, 0x7f, 0xff, 0x2, "571e2078"}, 0x6, 0x4, @planes=&(0x7f0000000040)={0xcc2d, 0x8, @userptr=0x7, 0x77}, 0x100})

06:40:29 executing program 0:
r0 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000340)={0x0, 0x3, 0x4, 0x0, 0x0, {0x0, 0xea60}, {0x0, 0x0, 0x0, 0x0, 0x6, 0x40, "3ea5d688"}, 0xdbd, 0x4, @offset=0x200, 0xebfb})

06:40:30 executing program 4:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0189436, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:30 executing program 3:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:30 executing program 1:
socketpair(0x9, 0xb, 0x3943, &(0x7f0000000000))

06:40:30 executing program 5:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0046209, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:30 executing program 2:
syz_open_dev$vim2m(&(0x7f0000000000), 0x3f, 0x2)
ioctl$vim2m_VIDIOC_DQBUF(0xffffffffffffffff, 0xc0585611, &(0x7f0000000080)={0x8, 0x3, 0x4, 0x1000, 0x8, {}, {0x3, 0xd, 0xf8, 0x7f, 0xff, 0x2, "571e2078"}, 0x6, 0x4, @planes=&(0x7f0000000040)={0xcc2d, 0x8, @userptr=0x7, 0x77}, 0x100})

06:40:30 executing program 0:
r0 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000340)={0x0, 0x3, 0x4, 0x0, 0x0, {0x0, 0xea60}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x40, "3ea5d688"}, 0xdbd, 0x4, @offset=0x200, 0xebfb})

06:40:30 executing program 4:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0189436, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:30 executing program 1:
socketpair(0x9, 0xb, 0x3943, &(0x7f0000000000))

06:40:30 executing program 3:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:31 executing program 2:
r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x3f, 0x2)
ioctl$vim2m_VIDIOC_DQBUF(r0, 0xc0585611, 0x0)

06:40:31 executing program 5:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0046209, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:31 executing program 4:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0189436, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:31 executing program 0:
r0 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000340)={0x0, 0x3, 0x4, 0x0, 0x0, {0x0, 0xea60}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "3ea5d688"}, 0xdbd, 0x4, @offset=0x200, 0xebfb})

06:40:31 executing program 1:
socketpair(0x0, 0xb, 0x3943, &(0x7f0000000000))

06:40:31 executing program 2:
r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x3f, 0x2)
ioctl$vim2m_VIDIOC_DQBUF(r0, 0xc0585611, 0x0)

06:40:31 executing program 3:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc018620c, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:31 executing program 5:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0046209, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:31 executing program 0:
r0 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000340)={0x0, 0x3, 0x4, 0x0, 0x0, {0x0, 0xea60}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "3ea5d688"}, 0x0, 0x4, @offset=0x200, 0xebfb})

06:40:31 executing program 4:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0189436, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:31 executing program 1:
socketpair(0x0, 0x0, 0x3943, &(0x7f0000000000))

06:40:32 executing program 2:
r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x3f, 0x2)
ioctl$vim2m_VIDIOC_DQBUF(r0, 0xc0585611, 0x0)

06:40:32 executing program 5:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0046209, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:32 executing program 3:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc018620c, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:32 executing program 0:
r0 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000340)={0x0, 0x3, 0x4, 0x0, 0x0, {0x0, 0xea60}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "3ea5d688"}, 0x0, 0x0, @offset=0x200, 0xebfb})

06:40:32 executing program 4:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0189436, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:32 executing program 1:
socketpair(0x0, 0x0, 0x3943, &(0x7f0000000000))

06:40:32 executing program 2:
r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x3f, 0x2)
ioctl$vim2m_VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000080)={0x0, 0x3, 0x4, 0x1000, 0x8, {}, {0x3, 0xd, 0xf8, 0x7f, 0xff, 0x2, "571e2078"}, 0x6, 0x4, @planes=&(0x7f0000000040)={0xcc2d, 0x8, @userptr=0x7, 0x77}, 0x100})

06:40:32 executing program 3:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc018620c, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:32 executing program 0:
r0 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000340)={0x0, 0x3, 0x4, 0x0, 0x0, {0x0, 0xea60}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "3ea5d688"}, 0x0, 0x0, @offset, 0xebfb})

06:40:32 executing program 5:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0046209, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:32 executing program 4:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0189436, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:33 executing program 2:
r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x3f, 0x2)
ioctl$vim2m_VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000080)={0x0, 0x0, 0x4, 0x1000, 0x8, {}, {0x3, 0xd, 0xf8, 0x7f, 0xff, 0x2, "571e2078"}, 0x6, 0x4, @planes=&(0x7f0000000040)={0xcc2d, 0x8, @userptr=0x7, 0x77}, 0x100})

06:40:33 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc018620c, 0x0)

06:40:33 executing program 1:
socketpair(0x0, 0x0, 0x3943, &(0x7f0000000000))

06:40:33 executing program 0:
r0 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000340)={0x0, 0x3, 0x4, 0x0, 0x0, {0x0, 0xea60}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "3ea5d688"}})

06:40:33 executing program 5:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0046209, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:33 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0189436, 0x0)

[ 1745.862968][T13191] binder: 13189:13191 ioctl c018620c 0 returned -14
06:40:33 executing program 2:
r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x3f, 0x2)
ioctl$vim2m_VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000080)={0x0, 0x0, 0x4, 0x1000, 0x8, {}, {0x3, 0xd, 0xf8, 0x7f, 0xff, 0x2, "571e2078"}, 0x6, 0x4, @planes=&(0x7f0000000040)={0xcc2d, 0x8, @userptr=0x7, 0x77}, 0x100})

06:40:33 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc018620c, 0x0)

06:40:33 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0046209, 0x0)

06:40:33 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0045878, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:34 executing program 1:
socketpair(0x0, 0xb, 0x0, &(0x7f0000000000))

[ 1746.467409][T13204] binder: 13202:13204 ioctl c018620c 0 returned -14
06:40:34 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0189436, 0x0)

06:40:34 executing program 2:
r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x3f, 0x2)
ioctl$vim2m_VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000080)={0x0, 0x0, 0x4, 0x1000, 0x8, {}, {0x3, 0xd, 0xf8, 0x7f, 0xff, 0x2, "571e2078"}, 0x6, 0x4, @planes=&(0x7f0000000040)={0xcc2d, 0x8, @userptr=0x7, 0x77}, 0x100})

[ 1746.579366][T13208] binder: 13205:13208 ioctl c0046209 0 returned -22
06:40:34 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc018620c, 0x0)

06:40:34 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0045878, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:34 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0046209, 0x0)

06:40:34 executing program 1:
socketpair(0x0, 0xb, 0x0, 0x0)

06:40:34 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0189436, 0x0)

[ 1747.092383][T13219] binder: 13217:13219 ioctl c018620c 0 returned -14
06:40:34 executing program 2:
r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x3f, 0x2)
ioctl$vim2m_VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000080)={0x0, 0x3, 0x4, 0x0, 0x8, {}, {0x3, 0xd, 0xf8, 0x7f, 0xff, 0x2, "571e2078"}, 0x6, 0x4, @planes=&(0x7f0000000040)={0xcc2d, 0x8, @userptr=0x7, 0x77}, 0x100})

06:40:34 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

[ 1747.259103][T13223] binder: 13220:13223 ioctl c0046209 0 returned -22
06:40:35 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0045878, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:35 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0046209, 0x0)

06:40:35 executing program 1:
socketpair(0x0, 0xb, 0x0, 0x0)

[ 1747.631552][T13232] binder: 13229:13232 ioctl c018620c 20000180 returned -1
06:40:35 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0189436, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

06:40:35 executing program 2:
r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x3f, 0x2)
ioctl$vim2m_VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000080)={0x0, 0x3, 0x4, 0x0, 0x0, {}, {0x3, 0xd, 0xf8, 0x7f, 0xff, 0x2, "571e2078"}, 0x6, 0x4, @planes=&(0x7f0000000040)={0xcc2d, 0x8, @userptr=0x7, 0x77}, 0x100})

06:40:35 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

[ 1747.856676][T13236] binder: 13234:13236 ioctl c0046209 0 returned -22
06:40:35 executing program 0:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0045878, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:35 executing program 1:
socketpair(0x0, 0xb, 0x0, 0x0)

06:40:35 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0046209, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

06:40:35 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0189436, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

[ 1748.212652][T13245] binder: 13241:13245 ioctl c018620c 20000180 returned -1
06:40:36 executing program 2:
r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x3f, 0x2)
ioctl$vim2m_VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000080)={0x0, 0x3, 0x4, 0x0, 0x0, {}, {0x0, 0xd, 0xf8, 0x7f, 0xff, 0x2, "571e2078"}, 0x6, 0x4, @planes=&(0x7f0000000040)={0xcc2d, 0x8, @userptr=0x7, 0x77}, 0x100})

06:40:36 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

06:40:36 executing program 0:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0045878, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:36 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0189436, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

06:40:36 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0189436, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

06:40:36 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0046209, 0x0)

[ 1748.776324][T13256] binder: 13254:13256 ioctl c018620c 20000180 returned -1
06:40:36 executing program 2:
r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x3f, 0x2)
ioctl$vim2m_VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000080)={0x0, 0x3, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0xf8, 0x7f, 0xff, 0x2, "571e2078"}, 0x6, 0x4, @planes=&(0x7f0000000040)={0xcc2d, 0x8, @userptr=0x7, 0x77}, 0x100})

06:40:36 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f0000000180)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer], 0x0, 0x0, 0x0})

06:40:36 executing program 0:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0045878, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

[ 1749.081279][T13264] binder: 13262:13264 ioctl c0046209 0 returned -22
06:40:36 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0189436, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

06:40:36 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0046209, 0x0)

06:40:37 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0189436, &(0x7f0000000180)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer], 0x0, 0x0, 0x0})

06:40:37 executing program 2:
r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x3f, 0x2)
ioctl$vim2m_VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000080)={0x0, 0x3, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x7f, 0xff, 0x2, "571e2078"}, 0x6, 0x4, @planes=&(0x7f0000000040)={0xcc2d, 0x8, @userptr=0x7, 0x77}, 0x100})

[ 1749.496564][T13272] binder: 13269:13272 ioctl c018620c 20000180 returned -22
[ 1749.610759][T13277] binder: 13274:13277 ioctl c0046209 0 returned -22
06:40:37 executing program 0:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0045878, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:37 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0189436, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

06:40:37 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040), 0x0, 0x0, 0x0})

06:40:37 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0046209, 0x0)

06:40:37 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0189436, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040), 0x0, 0x0, 0x0})

06:40:37 executing program 2:
r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x3f, 0x2)
ioctl$vim2m_VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000080)={0x0, 0x3, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0xff, 0x2, "571e2078"}, 0x6, 0x4, @planes=&(0x7f0000000040)={0xcc2d, 0x8, @userptr=0x7, 0x77}, 0x100})

[ 1750.147939][T13287] binder: 13285:13287 ioctl c018620c 20000180 returned -22
06:40:37 executing program 0:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0045878, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:37 executing program 1:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0189436, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

[ 1750.257770][T13291] binder: 13289:13291 ioctl c0046209 0 returned -22
06:40:38 executing program 5:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0046209, 0x0)

06:40:38 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0189436, 0x0)

06:40:38 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x4018620d, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:38 executing program 2:
r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x3f, 0x2)
ioctl$vim2m_VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000080)={0x0, 0x3, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x2, "571e2078"}, 0x6, 0x4, @planes=&(0x7f0000000040)={0xcc2d, 0x8, @userptr=0x7, 0x77}, 0x100})

06:40:38 executing program 0:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0045878, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:38 executing program 1:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0189436, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

06:40:38 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x4018620d, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:38 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0189436, 0x0)

06:40:38 executing program 2:
r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x3f, 0x2)
ioctl$vim2m_VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000080)={0x0, 0x3, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "571e2078"}, 0x6, 0x4, @planes=&(0x7f0000000040)={0xcc2d, 0x8, @userptr=0x7, 0x77}, 0x100})

06:40:38 executing program 0:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0045878, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:38 executing program 1:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0189436, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

06:40:39 executing program 5:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0046209, 0x0)

06:40:39 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0189436, 0x0)

06:40:39 executing program 2:
r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x3f, 0x2)
ioctl$vim2m_VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000080)={0x0, 0x3, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "571e2078"}, 0x0, 0x4, @planes=&(0x7f0000000040)={0xcc2d, 0x8, @userptr=0x7, 0x77}, 0x100})

06:40:39 executing program 1:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0189436, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

06:40:39 executing program 0:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0045878, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:39 executing program 5:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0046209, 0x0)

06:40:39 executing program 2:
r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x3f, 0x2)
ioctl$vim2m_VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000080)={0x0, 0x3, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "571e2078"}, 0x0, 0x0, @planes=&(0x7f0000000040)={0xcc2d, 0x8, @userptr=0x7, 0x77}, 0x100})

06:40:40 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x4018620d, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:40 executing program 3:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0189436, 0x0)

06:40:40 executing program 5:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0046209, 0x0)

06:40:40 executing program 0:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0045878, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:40 executing program 1:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0189436, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

06:40:40 executing program 2:
r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x3f, 0x2)
ioctl$vim2m_VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000080)={0x0, 0x3, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "571e2078"}, 0x0, 0x0, @planes=&(0x7f0000000040)={0xcc2d, 0x8, @userptr=0x7, 0x77}, 0x100})

06:40:40 executing program 5:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0046209, 0x0)

06:40:40 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0045878, 0x0)

06:40:40 executing program 1:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0189436, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

06:40:40 executing program 2:
r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x3f, 0x2)
ioctl$vim2m_VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000080)={0x0, 0x3, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "571e2078"}, 0x0, 0x0, @planes=0x0, 0x100})

06:40:40 executing program 3:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0189436, 0x0)

06:40:40 executing program 4:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x4018620d, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:41 executing program 5:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0046209, 0x0)

06:40:41 executing program 3:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0189436, 0x0)

06:40:41 executing program 0:
socketpair(0x2, 0x3, 0x81, &(0x7f00000015c0))

06:40:41 executing program 2:
r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x3f, 0x2)
ioctl$vim2m_VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000080)={0x0, 0x3, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "571e2078"}, 0x0, 0x0, @planes=0x0})

06:40:41 executing program 1:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0189436, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

06:40:41 executing program 4:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x4018620d, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:41 executing program 5:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0046209, 0x0)

06:40:41 executing program 3:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0189436, 0x0)

06:40:41 executing program 0:
socketpair(0x2, 0x3, 0x81, &(0x7f00000015c0))

06:40:41 executing program 2:
socketpair(0x2, 0x2, 0x81, &(0x7f00000015c0))

06:40:41 executing program 1:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0189436, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

06:40:42 executing program 4:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x4018620d, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:42 executing program 3:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0189436, 0x0)

06:40:42 executing program 5:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0046209, 0x0)

06:40:42 executing program 0:
socketpair(0x2, 0x3, 0x81, &(0x7f00000015c0))

06:40:42 executing program 3:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0189436, 0x0)

06:40:42 executing program 1:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0189436, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

06:40:42 executing program 2:
socketpair(0x2, 0x2, 0x81, &(0x7f00000015c0))

06:40:42 executing program 4:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x4018620d, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:42 executing program 5:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0046209, 0x0)

06:40:42 executing program 0:
socketpair(0x0, 0x3, 0x81, &(0x7f00000015c0))

06:40:43 executing program 3:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0189436, 0x0)

06:40:43 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0189436, 0x0)

06:40:43 executing program 2:
socketpair(0x2, 0x2, 0x81, &(0x7f00000015c0))

06:40:43 executing program 5:
socketpair(0x2e, 0xa, 0x81, &(0x7f00000015c0))

06:40:43 executing program 4:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x4018620d, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:43 executing program 0:
socketpair(0x0, 0x3, 0x81, &(0x7f00000015c0))

06:40:43 executing program 3:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0189436, 0x0)

06:40:43 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0189436, 0x0)

06:40:43 executing program 5:
socketpair(0x2e, 0xa, 0x81, &(0x7f00000015c0))

06:40:43 executing program 4:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x4018620d, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:44 executing program 2:
socketpair(0x0, 0x2, 0x81, &(0x7f00000015c0))

06:40:44 executing program 0:
socketpair(0x0, 0x3, 0x81, &(0x7f00000015c0))

06:40:44 executing program 3:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0189436, 0x0)

06:40:44 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0189436, 0x0)

06:40:44 executing program 5:
socketpair(0x2e, 0xa, 0x81, &(0x7f00000015c0))

06:40:44 executing program 4:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x4018620d, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:44 executing program 2:
socketpair(0x0, 0x2, 0x81, &(0x7f00000015c0))

06:40:44 executing program 0:
socketpair(0x2, 0x0, 0x81, &(0x7f00000015c0))

06:40:44 executing program 3:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, &(0x7f00000000c0))

06:40:45 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5450, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:45 executing program 5:
socketpair(0x0, 0xa, 0x81, &(0x7f00000015c0))

06:40:45 executing program 4:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x4018620d, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:45 executing program 3:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, &(0x7f00000000c0))

06:40:45 executing program 2:
socketpair(0x0, 0x2, 0x81, &(0x7f00000015c0))

06:40:45 executing program 0:
socketpair(0x2, 0x0, 0x81, &(0x7f00000015c0))

06:40:45 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5450, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:45 executing program 4:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x4018620d, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:45 executing program 5:
socketpair(0x0, 0xa, 0x81, &(0x7f00000015c0))

06:40:46 executing program 3:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, &(0x7f00000000c0))

06:40:46 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5450, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:46 executing program 2:
socketpair(0x2, 0x0, 0x81, &(0x7f00000015c0))

06:40:46 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x4018620d, 0x0)

06:40:46 executing program 0:
socketpair(0x2, 0x0, 0x81, &(0x7f00000015c0))

06:40:46 executing program 5:
socketpair(0x0, 0xa, 0x81, &(0x7f00000015c0))

06:40:46 executing program 3:
ioctl$FBIOGET_CON2FBMAP(0xffffffffffffffff, 0x460f, &(0x7f00000000c0))

[ 1759.058736][T13498] binder: 13495:13498 ioctl 4018620d 0 returned -22
06:40:46 executing program 1:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x5450, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:47 executing program 2:
socketpair(0x2, 0x0, 0x81, &(0x7f00000015c0))

06:40:47 executing program 5:
socketpair(0x2e, 0x0, 0x81, &(0x7f00000015c0))

06:40:47 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x4018620d, 0x0)

06:40:47 executing program 3:
ioctl$FBIOGET_CON2FBMAP(0xffffffffffffffff, 0x460f, &(0x7f00000000c0))

06:40:47 executing program 0:
socketpair(0x2, 0x3, 0x0, &(0x7f00000015c0))

06:40:47 executing program 1:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x5450, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

[ 1759.770061][T13516] binder: 13511:13516 ioctl 4018620d 0 returned -22
06:40:47 executing program 5:
socketpair(0x2e, 0x0, 0x0, &(0x7f00000015c0))

06:40:47 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x4018620d, 0x0)

06:40:47 executing program 3:
ioctl$FBIOGET_CON2FBMAP(0xffffffffffffffff, 0x460f, &(0x7f00000000c0))

06:40:47 executing program 2:
socketpair(0x2, 0x0, 0x81, &(0x7f00000015c0))

06:40:47 executing program 1:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x5450, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

[ 1760.360094][T13530] binder: 13528:13530 ioctl 4018620d 0 returned -22
06:40:48 executing program 0:
socketpair(0x2, 0x3, 0x0, &(0x7f00000015c0))

06:40:48 executing program 5:
socketpair(0x2e, 0x0, 0x0, 0x0)

06:40:48 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x4018620d, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

06:40:48 executing program 3:
r0 = openat$fb1(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, &(0x7f00000000c0))

06:40:48 executing program 1:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5450, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:48 executing program 2:
socketpair(0x2, 0x2, 0x0, &(0x7f00000015c0))

06:40:48 executing program 5:
socketpair(0x2e, 0x0, 0x0, 0x0)

06:40:48 executing program 0:
socketpair(0x2, 0x3, 0x0, &(0x7f00000015c0))

06:40:48 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:49 executing program 3:
r0 = openat$fb1(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, &(0x7f00000000c0))

06:40:49 executing program 1:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5450, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:49 executing program 2:
socketpair(0x2, 0x2, 0x0, &(0x7f00000015c0))

06:40:49 executing program 5:
socketpair(0x2e, 0x0, 0x0, 0x0)

06:40:49 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:49 executing program 3:
r0 = openat$fb1(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, &(0x7f00000000c0))

06:40:49 executing program 1:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5450, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:49 executing program 0:
socketpair(0x2, 0x3, 0x81, 0x0)

06:40:49 executing program 2:
socketpair(0x2, 0x2, 0x0, &(0x7f00000015c0))

06:40:49 executing program 5:
socketpair(0x2, 0x2, 0x0, &(0x7f00000015c0))

06:40:50 executing program 3:
openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(0xffffffffffffffff, 0x460f, &(0x7f00000000c0))

06:40:50 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:50 executing program 1:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x5450, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:50 executing program 0:
socketpair(0x2, 0x3, 0x81, 0x0)

06:40:50 executing program 2:
socketpair(0x2, 0x2, 0x81, 0x0)

06:40:50 executing program 5:
socketpair(0x2, 0x2, 0x0, &(0x7f00000015c0))

06:40:50 executing program 4:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x5421, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:50 executing program 3:
openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(0xffffffffffffffff, 0x460f, &(0x7f00000000c0))

06:40:50 executing program 0:
socketpair(0x2, 0x3, 0x81, 0x0)

06:40:50 executing program 1:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x5450, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:51 executing program 2:
socketpair(0x2, 0x2, 0x81, 0x0)

06:40:51 executing program 5:
socketpair(0x2, 0x2, 0x0, &(0x7f00000015c0))

06:40:51 executing program 4:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x5421, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:51 executing program 3:
openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(0xffffffffffffffff, 0x460f, &(0x7f00000000c0))

06:40:51 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x541b, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:51 executing program 1:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x5450, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:51 executing program 2:
socketpair(0x2, 0x2, 0x81, 0x0)

06:40:51 executing program 5:
socketpair(0x0, 0x2, 0x0, &(0x7f00000015c0))

[ 1764.045898][T13617] binder: 13614:13617 ioctl 541b 20000180 returned -22
06:40:51 executing program 4:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x5421, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:51 executing program 3:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)

06:40:52 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x541b, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:52 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)

06:40:52 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5450, 0x0)

06:40:52 executing program 5:
socketpair(0x0, 0x2, 0x0, &(0x7f00000015c0))

[ 1764.648853][T13631] binder: 13629:13631 ioctl 541b 20000180 returned -22
06:40:52 executing program 4:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:52 executing program 3:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)

06:40:52 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x541b, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:52 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x10, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:52 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)

[ 1765.331286][T13646] binder: 13644:13646 ioctl 541b 20000180 returned -22
[ 1765.347284][T13647] binder: 13645:13647 ioctl 10 20000180 returned -22
06:40:53 executing program 5:
socketpair(0x0, 0x2, 0x0, &(0x7f00000015c0))

06:40:53 executing program 4:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:53 executing program 3:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)

06:40:53 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)

06:40:53 executing program 0:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x541b, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:53 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x10, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:53 executing program 4:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:53 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x2, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:53 executing program 5:
socketpair(0x2, 0x0, 0x0, &(0x7f00000015c0))

[ 1766.081386][T13664] binder: 13661:13664 ioctl 10 20000180 returned -22
06:40:53 executing program 2:
ioctl$FBIOGET_CON2FBMAP(0xffffffffffffffff, 0x460f, 0x0)

06:40:53 executing program 0:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x541b, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:53 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x10, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:54 executing program 4:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x5421, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:54 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x2, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

[ 1766.669394][T13680] binder: 13679:13680 ioctl 10 20000180 returned -22
06:40:54 executing program 2:
ioctl$FBIOGET_CON2FBMAP(0xffffffffffffffff, 0x460f, 0x0)

06:40:54 executing program 5:
socketpair(0x2, 0x0, 0x0, &(0x7f00000015c0))

06:40:54 executing program 0:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x541b, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:54 executing program 1:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x10, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:54 executing program 4:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x5421, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:54 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x2, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:55 executing program 2:
ioctl$FBIOGET_CON2FBMAP(0xffffffffffffffff, 0x460f, 0x0)

06:40:55 executing program 0:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x541b, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:55 executing program 1:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x10, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:55 executing program 5:
socketpair(0x2, 0x0, 0x0, &(0x7f00000015c0))

06:40:55 executing program 4:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x5421, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:55 executing program 3:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x2, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:55 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)

06:40:55 executing program 0:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x541b, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:55 executing program 1:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x10, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:55 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, 0x0)

06:40:56 executing program 3:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x2, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:56 executing program 5:
socketpair(0x2, 0x2, 0x0, 0x0)

06:40:56 executing program 0:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x541b, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:56 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)

06:40:56 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, 0x0)

06:40:56 executing program 1:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x10, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:56 executing program 3:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x2, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:56 executing program 5:
socketpair(0x2, 0x2, 0x0, 0x0)

06:40:56 executing program 0:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x541b, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:56 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)

06:40:56 executing program 1:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x10, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:56 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, 0x0)

06:40:57 executing program 3:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x2, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:57 executing program 5:
socketpair(0x2, 0x2, 0x0, 0x0)

06:40:57 executing program 0:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x541b, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:57 executing program 2:
openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(0xffffffffffffffff, 0x460f, 0x0)

06:40:57 executing program 1:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x10, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:57 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

06:40:57 executing program 3:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x2, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:57 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, 0x0)

06:40:57 executing program 0:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x541b, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:57 executing program 2:
openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(0xffffffffffffffff, 0x460f, 0x0)

06:40:58 executing program 1:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x10, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:58 executing program 4 (fault-call:1 fault-nth:0):
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

06:40:58 executing program 3:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x2, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

[ 1770.734889][T13772] FAULT_INJECTION: forcing a failure.
[ 1770.734889][T13772] name failslab, interval 1, probability 0, space 0, times 0
[ 1770.748084][T13772] CPU: 0 PID: 13772 Comm: syz-executor.4 Not tainted 5.12.0-rc6-syzkaller #0
[ 1770.757011][T13772] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 1770.767194][T13772] Call Trace:
[ 1770.770563][T13772]  dump_stack+0x24c/0x2e0
[ 1770.775090][T13772]  should_fail+0x8bd/0x9e0
[ 1770.779801][T13772]  __should_failslab+0x1f1/0x290
[ 1770.784922][T13772]  should_failslab+0x29/0x70
[ 1770.789791][T13772]  __kmalloc+0xbd/0x550
[ 1770.794210][T13772]  ? tomoyo_realpath_from_path+0x142/0xc20
[ 1770.800278][T13772]  ? kmsan_get_metadata+0x116/0x180
[ 1770.806780][T13772]  tomoyo_realpath_from_path+0x142/0xc20
[ 1770.812680][T13772]  ? __msan_instrument_asm_store+0x22/0x130
[ 1770.818757][T13772]  tomoyo_path_number_perm+0x2a3/0xaf0
[ 1770.824809][T13772]  ? kmsan_internal_unpoison_shadow+0x2f/0x40
06:40:58 executing program 1:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x10, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

[ 1770.831054][T13772]  ? __msan_get_context_state+0x9/0x20
[ 1770.836686][T13772]  tomoyo_file_ioctl+0x74/0x90
[ 1770.841698][T13772]  ? tomoyo_inode_getattr+0x60/0x60
[ 1770.847060][T13772]  security_file_ioctl+0x10a/0x210
[ 1770.852408][T13772]  __se_sys_ioctl+0x13f/0x4d0
[ 1770.857296][T13772]  __x64_sys_ioctl+0x4a/0x70
[ 1770.862169][T13772]  do_syscall_64+0x9f/0x140
[ 1770.866861][T13772]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 1770.872946][T13772] RIP: 0033:0x4665d9
[ 1770.876944][T13772] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 1770.897007][T13772] RSP: 002b:00007f0cf7c79188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 1770.905668][T13772] RAX: ffffffffffffffda RBX: 000000000056bf80 RCX: 00000000004665d9
[ 1770.913760][T13772] RDX: 0000000020000180 RSI: 0000000000005421 RDI: 0000000000000003
[ 1770.922218][T13772] RBP: 00007f0cf7c791d0 R08: 0000000000000000 R09: 0000000000000000
06:40:58 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, 0x0)

[ 1770.930759][T13772] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 1770.938922][T13772] R13: 0000000000a9fb1f R14: 00007f0cf7c79300 R15: 0000000000022000
[ 1770.951297][T13772] ERROR: Out of memory at tomoyo_realpath_from_path.
06:40:58 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x541b, 0x0)

06:40:58 executing program 2:
openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(0xffffffffffffffff, 0x460f, 0x0)

06:40:58 executing program 3:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x2, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:59 executing program 4 (fault-call:1 fault-nth:1):
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

[ 1771.348334][T13783] binder: 13778:13783 ioctl 541b 0 returned -22
06:40:59 executing program 1:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x10, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:59 executing program 0 (fault-call:1 fault-nth:0):
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x541b, 0x0)

06:40:59 executing program 3:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x2, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:40:59 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, 0x0)

06:40:59 executing program 2 (fault-call:1 fault-nth:0):
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)

[ 1771.732434][T13788] FAULT_INJECTION: forcing a failure.
[ 1771.732434][T13788] name failslab, interval 1, probability 0, space 0, times 0
[ 1771.747628][T13788] CPU: 1 PID: 13788 Comm: syz-executor.4 Not tainted 5.12.0-rc6-syzkaller #0
[ 1771.756580][T13788] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 1771.766742][T13788] Call Trace:
[ 1771.770096][T13788]  dump_stack+0x24c/0x2e0
[ 1771.774596][T13788]  should_fail+0x8bd/0x9e0
[ 1771.779173][T13788]  __should_failslab+0x1f1/0x290
[ 1771.784266][T13788]  should_failslab+0x29/0x70
[ 1771.789093][T13788]  __kmalloc+0xbd/0x550
[ 1771.793397][T13788]  ? tomoyo_encode2+0x608/0xa50
[ 1771.798556][T13788]  ? kmsan_get_metadata+0x116/0x180
[ 1771.803898][T13788]  tomoyo_encode2+0x608/0xa50
[ 1771.808722][T13788]  tomoyo_realpath_from_path+0xb05/0xc20
[ 1771.814600][T13788]  tomoyo_path_number_perm+0x2a3/0xaf0
[ 1771.820278][T13788]  ? kmsan_internal_unpoison_shadow+0x2f/0x40
[ 1771.826487][T13788]  ? __msan_get_context_state+0x9/0x20
[ 1771.832099][T13788]  tomoyo_file_ioctl+0x74/0x90
[ 1771.837000][T13788]  ? tomoyo_inode_getattr+0x60/0x60
[ 1771.842433][T13788]  security_file_ioctl+0x10a/0x210
[ 1771.847904][T13788]  __se_sys_ioctl+0x13f/0x4d0
[ 1771.852782][T13788]  __x64_sys_ioctl+0x4a/0x70
[ 1771.857640][T13788]  do_syscall_64+0x9f/0x140
[ 1771.862328][T13788]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 1771.868366][T13788] RIP: 0033:0x4665d9
[ 1771.872360][T13788] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 1771.892103][T13788] RSP: 002b:00007f0cf7c79188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 1771.900659][T13788] RAX: ffffffffffffffda RBX: 000000000056bf80 RCX: 00000000004665d9
[ 1771.908748][T13788] RDX: 0000000020000180 RSI: 0000000000005421 RDI: 0000000000000003
[ 1771.916834][T13788] RBP: 00007f0cf7c791d0 R08: 0000000000000000 R09: 0000000000000000
[ 1771.924920][T13788] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 1771.932992][T13788] R13: 0000000000a9fb1f R14: 00007f0cf7c79300 R15: 0000000000022000
[ 1771.941558][T13788] ERROR: Out of memory at tomoyo_realpath_from_path.
[ 1772.087281][T13794] FAULT_INJECTION: forcing a failure.
[ 1772.087281][T13794] name failslab, interval 1, probability 0, space 0, times 0
[ 1772.100630][T13794] CPU: 0 PID: 13794 Comm: syz-executor.0 Not tainted 5.12.0-rc6-syzkaller #0
[ 1772.109572][T13794] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 1772.119753][T13794] Call Trace:
[ 1772.123214][T13794]  dump_stack+0x24c/0x2e0
[ 1772.127750][T13794]  should_fail+0x8bd/0x9e0
[ 1772.132458][T13794]  __should_failslab+0x1f1/0x290
[ 1772.137574][T13794]  should_failslab+0x29/0x70
[ 1772.139026][T13797] FAULT_INJECTION: forcing a failure.
[ 1772.139026][T13797] name failslab, interval 1, probability 0, space 0, times 0
[ 1772.142331][T13794]  __kmalloc+0xbd/0x550
[ 1772.142470][T13794]  ? tomoyo_realpath_from_path+0x142/0xc20
[ 1772.165466][T13794]  ? kmsan_get_metadata+0x116/0x180
[ 1772.170837][T13794]  tomoyo_realpath_from_path+0x142/0xc20
[ 1772.176653][T13794]  ? __msan_instrument_asm_store+0x22/0x130
[ 1772.182707][T13794]  tomoyo_path_number_perm+0x2a3/0xaf0
[ 1772.188494][T13794]  ? kmsan_internal_unpoison_shadow+0x2f/0x40
[ 1772.194710][T13794]  ? __msan_get_context_state+0x9/0x20
[ 1772.200308][T13794]  tomoyo_file_ioctl+0x74/0x90
[ 1772.205208][T13794]  ? tomoyo_inode_getattr+0x60/0x60
[ 1772.210554][T13794]  security_file_ioctl+0x10a/0x210
[ 1772.215849][T13794]  __se_sys_ioctl+0x13f/0x4d0
[ 1772.220703][T13794]  __x64_sys_ioctl+0x4a/0x70
[ 1772.225450][T13794]  do_syscall_64+0x9f/0x140
[ 1772.230111][T13794]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 1772.236152][T13794] RIP: 0033:0x4665d9
[ 1772.240137][T13794] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 1772.259890][T13794] RSP: 002b:00007f9c09032188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 1772.268448][T13794] RAX: ffffffffffffffda RBX: 000000000056bf80 RCX: 00000000004665d9
[ 1772.276701][T13794] RDX: 0000000000000000 RSI: 000000000000541b RDI: 0000000000000003
[ 1772.284868][T13794] RBP: 00007f9c090321d0 R08: 0000000000000000 R09: 0000000000000000
[ 1772.293117][T13794] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 1772.301187][T13794] R13: 0000000000a9fb1f R14: 00007f9c09032300 R15: 0000000000022000
[ 1772.309315][T13797] CPU: 1 PID: 13797 Comm: syz-executor.2 Not tainted 5.12.0-rc6-syzkaller #0
[ 1772.313182][T13794] ERROR: Out of memory at tomoyo_realpath_from_path.
[ 1772.318201][T13797] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 1772.325863][T13794] binder: 13790:13794 ioctl 541b 0 returned -22
[ 1772.335413][T13797] Call Trace:
[ 1772.335453][T13797]  dump_stack+0x24c/0x2e0
[ 1772.351108][T13797]  should_fail+0x8bd/0x9e0
[ 1772.355725][T13797]  __should_failslab+0x1f1/0x290
[ 1772.360845][T13797]  should_failslab+0x29/0x70
[ 1772.365609][T13797]  __kmalloc+0xbd/0x550
[ 1772.369935][T13797]  ? tomoyo_realpath_from_path+0x142/0xc20
[ 1772.375992][T13797]  ? kmsan_get_metadata+0x116/0x180
[ 1772.381400][T13797]  tomoyo_realpath_from_path+0x142/0xc20
[ 1772.387213][T13797]  ? __msan_instrument_asm_store+0x22/0x130
[ 1772.393415][T13797]  tomoyo_path_number_perm+0x2a3/0xaf0
[ 1772.399121][T13797]  ? kmsan_internal_unpoison_shadow+0x2f/0x40
[ 1772.405456][T13797]  ? __msan_get_context_state+0x9/0x20
[ 1772.411090][T13797]  tomoyo_file_ioctl+0x74/0x90
[ 1772.416106][T13797]  ? tomoyo_inode_getattr+0x60/0x60
[ 1772.421466][T13797]  security_file_ioctl+0x10a/0x210
[ 1772.426778][T13797]  __se_sys_ioctl+0x13f/0x4d0
[ 1772.431655][T13797]  __x64_sys_ioctl+0x4a/0x70
[ 1772.436437][T13797]  do_syscall_64+0x9f/0x140
[ 1772.441120][T13797]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 1772.447184][T13797] RIP: 0033:0x4665d9
[ 1772.451190][T13797] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 1772.471071][T13797] RSP: 002b:00007fcf6c007188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 1772.479740][T13797] RAX: ffffffffffffffda RBX: 000000000056bf80 RCX: 00000000004665d9
[ 1772.487846][T13797] RDX: 0000000000000000 RSI: 000000000000460f RDI: 0000000000000003
[ 1772.495952][T13797] RBP: 00007fcf6c0071d0 R08: 0000000000000000 R09: 0000000000000000
[ 1772.504057][T13797] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 1772.512149][T13797] R13: 0000000000a9fb1f R14: 00007fcf6c007300 R15: 0000000000022000
[ 1772.520395][T13797] ERROR: Out of memory at tomoyo_realpath_from_path.
06:41:00 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x10, 0x0)

06:41:00 executing program 5:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x5421, 0x0)

[ 1772.839051][T13801] binder: 13799:13801 ioctl 10 0 returned -22
06:41:00 executing program 5:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x5421, 0x0)

06:41:00 executing program 1 (fault-call:1 fault-nth:0):
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x10, 0x0)

06:41:00 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:00 executing program 5:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x5421, 0x0)

[ 1773.266503][T13809] FAULT_INJECTION: forcing a failure.
[ 1773.266503][T13809] name failslab, interval 1, probability 0, space 0, times 0
[ 1773.281878][T13809] CPU: 0 PID: 13809 Comm: syz-executor.1 Not tainted 5.12.0-rc6-syzkaller #0
[ 1773.290904][T13809] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 1773.301094][T13809] Call Trace:
[ 1773.304464][T13809]  dump_stack+0x24c/0x2e0
[ 1773.308993][T13809]  should_fail+0x8bd/0x9e0
[ 1773.313610][T13809]  __should_failslab+0x1f1/0x290
[ 1773.318810][T13809]  should_failslab+0x29/0x70
[ 1773.323589][T13809]  __kmalloc+0xbd/0x550
[ 1773.327918][T13809]  ? tomoyo_realpath_from_path+0x142/0xc20
[ 1773.333890][T13809]  ? kmsan_get_metadata+0x116/0x180
[ 1773.339251][T13809]  tomoyo_realpath_from_path+0x142/0xc20
[ 1773.345046][T13809]  ? __msan_instrument_asm_store+0x22/0x130
[ 1773.351092][T13809]  tomoyo_path_number_perm+0x2a3/0xaf0
[ 1773.356772][T13809]  ? kmsan_internal_unpoison_shadow+0x2f/0x40
[ 1773.363160][T13809]  ? __msan_get_context_state+0x9/0x20
[ 1773.368760][T13809]  tomoyo_file_ioctl+0x74/0x90
[ 1773.373673][T13809]  ? tomoyo_inode_getattr+0x60/0x60
[ 1773.379044][T13809]  security_file_ioctl+0x10a/0x210
[ 1773.384625][T13809]  __se_sys_ioctl+0x13f/0x4d0
[ 1773.389577][T13809]  __x64_sys_ioctl+0x4a/0x70
[ 1773.394352][T13809]  do_syscall_64+0x9f/0x140
[ 1773.399018][T13809]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 1773.405061][T13809] RIP: 0033:0x4665d9
[ 1773.409052][T13809] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 1773.429498][T13809] RSP: 002b:00007fd833093188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 1773.438062][T13809] RAX: ffffffffffffffda RBX: 000000000056bf80 RCX: 00000000004665d9
[ 1773.446198][T13809] RDX: 0000000000000000 RSI: 0000000000000010 RDI: 0000000000000003
[ 1773.454286][T13809] RBP: 00007fd8330931d0 R08: 0000000000000000 R09: 0000000000000000
[ 1773.462414][T13809] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 1773.470488][T13809] R13: 0000000000a9fb1f R14: 00007fd833093300 R15: 0000000000022000
[ 1773.479380][T13809] ERROR: Out of memory at tomoyo_realpath_from_path.
[ 1773.486673][T13809] binder: 13808:13809 ioctl 10 0 returned -22
06:41:01 executing program 3:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x2, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000040)=[@free_buffer, @exit_looper], 0x0, 0x0, 0x0})

06:41:01 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x541b, 0x0)

06:41:01 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x2, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:01 executing program 5:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, 0x0)

06:41:01 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x2, 0x0)

[ 1774.046030][T13818] binder: 13817:13818 ioctl 541b 0 returned -22
06:41:02 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)

06:41:02 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x2, 0x0)

06:41:02 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x10, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:02 executing program 5:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, 0x0)

06:41:02 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x10, 0x0)

06:41:02 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x2, 0x0)

[ 1774.672940][T13831] binder: 13829:13831 ioctl 10 20000180 returned -22
06:41:02 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x2, 0x0)

06:41:02 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x10, 0x0)

06:41:02 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x4c01, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

[ 1775.032009][T13838] binder: 13836:13838 ioctl 10 0 returned -22
06:41:02 executing program 5:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, 0x0)

06:41:02 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x2, 0x0)

[ 1775.239504][T13842] binder: 13840:13842 ioctl 10 0 returned -22
06:41:02 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x2, 0x0)

[ 1775.350992][T13844] binder: 13843:13844 ioctl 4c01 20000180 returned -22
06:41:03 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x10, 0x0)

06:41:03 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x4c01, 0x0)

06:41:03 executing program 5:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x5421, 0x0)

06:41:03 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x541b, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:03 executing program 3:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x2, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:03 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x3, 0x0)

[ 1775.872058][T13857] binder: 13854:13857 ioctl 4c01 0 returned -22
06:41:03 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x4600, 0x0)

[ 1775.961286][T13859] binder: 13856:13859 ioctl 541b 20000180 returned -22
06:41:03 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, 0x0)

06:41:03 executing program 5:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x5421, 0x0)

[ 1776.129678][T13862] binder: 13860:13862 ioctl 3 0 returned -22
06:41:03 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5450, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:04 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x4, 0x0)

06:41:04 executing program 3:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x10, 0x0)

06:41:04 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x4601, 0x0)

06:41:04 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5450, 0x0)

06:41:04 executing program 5:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x5421, 0x0)

[ 1776.765287][T13875] binder: 13873:13875 ioctl 4 0 returned -22
06:41:04 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5451, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:04 executing program 3:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x10, 0x0)

06:41:04 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5, 0x0)

06:41:04 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x4602, 0x0)

06:41:04 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5451, 0x0)

06:41:05 executing program 5:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x4601, 0x0)

[ 1777.386030][T13890] binder: 13887:13890 ioctl 5 0 returned -22
06:41:05 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5452, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:05 executing program 3:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x10, 0x0)

06:41:05 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x4604, 0x0)

06:41:05 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x6, 0x0)

06:41:05 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5452, 0x0)

06:41:05 executing program 5:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x4601, 0x0)

06:41:05 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5460, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

[ 1778.029694][T13904] binder: 13901:13904 ioctl 6 0 returned -22
06:41:05 executing program 3:
ioctl$FBIOGET_CON2FBMAP(0xffffffffffffffff, 0x10, 0x0)

06:41:05 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x4605, 0x0)

06:41:05 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x7, 0x0)

06:41:06 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5460, 0x0)

06:41:06 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x6364, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:06 executing program 5:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x4601, 0x0)

06:41:06 executing program 3:
ioctl$FBIOGET_CON2FBMAP(0xffffffffffffffff, 0x10, 0x0)

[ 1778.581694][T13918] binder: 13914:13918 ioctl 7 0 returned -22
06:41:06 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x4606, 0x0)

[ 1778.828277][T13922] binder: 13920:13922 ioctl 6364 20000180 returned -22
06:41:06 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x6364, 0x0)

06:41:06 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x8, 0x0)

06:41:06 executing program 3:
ioctl$FBIOGET_CON2FBMAP(0xffffffffffffffff, 0x10, 0x0)

06:41:06 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x8913, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:06 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5452, 0x0)

[ 1779.203287][T13931] binder: 13928:13931 ioctl 6364 0 returned -22
[ 1779.250190][T13933] binder: 13929:13933 ioctl 8 0 returned -22
[ 1779.448797][T13938] binder: 13934:13938 ioctl 8913 20000180 returned -22
06:41:07 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x4610, 0x0)

06:41:07 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x8913, 0x0)

06:41:07 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x9, 0x0)

06:41:07 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5452, 0x0)

06:41:07 executing program 3:
r0 = openat$fb1(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x10, 0x0)

06:41:07 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x8914, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

[ 1779.850462][T13943] binder: 13942:13943 ioctl 8913 0 returned -22
[ 1779.961476][T13946] binder: 13945:13946 ioctl 9 0 returned -22
06:41:07 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x4611, 0x0)

[ 1780.108964][T13951] binder: 13949:13951 ioctl 8914 20000180 returned -22
06:41:07 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x8914, 0x0)

06:41:07 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xa, 0x0)

06:41:07 executing program 3:
r0 = openat$fb1(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x10, 0x0)

06:41:07 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5452, 0x0)

06:41:08 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x8933, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

[ 1780.472029][T13957] binder: 13955:13957 ioctl 8914 0 returned -22
[ 1780.494654][T13958] binder: 13956:13958 ioctl a 0 returned -22
06:41:08 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x4c01, 0x0)

06:41:08 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x8933, 0x0)

[ 1780.704347][T13965] binder: 13963:13965 ioctl 8933 20000180 returned -22
06:41:08 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xb, 0x0)

06:41:08 executing program 3:
r0 = openat$fb1(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x10, 0x0)

06:41:08 executing program 5:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x5452, 0x0)

06:41:08 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xae04, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

[ 1781.036097][T13971] binder: 13968:13971 ioctl 8933 0 returned -22
[ 1781.078570][T13973] binder: 13969:13973 ioctl b 0 returned -22
06:41:08 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x541b, 0x0)

06:41:09 executing program 3:
openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(0xffffffffffffffff, 0x10, 0x0)

06:41:09 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc, 0x0)

06:41:09 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x400448c9, 0x0)

06:41:09 executing program 5:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x5452, 0x0)

06:41:09 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x400448c9, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

[ 1781.624712][T13985] binder: 13981:13985 ioctl c 0 returned -22
[ 1781.747146][T13989] binder: 13986:13989 ioctl 400448c9 0 returned -22
06:41:09 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x5421, 0x0)

06:41:09 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xd, 0x0)

06:41:09 executing program 3:
openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(0xffffffffffffffff, 0x10, 0x0)

[ 1781.892104][T13992] binder: 13990:13992 ioctl 400448c9 20000180 returned -22
06:41:09 executing program 5:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x5452, 0x0)

06:41:09 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x400448dd, 0x0)

06:41:09 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x400448dd, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

[ 1782.256324][T13998] binder: 13995:13998 ioctl d 0 returned -22
06:41:10 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x5450, 0x0)

06:41:10 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xe, 0x0)

06:41:10 executing program 3:
openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(0xffffffffffffffff, 0x10, 0x0)

[ 1782.501113][T14003] binder: 14001:14003 ioctl 400448dd 20000180 returned -22
06:41:10 executing program 5:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5452, 0x0)

[ 1782.557923][T14004] binder: 14002:14004 ioctl 400448dd 0 returned -22
06:41:10 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x400454ca, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:10 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x400454ca, 0x0)

[ 1782.839113][T14011] binder: 14008:14011 ioctl e 0 returned -22
06:41:10 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x5451, 0x0)

06:41:10 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x11, 0x0)

06:41:10 executing program 5:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5452, 0x0)

06:41:10 executing program 3:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x541b, 0x0)

[ 1783.118740][T14017] binder: 14016:14017 ioctl 400454ca 20000180 returned -22
[ 1783.138721][T14018] binder: 14015:14018 ioctl 400454ca 0 returned -22
06:41:11 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x40046205, 0x0)

06:41:11 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x40049409, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

[ 1783.492450][T14027] binder: 14024:14027 ioctl 11 0 returned -22
06:41:11 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x5452, 0x0)

06:41:11 executing program 5:
r0 = syz_open_dev$binderN(0x0, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5452, 0x0)

06:41:11 executing program 3:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x541b, 0x0)

06:41:11 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x12, 0x0)

[ 1783.802708][T14032] binder: 14028:14032 ioctl 40046205 0 returned -22
06:41:11 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x40186366, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:11 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x40046207, 0x0)

06:41:11 executing program 5:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x5452, 0x0)

[ 1784.066614][T14040] binder: 14038:14040 ioctl 12 0 returned -22
06:41:11 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x5460, 0x0)

06:41:11 executing program 3:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x541b, 0x0)

[ 1784.292924][T14042] binder: 14041:14042 ioctl 40186366 20000180 returned -22
06:41:12 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x29, 0x0)

06:41:12 executing program 5:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x5452, 0x0)

06:41:12 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x4020940d, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:12 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0)

[ 1784.666158][T14052] binder: 14050:14052 ioctl 29 0 returned -22
06:41:12 executing program 3:
ioctl$FBIOGET_CON2FBMAP(0xffffffffffffffff, 0x541b, 0x0)

06:41:12 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x6364, 0x0)

06:41:12 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5e, 0x0)

06:41:12 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x80086301, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:12 executing program 5:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x5452, 0x0)

06:41:12 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x40049409, 0x0)

[ 1785.308703][T14065] binder: 14064:14065 ioctl 5e 0 returned -22
06:41:13 executing program 3:
ioctl$FBIOGET_CON2FBMAP(0xffffffffffffffff, 0x541b, 0x0)

06:41:13 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x8913, 0x0)

[ 1785.543618][T14070] binder: 14067:14070 ioctl 80086301 20000180 returned -22
06:41:13 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x4c01, 0x0)

06:41:13 executing program 5:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x4611, 0x0)

06:41:13 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0045878, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:13 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x8914, 0x0)

06:41:13 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x4018620d, 0x0)

06:41:13 executing program 3:
ioctl$FBIOGET_CON2FBMAP(0xffffffffffffffff, 0x541b, 0x0)

[ 1785.971056][T14078] binder: 14077:14078 ioctl 4c01 0 returned -22
[ 1786.164500][T14085] binder: 14082:14085 ioctl 4018620d 0 returned -22
06:41:13 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x541b, 0x0)

06:41:14 executing program 5:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x4611, 0x0)

06:41:14 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x40186366, 0x0)

06:41:14 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x8933, 0x0)

06:41:14 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0045878, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

[ 1786.532710][T14091] binder: 14090:14091 ioctl 541b 0 returned -22
06:41:14 executing program 3:
r0 = openat$fb1(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x541b, 0x0)

06:41:14 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, 0x0)

[ 1786.839508][T14098] binder: 14094:14098 ioctl 40186366 0 returned -22
06:41:14 executing program 5:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x4611, 0x0)

06:41:14 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x400448c9, 0x0)

06:41:14 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x4020940d, 0x0)

06:41:14 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0189436, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:14 executing program 3:
r0 = openat$fb1(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x541b, 0x0)

06:41:15 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5450, 0x0)

06:41:15 executing program 5:
ioctl$FBIOGET_CON2FBMAP(0xffffffffffffffff, 0x4611, 0x0)

06:41:15 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x400448dd, 0x0)

06:41:15 executing program 3:
r0 = openat$fb1(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x541b, 0x0)

06:41:15 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x80086301, 0x0)

06:41:15 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc020660b, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:15 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5451, 0x0)

[ 1788.057833][T14127] binder: 14124:14127 ioctl 80086301 0 returned -22
06:41:15 executing program 5:
ioctl$FBIOGET_CON2FBMAP(0xffffffffffffffff, 0x4611, 0x0)

06:41:15 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x400454ca, 0x0)

06:41:15 executing program 3:
openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(0xffffffffffffffff, 0x541b, 0x0)

06:41:16 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0045878, 0x0)

06:41:16 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0585609, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:16 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5452, 0x0)

[ 1788.653706][T14140] binder: 14137:14140 ioctl c0585609 20000180 returned -22
06:41:16 executing program 5:
ioctl$FBIOGET_CON2FBMAP(0xffffffffffffffff, 0x4611, 0x0)

06:41:16 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x40049409, 0x0)

06:41:16 executing program 3:
openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(0xffffffffffffffff, 0x541b, 0x0)

06:41:16 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0045878, 0x0)

06:41:16 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5460, 0x0)

06:41:16 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:16 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x40186366, 0x0)

06:41:16 executing program 5:
r0 = openat$fb1(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x4611, 0x0)

06:41:17 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0046209, 0x0)

06:41:17 executing program 3:
openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(0xffffffffffffffff, 0x541b, 0x0)

06:41:17 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x6364, 0x0)

06:41:17 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x3, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:17 executing program 5:
r0 = openat$fb1(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x4611, 0x0)

06:41:17 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x4020940d, 0x0)

[ 1789.793782][T14164] binder: 14163:14164 ioctl 6364 0 returned -22
[ 1789.797846][T14165] binder: 14161:14165 ioctl c0046209 0 returned -22
06:41:17 executing program 3:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x4610, 0x0)

06:41:17 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x8913, 0x0)

06:41:17 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc018620b, 0x0)

06:41:17 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x4, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:17 executing program 5:
r0 = openat$fb1(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x4611, 0x0)

06:41:18 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x80086301, 0x0)

[ 1790.405849][T14178] binder: 14175:14178 ioctl 8913 0 returned -22
[ 1790.418594][T14179] binder: 14177:14179 ioctl c018620b 0 returned -14
06:41:18 executing program 3:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x4610, 0x0)

06:41:18 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc018620c, 0x0)

06:41:18 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x8914, 0x0)

06:41:18 executing program 5:
openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(0xffffffffffffffff, 0x4611, 0x0)

06:41:18 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x5, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:18 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0xc0045878, 0x0)

[ 1791.023688][T14190] binder: 14189:14190 ioctl c018620c 0 returned -14
06:41:18 executing program 3:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x4610, 0x0)

[ 1791.120549][T14194] binder: 14192:14194 ioctl 8914 0 returned -22
06:41:18 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0189436, 0x0)

06:41:19 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x8933, 0x0)

06:41:19 executing program 5:
openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(0xffffffffffffffff, 0x4611, 0x0)

06:41:19 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x6, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:19 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0xc0045878, 0x0)

06:41:19 executing program 3:
ioctl$FBIOGET_CON2FBMAP(0xffffffffffffffff, 0x4610, 0x0)

[ 1791.756515][T14208] binder: 14204:14208 ioctl 8933 0 returned -22
06:41:19 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc020660b, 0x0)

06:41:19 executing program 5:
openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(0xffffffffffffffff, 0x4611, 0x0)

06:41:19 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x7, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:19 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x400448c9, 0x0)

06:41:19 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0xc0189436, 0x0)

06:41:19 executing program 3:
ioctl$FBIOGET_CON2FBMAP(0xffffffffffffffff, 0x4610, 0x0)

06:41:20 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)

[ 1792.434902][T14222] binder: 14221:14222 ioctl 400448c9 0 returned -22
06:41:20 executing program 5:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x4606, 0x0)

06:41:20 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:20 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x400448dd, 0x0)

06:41:20 executing program 3:
ioctl$FBIOGET_CON2FBMAP(0xffffffffffffffff, 0x4610, 0x0)

[ 1792.767860][T14230] binder: 14227:14230 ioctl c0306201 0 returned -14
06:41:20 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0xc020660b, 0x0)

06:41:20 executing program 5:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x4606, 0x0)

06:41:20 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000040), 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r0, 0x541b, 0x0)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x105140, 0x0)
r2 = syz_open_dev$dri(&(0x7f0000000080), 0x10000, 0x40000)
ioctl$DRM_IOCTL_ADD_CTX(r1, 0xc0086420, &(0x7f00000000c0)={<r3=>0x0})
ioctl$DRM_IOCTL_SWITCH_CTX(r2, 0x40086424, &(0x7f0000000100)={r3})

[ 1793.058600][T14236] binder: 14233:14236 ioctl 400448dd 0 returned -22
06:41:20 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x9, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:21 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0xc0684608, 0x0)

06:41:21 executing program 3:
r0 = openat$fb1(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x4610, 0x0)

06:41:21 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x400454ca, 0x0)

[ 1793.370566][T14243] binder: 14240:14243 ioctl 541b 0 returned -22
[ 1793.390773][T14243] binder: 14240:14243 ioctl 541b 0 returned -22
06:41:21 executing program 5:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x4606, 0x0)

06:41:21 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x800)
ioctl$BINDER_WRITE_READ(r0, 0x541b, 0x0)
r1 = socket$xdp(0x2c, 0x3, 0x0)
accept4(0xffffffffffffffff, &(0x7f0000000040)=@ll={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f00000000c0)=0x80, 0x800)
bind$xdp(r1, &(0x7f0000000100)={0x2c, 0x3, r2, 0x2f}, 0x10)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IPVS_CMD_NEW_DEST(r4, &(0x7f0000000ac0)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000a80)={&(0x7f00000004c0)={0x4c, 0x0, 0x400, 0x70bd27, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x7f}, @IPVS_CMD_ATTR_SERVICE={0x1c, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e24}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e23}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x573}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x1}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x2}]}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40008d0}, 0x814)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r3, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
r6 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000005c0)={'wlan1\x00', <r7=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="db1e29bd7000fbdbdf250600000008000300", @ANYRES32=r7, @ANYBLOB="bb"], 0x30}}, 0x0)
r8 = openat$zero(0xffffffffffffff9c, &(0x7f0000000600), 0x20003, 0x0)
ioctl$SNDCTL_MIDI_INFO(r8, 0xc074510c, &(0x7f0000000640)={"cdc9d207d61bcee7b989fe2f50d8b41210692631122491df3cb84374b594", 0x7ff, 0x8001, 0x4, [0x2, 0xdca8, 0x3, 0xffffffff, 0xffff881c, 0x4, 0x0, 0xe3, 0x80000000, 0x9, 0x9b, 0x3ff, 0xfffff001, 0x0, 0x7, 0x20d, 0x6, 0x3e34000]})
sendmsg$NL80211_CMD_DEL_STATION(r3, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x30, 0x0, 0x408, 0x70bd2a, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r7}, @val={0xc, 0x99, {0x5f58, 0x1f}}}}, [@NL80211_ATTR_STA_LISTEN_INTERVAL={0x6, 0x12, 0x40}]}, 0x30}, 0x1, 0x0, 0x0, 0x890}, 0x40800)
r9 = socket(0xa, 0x803, 0x7f)
syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r9)
recvmsg$can_bcm(r9, &(0x7f0000000580)={&(0x7f0000000300)=@caif=@rfm, 0x80, &(0x7f0000000480)=[{&(0x7f00000003c0)=""/75, 0x4b}, {&(0x7f0000002600)=""/4097, 0x1001}, {&(0x7f00000006c0)=""/101, 0x65}, {&(0x7f0000000440)=""/7, 0x7}], 0x4, &(0x7f0000000740)=""/142, 0x8e}, 0x10000)

06:41:21 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0xa, 0x0, 0x0, 0x0, 0x0, 0x0})

[ 1793.757777][T14254] binder: 14252:14254 ioctl 400454ca 0 returned -22
06:41:21 executing program 3:
r0 = openat$fb1(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x4610, 0x0)

06:41:21 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x18000, 0x0)
ioctl$vim2m_VIDIOC_EXPBUF(r1, 0xc0405610, &(0x7f0000000040)={0x0, 0x8966, 0x81, 0x4000, <r2=>r1})
ioctl$vim2m_VIDIOC_EXPBUF(0xffffffffffffffff, 0xc0405610, &(0x7f0000000180)={0x3, 0x7f, 0x6f77, 0x2800, r2})
ioctl$FBIOPAN_DISPLAY(r1, 0x4606, &(0x7f00000000c0)={0x550, 0x320, 0x500, 0x140, 0x5, 0x5, 0x1, 0x0, {0x9, 0xc1}, {0xb37, 0x1, 0x1}, {0x9, 0x5, 0x1}, {0x7, 0xff, 0x1}, 0x3, 0x10, 0x100, 0x1f, 0x0, 0x5, 0x101, 0x80000000, 0x400, 0x10001, 0x2, 0x71, 0x21, 0x200, 0x3})

[ 1793.995284][T14258] binder: 14256:14258 ioctl 541b 0 returned -22
06:41:21 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x40046205, 0x0)

[ 1794.092682][T14258] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.0'.
[ 1794.177919][T14258] binder: 14256:14258 ioctl 541b 0 returned -22
[ 1794.215631][T14261] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.0'.
06:41:21 executing program 5:
ioctl$FBIOGET_CON2FBMAP(0xffffffffffffffff, 0x4606, 0x0)

06:41:22 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0xb, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:22 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r1, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f00000001c0)={'vxcan0\x00'})
socketpair(0x29, 0x800, 0x0, &(0x7f0000000040)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
sendmsg$IPVS_CMD_DEL_DEST(r2, &(0x7f0000000180)={&(0x7f0000000080), 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x5c, 0x0, 0x300, 0x70bd26, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DEST={0x30, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x1}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x1f}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@mcast2}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0xff}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x80000000}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4041}, 0x24040010)
ioctl$BINDER_WRITE_READ(r0, 0x541b, 0x0)

06:41:22 executing program 3:
r0 = openat$fb1(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x4610, 0x0)

[ 1794.510114][T14271] binder: 14270:14271 ioctl 40046205 0 returned -22
06:41:22 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)
ioctl$FBIOGET_VSCREENINFO(r0, 0x4600, &(0x7f00000000c0))

[ 1794.696593][T14277] binder: 14274:14277 ioctl 541b 0 returned -22
06:41:22 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x40046207, 0x0)

06:41:22 executing program 5:
ioctl$FBIOGET_CON2FBMAP(0xffffffffffffffff, 0x4606, 0x0)

06:41:22 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0xc, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:22 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0xc00)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000140)={0x2})
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r2, 0xcd6ccc609280a2c3, 0x0, 0x0, {{}, {@void, @void}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x24}}, 0x0)
sendmsg$NL80211_CMD_NEW_KEY(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x28, r2, 0x400, 0x70bd29, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x7f, 0x74}}}}, [@NL80211_ATTR_KEY_DEFAULT_TYPES={0x8, 0x6e, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x4040000}, 0x20000004)
ioctl$BINDER_WRITE_READ(r0, 0x541b, 0x0)

06:41:22 executing program 3:
openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(0xffffffffffffffff, 0x4610, 0x0)

06:41:22 executing program 2:
r0 = shmget(0x3, 0x1000, 0x40, &(0x7f0000fff000/0x1000)=nil)
shmctl$SHM_STAT(r0, 0xd, &(0x7f00000000c0)=""/130)
r1 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r1, 0x460f, 0x0)

[ 1795.288583][T14293] binder: 14290:14293 ioctl 541b 0 returned -22
06:41:23 executing program 5:
ioctl$FBIOGET_CON2FBMAP(0xffffffffffffffff, 0x4606, 0x0)

[ 1795.436952][T14294] binder: 14290:14294 ioctl 541b 0 returned -22
06:41:23 executing program 3:
openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(0xffffffffffffffff, 0x4610, 0x0)

06:41:23 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0)

06:41:23 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0xd, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:23 executing program 0:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080), 0x202800, 0x0)
write$sequencer(r0, &(0x7f00000000c0)=[@echo=0x8000, @e={0xff, 0x9, 0x2, 0x1, @generic=0x2, 0x95, 0x6, 0x7c}, @s={0x5, @generic=0x2, 0x1a, 0x80}, @l={0x92, 0x64, 0xe0, 0xa, 0x0, 0x3f, 0x6ca}, @v={0x93, 0x5, 0x90, 0x9, @MIDI_NOTEON=@special, 0x7, 0x6}, @generic={0x82}, @e={0xff, 0x0, 0x1, 0x1, @generic=0x3, 0x9, 0x8a, 0x8}, @l={0x92, 0x8, 0xd0, 0x17, 0xff, 0x0, 0x94}], 0x31)
r1 = syz_open_dev$binderN(&(0x7f0000000040), 0x0, 0x804)
ioctl$BINDER_WRITE_READ(r1, 0x541b, 0x0)

06:41:23 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000040), 0x12200, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)

06:41:23 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0xe, 0x0, 0x0, 0x0, 0x0, 0x0})

[ 1795.990462][T14310] binder: 14309:14310 ioctl 541b 0 returned -22
06:41:23 executing program 5:
r0 = openat$fb1(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x4606, 0x0)

[ 1796.048732][T14311] binder: 14309:14311 ioctl 541b 0 returned -22
06:41:23 executing program 3:
openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(0xffffffffffffffff, 0x4610, 0x0)

06:41:23 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x40049409, 0x0)

06:41:24 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_open_dev$binderN(&(0x7f0000000040), 0x0, 0x800)
mmap$binder(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x1, 0x11, r1, 0x1ff)
ioctl$BINDER_WRITE_READ(r0, 0x541b, 0x0)

06:41:24 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r1, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
sendmsg$DEVLINK_CMD_SB_POOL_SET(r1, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000040)={&(0x7f00000000c0)={0xc8, 0x0, 0x4, 0x70bd27, 0x25dfdbfc, {}, [{@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x20}, {0x6, 0x11, 0x5}, {0x8, 0x13, 0xfffffffa}, {0x5, 0x14, 0x1}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x2}, {0x6, 0x11, 0x7}, {0x8, 0x13, 0x80000001}, {0x5}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x297}, {0x6, 0x11, 0xed0}, {0x8, 0x13, 0x9}, {0x5}}]}, 0xc8}, 0x1, 0x0, 0x0, 0x20000001}, 0x240000d0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)

06:41:24 executing program 5:
r0 = openat$fb1(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x4606, 0x0)

06:41:24 executing program 3:
r0 = shmget(0x3, 0x1000, 0x40, &(0x7f0000fff000/0x1000)=nil)
shmctl$SHM_STAT(r0, 0xd, &(0x7f00000000c0)=""/130)
r1 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r1, 0x460f, 0x0)

06:41:24 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x10, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:24 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x4018620d, 0x0)

[ 1796.777466][T14326] binder: 14324:14326 ioctl 541b 0 returned -22
06:41:24 executing program 0:
socketpair(0x11, 0x2, 0x7fffffff, &(0x7f0000000040)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="240000ac4ee400", @ANYRES16=r2, @ANYBLOB="c3a20000000000000000620000000600b400000000000600b30000000000"], 0x24}}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0xbc, r2, 0x100, 0x70bd26, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xc}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x5}, @NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x6}, @mon_options=[@NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "9d3f30f41fcbb4db04867b4e3590a266d27922f73377e6d5"}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "15b9d8c7d60415d852719aeeb7d7bbee2ac554a5dd1686a8"}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "25c1563c3170e3f122a9eba531b36da03bfcaf768bec48aa"}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa}], @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x6}, @NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0xbc}, 0x1, 0x0, 0x0, 0x4}, 0x4)
r3 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0x541b, 0x0)

[ 1797.029533][T14336] binder: 14333:14336 ioctl 4018620d 0 returned -22
06:41:24 executing program 2:
openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0xaec9fb8022680943, 0x0)
r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, 0x0, 0x0)
ioctl$FBIOPAN_DISPLAY(r0, 0x4606, &(0x7f00000000c0)={0xa0, 0x300, 0x556, 0x300, 0x3, 0xfff, 0xf, 0x2, {0x8001, 0x7, 0x1}, {0x80000000, 0x1000, 0x1}, {0x9, 0xf8b}, {0x8, 0x1}, 0x1, 0x40, 0x6, 0x8001, 0x1, 0x80, 0x3, 0x90000000, 0x80, 0x0, 0x0, 0x20000, 0x20, 0x1, 0x1, 0x1})
r1 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000040), 0x400c00, 0x0)
ioctl$FBIOGET_CON2FBMAP(r1, 0x460f, 0x0)
r2 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000000), 0x401100, 0x0)
mmap$fb(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x1000000, 0x30, r2, 0x24000)

06:41:24 executing program 5:
r0 = openat$fb1(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x4606, 0x0)

06:41:24 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:24 executing program 3:
r0 = shmget(0x3, 0x1000, 0x40, &(0x7f0000fff000/0x1000)=nil)
shmctl$SHM_STAT(r0, 0xd, &(0x7f00000000c0)=""/130)
r1 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r1, 0x460f, 0x0)

06:41:25 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x40186366, 0x0)

[ 1797.409540][T14340] binder: 14339:14340 ioctl 541b 0 returned -22
06:41:25 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
write$fb(r1, &(0x7f0000000140)="4260dedefb2cdbef5ac9690cf3c94d6e9de46cd12a467b8e3aa061ebbc3a3705761d8b1c406475620088c76ac284e178f84c8185a8531fe02b7f8896c5f8aacdfa66dbd6f6e111d0019daf", 0x4b)
r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r2, 0x11b, 0x5, 0x0, 0x0)
write$proc_mixer(r2, &(0x7f00000001c0)=[{'LINE2', @val={' \'', 'Master Playback Volume'}}, {'DIGITAL2', @void}, {'VIDEO', @val={' \'', 'Line'}}, {'SPEAKER', @void}, {'DIGITAL3', @void}], 0x70)
ioctl$IOC_PR_RELEASE(r2, 0x401070ca, &(0x7f0000000000)={0x3f, 0x7})

06:41:25 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x541b, 0x0)

06:41:25 executing program 5:
openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(0xffffffffffffffff, 0x4606, 0x0)

[ 1797.802718][T14354] binder: 14352:14354 ioctl 40186366 0 returned -22
06:41:25 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x12, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:25 executing program 3:
r0 = shmget(0x3, 0x1000, 0x40, &(0x7f0000fff000/0x1000)=nil)
shmctl$SHM_STAT(r0, 0xd, &(0x7f00000000c0)=""/130)
r1 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r1, 0x460f, 0x0)

[ 1798.002811][T14358] binder: 14355:14358 ioctl 541b 0 returned -22
[ 1798.029204][T14360] binder: 14355:14360 ioctl 541b 0 returned -22
06:41:25 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x4020940d, 0x0)

06:41:25 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x541b, 0x0)
socket$inet6_udplite(0xa, 0x2, 0x88)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r1, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
accept4(r1, 0x0, &(0x7f0000000040), 0x80800)

06:41:25 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)
sendmsg$IPVS_CMD_SET_SERVICE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000040)={&(0x7f00000000c0)={0xb4, 0x0, 0x0, 0x70bd27, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xfff}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x9}, @IPVS_CMD_ATTR_SERVICE={0x1c, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x40}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x1}]}, @IPVS_CMD_ATTR_DAEMON={0x60, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x200}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e22}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x3}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @initdev={0xac, 0x1e, 0x0, 0x0}}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e21}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast2}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'team0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x2}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e21}]}]}, 0xb4}, 0x1, 0x0, 0x0, 0x8000}, 0x8000)

06:41:26 executing program 5:
openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(0xffffffffffffffff, 0x4606, 0x0)

06:41:26 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x25, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:26 executing program 3:
r0 = shmget(0x3, 0x1000, 0x40, &(0x7f0000fff000/0x1000)=nil)
shmctl$SHM_STAT(r0, 0xd, &(0x7f00000000c0)=""/130)
openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)

[ 1798.555298][T14372] binder: 14370:14372 ioctl 541b 0 returned -22
[ 1798.600147][T14372] binder: 14370:14372 ioctl 541b 0 returned -22
06:41:26 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x80086301, 0x0)

06:41:26 executing program 5:
openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(0xffffffffffffffff, 0x4606, 0x0)

06:41:26 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x541b, 0x0)
r1 = syz_open_dev$binderN(&(0x7f0000000040), 0x0, 0x2)
mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x4)

06:41:26 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x5c, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:26 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
mmap$fb(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0xb, 0x80010, r0, 0x55000)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)

[ 1799.064585][T14384] binder: 14382:14384 ioctl 80086301 0 returned -22
06:41:26 executing program 3:
r0 = shmget(0x3, 0x1000, 0x40, &(0x7f0000fff000/0x1000)=nil)
shmctl$SHM_STAT(r0, 0xd, &(0x7f00000000c0)=""/130)

[ 1799.140208][T14388] binder: 14385:14388 ioctl 541b 0 returned -22
[ 1799.179721][T14388] binder: 14385:14388 ioctl 541b 0 returned -22
06:41:27 executing program 5:
socketpair(0x11, 0x2, 0x7fffffff, &(0x7f0000000040)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="240000ac4ee400", @ANYRES16=r2, @ANYBLOB="c3a20000000000000000620000000600b400000000000600b30000000000"], 0x24}}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0xbc, r2, 0x100, 0x70bd26, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xc}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x5}, @NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x6}, @mon_options=[@NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "9d3f30f41fcbb4db04867b4e3590a266d27922f73377e6d5"}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "15b9d8c7d60415d852719aeeb7d7bbee2ac554a5dd1686a8"}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "25c1563c3170e3f122a9eba531b36da03bfcaf768bec48aa"}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa}], @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x6}, @NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0xbc}, 0x1, 0x0, 0x0, 0x4}, 0x4)
r3 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0x541b, 0x0)

06:41:27 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0045878, 0x0)

06:41:27 executing program 0:
r0 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_QUERYBUF(r0, 0xc0585609, &(0x7f0000000180)={0x0, 0x0, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "56850780"}})
ioctl$vim2m_VIDIOC_STREAMOFF(r0, 0x40045612, &(0x7f0000000080)=0x2)
r1 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r2, 0x11b, 0x5, 0x0, 0x0)
ioctl$BINDER_GET_NODE_INFO_FOR_REF(r2, 0xc018620c, &(0x7f0000000040)={0x2})
r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, 0x0, 0x0)
mmap$binder(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x1, 0x11, r3, 0x8)
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0x541b, 0x0)

06:41:27 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x300, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:27 executing program 2:
openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, 0x0, 0x0)
r1 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x280200, 0x0)
ioctl$FBIOGET_CON2FBMAP(r1, 0x460f, 0x0)

06:41:27 executing program 3:
shmctl$SHM_STAT(0x0, 0xd, &(0x7f00000000c0)=""/130)

[ 1799.732129][T14398] binder: 14397:14398 ioctl 541b 0 returned -22
[ 1799.846940][T14404] binder: 14401:14404 ioctl 541b 0 returned -22
06:41:27 executing program 5:
socketpair(0x11, 0x2, 0x7fffffff, &(0x7f0000000040)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="240000ac4ee400", @ANYRES16=r2, @ANYBLOB="c3a20000000000000000620000000600b400000000000600b30000000000"], 0x24}}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0xbc, r2, 0x100, 0x70bd26, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xc}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x5}, @NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x6}, @mon_options=[@NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "9d3f30f41fcbb4db04867b4e3590a266d27922f73377e6d5"}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "15b9d8c7d60415d852719aeeb7d7bbee2ac554a5dd1686a8"}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "25c1563c3170e3f122a9eba531b36da03bfcaf768bec48aa"}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa}], @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x6}, @NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0xbc}, 0x1, 0x0, 0x0, 0x4}, 0x4)
r3 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0x541b, 0x0)

06:41:27 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0045878, 0x0)

06:41:27 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x500, 0x0, 0x0, 0x0, 0x0, 0x0})

[ 1800.093512][ T3126] ieee802154 phy0 wpan0: encryption failed: -22
[ 1800.100151][ T3126] ieee802154 phy1 wpan1: encryption failed: -22
06:41:27 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
mmap$fb(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x1000000, 0x10, r1, 0xb2000)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)
r2 = accept4(r1, &(0x7f0000000180)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000000)=0x80, 0x80000)
sendmsg$IPVS_CMD_GET_DAEMON(r2, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000300)={&(0x7f0000000380)={0x9c, 0x0, 0x100, 0x70bd27, 0x25dddbff, {}, [@IPVS_CMD_ATTR_DAEMON={0x1c, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x20}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x8}]}, @IPVS_CMD_ATTR_SERVICE={0x18, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x2, 0x3}}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x1e}]}, @IPVS_CMD_ATTR_DAEMON={0x4c, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'macsec0\x00'}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x5}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth1_virt_wifi\x00'}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @private=0xa010101}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x94a9}]}, 0x9c}, 0x1, 0x0, 0x0, 0x4000}, 0x4040000)
ioctl$FBIO_WAITFORVSYNC(r0, 0x40044620, 0x0)
r3 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x24000, 0x0)
write$fb(r3, &(0x7f00000000c0)="1540af7cbab9e2d8b19f34a19f7585b14cd730126108b6eeec940ba60cc0eb7d155820bb7c430e5ff6928a4a40faded09f8df50f7d72995980c00720f1ba430e9f713d8fb745a0f0877e2534f973765f127bada6c2ded0808d5f0024a15f31049663d3deb98aa8f9560d14b37a7fe3d1fa6dd84c632b1642a444511cc7e3615b0b907773073596cd82bd0c061ae0856a597288", 0x93)

06:41:27 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x541b, 0x0)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
ioctl$FBIO_WAITFORVSYNC(r1, 0x40044620, 0x0)

[ 1800.357772][T14414] binder: 14413:14414 ioctl 541b 0 returned -22
06:41:28 executing program 3:
shmctl$SHM_STAT(0x0, 0xd, 0x0)

06:41:28 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0046209, 0x0)

06:41:28 executing program 5:
socketpair(0x11, 0x2, 0x7fffffff, &(0x7f0000000040)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="240000ac4ee400", @ANYRES16=r2, @ANYBLOB="c3a20000000000000000620000000600b400000000000600b30000000000"], 0x24}}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0xbc, r2, 0x100, 0x70bd26, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xc}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x5}, @NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x6}, @mon_options=[@NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "9d3f30f41fcbb4db04867b4e3590a266d27922f73377e6d5"}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "15b9d8c7d60415d852719aeeb7d7bbee2ac554a5dd1686a8"}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "25c1563c3170e3f122a9eba531b36da03bfcaf768bec48aa"}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa}], @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x6}, @NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0xbc}, 0x1, 0x0, 0x0, 0x4}, 0x4)
r3 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0x541b, 0x0)

[ 1800.596008][T14422] binder: 14419:14422 ioctl 541b 0 returned -22
06:41:28 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x600, 0x0, 0x0, 0x0, 0x0, 0x0})

[ 1800.667512][T14422] binder: 14419:14422 ioctl 541b 0 returned -22
06:41:28 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOPUT_CON2FBMAP(r0, 0x4610, &(0x7f0000000000)={0x1f, 0x2})
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)

06:41:28 executing program 3:
shmctl$SHM_STAT(0x0, 0xd, 0x0)

[ 1800.914120][T14431] binder: 14428:14431 ioctl c0046209 0 returned -22
06:41:28 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x541b, 0x0)
mmap$xdp(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x2000001, 0x4012, 0xffffffffffffffff, 0x80000000)

[ 1801.048010][T14432] binder: 14430:14432 ioctl 541b 0 returned -22
06:41:28 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x700, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:28 executing program 5:
socketpair(0x11, 0x2, 0x7fffffff, &(0x7f0000000040)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="240000ac4ee400", @ANYRES16=r2, @ANYBLOB="c3a20000000000000000620000000600b400000000000600b30000000000"], 0x24}}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0xbc, r2, 0x100, 0x70bd26, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xc}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x5}, @NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x6}, @mon_options=[@NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "9d3f30f41fcbb4db04867b4e3590a266d27922f73377e6d5"}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "15b9d8c7d60415d852719aeeb7d7bbee2ac554a5dd1686a8"}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "25c1563c3170e3f122a9eba531b36da03bfcaf768bec48aa"}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa}], @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x6}, @NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0xbc}, 0x1, 0x0, 0x0, 0x4}, 0x4)
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)

06:41:28 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc018620b, 0x0)

[ 1801.285410][T14441] binder: 14436:14441 ioctl 541b 0 returned -22
06:41:29 executing program 3:
shmctl$SHM_STAT(0x0, 0xd, 0x0)

06:41:29 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x715480, 0x0)
clock_gettime(0x0, &(0x7f0000000040)={<r1=>0x0, <r2=>0x0})
timerfd_settime(0xffffffffffffffff, 0x1, &(0x7f00000000c0)={{r1, r2+60000000}, {0x77359400}}, &(0x7f0000000100))
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)
r3 = socket(0x22, 0x2, 0x7f)
syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r3)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000), 0x4)

06:41:29 executing program 0:
socket$inet6_udplite(0xa, 0x2, 0x88)
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x800)
ioctl$BINDER_WRITE_READ(r0, 0x541b, 0x0)

06:41:29 executing program 5:
socketpair(0x11, 0x2, 0x7fffffff, &(0x7f0000000040)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="240000ac4ee400", @ANYRES16=r2, @ANYBLOB="c3a20000000000000000620000000600b400000000000600b30000000000"], 0x24}}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0xbc, r2, 0x100, 0x70bd26, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xc}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x5}, @NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x6}, @mon_options=[@NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "9d3f30f41fcbb4db04867b4e3590a266d27922f73377e6d5"}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "15b9d8c7d60415d852719aeeb7d7bbee2ac554a5dd1686a8"}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "25c1563c3170e3f122a9eba531b36da03bfcaf768bec48aa"}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa}], @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x6}, @NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0xbc}, 0x1, 0x0, 0x0, 0x4}, 0x4)

[ 1801.870952][T14455] binder: 14454:14455 ioctl 541b 0 returned -22
06:41:29 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x900, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:29 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc018620c, 0x0)

[ 1801.932045][T14457] binder: 14454:14457 ioctl 541b 0 returned -22
06:41:29 executing program 3:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOPUT_CON2FBMAP(r0, 0x4610, &(0x7f0000000000)={0x1f, 0x2})
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)

06:41:29 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000000), 0x180, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)

06:41:29 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000040)={0xffffffffffffffff}, 0x4)
ioctl$BINDER_WRITE_READ(r0, 0x541b, 0x0)
recvmsg$can_raw(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000080)=""/249, 0xf9}, {&(0x7f0000000180)=""/73, 0x49}], 0x2, &(0x7f0000000240)=""/112, 0x70}, 0x60013000)
ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0)

[ 1802.235226][T14464] binder: 14462:14464 ioctl c018620c 0 returned -14
06:41:30 executing program 5:
socketpair(0x11, 0x2, 0x7fffffff, &(0x7f0000000040))
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r0, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="240000ac4ee400", @ANYRES16=r1, @ANYBLOB="c3a20000000000000000620000000600b400000000000600b30000000000"], 0x24}}, 0x0)

06:41:30 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0xa00, 0x0, 0x0, 0x0, 0x0, 0x0})

[ 1802.555304][T14473] binder: 14471:14473 ioctl 541b 0 returned -22
06:41:30 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)
r1 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x2020, 0x0)
ioctl$FBIOPAN_DISPLAY(r1, 0x4606, &(0x7f00000000c0)={0x320, 0x1e0, 0x400, 0x140, 0x7, 0x400, 0x1, 0x2, {0xffff, 0x1}, {0x1f, 0x7ff}, {0x9, 0x3ff, 0x1}, {0x8, 0xae20, 0x1}, 0x1, 0x80, 0xa252, 0x9d, 0x0, 0x1, 0x80000000, 0x6, 0x7, 0x401, 0x7fffffff, 0xffffffff, 0x4, 0x4, 0x1, 0xa})

06:41:30 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0189436, 0x0)

[ 1802.624687][T14474] binder: 14471:14474 ioctl 541b 0 returned -22
06:41:30 executing program 3:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOPUT_CON2FBMAP(r0, 0x4610, &(0x7f0000000000)={0x1f, 0x2})
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)

06:41:30 executing program 0:
r0 = syz_open_dev$dri(&(0x7f0000000040), 0x7fffffff, 0x80002)
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000080)={<r1=>0x0})
ioctl$DRM_IOCTL_SET_SAREA_CTX(r0, 0x4010641c, &(0x7f0000000140)={r1, &(0x7f00000000c0)=""/97})
r2 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(r2, 0x40046208, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0x541b, 0x0)

06:41:30 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc020660b, 0x0)

06:41:30 executing program 5:
socketpair(0x11, 0x2, 0x7fffffff, &(0x7f0000000040))
socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)

06:41:30 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0xb00, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:30 executing program 3:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOPUT_CON2FBMAP(r0, 0x4610, &(0x7f0000000000)={0x1f, 0x2})
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)

06:41:30 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040), 0x361100, 0x0)
mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x5)
ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, &(0x7f0000000000))

[ 1803.333639][T14493] binder: 14491:14493 ioctl 541b 0 returned -22
06:41:31 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)

06:41:31 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x541b, 0x0)
getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000040)={@remote}, &(0x7f0000000080)=0x14)

06:41:31 executing program 5:
socketpair(0x11, 0x2, 0x7fffffff, &(0x7f0000000040))
socket$nl_generic(0x10, 0x3, 0x10)

06:41:31 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0xc00, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:31 executing program 3:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOPUT_CON2FBMAP(r0, 0x4610, &(0x7f0000000000)={0x1f, 0x2})

06:41:31 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r1, 0x460f, &(0x7f0000000000)={0x8d, 0x2})
openat$fb1(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0)
write$fb(r0, &(0x7f0000000140)="a8a4c3521699407b9058fb6018be8ccc5823b2406296543dd37c6057c3be4935b327efc4e002c99896f8648ad7b2d6b5d2948c48becdf289583a1015d2a4345fe9fab33ceb191a169a842efd213731a4b74d966aa7a36f5263a23ce35005b82fddc659e0abe61b677aeafd3df8c6e9d1a812933515d6af1c69ed7c9818733b95bf389a950ece59a108b0a4ef5e", 0x8d)
ioctl$DRM_IOCTL_GET_CTX(r1, 0xc0086423, &(0x7f0000000200)={0x0, 0x1})
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)
ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, &(0x7f00000000c0))

[ 1803.881038][T14509] binder: 14508:14509 ioctl c0306201 0 returned -14
[ 1804.010741][T14514] binder: 14511:14514 ioctl 541b 0 returned -22
[ 1804.035075][T14514] binder: 14511:14514 ioctl 541b 0 returned -22
06:41:31 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x10, 0x0)
r1 = syz_open_dev$binderN(&(0x7f0000000340), 0x0, 0x2)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000380)={0x2})
r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r2, 0x11b, 0x5, 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000300)={0x73622a85, 0x100, 0x1})
r3 = accept4(0xffffffffffffffff, &(0x7f0000000040)=@x25, &(0x7f00000000c0)=0x80, 0x1c1800)
sendmsg$NL80211_CMD_SET_CQM(r3, &(0x7f00000002c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000280)={&(0x7f0000000140)={0x108, 0x0, 0x200, 0x70bd27, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x200, 0x3a}}}}, [@NL80211_ATTR_CQM={0x1c, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_TXE_INTVL={0x8, 0x7, 0x48e}, @NL80211_ATTR_CQM_RSSI_HYST={0x8, 0x2, 0x4}, @NL80211_ATTR_CQM_RSSI_HYST={0x8, 0x2, 0x4}]}, @NL80211_ATTR_CQM={0x3c, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT={0x8, 0x3, 0x3ff}, @NL80211_ATTR_CQM_RSSI_HYST={0x8, 0x2, 0x2}, @NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT={0x8, 0x3, 0x1000}, @NL80211_ATTR_CQM_RSSI_THOLD={0x20, 0x1, [0xfffffffa, 0x7, 0x0, 0x20, 0x8c, 0x3ff, 0x7]}]}, @NL80211_ATTR_CQM={0x4}, @NL80211_ATTR_CQM={0x60, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT={0x8, 0x3, 0x6a634a5e}, @NL80211_ATTR_CQM_TXE_INTVL={0x8, 0x7, 0x67e}, @NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT={0x8, 0x3, 0x1}, @NL80211_ATTR_CQM_RSSI_THOLD={0x2c, 0x1, [0x7fffffff, 0x10000, 0x7, 0x8, 0x1, 0x0, 0x75f8b1a, 0xff, 0x90, 0x800]}, @NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT={0x8, 0x3, 0x9}, @NL80211_ATTR_CQM_RSSI_LEVEL={0x8, 0x9, 0x2}, @NL80211_ATTR_CQM_TXE_INTVL={0x8, 0x7, 0x1ca}]}, @NL80211_ATTR_CQM={0x2c, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_RSSI_HYST={0x8, 0x2, 0x6}, @NL80211_ATTR_CQM_TXE_RATE={0x8, 0x5, 0x1f}, @NL80211_ATTR_CQM_TXE_RATE={0x8, 0x5, 0x25}, @NL80211_ATTR_CQM_RSSI_LEVEL={0x8, 0x9, 0x43}, @NL80211_ATTR_CQM_TXE_INTVL={0x8, 0x7, 0x1d2}]}]}, 0x108}, 0x1, 0x0, 0x0, 0x48800}, 0x24004000)

06:41:31 executing program 5:
socketpair(0x11, 0x2, 0x7fffffff, &(0x7f0000000040))

06:41:31 executing program 0:
r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, 0x0, 0x0)
ioctl$VIDIOC_QUERYBUF(0xffffffffffffffff, 0xc0585609, &(0x7f0000000080)={0x0, 0x3, 0x4, 0xe020, 0x7, {0x77359400}, {0x1, 0x3, 0x7, 0x80, 0x3f, 0x2, "465e1ea2"}, 0x0, 0x2, @planes=&(0x7f0000000040)={0xd950, 0x3ff, @fd=r0, 0x5}, 0x8000})
r1 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0x541b, 0x0)

06:41:32 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0xd00, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:32 executing program 3:
ioctl$FBIOPUT_CON2FBMAP(0xffffffffffffffff, 0x4610, &(0x7f0000000000)={0x1f, 0x2})

06:41:32 executing program 2:
ioctl$SNDCTL_MIDI_INFO(0xffffffffffffffff, 0xc074510c, &(0x7f0000000040)={"e9156d70f8f0aed6b6c1140e5c8eeb5d7ecdadcb65b2875185a95c20b68f", 0x9, 0x8a, 0x200, [0xd, 0x7f, 0x3f, 0x1f, 0xe355, 0x0, 0x3f, 0x9, 0xffffff03, 0x7fff, 0x80, 0x7f, 0x75, 0x9, 0x5, 0x8, 0x3, 0x6]})
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
ioctl$FBIOPAN_DISPLAY(r1, 0x4606, &(0x7f00000000c0)={0x190, 0x140, 0x0, 0x140, 0xd17, 0xffff, 0x0, 0x2, {0xb1, 0xffff, 0x1}, {0x1f, 0xfffffffb}, {0x3, 0x7, 0x1}, {0x2, 0xb3e5}, 0x0, 0x10, 0x7ba16081, 0x80000001, 0x1, 0xfffffffc, 0x6, 0x7, 0xebb, 0x0, 0x7f, 0x9, 0x1, 0x100, 0x0, 0x7})

[ 1804.552873][T14528] binder: 14524:14528 ioctl 10 0 returned -22
[ 1804.608185][T14530] binder: 14527:14530 ioctl 541b 0 returned -22
[ 1804.611011][T14528] binder: 14524:14528 ioctl 10 0 returned -22
[ 1804.706726][T14534] binder: 14527:14534 ioctl 541b 0 returned -22
06:41:32 executing program 5:
socketpair(0x0, 0x2, 0x7fffffff, &(0x7f0000000040))

06:41:32 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0xe00, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:32 executing program 1:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x10, 0x0)

06:41:32 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x541b, 0x0)
ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0)

06:41:32 executing program 3:
ioctl$FBIOPUT_CON2FBMAP(0xffffffffffffffff, 0x4610, &(0x7f0000000000)={0x1f, 0x2})

06:41:32 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r1, 0x460f, &(0x7f0000000180)={0x16, 0x2})
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)
r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
setsockopt$XDP_UMEM_FILL_RING(r2, 0x11b, 0x5, 0x0, 0x0)
ioctl$FBIOPUTCMAP(r2, 0x4605, &(0x7f0000000140)={0x2, 0x2, &(0x7f0000000000)=[0x200, 0x9], &(0x7f0000000040)=[0xdd6f, 0x3ff, 0x45, 0x7d47, 0xdb, 0x8000, 0x5, 0x100, 0x0], &(0x7f00000000c0)=[0x5, 0x3, 0x2, 0x9], &(0x7f0000000100)=[0x8001, 0xffff, 0x80, 0x8001, 0x40, 0x3, 0x5, 0x7f]})
socket$can_bcm(0x1d, 0x2, 0x2)

[ 1805.378119][T14550] binder: 14549:14550 ioctl 541b 0 returned -22
[ 1805.431412][T14550] binder: 14549:14550 ioctl 541b 0 returned -22
06:41:33 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x10, 0x0)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0x0)
ioctl$VIDIOC_EXPBUF(r1, 0xc0405610, &(0x7f0000000040)={0x0, 0x7, 0x2, 0x80000})

06:41:33 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x1100, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:33 executing program 5:
socketpair(0x0, 0x2, 0x7fffffff, &(0x7f0000000040))

06:41:33 executing program 3:
ioctl$FBIOPUT_CON2FBMAP(0xffffffffffffffff, 0x4610, &(0x7f0000000000)={0x1f, 0x2})

06:41:33 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x541b, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000200)={'wlan1\x00', <r3=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="db1e29bd7000fbdbdf250600000008000300", @ANYRES32=r3, @ANYBLOB='\f'], 0x30}}, 0x0)
sendmsg$NL80211_CMD_DEL_KEY(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x50, 0x0, 0x800, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "e3c30561a8"}, @NL80211_ATTR_KEY_DEFAULT_TYPES={0x4}, @NL80211_ATTR_KEY_DATA_WEP40={0x9, 0x7, "926e1246af"}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "165541b5f319c0524a908aeac5"}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x44014)

06:41:33 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f00000000c0)={0x40, 0x400, 0x300, 0x5e0, 0x8, 0x1f, 0x2, 0x2, {0x8, 0xfffffffe, 0x1}, {0x3f, 0x10000, 0x1}, {0x2, 0x6, 0x1}, {0x7fffffff, 0x3f, 0x1}, 0x2, 0x2, 0x1, 0x80000001, 0x1, 0x4f8000, 0x1, 0xffffffff, 0xac, 0x6, 0x55e, 0x6, 0x10, 0x2, 0x0, 0x3})

[ 1805.825088][T14562] binder: 14558:14562 ioctl 10 0 returned -22
[ 1805.896546][T14562] binder: 14558:14562 ioctl 10 0 returned -22
[ 1805.998972][T14569] binder: 14567:14569 ioctl 541b 0 returned -22
[ 1806.056497][T14569] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'.
06:41:33 executing program 5:
socketpair(0x0, 0x2, 0x7fffffff, &(0x7f0000000040))

[ 1806.127691][T14569] binder: 14567:14569 ioctl 541b 0 returned -22
06:41:33 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r0, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
sendmsg$IPVS_CMD_NEW_DEST(r0, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000080)={0x114, 0x0, 0x4, 0x70bd2d, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x7}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x7}, @IPVS_CMD_ATTR_DAEMON={0x54, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @loopback}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @empty}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x1}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x4d}]}, @IPVS_CMD_ATTR_DAEMON={0x28, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth1\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x9}]}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x200}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x2}, @IPVS_CMD_ATTR_DAEMON={0x30, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @broadcast}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @initdev={0xac, 0x1e, 0x1, 0x0}}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e22}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth1_to_team\x00'}]}, @IPVS_CMD_ATTR_DAEMON={0x28, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e24}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth0_to_bond\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x80}]}]}, 0x114}, 0x1, 0x0, 0x0, 0x881}, 0x8001)
r1 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x806)
ioctl$BINDER_WRITE_READ(r1, 0x10, 0x0)

06:41:33 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x1200, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:33 executing program 3:
r0 = openat$fb1(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$FBIOPUT_CON2FBMAP(r0, 0x4610, &(0x7f0000000000)={0x1f, 0x2})

06:41:34 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x541b, 0x0)

[ 1806.467470][T14580] binder: 14577:14580 ioctl 10 0 returned -22
06:41:34 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGETCMAP(r0, 0x4604, &(0x7f0000000200)={0x5, 0xa, &(0x7f0000000000)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000001c0)=[0x0, 0x0, 0x0, 0x0, 0x0]})
ioctl$FBIOGET_VSCREENINFO(r0, 0x4600, &(0x7f00000000c0))
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)

[ 1806.689406][T14587] binder: 14585:14587 ioctl 541b 0 returned -22
06:41:34 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x2500, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:34 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x10, 0x0)
socket$inet6_mptcp(0xa, 0x1, 0x106)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x105882, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000040)={0x2})

06:41:34 executing program 5:
socketpair(0x11, 0x0, 0x7fffffff, &(0x7f0000000040))

06:41:34 executing program 3:
r0 = openat$fb1(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$FBIOPUT_CON2FBMAP(r0, 0x4610, &(0x7f0000000000)={0x1f, 0x2})

06:41:34 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x541b, 0x0)
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xd, &(0x7f0000000040)='/dev/binder#\x00'}, 0x30)

[ 1807.115526][T14596] binder: 14593:14596 ioctl 10 0 returned -22
06:41:34 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r0, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_PORT_UNSPLIT(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="ac000000", @ANYRES16=r1, @ANYBLOB="000329bd7000ffdbdf250a0000000800010070636900110002003030a8a0de5c303a31302e300000000008000300020000000e0001006e657464657673696d0000000f0002006e657464657673696d3000000800030003001500080001007063690011000200303030303a30303a31302e300000000008000300030000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008000300010000007c62d073aada5a1a1d4d3a50268deecf85f9d9842f1b6b4582b5560984e2398fd98843cf4d3c50ee3bdb9f01bf0021e45bb7f81f96ae518d0a79b7e54d5372d6723d332f3e155000f894cea95119499045bb9a4adbc3ace903b560b22c0a4bd51f823e99f4e99b409e928248f836eec44f8183c7cfbbfbafe4a7ecf6cacb8bb9ea33e5128d52164214bfcf4c6c9bdfe91ed1c163df9da0c05beed7516acb858b3d03af2d6d501a594dd35b95463bec046c671fc92b309375e22900fb4b3b5125077b007c0fd2f390028d174b062b12c3cb794b8c2f1127f79015a5675a714b07a1"], 0xac}, 0x1, 0x0, 0x0, 0x2000c010}, 0x4004000)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r2, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r2, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r5, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r5, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
sendmsg$DEVLINK_CMD_PORT_UNSPLIT(r5, &(0x7f00000005c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000240)={0x38, 0x0, 0x8, 0x70bd29, 0x25dfdbfd, {}, [{{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x2}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40}, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r3, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r4, 0xcd6ccc609280a2c3, 0x0, 0x0, {{}, {@void, @void}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x24}}, 0x0)
sendmsg$NL80211_CMD_UPDATE_FT_IES(r2, &(0x7f0000000140)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000100)={&(0x7f0000000440)={0x120, r4, 0xa2428ae0460755c6, 0x70bd26, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x6fb, 0x17}}}}, [@NL80211_ATTR_IE={0xf6, 0x2a, [@random_vendor={0xdd, 0xd5, "bf624a18dd856c63e4804d7d2cd7eeabbbe5561115c03c473ee5c59474d9b4a25ecf51d635e095e124759e5798dd12cf241d7ac8d8b84d59738f0a308720acb5dc7f1c5868db99113101bdd4da2695d06d89d29d81849e681906fd8b732e60aa9966774fcd28199d679097d184c43890d939e3ab0f7a218f301fc864d8f479272ce4b710643dabe1399eb952947ec9c25dec2f4fb89700a3a293d24ee2aeebf2698d244c3c52d19496d0fa1132e821a31eb0510e45432e99349f16f355ddbb36353b283ea9c91fb77671b99d76d753260ab340d0f0"}, @tim={0x5, 0x5, {0xc2, 0x7, 0x28, "9adb"}}, @link_id={0x65, 0x12, {@from_mac}}]}, @NL80211_ATTR_MDID={0x6, 0xb1, 0xfe00}]}, 0x120}, 0x1, 0x0, 0x0, 0x40040}, 0x4814)
r6 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r6, 0x460f, 0x0)

[ 1807.158122][T14596] binder: 14593:14596 ioctl 10 0 returned -22
06:41:34 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x5c00, 0x0, 0x0, 0x0, 0x0, 0x0})

[ 1807.294901][T14603] binder: 14600:14603 ioctl 541b 0 returned -22
06:41:35 executing program 1:
ioctl$UFFDIO_COPY(0xffffffffffffffff, 0xc028aa03, &(0x7f0000000040)={&(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffb000/0x1000)=nil, 0x3000, 0x1})
r0 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r0, 0x10, 0x0)
mmap$binder(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x1, 0x11, 0xffffffffffffffff, 0xa3d)
socket$inet6_mptcp(0xa, 0x1, 0x106)
sendmsg$IPVS_CMD_DEL_DAEMON(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000200)={&(0x7f00000000c0)={0x124, 0x0, 0x100, 0x70bd26, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_DAEMON={0x2c, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @private=0xa010101}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @private=0xa010101}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x9d}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e20}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e24}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x59}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x20, 0x25}}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x8}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x2fc4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xd6f0}, @IPVS_CMD_ATTR_SERVICE={0x34, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@empty}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@loopback}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x87}]}, @IPVS_CMD_ATTR_SERVICE={0x38, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e21}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x7d5f}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x4b}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@initdev={0xac, 0x1e, 0x0, 0x0}}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'nq\x00'}]}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0xa}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x10, 0x1}}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e24}]}]}, 0x124}, 0x1, 0x0, 0x0, 0x4000081}, 0x81)

06:41:35 executing program 5:
socketpair(0x11, 0x0, 0x7fffffff, &(0x7f0000000040))

06:41:35 executing program 3:
r0 = openat$fb1(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$FBIOPUT_CON2FBMAP(r0, 0x4610, &(0x7f0000000000)={0x1f, 0x2})

06:41:35 executing program 0:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, 0x0, 0x0)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040), 0x24000, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0x541b, 0x0)

[ 1807.697053][T14612] binder: 14609:14612 ioctl 10 0 returned -22
[ 1807.740912][T14613] binder: 14609:14613 ioctl 10 0 returned -22
06:41:35 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0xff00, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:35 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x682101, 0x0)
mmap$fb(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1000009, 0x40010, r0, 0xef000)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)

06:41:35 executing program 1:
read$sequencer(0xffffffffffffffff, &(0x7f0000000040)=""/54, 0x36)
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x10, 0x0)

06:41:35 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
openat$zero(0xffffffffffffff9c, &(0x7f0000000040), 0x80, 0x0)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
r2 = gettid()
waitid(0x2, r2, 0x0, 0x2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x541b, 0x0)

06:41:35 executing program 3:
openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOPUT_CON2FBMAP(0xffffffffffffffff, 0x4610, &(0x7f0000000000)={0x1f, 0x2})

06:41:35 executing program 5:
socketpair(0x11, 0x0, 0x7fffffff, &(0x7f0000000040))

[ 1808.210979][T14626] binder: 14623:14626 ioctl 10 0 returned -22
[ 1808.240635][T14628] binder: 14623:14628 ioctl 10 0 returned -22
06:41:36 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x1000000, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:36 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x10, 0x0)
r1 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_QUERYBUF(r1, 0xc0585609, &(0x7f0000000180)={0x0, 0x0, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "56850780"}})
r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r2, 0x11b, 0x5, 0x0, 0x0)
ioctl$VIDIOC_QUERYBUF(0xffffffffffffffff, 0xc0585609, &(0x7f0000000080)={0x100, 0x5, 0x4, 0x10, 0x9, {}, {0x78dd79d07fac30ec, 0x2, 0x5, 0x5, 0x3f, 0x55, "b49d6696"}, 0x2, 0x2, @fd, 0x3f, 0x0, <r3=>0xffffffffffffffff})
ioctl$vim2m_VIDIOC_QUERYBUF(r1, 0xc0585609, &(0x7f0000000100)={0x42, 0x3, 0x4, 0x0, 0x7ff, {0x0, 0x2710}, {0x1, 0x0, 0x0, 0x3f, 0x0, 0x7, "3cadfdc2"}, 0x6c, 0x2, @planes=&(0x7f0000000040)={0x3, 0x2, @fd=r2, 0x5}, 0xffffff80, 0x0, <r4=>r3})
r5 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r5, 0x11b, 0x5, 0x0, 0x0)
ioctl$vim2m_VIDIOC_QBUF(0xffffffffffffffff, 0xc058560f, &(0x7f0000000200)={0x81, 0x2, 0x4, 0x0, 0x633, {}, {0x2, 0x524952e611b97139, 0x20, 0x1, 0x5, 0xaf, "b82aeea1"}, 0x3, 0x2, @fd=r5, 0x8, 0x0, r4})

[ 1808.477279][T14634] binder: 14631:14634 ioctl 541b 0 returned -22
06:41:36 executing program 2:
r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, 0x0, 0x0)
ioctl$FBIOGETCMAP(r0, 0x4604, &(0x7f0000000200)={0x5, 0x3, &(0x7f0000000000)=[0x0, 0x0, 0x0], &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0], &(0x7f00000001c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
r1 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0)
ioctl$VIDIOC_QUERYBUF(r1, 0xc0585609, &(0x7f0000000280)={0xc536, 0x0, 0x4, 0x0, 0x800, {}, {0x2, 0x2, 0x0, 0x5a, 0x3f, 0x9, '6k\r-'}, 0x8, 0x2, @fd=r0, 0x100})
mmap$binder(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x1)
r2 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r2, 0x460f, 0x0)
ioctl$FBIOGET_VSCREENINFO(r2, 0x4600, &(0x7f00000000c0))

06:41:36 executing program 3:
openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOPUT_CON2FBMAP(0xffffffffffffffff, 0x4610, &(0x7f0000000000)={0x1f, 0x2})

06:41:36 executing program 5:
socketpair(0x11, 0x2, 0x0, &(0x7f0000000040))

06:41:36 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x541b, 0x0)
r1 = timerfd_create(0x7, 0x0)
clock_gettime(0x0, &(0x7f0000000040)={<r2=>0x0, <r3=>0x0})
timerfd_settime(r1, 0x1, &(0x7f0000000080)={{r2, r3+60000000}}, &(0x7f00000000c0))
ioctl$BLKTRACESTOP(0xffffffffffffffff, 0x1275, 0x0)
sendmsg$NL80211_CMD_STOP_NAN(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000280)={0x28, 0x0, 0x0, 0x70bd28, 0x2ddfdbfe, {{}, {@val={0x8}, @val={0xc, 0x99, {0x3, 0x4f}}}}, ["", ""]}, 0xffffffffffffff82}, 0x1, 0x0, 0x0, 0x80}, 0x0)
r4 = add_key$keyring(&(0x7f0000000080), &(0x7f00000000c0)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffc)
add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x3}, 0x0, 0x0, r4)
keyctl$restrict_keyring(0x1d, r4, &(0x7f0000000200)='.request_key_auth\x00', &(0x7f0000000240)='/dev/binder#\x00')

[ 1808.835267][T14641] binder: 14638:14641 ioctl 10 0 returned -22
[ 1808.955688][T14641] binder: 14638:14641 ioctl 10 0 returned -22
06:41:36 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:36 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_PORT_POOL_GET(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x80, 0x0, 0x200, 0x70bd2a, 0x25dfdbfe, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}, {0x8, 0xb, 0x80}, {0x6, 0x11, 0x1}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x1}}, {0x8}, {0x6, 0x11, 0x3}}]}, 0x80}, 0x1, 0x0, 0x0, 0x803}, 0x11)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r0, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$IPVS_CMD_SET_SERVICE(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x3c, r1, 0x728, 0x70bd2a, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x3}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7f}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3bb8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0)
r2 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r2, 0x460f, 0x0)

[ 1809.153687][T14653] binder: 14650:14653 ioctl 541b 0 returned -22
06:41:36 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x10, 0x0)

[ 1809.239984][T14653] binder: 14650:14653 ioctl 541b 0 returned -22
06:41:37 executing program 3:
openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOPUT_CON2FBMAP(0xffffffffffffffff, 0x4610, &(0x7f0000000000)={0x1f, 0x2})

06:41:37 executing program 5:
socketpair(0x11, 0x2, 0x0, 0x0)

06:41:37 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
r2 = syz_open_dev$vim2m(&(0x7f0000000040), 0x80000001, 0x2)
ioctl$vim2m_VIDIOC_ENUM_FRAMESIZES(r2, 0xc02c564a, &(0x7f0000000080)={0x8, 0x20363059, 0x2, @discrete={0x7, 0x4}})
ioctl$BINDER_WRITE_READ(r0, 0x541b, 0x0)

[ 1809.554957][T14663] binder: 14660:14663 ioctl 10 0 returned -22
[ 1809.603263][T14664] binder: 14660:14664 ioctl 10 0 returned -22
06:41:37 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOPUT_CON2FBMAP(r0, 0x4610, &(0x7f0000000000)={0x13, 0x2})

06:41:37 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x3000000, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:37 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_CQM(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000300)={&(0x7f0000000100)=ANY=[@ANYBLOB="c4010000", @ANYRES16=r1, @ANYBLOB="000327bd7000fcdbdf253f00000068005e8008000300040000000800030001000000080005005700000008000700bf00000024000100ffff00000400000003000000c7000000050000000000e0ff40000000000000000800060007000000080005004500000008000600ef000000080006003f0000000c005e8008000900d10000002c005e8008000200ff0f0000080005002f00000008000700bd0400000800050034000000080007006b00000050005e8008000600050000000800050029000000080006000000000014000100ffffffff630d0000200000000000000008000700fc0600000800030002d8aa092f00000008000900ff00000008000900fdffffff50005e800800010004000000080003008c0c00001c000100ff0f00000600000000000100000000000104000002000000080007003703000008000500090000000800070066050000080009000800000020005e80080007002805000008000900050000000800060000000080040001002c005e800800020080ffffff0800070060060000080007001900000008000700ca060000080007004905000024005e80080007006f030000080009000100ffff080003000700000008000200"], 0x1c4}, 0x1, 0x0, 0x0, 0x20000000}, 0x40004)
ioctl$BINDER_WRITE_READ(r0, 0x10, 0x0)
r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x101000, 0x0)
ioctl$SNDCTL_TMR_CONTINUE(r2, 0x5404)

06:41:37 executing program 3:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOPUT_CON2FBMAP(r0, 0x4610, 0x0)

06:41:37 executing program 5:
socketpair(0x11, 0x2, 0x0, 0x0)

[ 1809.952292][T14670] binder: 14669:14670 ioctl 541b 0 returned -22
[ 1810.004538][T14673] binder: 14669:14673 ioctl 541b 0 returned -22
[ 1810.197552][T14679] binder: 14677:14679 ioctl 10 0 returned -22
06:41:37 executing program 0:
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000340))
ioctl$DRM_IOCTL_DMA(0xffffffffffffffff, 0xc0406429, &(0x7f0000000140)={0x0, 0x1, &(0x7f0000000040)=[0xec6e], &(0x7f0000000080)=[0x262, 0x2, 0x6, 0x80000001, 0x80000000], 0x1, 0x8, 0xffff7f1e, &(0x7f00000000c0)=[0x7f, 0xcf9, 0x6, 0xfffff801, 0x0, 0x5, 0x7, 0x7ff], &(0x7f0000000100)=[0x5, 0xec6, 0x3ff]})
r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, 0x0, 0x0)
ioctl$DRM_IOCTL_SWITCH_CTX(r0, 0x40086424, &(0x7f0000000180)={0x0, 0x2})
r1 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0x541b, 0x0)
socketpair(0x1, 0x2, 0xffffffff, &(0x7f00000001c0)={<r2=>0xffffffffffffffff})
r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), r0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r2, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x1c, r3, 0x200, 0x70bd2c, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x4004)

06:41:37 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x4000000, 0x0, 0x0, 0x0, 0x0, 0x0})

[ 1810.300749][T14679] binder: 14677:14679 ioctl 10 0 returned -22
06:41:38 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
r1 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000000), 0x220901, 0x0)
r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r2, 0x11b, 0x5, 0x0, 0x0)
ioctl$FBIOPAN_DISPLAY(r2, 0x4606, &(0x7f0000000180)={0x840, 0x240, 0x500, 0x2000, 0x7, 0x80000001, 0x1, 0x1, {0xc88, 0xffff}, {0x7, 0x3}, {0x0, 0x9}, {0x5, 0x3, 0x1}, 0x3, 0x100, 0xfffffffb, 0xb216, 0x0, 0x6, 0x9, 0x9, 0x5, 0x75c0635b, 0x1, 0x1, 0xad722011b42fb320, 0x2, 0x3, 0xb})
ioctl$FBIOPAN_DISPLAY(r1, 0x4606, &(0x7f00000000c0)={0x86, 0x640, 0x280, 0x20, 0x2f770c80, 0x5, 0x0, 0x0, {0x1f, 0x3}, {0xfce, 0x4}, {0x3, 0x3f}, {0x8, 0x8bb, 0x1}, 0x2, 0x40, 0x7000, 0x5, 0x1, 0x1000, 0x8000, 0x80000000, 0x3, 0x9, 0x6, 0x1f, 0x15, 0x200, 0x3, 0xb})
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)

06:41:38 executing program 3:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOPUT_CON2FBMAP(r0, 0x4610, 0x0)

06:41:38 executing program 5:
socketpair(0x11, 0x2, 0x0, 0x0)

06:41:38 executing program 1:
sendmsg$IPVS_CMD_GET_DAEMON(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0xb4, 0x0, 0x200, 0x70bd2b, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x4d64e6d7}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x6a}, @IPVS_CMD_ATTR_DAEMON={0x34, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @empty}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @dev={0xfe, 0x80, '\x00', 0x3f}}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0xff}]}, @IPVS_CMD_ATTR_SERVICE={0x38, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@mcast2}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x32}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'ovf\x00'}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x1}, @IPVS_SVC_ATTR_PE_NAME={0x8}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x51}, @IPVS_CMD_ATTR_DAEMON={0x14, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x9}]}]}, 0xb4}, 0x1, 0x0, 0x0, 0x20000000}, 0x800)
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x10, 0x0)

[ 1810.643939][T14687] binder: 14685:14687 ioctl 541b 0 returned -22
[ 1810.719187][T14690] binder: 14685:14690 ioctl 541b 0 returned -22
06:41:38 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x5000000, 0x0, 0x0, 0x0, 0x0, 0x0})

[ 1810.905979][T14697] binder: 14693:14697 ioctl 10 0 returned -22
[ 1810.924020][T14699] binder: 14693:14699 ioctl 10 0 returned -22
06:41:38 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x541b, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r1, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000080)={0xe4, 0x0, 0x20, 0x70bd25, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x3, 0x44}}}}, [@NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}, @mon_options=[@NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @device_b}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "e99c5d98e87971f78ae82e2b7556a39003a35cbcd458b138"}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "ac6deb1f4da9bd0720dedcc415c7efc4f027595032864378"}, @NL80211_ATTR_MNTR_FLAGS={0x10, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}]}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "c99a1ee1c8c964ff55c271557b0f43752e72839118daa472"}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @device_b}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @broadcast}], @mon_options=[@NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "4978df9864b4a99991ea371d6169a831ce00cccdfc4e3150"}]]}, 0xe4}, 0x1, 0x0, 0x0, 0x8881}, 0x84)

06:41:38 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)
openat$fb0(0xffffffffffffff9c, &(0x7f00000001c0), 0x80100, 0x0)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040), 0x612080, 0x0)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
getsockopt$inet6_mreq(r2, 0x29, 0x1c, 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
getsockopt$inet6_mreq(r1, 0x29, 0x14, &(0x7f0000000000)={@ipv4}, &(0x7f0000000200)=0x14)
write$fb(r1, &(0x7f00000000c0)="fc19d3a481fdab531b93f7d9398975b496f9aa1d57c163c73fc2845fd47c53900885f32ded63420ea50263a5e8e938dcc5aeee0574f90796376771c379529d07dc372b8d6e13cf20615b8adc9cc20b348f142cac01f52849269943db0f7eeeae49eb62d49a356ee3f0538c7b2c9c272a763078e7bcd06a06a38d7ff50e4398434faebb7a1ccbeead24860d0ef0fc70eef7140f589836af1d63a9d1d8f78b1f01c27782e7db7b9dc576d8a938330fbed31c57276a6ac276380b9ec7ea72f0ce1ddd61bb55", 0xc4)

06:41:38 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_CQM(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000300)={&(0x7f0000000100)=ANY=[@ANYBLOB="c4010000", @ANYRES16=r1, @ANYBLOB="000327bd7000fcdbdf253f00000068005e8008000300040000000800030001000000080005005700000008000700bf00000024000100ffff00000400000003000000c7000000050000000000e0ff40000000000000000800060007000000080005004500000008000600ef000000080006003f0000000c005e8008000900d10000002c005e8008000200ff0f0000080005002f00000008000700bd0400000800050034000000080007006b00000050005e8008000600050000000800050029000000080006000000000014000100ffffffff630d0000200000000000000008000700fc0600000800030002d8aa092f00000008000900ff00000008000900fdffffff50005e800800010004000000080003008c0c00001c000100ff0f00000600000000000100000000000104000002000000080007003703000008000500090000000800070066050000080009000800000020005e80080007002805000008000900050000000800060000000080040001002c005e800800020080ffffff0800070060060000080007001900000008000700ca060000080007004905000024005e80080007006f030000080009000100ffff080003000700000008000200"], 0x1c4}, 0x1, 0x0, 0x0, 0x20000000}, 0x40004)
ioctl$BINDER_WRITE_READ(r0, 0x10, 0x0)
r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x101000, 0x0)
ioctl$SNDCTL_TMR_CONTINUE(r2, 0x5404)

06:41:38 executing program 3:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOPUT_CON2FBMAP(r0, 0x4610, 0x0)

06:41:38 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x10, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'})

[ 1811.395450][T14704] binder: 14703:14704 ioctl 541b 0 returned -22
[ 1811.437033][T14704] binder: 14703:14704 ioctl 541b 0 returned -22
06:41:39 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x6000000, 0x0, 0x0, 0x0, 0x0, 0x0})

[ 1811.527790][T14712] binder: 14705:14712 ioctl 10 0 returned -22
[ 1811.565661][T14713] binder: 14706:14713 ioctl 10 0 returned -22
06:41:39 executing program 0:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x541b, 0x0)
ioctl$vim2m_VIDIOC_S_CTRL(0xffffffffffffffff, 0xc008561c, &(0x7f0000000000)={0x5, 0x5ad378df})

06:41:39 executing program 2:
r0 = syz_open_dev$vim2m(&(0x7f0000000480), 0x0, 0x2)
ioctl$VIDIOC_QUERYBUF(0xffffffffffffffff, 0xc0585609, &(0x7f0000000000)={0x8, 0xb, 0x4, 0x1000, 0x401, {0x77359400}, {0x3, 0xc, 0x9, 0x7f, 0x1, 0x1, "a25ad60a"}, 0x2, 0x4, @offset=0x2, 0x6, 0x0, <r1=>0xffffffffffffffff})
ioctl$VIDIOC_QUERYBUF(0xffffffffffffffff, 0xc0585609, &(0x7f00000000c0)={0x2, 0xb, 0x4, 0x1000, 0x400, {0x0, 0xea60}, {0x4, 0x8, 0x3f, 0x4, 0x0, 0x1, "102a512c"}, 0x9, 0x2, @fd=<r2=>0xffffffffffffffff, 0x6be, 0x0, <r3=>0xffffffffffffffff})
r4 = syz_open_dev$radio(&(0x7f00000001c0), 0x2, 0x2)
ioctl$VIDIOC_QUERYBUF(0xffffffffffffffff, 0xc0585609, &(0x7f0000000240)={0x9, 0x4, 0x4, 0x2000, 0x10001, {0x0, 0xea60}, {0x4, 0x0, 0x9, 0x40, 0xb3, 0x2, "db67cde9"}, 0x6, 0x4, @planes=&(0x7f0000000200)={0x0, 0x3, @fd=r2, 0x2}, 0x5, 0x0, <r5=>r1})
ioctl$VIDIOC_QUERYBUF(r4, 0xc0585609, &(0x7f00000002c0)={0x1f, 0xa, 0x4, 0x4000, 0x8, {0x0, 0xea60}, {0x3, 0x0, 0x2, 0x3f, 0x9, 0xef, "21a16f89"}, 0x32dd07aa, 0x2, @offset=0x8, 0x9, 0x0, r5})
r6 = openat$zero(0xffffffffffffff9c, &(0x7f0000000140), 0x400, 0x0)
ioctl$KVM_GET_MSR_INDEX_LIST(r6, 0xc004ae02, &(0x7f0000000180))
ioctl$BINDER_THREAD_EXIT(r6, 0x40046208, 0x0)
ioctl$vim2m_VIDIOC_PREPARE_BUF(r0, 0xc058565d, &(0x7f00000004c0)={0x0, 0x1, 0x4, 0xe000, 0xfffffffd, {0x77359400}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "ffe6e889"}, 0x0, 0x0, @fd, 0xffffffff, 0x0, r3})
r7 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r7, 0x460f, 0x0)

06:41:39 executing program 1:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x10, 0x0)
setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000080)=@ccm_128={{0x303}, "8ce2edd7a8c03ef0", "0cbdd80b5447a7da13719e05cf840baa", "2da3629d", "5f1a2e9c5cbf50b2"}, 0x28)
r0 = socket(0x2c, 0x2, 0xfffffff8)
sendmsg$DEVLINK_CMD_SB_PORT_POOL_GET(r0, &(0x7f00000003c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000380)={&(0x7f0000000240)={0x124, 0x0, 0x800, 0x70bd28, 0x25dfdbfb, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}, {0x8, 0xb, 0x2}, {0x6, 0x11, 0x6}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x1}}, {0x8, 0xb, 0x6}, {0x6, 0x11, 0x3}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}, {0x8, 0xb, 0x2}, {0x6, 0x11, 0x400}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}, {0x8, 0xb, 0x7}, {0x6, 0x11, 0x4}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x1}}, {0x8, 0xb, 0xfffffffb}, {0x6, 0x11, 0xb9}}]}, 0x124}, 0x1, 0x0, 0x0, 0xc040}, 0x40000)
ioctl$IOC_PR_PREEMPT(0xffffffffffffffff, 0x401870cb, &(0x7f0000000040)={0x1ff, 0x3, 0x81, 0x8})
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r1, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r2, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r3, 0xcd6ccc609280a2c3, 0x0, 0x0, {{}, {@void, @void}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x24}}, 0x0)
sendmsg$NL80211_CMD_STOP_NAN(r1, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, r3, 0x300, 0x70bd26, 0x25dfdbfc, {{}, {@val={0x8}, @void}}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4000)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f00000000c0), 0x4200, 0x0)
ioctl$BINDER_THREAD_EXIT(r4, 0x40046208, 0x0)

06:41:39 executing program 3:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOPUT_CON2FBMAP(r0, 0x4610, &(0x7f0000000000)={0x0, 0x2})

06:41:39 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_CQM(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000300)={&(0x7f0000000100)=ANY=[@ANYBLOB="c4010000", @ANYRES16=r1, @ANYBLOB="000327bd7000fcdbdf253f00000068005e8008000300040000000800030001000000080005005700000008000700bf00000024000100ffff00000400000003000000c7000000050000000000e0ff40000000000000000800060007000000080005004500000008000600ef000000080006003f0000000c005e8008000900d10000002c005e8008000200ff0f0000080005002f00000008000700bd0400000800050034000000080007006b00000050005e8008000600050000000800050029000000080006000000000014000100ffffffff630d0000200000000000000008000700fc0600000800030002d8aa092f00000008000900ff00000008000900fdffffff50005e800800010004000000080003008c0c00001c000100ff0f00000600000000000100000000000104000002000000080007003703000008000500090000000800070066050000080009000800000020005e80080007002805000008000900050000000800060000000080040001002c005e800800020080ffffff0800070060060000080007001900000008000700ca060000080007004905000024005e80080007006f030000080009000100ffff080003000700000008000200"], 0x1c4}, 0x1, 0x0, 0x0, 0x20000000}, 0x40004)
ioctl$BINDER_WRITE_READ(r0, 0x10, 0x0)
r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x101000, 0x0)
ioctl$SNDCTL_TMR_CONTINUE(r2, 0x5404)

06:41:39 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x7000000, 0x0, 0x0, 0x0, 0x0, 0x0})

[ 1812.240211][T14731] binder: 14728:14731 ioctl 10 0 returned -22
06:41:40 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r1, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_PORT_UNSPLIT(r2, &(0x7f0000000380)={&(0x7f00000001c0), 0xc, &(0x7f0000000340)={&(0x7f0000000480)={0x14, r3, 0x7ff}, 0x14}}, 0x0)
r4 = gettid()
r5 = syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/user\x00')
sendmsg$DEVLINK_CMD_RELOAD(r1, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0xb0, r3, 0x4, 0x70bd26, 0x25dfdbfd, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_FD={0x8}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_ID={0x8, 0x8c, 0x2}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r4}}, {@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_FD={0x8, 0x8a, r5}}]}, 0xb0}, 0x1, 0x0, 0x0, 0x40800}, 0x40000)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)

06:41:40 executing program 0:
r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, 0x0, 0x0)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
r2 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r2, 0x541b, 0x0)

06:41:40 executing program 3:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOPUT_CON2FBMAP(r0, 0x4610, &(0x7f0000000000)={0x0, 0x2})

06:41:40 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_CQM(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000300)={&(0x7f0000000100)=ANY=[@ANYBLOB="c4010000", @ANYRES16=r1, @ANYBLOB="000327bd7000fcdbdf253f00000068005e8008000300040000000800030001000000080005005700000008000700bf00000024000100ffff00000400000003000000c7000000050000000000e0ff40000000000000000800060007000000080005004500000008000600ef000000080006003f0000000c005e8008000900d10000002c005e8008000200ff0f0000080005002f00000008000700bd0400000800050034000000080007006b00000050005e8008000600050000000800050029000000080006000000000014000100ffffffff630d0000200000000000000008000700fc0600000800030002d8aa092f00000008000900ff00000008000900fdffffff50005e800800010004000000080003008c0c00001c000100ff0f00000600000000000100000000000104000002000000080007003703000008000500090000000800070066050000080009000800000020005e80080007002805000008000900050000000800060000000080040001002c005e800800020080ffffff0800070060060000080007001900000008000700ca060000080007004905000024005e80080007006f030000080009000100ffff080003000700000008000200"], 0x1c4}, 0x1, 0x0, 0x0, 0x20000000}, 0x40004)
ioctl$BINDER_WRITE_READ(r0, 0x10, 0x0)
r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x101000, 0x0)
ioctl$SNDCTL_TMR_CONTINUE(r2, 0x5404)

06:41:40 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x10, 0x0)
r1 = socket(0xa, 0x803, 0x7f)
syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r1)
getsockopt$inet6_mreq(r1, 0x29, 0x14, &(0x7f00000002c0)={@local}, &(0x7f0000000300)=0x14)
r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r2, 0x11b, 0x5, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000280)={0x58, 0x0, &(0x7f0000000140)=[@reply_sg={0x40486312, {0x3, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000080)={@ptr={0x70742a85, 0x0, &(0x7f0000000040)=""/60, 0x3c, 0x0, 0xf}, @flat=@handle={0x73682a85, 0x100, 0x92d}, @fda={0x66646185, 0x9, 0xd73, 0x3f}}, &(0x7f0000000100)={0x0, 0x28, 0x40}}, 0x40}, @release, @exit_looper], 0xa3, 0x0, &(0x7f00000001c0)="920437d1f1d216a9b1e130b8da56bfaca2cea413e7932dfd4d5ca3ec0ca286b7b3a2556fb53605725f5565017296058e4ac8afc8d4db62b5f083296707969496efcd5024cdef9c180eb62529b8ebcde2d51b4618108fe0ef7151369ba9113272a13a4afc91fca475d21a193f2d50c054f7cb6c58ed9538c53f87609fbb14028b4c03fabb9d6dc4d0708bae4e947297bcc507ef9eb42d99be24db84460fffc93b7ac4a0"})

06:41:40 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x8000000, 0x0, 0x0, 0x0, 0x0, 0x0})

[ 1812.821210][T14742] binder: 14738:14742 ioctl 541b 0 returned -22
[ 1812.944789][T14747] binder: 14745:14747 ioctl 10 0 returned -22
[ 1812.987477][T14749] binder: 14746:14749 ioctl 10 0 returned -22
[ 1813.004514][T14747] binder: 14745:14747 ioctl 10 0 returned -22
06:41:40 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_CQM(r0, &(0x7f0000000340)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000300)={&(0x7f00000000c0)={0x210, r1, 0x20, 0x70bd27, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x8, 0x71}}}}, [@NL80211_ATTR_CQM={0x24, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_RSSI_LEVEL={0x8, 0x9, 0x6}, @NL80211_ATTR_CQM_TXE_PKTS={0x8, 0x6, 0x3}, @NL80211_ATTR_CQM_TXE_INTVL={0x8, 0x7, 0x18e}, @NL80211_ATTR_CQM_RSSI_HYST={0x8, 0x2, 0x6}]}, @NL80211_ATTR_CQM={0x44, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT={0x8, 0x3, 0xffffffff}, @NL80211_ATTR_CQM_TXE_RATE={0x8, 0x5, 0x25}, @NL80211_ATTR_CQM_TXE_RATE={0x8, 0x5, 0x30}, @NL80211_ATTR_CQM_RSSI_THOLD={0x28, 0x1, [0x1f, 0x80, 0xfffffff8, 0x5, 0xfffffbff, 0x4, 0x0, 0x3f, 0x5]}]}, @NL80211_ATTR_CQM={0x14, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_TXE_PKTS={0x8, 0x6, 0xff}, @NL80211_ATTR_CQM_TXE_RATE={0x8, 0x5, 0x17}]}, @NL80211_ATTR_CQM={0x3c, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_RSSI_LEVEL={0x8, 0x9, 0x39f9}, @NL80211_ATTR_CQM_RSSI_HYST={0x8, 0x2, 0x27dc}, @NL80211_ATTR_CQM_RSSI_LEVEL={0x8, 0x9, 0x400}, @NL80211_ATTR_CQM_RSSI_LEVEL={0x8, 0x9, 0x7}, @NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT={0x8, 0x3, 0x7}, @NL80211_ATTR_CQM_TXE_INTVL={0x8, 0x7, 0x606}, @NL80211_ATTR_CQM_TXE_INTVL={0x8, 0x7, 0x48d}]}, @NL80211_ATTR_CQM={0x2c, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_TXE_RATE={0x8, 0x5, 0x28}, @NL80211_ATTR_CQM_RSSI_HYST={0x8, 0x2, 0xb3b}, @NL80211_ATTR_CQM_RSSI_HYST={0x8, 0x2, 0x4}, @NL80211_ATTR_CQM_TXE_INTVL={0x8, 0x7, 0xb9}, @NL80211_ATTR_CQM_TXE_PKTS={0x8, 0x6, 0x5}]}, @NL80211_ATTR_CQM={0x5c, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT={0x8, 0x3, 0x55b}, @NL80211_ATTR_CQM_RSSI_HYST={0x8, 0x2, 0x7}, @NL80211_ATTR_CQM_TXE_INTVL={0x8, 0x7, 0x4d9}, @NL80211_ATTR_CQM_RSSI_LEVEL={0x8, 0x9, 0x8}, @NL80211_ATTR_CQM_RSSI_LEVEL={0x8, 0x9, 0x4}, @NL80211_ATTR_CQM_RSSI_THOLD={0x20, 0x1, [0x8, 0x8, 0x3, 0x7, 0x2, 0x20, 0x8]}, @NL80211_ATTR_CQM_TXE_RATE={0x8, 0x5, 0x3e}, @NL80211_ATTR_CQM_RSSI_HYST={0x8, 0x2, 0x3}]}, @NL80211_ATTR_CQM={0x1c, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_TXE_INTVL={0x8, 0x7, 0x2ff}, @NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT={0x8, 0x3, 0x10001}, @NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT={0x8, 0x3, 0x3}]}, @NL80211_ATTR_CQM={0xc, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_TXE_INTVL={0x8, 0x7, 0x570}]}, @NL80211_ATTR_CQM={0x34, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_RSSI_THOLD={0x8, 0x1, [0x8001]}, @NL80211_ATTR_CQM_RSSI_THOLD={0x8, 0x1, [0x3]}, @NL80211_ATTR_CQM_TXE_PKTS={0x8, 0x6, 0x1}, @NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT={0x8, 0x3, 0x2}, @NL80211_ATTR_CQM_TXE_PKTS={0x8, 0x6, 0x8}, @NL80211_ATTR_CQM_RSSI_HYST={0x8, 0x2, 0x7fffffff}]}, @NL80211_ATTR_CQM={0x54, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT={0x8, 0x3, 0x3}, @NL80211_ATTR_CQM_TXE_RATE={0x8, 0x5, 0x62}, @NL80211_ATTR_CQM_TXE_PKTS={0x8, 0x6, 0x8}, @NL80211_ATTR_CQM_RSSI_HYST={0x8, 0x2, 0x274}, @NL80211_ATTR_CQM_RSSI_HYST={0x8}, @NL80211_ATTR_CQM_TXE_INTVL={0x8, 0x7, 0x6f3}, @NL80211_ATTR_CQM_TXE_INTVL={0x8, 0x7, 0x5d8}, @NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT={0x8, 0x3, 0x7}, @NL80211_ATTR_CQM_TXE_RATE={0x8, 0x5, 0x4b}, @NL80211_ATTR_CQM_TXE_PKTS={0x8, 0x6, 0x8f}]}]}, 0x210}, 0x1, 0x0, 0x0, 0x4804}, 0x10000000)
r2 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r2, 0x460f, 0x0)

06:41:40 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x541b, 0x0)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040), 0x200100, 0x0)
ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f0000000080))

06:41:40 executing program 3:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOPUT_CON2FBMAP(r0, 0x4610, &(0x7f0000000000)={0x0, 0x2})

06:41:40 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x9000000, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:41 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_CQM(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000300)={&(0x7f0000000100)=ANY=[@ANYBLOB="c4010000", @ANYRES16=r1, @ANYBLOB="000327bd7000fcdbdf253f00000068005e8008000300040000000800030001000000080005005700000008000700bf00000024000100ffff00000400000003000000c7000000050000000000e0ff40000000000000000800060007000000080005004500000008000600ef000000080006003f0000000c005e8008000900d10000002c005e8008000200ff0f0000080005002f00000008000700bd0400000800050034000000080007006b00000050005e8008000600050000000800050029000000080006000000000014000100ffffffff630d0000200000000000000008000700fc0600000800030002d8aa092f00000008000900ff00000008000900fdffffff50005e800800010004000000080003008c0c00001c000100ff0f00000600000000000100000000000104000002000000080007003703000008000500090000000800070066050000080009000800000020005e80080007002805000008000900050000000800060000000080040001002c005e800800020080ffffff0800070060060000080007001900000008000700ca060000080007004905000024005e80080007006f030000080009000100ffff080003000700000008000200"], 0x1c4}, 0x1, 0x0, 0x0, 0x20000000}, 0x40004)
ioctl$BINDER_WRITE_READ(r0, 0x10, 0x0)
ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404)

06:41:41 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x10, 0x0)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000140))
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r3, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r4, 0xcd6ccc609280a2c3, 0x0, 0x0, {{}, {@void, @void}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x24}}, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r2, &(0x7f0000000500)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x20002}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x2c, r4, 0x100, 0x70bd26, 0x25dfdbfc, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0xeb5}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40084}, 0x20004080)

[ 1813.400219][T14757] binder: 14754:14757 ioctl 541b 0 returned -22
[ 1813.423835][T14757] binder: 14754:14757 ioctl 541b 0 returned -22
06:41:41 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IPVS_CMD_GET_DAEMON(r2, &(0x7f0000000b00)={&(0x7f0000000a40)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a80)=ANY=[@ANYBLOB="9c30a7ae", @ANYRES16=0x0, @ANYBLOB="000128bd7000fedbdf250b0000000800050006000000"], 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x40000)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
r3 = socket(0xa, 0x803, 0x7f)
r4 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r3)
getsockopt$XDP_MMAP_OFFSETS(r3, 0x11b, 0x1, &(0x7f0000000280), &(0x7f0000000300)=0x80)
sendmsg$DEVLINK_CMD_SB_POOL_SET(r2, &(0x7f00000004c0)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000480)={&(0x7f0000000780)={0x200, r4, 0x1, 0x70bd28, 0x25dfdbff, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0x3}, {0x6, 0x11, 0x4c}, {0x8, 0x13, 0x9a8}, {0x5}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x1}, {0x6, 0x11, 0x6}, {0x8, 0x13, 0xfffffff8}, {0x5}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x80000001}, {0x6, 0x11, 0x8001}, {0x8, 0x13, 0x3}, {0x5, 0x14, 0x9}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x200}, {0x6, 0x11, 0x4}, {0x8, 0x13, 0x311bdd07}, {0x5}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0x7}, {0x6, 0x11, 0x1}, {0x8, 0x13, 0x81}, {0x5, 0x14, 0x1}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0x6}, {0x6, 0x11, 0x400}, {0x8, 0x13, 0x7}, {0x5, 0x14, 0x1}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0xc2}, {0x6, 0x11, 0x9}, {0x8, 0x13, 0x9}, {0x5, 0x14, 0x1}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x81}, {0x6, 0x11, 0xd505}, {0x8}, {0x5, 0x14, 0x1}}]}, 0x200}, 0x1, 0x0, 0x0, 0x4008000}, 0x22048018)
ioctl$FBIOGET_FSCREENINFO(r1, 0x4602, &(0x7f0000000040))
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)
r5 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r5, 0x11b, 0x5, 0x0, 0x0)
ioctl$FBIOPUT_CON2FBMAP(r5, 0x4610, &(0x7f00000000c0)={0x20, 0x2})
r6 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0xc000, 0x0)
ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000740)={0xac, 0x0, &(0x7f0000000540)=[@request_death={0x400c630e, 0x2}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x19, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000180)={@ptr={0x70742a85, 0x1, &(0x7f0000000200)=""/61, 0x3d, 0x0, 0x29}, @ptr={0x70742a85, 0x0, &(0x7f0000000380)=""/194, 0xc2, 0x0, 0x12}, @fda={0x66646185, 0x3, 0x0, 0x34}}, &(0x7f0000000500)={0x0, 0x28, 0x50}}}, @acquire={0x40046305, 0x1}, @increfs={0x40046304, 0x3}, @dead_binder_done, @clear_death={0x400c630f, 0x1}, @clear_death, @clear_death={0x400c630f, 0x1}, @enter_looper], 0xce, 0x0, &(0x7f0000000640)="44a52df61e9cb159f1c8cd39130c2d6d6dd83ec89a269c852d939ef540a20dd8f311ea66417c09bc7ede3bbd7c1233ff342c42bfc4dba995944221c12efe582c516d1a0d3a3c40468444f9b95d415ef784754e9f468f5066c9cb64db0e3af91f4e50928591cf678ea187864eabdce2de64aedac93a2d217011618e648dfce84d64de3789270a2e26c25595b253bd0082ea87afabf9f18233603c659c17c59afd5b9d1fa0faad79ae28402e9043920f0106d30460517ebbda3715bde49af91ce99e456a58de4e0c70b73a8f9e967b"})
r7 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r7, 0x11b, 0x5, 0x0, 0x0)
ioctl$UFFDIO_API(r7, 0xc018aa3f, &(0x7f0000000240))
sendmsg$DEVLINK_CMD_SB_PORT_POOL_GET(0xffffffffffffffff, &(0x7f0000002240)={&(0x7f0000002100)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000002200)={&(0x7f0000002140)={0x84, 0x0, 0x20, 0x70bd27, 0x25dfdbfe, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0x93}, {0x6, 0x11, 0x40}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}, {0x8, 0xb, 0x6}, {0x6, 0x11, 0x8000}}]}, 0x84}, 0x1, 0x0, 0x0, 0x4060}, 0x1)

[ 1813.675968][T14766] binder: 14763:14766 ioctl 10 0 returned -22
06:41:41 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x100, 0x1})
ioctl$BINDER_WRITE_READ(r0, 0x541b, 0x0)

[ 1813.774735][T14767] binder: 14764:14767 ioctl 10 0 returned -22
06:41:41 executing program 3:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOPUT_CON2FBMAP(r0, 0x4610, &(0x7f0000000000)={0x1f})

06:41:41 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_CQM(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000300)={&(0x7f0000000100)=ANY=[@ANYBLOB="c4010000", @ANYRES16=r1, @ANYBLOB="000327bd7000fcdbdf253f00000068005e8008000300040000000800030001000000080005005700000008000700bf00000024000100ffff00000400000003000000c7000000050000000000e0ff40000000000000000800060007000000080005004500000008000600ef000000080006003f0000000c005e8008000900d10000002c005e8008000200ff0f0000080005002f00000008000700bd0400000800050034000000080007006b00000050005e8008000600050000000800050029000000080006000000000014000100ffffffff630d0000200000000000000008000700fc0600000800030002d8aa092f00000008000900ff00000008000900fdffffff50005e800800010004000000080003008c0c00001c000100ff0f00000600000000000100000000000104000002000000080007003703000008000500090000000800070066050000080009000800000020005e80080007002805000008000900050000000800060000000080040001002c005e800800020080ffffff0800070060060000080007001900000008000700ca060000080007004905000024005e80080007006f030000080009000100ffff080003000700000008000200"], 0x1c4}, 0x1, 0x0, 0x0, 0x20000000}, 0x40004)
ioctl$BINDER_WRITE_READ(r0, 0x10, 0x0)
ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404)

06:41:41 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0xa000000, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:41 executing program 1:
r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040), 0x101000, 0x0)
socketpair(0x21, 0xa, 0x7f, &(0x7f0000000440)={<r1=>0xffffffffffffffff})
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000004c0), r0)
sendmsg$NL80211_CMD_TDLS_CHANNEL_SWITCH(r1, &(0x7f0000000640)={&(0x7f0000000480), 0xc, &(0x7f0000000600)={&(0x7f0000000500)={0xd0, r2, 0x1, 0x70bd2d, 0x25dfdbfb, {{}, {@val={0x8}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x1}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x27}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x3a4}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x6}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xa}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x3f}], @chandef_params=[@NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0xffff}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x4}, @NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x16e4}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x2}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xf}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x2}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x2a8}], @NL80211_ATTR_OPER_CLASS={0x5, 0xd6, 0x9a}, @NL80211_ATTR_OPER_CLASS={0x5, 0xd6, 0x2}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @chandef_params=[@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x18}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x160}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x12}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x7}]]}, 0xd0}, 0x1, 0x0, 0x0, 0x4000000}, 0x0)
ioctl$DRM_IOCTL_ADD_CTX(r0, 0xc0086420, &(0x7f0000000080))
r3 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0x10, 0x0)

[ 1814.104258][T14775] binder: 14773:14775 ioctl 541b 0 returned -22
[ 1814.143872][T14776] binder: 14773:14776 ioctl 541b 0 returned -22
[ 1814.249030][T14781] binder: 14778:14781 ioctl 10 0 returned -22
06:41:42 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x541b, 0x0)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="6347649bc0c751965b8500c2b319010044b0a756194cadb8dda803", @ANYRES16=0x0, @ANYBLOB="040027bd7000ffdbdf25620000000600b30000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x4000005)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f0000000080))

[ 1814.416450][T14786] binder: 14784:14786 ioctl 10 0 returned -22
06:41:42 executing program 3:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOPUT_CON2FBMAP(r0, 0x4610, &(0x7f0000000000)={0x1f})

06:41:42 executing program 2:
openat$fb1(0xffffffffffffff9c, &(0x7f0000000040), 0x2d0001, 0x0)
r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, 0x0, 0x0)
mmap$fb(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x2ba499d965695192, r0, 0x91000)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
ioctl$FBIOPUTCMAP(r1, 0x4605, &(0x7f0000000180)={0x20, 0x5, &(0x7f0000000000)=[0x89ad, 0x3e1d, 0x1f, 0x0, 0x9], &(0x7f0000000080)=[0x1], &(0x7f00000000c0)=[0x5, 0x400, 0x3, 0x6], &(0x7f0000000140)=[0x8, 0x20, 0x2, 0xfc01, 0x40]})

[ 1814.497961][T14787] binder: 14784:14787 ioctl 10 0 returned -22
06:41:42 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0xb000000, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:42 executing program 5:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_CQM(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000300)={&(0x7f0000000100)=ANY=[@ANYBLOB="c4010000", @ANYRES16=r1, @ANYBLOB="000327bd7000fcdbdf253f00000068005e8008000300040000000800030001000000080005005700000008000700bf00000024000100ffff00000400000003000000c7000000050000000000e0ff40000000000000000800060007000000080005004500000008000600ef000000080006003f0000000c005e8008000900d10000002c005e8008000200ff0f0000080005002f00000008000700bd0400000800050034000000080007006b00000050005e8008000600050000000800050029000000080006000000000014000100ffffffff630d0000200000000000000008000700fc0600000800030002d8aa092f00000008000900ff00000008000900fdffffff50005e800800010004000000080003008c0c00001c000100ff0f00000600000000000100000000000104000002000000080007003703000008000500090000000800070066050000080009000800000020005e80080007002805000008000900050000000800060000000080040001002c005e800800020080ffffff0800070060060000080007001900000008000700ca060000080007004905000024005e80080007006f030000080009000100ffff080003000700000008000200"], 0x1c4}, 0x1, 0x0, 0x0, 0x20000000}, 0x40004)
ioctl$BINDER_WRITE_READ(r0, 0x10, 0x0)
ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404)

[ 1814.749155][T14792] binder: 14789:14792 ioctl 541b 0 returned -22
06:41:42 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x1900, 0x2})
ioctl$BINDER_WRITE_READ(r0, 0x10, 0x0)

[ 1814.799721][T14795] binder: 14789:14795 ioctl 541b 0 returned -22
[ 1814.912956][T14800] binder: 14798:14800 ioctl 10 0 returned -22
06:41:42 executing program 3:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOPUT_CON2FBMAP(r0, 0x4610, &(0x7f0000000000)={0x1f})

06:41:42 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000000), 0x148fc2, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)

06:41:42 executing program 5:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r0 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_CQM(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000300)={&(0x7f0000000100)=ANY=[@ANYBLOB="c4010000", @ANYRES16=r0, @ANYBLOB="000327bd7000fcdbdf253f00000068005e8008000300040000000800030001000000080005005700000008000700bf00000024000100ffff00000400000003000000c7000000050000000000e0ff40000000000000000800060007000000080005004500000008000600ef000000080006003f0000000c005e8008000900d10000002c005e8008000200ff0f0000080005002f00000008000700bd0400000800050034000000080007006b00000050005e8008000600050000000800050029000000080006000000000014000100ffffffff630d0000200000000000000008000700fc0600000800030002d8aa092f00000008000900ff00000008000900fdffffff50005e800800010004000000080003008c0c00001c000100ff0f00000600000000000100000000000104000002000000080007003703000008000500090000000800070066050000080009000800000020005e80080007002805000008000900050000000800060000000080040001002c005e800800020080ffffff0800070060060000080007001900000008000700ca060000080007004905000024005e80080007006f030000080009000100ffff080003000700000008000200"], 0x1c4}, 0x1, 0x0, 0x0, 0x20000000}, 0x40004)
r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x101000, 0x0)
ioctl$SNDCTL_TMR_CONTINUE(r1, 0x5404)

[ 1815.109506][T14802] binder: 14801:14802 ioctl 10 0 returned -22
06:41:42 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f00000000c0), 0x0, 0x802)
r1 = syz_open_dev$binderN(&(0x7f0000000040), 0x0, 0x802)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)={0x1})
r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r2, 0x11b, 0x5, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001100)={0x2c, 0x0, &(0x7f0000000000)=[@release, @decrefs={0x40046307, 0x1}, @acquire, @dead_binder_done, @decrefs], 0x1000, 0x0, &(0x7f0000000100)="7ce02dc80cd3837845c1a129515cca0541370ada5b64f82eb67b7f6e435995d797bee0fadb36a6fbbc9011889e1a892afc7a76d8405c32013a7eec41f088e3bcc787be46b3f18f3504e89432ab52df33618e561c792586aa0d8001f514c0bfa37ba6f15490016e2a4c6502cd1bf4cb2abe9b073a8d943354b948cba92c8112f861e189e61038ede070b29f873b9ccd93695a14b2cf3c444e6c53ebf64e16125a32fdb62f2bfc3ab3b380590c86fe2eac72b6c37f531b30d8817c7abfd77eddff2986cbb980627defea9e45f4525dcc2f4435ffeb909501e333472671cc76a63ea493b85631fe974a4af1e14b79197990738aa18ffed6153bd591d7765fff2e530df1f6c2fa496d7fcaa49517f5d9d1a8c0d2c0c1f8727316972362e3f32f0f3da7d3dfb7cc5f1a76f4bbefaf67ec432e07781c27ccc60a009910e44b102707e557cdfa77c2004ba57ef161ca6ba990d0876356fa6ef425f077229ca6ca2a039c71bc349aff0cef14078d51853d809695e81408945232e1b223d9cd2ee2dfa19eb4071ecf4147817eb8b4c6768f0ee55cb609210393d002b28132d4bd6aca0393faa17c3701a32f9cf3b6c483c64e8c44154f3bb1bc2ec8c42120e8c020a973940a930a0ff53ed7318b021db28300f64f032fc871d7f6dd80f96b1c7f0a308bbfdb2983a94589ebc785e9914603b22a7c18ea88fb51b91bdfcb46e65fd16166a5c38df0463c6f6f793de369b71d8f6723ba089025e42181e1615ce6e4f4d9f179234c31bd9186f9ba514f9b4d2ab094e1ab8fc20711a06d31f1600b8cd4b0624de4c61aee196784b3081092db596ecafa9b7d9dfa32db0d9c8198261bcd47660db0b52c62cef16d6bb1184bed02943044d47c9790fef83ba68f87fb94dfd2582d54c80fe3caf92e9e4235626b496c0a9e182adf5f2b7448bcfda5f6b6fe73cbade37450d4f52306069a1564800f49fe652150bef55d884e3d1df4abd84385f108eb07a3cbb22a59142a24ee03b4ecd3322f12ce98a32992917957ab4a3395f958308d15d8a9c5d64e3298f2581bd8c4f419f0db52e58ad7581b71dfdf5c160c5c7ace1ab3f88b6ccf5f24536c5eff0dd85b860d44616d47f1f5b8a34136fa8f90aa86c2108862106c7fa7503841c10836ae2238c25292692c0178c167c3d1ee397463e6f306a8ebb823d3ac84a64e40d6d8865519c52fa35944df86f2db88c1d8ec91409843a05ad84116af1cf59eef27df707724d44107048e13fb3e1c12d2d718b43363ef196e2f617f36638122015fa670f0dbaad5fac8ae268172925152616b12a2a160761ac7ad5e6f615f8f4353113a6fbec91b137d2837bb2eaa12e6702255eabe024c9c55cb6e7ae859da1bd91df39bf6fd94dd7deef753d0e3568a873a4ee10fdf25a74b453fce3b5919f1af625290a8a9ab77578007565c221f6cbe969527dcf61527ca0edff4a62ee95b22acb580d6e1c0508ef047e57416d293176c66950382399ed3f3136a26412d4993c072f89a0665e20ad89c265b69cd80e35f32cb7e4b3e59ef1593bec419ee4d0724fc5f38ac2287b6ff09337de50df30464c8cc928835a9e03dad97a48142ab7ce07cb625bac581bc3428faa4f5e6171273112e08abcefb5954296026eeb1f37d67dabb45045d4a60906c0b0b13e46fe525c05f0a432e8802d84102dae15d4ceddf090cd47d6e139b5fd47a3da9c69df3093d9d3db03686c5957424bec3da57baecb9e6e9b63df22cdcc7035abbb1086fa22cd766f02b321fb250639d3cedf5a2b21aae0d8427e1a4f13cf5ccae24c7d524b22785cbafb2126de48865a621848d0e548a8565445344bfb9b8382b1ff1462a508033013bd47ab2de4b9a60ea05c3293afe392c15ca182a9f5e9ebb3b857a20d54ba15fddb315a3caf442342dc19ad33a85b10823967460f5731bdb264bc8d63eb057c319f1e7db5376927cf2e64f8a710d2effcf269f98e0eecd9e11d35503a38d3e87cb31016385613c66fd1dc635acd3819a14fbfdd1169124f7ddea68e04ecdc2edf0156e343cf0b25954ba486c7ad92439e687cde25e33de63a335387e20a15074d84655b10ff06fdb98ed7d648061717fb83b15d891b241d095b26f6f1f1dd503256d54ab132b847cbd10aedf9308813ceaf4e14633c3f6ee8e4e60b554bc0e849eef8f03619e555cf177d80f9371f0a0df2cdb49291333788c91a7e3f9138cd2029a1eb23aa2111247f90e3ac6477ec8deb8c27205ae2ef0eb723f110b4ade5fd4611057f8dab7b7adeae7ccb17ef44dd635331df9271761a0ec572ffb177bc630eda554559ba1043649f77d5615921814a7e22ec0c78c65100a52b620748f679ea219b2030730fae8a493c8fb3d94a46ad5099d8ae1ca09e6e17cf8012a1fbff40411918fdaaa1345e50e6540867ae475a6147767bad6bf4d581e11380c6159e2c7c57a7a02b5200e2016b534455b15f6947b7dacb3e556f3ab618e92890c407a118f3f39b7a1f2c4121a492b6422324d86fdc0b71e3e69eca3356f3f9d4bafc5eccc23490ea4533b7b2e69c229397c97394f647d9e471cf9e58015acd1222727a4c24f6ee7d60dd0477d60c9e3cacac42e77e6b5945ec21ab69b3a122d37aafafe6a13d5a2eb1ce58e245abf18ce064179524c4dc588db7e830f9af3374aa4ffe9a318a65fce38e62efaacba817cc01974ad5f0c8dc7c1f67c7348fe8a16cdec8e59c07a5a28766ad3348db45aa1a431b6cdb811a1c26b8063c469139d9c71588079d492cc15f7cb81b5b67db233425669640604abb6d15e0ebb4d15984993d55c8267edf937c9a69ce3901e660c317f815fa56947a1c6f46423b94273cd2647f8f801dee91ae373bae10d621323213b78e2a5d05eaf7fdc2cf36817ed521248bbba3ab16a779323340fb04863d6323792cf2a572771488974fa4e0b129e12c3edeb5e54ec7ae009764a01771e50da623d7d5302afb86cc03fb79d7d9fe6f03719da8a113a111cd3c9962f439469219edc449dd6cb917a6b46437916ce9c6cf5d07cb4eaa3217a535692a30ce4d82ad1db32cc2cd9d75bc98d12f4c047537e5b3827e8011da00eba04b73a8f7d52f585af015f6fa94b13e8aae53fd793ba7505410ec593c8597056672f75e808ea73a78c9e72fca92db6e323b0b1cdf9786330fbbebaa2a6afec1a568c1262a8b05e3ab78b422f7a5f47d3f8520405adceaad4993463ac9a428a6a882c1ff6d61838fc519682e2a9f200c5efb3e23781d318254d0972807b71f564eb9134ee91d1c7b85c3321f58829c4eb424547bdaabcb9f9fc0d492d0c4880689f292f93672894a63e6b98123a426e8c6a05dc8a845fcbebf17cb70aa4a17d7edb89e2029fd2347635d992a84fa3febf0938d5cc8e432e0d6aff8dac7b1fccf699b006a34f4a34a64434f95231bf1b60d46c3f742e0bffce932ba1b303e7a7a347eddbd88a1118add21edd7d60e0bbc5563fc967c6284cf3f0c2d6015bc531a10d04a457a599fbee588e5b8b1ca3d7f3650223ac33acea5c4aa444d1cae113e4ded06b334aba92d8dd5aca486a67a5698e9e8a9c79759ded9478059d57f1c91a0785075fa652ff60a15145046f05c2ed2ff23fbc924870b87525284ff8a0be827aa631946ac32a828a540e1d364cd0032039a7cc3824a7233bc4211b2c51cf61cfd364aec9dc3c3b59a27690cfd33ce48c586ca2618e6f8d9f404a812c1eb5286d7767f0aea59b44ce974d16ba237eaa7243a0d055b21af0306f8bfc20e3c733ceb98139a2c17bc0dd9556b51dc3a941f0e7bc1941610e2192a389e5cc12c991aad5e35ec5096d3d4be62d506c6fa8e75ae46b7bbe7b4931885c2f188e7cb3845c85825dd0e7c629388e99a293d53078e5871a73f4128ecb6b0c78ffad97f72e86080e07845d7dc58f16d11ea925aba1f7d390b286c915ca00c65ce8e87922aa20c82d08ee6ffb4deef3e7aee96ada73ff475d9a191c58416e67e50e5de05b291ca5da48a706effc57e722d27cae84e1332c742b0dcef3254044f6b4cd2267268f329b507c965f5eae7df39c7a7424c8b4d3d8117d74b0d570bc4f10d3593ec510ab4f42ba998ac0232222f3742de3a5dc4fafe9c4c7cbe84e4017c987af886a3ca63232a11c6a762452641325e5ce0a7916772bf65cba78ce26c363fd9d2b486a1f7b2341d6084c8c2ab5c4283b9e3397876068bd90f45eb903f1d2f2e9ee83703de70b4df3f17e0b1a057fbb8d3bbcbc325111a1fff53128c63a14c25fcbc928eb2b6abe28b9d300645faabfc8f7cb9bc67c3d12842b11f130cad40551c9f38fd3ab1bc49f76e8e9de43bdc8a33f79eae930f3303b63ec0fc5f542731a0ce778a49f0234140bb1cfcaf301b235d3c02b40510ef4916339a09cb9edb4909363b19e5fbee59fa6d1800b8c601c728bf5c41acf15c51983f4d7b41b4a8d448e2c4ebc327f647cd45227b6c1bf1695466eb85068e28a2b5200e64c711a9332af5e4b0de419acee49553c5c5e4e1557b3a8a3e3726a574840a63b456e9165f5469dddddc441083297141b44b792373a81b8a1d6c2dcb2b063a88dd6abe2e2de630babfe770e0e58d4c2f50719abf5719460c6110d3cbd67e422ee9716256283c00a763d6bf4d21dc0d2c77f7b57d76ba0bcb1e4046ccccc4a4b76894a2bbc885aa2a17f2441467fc177f71e813644ad3823d7fb4e6a960dd1ff4519f6d23a7c289bff6c4701dbf7659b7aa9678817a492f16f93189315c3e076bd48caa098a96459c93a47d66b7257f24f72ba631360328a364250e687fb6aa797ddf375da3f1dacbef223be84c16671e8be6204b567b88e73ab574b9cbcbe43ba0cc41f9f72be631392980fe87927a9e8081eeec91813e28abf38f1e7a0148a9a33112b717c7e42db3f33ef00b6a7ef242ee1e90589befb71b5ef41b5b90808d16b558aeb76ff9264f1197d753c7087caafca1f0fc583405b5ae83bd5d94122030dd0a15b7edcd006f843af5828de087553ab3c0b318d3920ee6962518d958ef98ae379f503b40bdc2c084543d519d7752c4e73665bbbf12901e7e2d23ade7b7be9f173203230a960bf069b5e888cdd194a99b25f7639e5cd517ee800d0288d62b4bd2ae8e36dbbdc9afed6bcce96e0db1cf289699075ff2046775a5b978348231a46c0b4dc53c15de25e1585fee35485db9abc1919b80796eee653f9e7ad7637dd01d51fc14f303313ae8b5fa76d8e0eae0e76557332eaa364a18da14bb3c846a2f5d37f5c7bc581e97e1e918e71949527942e9efd72425daa55f90884ab7fa33f796f2e94b60cb7a33553be890c30be922b6c2032e4b7e3ccd3a4a8c73d57d33bca5e51bf23cf4d3f73942a1f2f7d7f625be6f90f277fb379629af899ce194ee3e4103251cf6a17e42f7294e8a2b1d3b11d1ab377bb55e29f08baf6a67da6ae200e3051ca6766f0a10ff53ba7fdd4839494e7e5b492f7bb6dfbc40342aa7b742f70fc352080b02339455106c0a3ef0dde0c959689a01e9fe007caa206190d6a2648af11c332167f4488bdd91c0f7b67a4518b6eedff2abcab4df52257fd296d7badd53941b4b774ddefc14a5f8327209f65197ab1b2bfc44ca6c34e401e2bd6d84ea620b9cdfc25eb3b0cfff83e033a00050833b1e7b208d2cf0619fc350971899d6e6dbba930358068dabb6ff6933d05432ed6e6232ab70eefd1107dcdc63d82b2cadede95f74a7cdcbc1ed071255ff229937665a2ae8e86315b353ea9cab0918dcc63775102bfe76863519f88f2482fcdea9af04d402006"})
ioctl$BINDER_WRITE_READ(r0, 0x541b, 0x0)
r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, 0x0, 0x0)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r4, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r4, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000001640)={0xfc, 0x0, &(0x7f00000014c0)=[@reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f00000011c0)={@flat=@weak_handle, @fd={0x66642a85, 0x0, r4}, @ptr={0x70742a85, 0x1, &(0x7f0000001140)=""/95, 0x5f, 0x2}}, &(0x7f0000001240)={0x0, 0x18, 0x30}}}, @increfs_done={0x40106308, 0x1}, @acquire={0x40046305, 0x3}, @transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000001280)={@fda={0x66646185, 0xffff, 0x1, 0x26}, @fda={0x66646185, 0x2, 0x2, 0xf}, @fd={0x66642a85, 0x0, r2}}, &(0x7f0000001300)={0x0, 0x20, 0x40}}}, @reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f0000001400)={@ptr={0x70742a85, 0x1, &(0x7f0000001340)=""/98, 0x62, 0x1}, @ptr={0x70742a85, 0x0, &(0x7f00000013c0)=""/44, 0x2c, 0x1, 0x18}, @fda={0x66646185, 0x2, 0x2, 0x17}}, &(0x7f0000001480)={0x0, 0x28, 0x50}}, 0x40}, @dead_binder_done], 0x60, 0x0, &(0x7f00000015c0)="ca83fadfb372f3fa56e280978e370978cf56549e7611327d9520ef75836c01c87691adc78fdb1baffba05b34cbb7a3938b77ccdf31d879a7b74f5adf156b216273d3fd7d7315d829b647824c74b85fc2390bd3d0ee2c679b681ed6436336da3e"})

06:41:42 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0xc000000, 0x0, 0x0, 0x0, 0x0, 0x0})

[ 1815.193018][T14803] binder: 14801:14803 ioctl 10 0 returned -22
06:41:43 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000040), 0x0, 0x0)
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3, &(0x7f00000001c0)='%\'\x00'}, 0x30)
ioctl$BINDER_WRITE_READ(r0, 0x10, 0x0)
r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000280), 0xffffffffffffffff)
sendmsg$IPVS_CMD_NEW_DAEMON(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000400)={&(0x7f00000002c0)={0x118, r1, 0x410, 0x70bd29, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DAEMON={0x1c, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0xe7}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast2}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @remote}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e22}, @IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x1}]}, @IPVS_CMD_ATTR_SERVICE={0x40, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x39}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0xc}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x10, 0xc}}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x4, 0x10}}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0xc, 0x2}}]}, @IPVS_CMD_ATTR_DAEMON={0x3c, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x3}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast2}]}, @IPVS_CMD_ATTR_SERVICE={0x44, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x2f}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}, @IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0xed92}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x15}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e22}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e23}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}]}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x9}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x5}]}, 0x118}, 0x1, 0x0, 0x0, 0x44005}, 0x1)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r2, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f0000000f80)={0x14}, 0x14}}, 0x0)
r3 = syz_open_dev$dri(&(0x7f0000000000), 0x101, 0x4080)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000480)={0x73622a85, 0x100b, 0x3})
ioctl$DRM_IOCTL_GET_SAREA_CTX(r3, 0xc010641d, &(0x7f0000000180)={0x0, &(0x7f0000000080)=""/255})

[ 1815.490310][T14812] binder: 14809:14812 ioctl 541b 0 returned -22
[ 1815.556734][T14815] binder: 14809:14815 ioctl 541b 0 returned -22
06:41:43 executing program 3:
openat$fb1(0xffffffffffffff9c, &(0x7f0000000040), 0x2d0001, 0x0)
r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, 0x0, 0x0)
mmap$fb(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x2ba499d965695192, r0, 0x91000)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
ioctl$FBIOPUTCMAP(r1, 0x4605, &(0x7f0000000180)={0x20, 0x5, &(0x7f0000000000)=[0x89ad, 0x3e1d, 0x1f, 0x0, 0x9], &(0x7f0000000080)=[0x1], &(0x7f00000000c0)=[0x5, 0x400, 0x3, 0x6], &(0x7f0000000140)=[0x8, 0x20, 0x2, 0xfc01, 0x40]})

06:41:43 executing program 5:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff)
r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x101000, 0x0)
ioctl$SNDCTL_TMR_CONTINUE(r0, 0x5404)

06:41:43 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x10200, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)

06:41:43 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0xd000000, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:43 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x541b, 0x0)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f0000000040)=0x4)

[ 1815.850800][T14817] binder: 14816:14817 ioctl 10 0 returned -22
[ 1815.923100][T14819] binder: 14816:14819 ioctl 10 0 returned -22
[ 1816.254880][T14829] binder: 14828:14829 ioctl 541b 0 returned -22
06:41:43 executing program 3:
openat$fb1(0xffffffffffffff9c, &(0x7f0000000040), 0x2d0001, 0x0)
r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, 0x0, 0x0)
mmap$fb(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x2ba499d965695192, r0, 0x91000)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
ioctl$FBIOPUTCMAP(r1, 0x4605, &(0x7f0000000180)={0x20, 0x5, &(0x7f0000000000)=[0x89ad, 0x3e1d, 0x1f, 0x0, 0x9], &(0x7f0000000080)=[0x1], &(0x7f00000000c0)=[0x5, 0x400, 0x3, 0x6], &(0x7f0000000140)=[0x8, 0x20, 0x2, 0xfc01, 0x40]})

06:41:43 executing program 1:
ioctl$VIDIOC_QUERYBUF(0xffffffffffffffff, 0xc0585609, &(0x7f0000000040)={0x80000001, 0xb, 0x4, 0x40, 0x2, {}, {0x1, 0x8, 0x5, 0xa2, 0x0, 0x6, 'N]/i'}, 0xa0c, 0x1, @offset=0x100, 0x9})
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x10, 0x0)

06:41:43 executing program 5:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x101000, 0x0)
ioctl$SNDCTL_TMR_CONTINUE(r0, 0x5404)

06:41:44 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000000), 0x430000, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)

06:41:44 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0})

[ 1816.328993][T14829] binder: 14828:14829 ioctl 541b 0 returned -22
06:41:44 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000180), 0x82800, 0x0)
ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f00000001c0)=0x59)
ioctl$BINDER_WRITE_READ(r0, 0x541b, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r2 = socket(0xa, 0x803, 0x7f)
syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r2)
setsockopt$XDP_UMEM_REG(r2, 0x11b, 0x4, &(0x7f0000000100)={&(0x7f0000000200)=""/157, 0x1000, 0x0, 0x79, 0x1}, 0x20)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x0, 0x1})
ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f0000000040)={0x2})
r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, 0x0, 0x0)
ioctl$DRM_IOCTL_NEW_CTX(r3, 0x40086425, &(0x7f0000000080)={0x0, 0x1})

[ 1816.626504][T14840] binder: 14834:14840 ioctl 10 0 returned -22
[ 1816.707399][T14843] binder: 14834:14843 ioctl 10 0 returned -22
06:41:44 executing program 3:
openat$fb1(0xffffffffffffff9c, &(0x7f0000000040), 0x2d0001, 0x0)
r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, 0x0, 0x0)
mmap$fb(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x2ba499d965695192, r0, 0x91000)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
ioctl$FBIOPUTCMAP(r1, 0x4605, &(0x7f0000000180)={0x20, 0x5, &(0x7f0000000000)=[0x89ad, 0x3e1d, 0x1f, 0x0, 0x9], &(0x7f0000000080)=[0x1], &(0x7f00000000c0)=[0x5, 0x400, 0x3, 0x6], &(0x7f0000000140)=[0x8, 0x20, 0x2, 0xfc01, 0x40]})

06:41:44 executing program 5:
r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x101000, 0x0)
ioctl$SNDCTL_TMR_CONTINUE(r0, 0x5404)

06:41:44 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000000), 0x742, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
mmap$fb(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x2, 0x100010, r1, 0xe2000)
recvmsg$kcm(r1, &(0x7f0000000480)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @remote}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)=""/80, 0x50}, {&(0x7f00000001c0)=""/200, 0xc8}, {&(0x7f00000002c0)=""/138, 0x8a}], 0x3, &(0x7f0000000380)=""/249, 0xf9}, 0x1)

06:41:44 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x10000000, 0x0, 0x0, 0x0, 0x0, 0x0})

[ 1816.985112][T14845] binder: 14844:14845 ioctl 541b 0 returned -22
06:41:44 executing program 1:
r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, 0x0, 0x0)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x1b9103, 0x0)
ioctl$KVM_GET_SUPPORTED_CPUID(r1, 0xc008ae05, &(0x7f0000000140)=""/202)
ioctl$BINDER_WRITE_READ(r0, 0x10, 0x0)

[ 1817.031925][T14845] binder: BINDER_SET_CONTEXT_MGR already set
[ 1817.038121][T14845] binder: 14844:14845 ioctl 4018620d 20000140 returned -16
[ 1817.126159][T14845] binder: 14844:14845 ioctl 541b 0 returned -22
[ 1817.145942][T14848] binder: BINDER_SET_CONTEXT_MGR already set
[ 1817.152424][T14848] binder: 14844:14848 ioctl 4018620d 20000140 returned -16
06:41:45 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r1, &(0x7f0000000200)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000001c0)={&(0x7f00000006c0)={0x10c, 0x0, 0x100, 0x70bd2b, 0x25dfdbfd, {}, [{{@nsim={{}, {0x0, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0xdc5}, {0x6, 0x16, 0x7fff}, {0x5, 0x12, 0x1}}, {{@nsim={{0x2d}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0xff}, {0x6, 0x16, 0x4}, {0x5, 0x12, 0x1}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}, {0xffffffffffffff3b, 0xb, 0x9}, {0x6, 0x16, 0xed70}, {0x5, 0x12, 0x1}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0xdd39}, {0x6, 0x16, 0x9}, {0x5, 0x12, 0x1}}]}, 0x10c}, 0x1, 0x0, 0x0, 0x4004000}, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x541b, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r2, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r3, 0xcd6ccc609280a2c3, 0x0, 0x0, {{}, {@void, @void}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x24}}, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000280)={'wlan1\x00', <r4=>0x0})
r5 = socket(0x1d, 0x800, 0x3)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r6, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r7, 0xcd6ccc609280a2c3, 0x0, 0x0, {{}, {@void, @void}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x24}}, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000480)={'wlan1\x00', <r8=>0x0})
sendmsg$IPVS_CMD_DEL_DAEMON(r6, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x40810}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x1c, 0x0, 0x8, 0x70bd27, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4048840}, 0x400d1)
sendmsg$NL80211_CMD_NEW_KEY(r5, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x30, r7, 0x400, 0x70bd25, 0x25dfdbff, {{}, {@val={0x8, 0x3, r8}, @val={0xc, 0x99, {0x1, 0x12}}}}, [@NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0xfac05}]}, 0x30}, 0x1, 0x0, 0x0, 0x800}, 0x4000000)
sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000400)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000003c0)={&(0x7f00000002c0)={0x100, r3, 0x200, 0x70bd28, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r4}, @val={0xc, 0x99, {0x6, 0x72}}}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x9}, @NL80211_ATTR_MESH_ID={0xa}, @mon_options=[@NL80211_ATTR_MNTR_FLAGS={0x8, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_PLCPFAIL={0x4}]}, @NL80211_ATTR_MNTR_FLAGS={0x20, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}]}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @device_b}, @NL80211_ATTR_MNTR_FLAGS={0x24, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}]}, @NL80211_ATTR_MNTR_FLAGS={0x28, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}]}, @NL80211_ATTR_MNTR_FLAGS={0x20, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}]}], @NL80211_ATTR_IFTYPE={0x8}, @NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}, @NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x9}]}, 0x100}, 0x1, 0x0, 0x0, 0x68880}, 0x24044000)

06:41:45 executing program 3:
openat$fb1(0xffffffffffffff9c, &(0x7f0000000040), 0x2d0001, 0x0)
r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, 0x0, 0x0)
mmap$fb(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x2ba499d965695192, r0, 0x91000)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)

06:41:45 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$vim2m_VIDIOC_TRY_FMT(0xffffffffffffffff, 0xc0d05640, &(0x7f00000000c0)={0x1, @pix={0x8, 0x8, 0x30314742, 0x8, 0x4, 0x5, 0x3, 0x5, 0x0, 0x4, 0x0, 0x2}})
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)
getsockopt$XDP_MMAP_OFFSETS(0xffffffffffffffff, 0x11b, 0x1, &(0x7f0000000280), &(0x7f0000000040)=0x80)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x40, 0x0)
ioctl$FBIOPAN_DISPLAY(r1, 0x4606, &(0x7f00000001c0)={0x40, 0x320, 0x280, 0x300, 0x2c, 0x5, 0x18, 0x1, {0xff, 0x1}, {0xece, 0x3f, 0x1}, {0x6bc, 0x6}, {0x10000, 0xff}, 0x1, 0x1, 0x5, 0x4, 0x0, 0xc4, 0x3f, 0x40, 0x0, 0x6eae, 0x8, 0x6, 0x8, 0x0, 0x0, 0x8})

06:41:45 executing program 5:
r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x101000, 0x0)
ioctl$SNDCTL_TMR_CONTINUE(r0, 0x5404)

06:41:45 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x11000000, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:45 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x10, 0x0)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f0000000040)=0xffffffbc)

[ 1817.801852][T14862] binder: 14861:14862 ioctl 541b 0 returned -22
[ 1817.968328][T14875] binder: 14869:14875 ioctl 10 0 returned -22
[ 1817.990923][T14862] can: request_module (can-proto-3) failed.
[ 1818.011804][T14871] binder: 14861:14871 ioctl 541b 0 returned -22
[ 1818.060560][T14875] binder: 14869:14875 ioctl 10 0 returned -22
[ 1818.102796][T14871] can: request_module (can-proto-3) failed.
06:41:45 executing program 2:
r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x842, 0x0)
r1 = accept4(r0, &(0x7f0000001500)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, &(0x7f0000001580)=0x80, 0x80800)
sendmsg$IPVS_CMD_SET_SERVICE(r1, &(0x7f0000001680)={&(0x7f00000015c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000001640)={&(0x7f0000001600)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="ff282abd42d6267000fddbdf2502000000080004000500000010000180090006006e6f6e6500"], 0x2c}, 0x1, 0x0, 0x0, 0x4000}, 0x4004880)
r2 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0)
ioctl$FBIOGET_CON2FBMAP(r2, 0x460f, 0x0)
timerfd_gettime(r0, &(0x7f0000000400))
r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r4, 0x11b, 0x5, 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(r4, 0x40046208, 0x0)
sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000003c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000380)={&(0x7f0000000100)={0x278, r3, 0x10, 0x70bd2b, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_IE={0x14e, 0x2a, [@chsw_timing={0x68, 0x4, {0x9, 0x3f}}, @preq={0x82, 0x25, @not_ext={{}, 0x5, 0x81, 0xfff, @device_b, 0x2, "", 0xd1f, 0x10000, 0x1, [{{}, @broadcast, 0x7}]}}, @perr={0x84, 0x35, {0x9, 0x3, [@ext={{}, @broadcast, 0xffffffc1, @device_a, 0x27}, @not_ext={{}, @device_b, 0x81, "", 0x40}, @ext={{}, @broadcast, 0x9, @broadcast, 0xf}]}}, @mesh_config={0x71, 0x7, {0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x1f, 0x28}}, @measure_req={0x26, 0xdb, {0x3, 0x0, 0x8, "3274d20c2f7bf26156077713de295f3a9733db4a7015107f98a4e60299108c483c5d8bd5b0a85c069f53446db1670d084b164e6a64b37015824fa95fdc120ff7d94a379ecfeba4766be3b037697cc821b7baeec9ffc7134604e5c4d7416c78b00b79d3d4f780449eb25f57a62bb7355d729f7beb024f5195c991f41ec271ec11d8419d6842d1565613996a138349088c3904946a87173f3a974d1842a5099026f8c70a47ae2e788f01e1473a4d699abaabc1fe4bb207cca8913b0fb92227e5558b8c7596e701fbaf6620d825818871f5806d04358b0980b1"}}]}, @NL80211_ATTR_PREV_BSSID={0xa, 0x4f, @random="53ebe9729959"}, @chandef_params=[@NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x6}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0xf6}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x4}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x2}], @NL80211_ATTR_IE={0xce, 0x2a, [@ssid={0x0, 0x6, @default_ap_ssid}, @random_vendor={0xdd, 0xc0, "95e8593eee053d9bee15e00e14e3aa2918432d326ef8dfa0c13984bbe16189971c893490e040bf8053597eaff4b5798966cf59b265a8ca44a3ace28eafc96838709fc5a83b633c249b37434b913852712ec6822bb7cd90ad48f08f17c3b8b927febfd13e6db98a42616fe67ec5335d04e92f333bd147692e53663097d0052e5a8492ae81708737ae83bf1ec71fa0e4bee1a6c92be8fd75ac5144556fe6ec4b90eb8584920974f748a726746fd4c646121b66f5f6ce6d13b60faed20f4d6cbb1b"}]}]}, 0x278}, 0x1, 0x0, 0x0, 0x9309a90c3f0d57fd}, 0x80)

06:41:45 executing program 3:
openat$fb1(0xffffffffffffff9c, &(0x7f0000000040), 0x2d0001, 0x0)
r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, 0x0, 0x0)
mmap$fb(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x2ba499d965695192, r0, 0x91000)
openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)

06:41:46 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x12000000, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:46 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x541b, 0x0)
r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040), 0x442002, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000080))

06:41:46 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000040), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x10, 0x0)

06:41:46 executing program 5:
r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x101000, 0x0)
ioctl$SNDCTL_TMR_CONTINUE(r0, 0x5404)

[ 1818.675315][T14892] binder: 14887:14892 ioctl 10 0 returned -22
[ 1818.680965][T14890] binder: 14886:14890 ioctl 541b 0 returned -22
[ 1818.728506][T14894] binder: 14886:14894 ioctl 541b 0 returned -22
06:41:46 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x25000000, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:46 executing program 3:
openat$fb1(0xffffffffffffff9c, &(0x7f0000000040), 0x2d0001, 0x0)
r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, 0x0, 0x0)
mmap$fb(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x2ba499d965695192, r0, 0x91000)

06:41:46 executing program 2:
r0 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffff8)
r1 = add_key$keyring(&(0x7f0000000240), &(0x7f0000000280)={'syz', 0x0}, 0x0, 0x0, r0)
add_key$user(&(0x7f00000002c0), &(0x7f0000000300)={'syz', 0x3}, &(0x7f0000000340)="0b0e639675dd090f19ca4ed648f16cd866f8ccfaa1f716e93de609044db4e9a7b5ebbb139c61b9ed9dd718", 0x2b, r0)
keyctl$link(0x8, r0, r1)
r2 = add_key$keyring(&(0x7f0000000080), &(0x7f00000000c0)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffc)
r3 = add_key$keyring(&(0x7f0000000080), &(0x7f00000000c0)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffc)
add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffc)
add_key(&(0x7f0000000400)='pkcs7_test\x00', &(0x7f0000000440)={'syz', 0x2}, &(0x7f0000000480)="95e09ce053a2fa9d7c410ba786d166dc884c202d3e02dc19b0689bfd6c5bee9b513c1c88f27c353cca118cf34f2f962c46f829d604c382f2e31fc274e4c2458ce0a186ab679af5aec02a0dd2830dca6fb2dd443fbf66bad0d57d6872ffdb581edb8ff1675a87f43e619837754162bedbc1f1da7f4a423291d8a14a9afd5d60343b3e54347859af2804bf4acca175e1e8e474501384", 0x95, 0xfffffffffffffffe)
r4 = add_key$keyring(&(0x7f0000000080), &(0x7f00000000c0)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffc)
add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x3}, 0x0, 0x0, r4)
keyctl$search(0xa, r3, &(0x7f0000000380)='asymmetric\x00', &(0x7f00000003c0)={'syz', 0x0}, r4)
add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x3}, 0x0, 0x0, r2)
keyctl$search(0xa, r0, &(0x7f00000000c0)='.dead\x00', &(0x7f0000000100)={'syz', 0x0}, r2)
r5 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r5, 0x460f, 0x0)
add_key$keyring(&(0x7f0000000540), &(0x7f0000000580)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffd)
r6 = add_key$keyring(&(0x7f00000001c0), &(0x7f0000000200)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffff9)
add_key(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x0}, 0x0, 0x0, r6)

06:41:46 executing program 0:
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000040)={<r0=>0x0})
ioctl$DRM_IOCTL_LOCK(0xffffffffffffffff, 0x4008642a, &(0x7f0000000080)={r0, 0x10})
r1 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0x541b, 0x0)
r2 = syz_open_dev$binderN(&(0x7f00000000c0), 0x0, 0x6)
r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000480), 0x8800, 0x0)
r4 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000500), 0x109100, 0x0)
ioctl$FBIOPAN_DISPLAY(r4, 0x4606, &(0x7f0000000540)={0xc80, 0x1da0, 0x640, 0x40, 0x1, 0x6, 0x0, 0x0, {0x2, 0x75b, 0x1}, {0x9, 0x7}, {0x7, 0xfffffe01}, {0x1f, 0x3}, 0x1, 0x0, 0x88, 0x4, 0x0, 0x5de, 0x4d, 0xff, 0x7, 0x101, 0x6, 0x100, 0x28, 0x4, 0x2, 0x4})
ioctl$DRM_IOCTL_UNLOCK(r3, 0x4008642b, &(0x7f00000004c0)={r0, 0x2})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x54, 0x0, &(0x7f00000002c0)=[@decrefs, @decrefs={0x40046307, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000200)={@fda={0x66646185, 0x1, 0x2, 0xa}, @fda={0x66646185, 0x3, 0x0, 0x3a}, @ptr={0x70742a85, 0x1, &(0x7f0000000100)=""/236, 0xec, 0x0, 0x2e}}, &(0x7f0000000280)={0x0, 0x20, 0x40}}}], 0xe4, 0x0, &(0x7f0000000340)="e2e26f2cc357737c4ef27c1ab3eaba40719280725d05b7c45a8172225ee9a04150697856b35aff5535e300d38b55a2a5e3a94af45d3aee9864ebe66e59e5daeec447db4a2c9944af2e5f03e3528cb06d2dd8aed1bc0b3316e7e09675d6c1a2150e7ca698ba6620558c47458d1f69031b148e384662c63932933c949d07ea8dadaf4b89090f2ff8168d87023c6d2bfabe5d2ecad594688061493f4e02ea6ed41e50e1f439eda78b17de945377aaf8f28a56c83d9a88962cc41c44285052448e03d48a50e861cd7cfef1ae8cd8b6dd5539b7a0b897cc83d7a46b8c53896cc6cdc82563f9e4"})

06:41:46 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r0, 0x10, 0x0)

06:41:46 executing program 5:
r0 = openat$sequencer2(0xffffffffffffff9c, 0x0, 0x101000, 0x0)
ioctl$SNDCTL_TMR_CONTINUE(r0, 0x5404)

[ 1819.342795][T14908] binder: 14903:14908 ioctl 10 0 returned -22
[ 1819.344583][T14906] binder: 14904:14906 ioctl 541b 0 returned -22
06:41:47 executing program 3:
openat$fb1(0xffffffffffffff9c, &(0x7f0000000040), 0x2d0001, 0x0)
r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
mmap$fb(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x2ba499d965695192, r0, 0x91000)

06:41:47 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x5c000000, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:47 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x63cc83, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)

[ 1819.480229][T14906] binder: 14904:14906 ioctl 541b 0 returned -22
06:41:47 executing program 5:
r0 = openat$sequencer2(0xffffffffffffff9c, 0x0, 0x101000, 0x0)
ioctl$SNDCTL_TMR_CONTINUE(r0, 0x5404)

06:41:47 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$DRM_IOCTL_LOCK(r1, 0x4008642a, &(0x7f0000000280)={0x0, 0xc})
ioctl$BINDER_WRITE_READ(r0, 0x10, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r2, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r3, 0xcd6ccc609280a2c3, 0x0, 0x0, {{}, {@void, @void}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x24}}, 0x0)
ioctl$KVM_CHECK_EXTENSION(r1, 0xae03, 0x108e)
sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x50, r3, 0x100, 0x70bd2b, 0x25dfdbfe, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_DONT_WAIT_FOR_ACK={0x4}, @NL80211_ATTR_CSA_C_OFFSETS_TX={0xe, 0xcd, [0x4, 0x2, 0x1, 0x5, 0x0]}, @NL80211_ATTR_OFFCHANNEL_TX_OK={0x4}, @NL80211_ATTR_CSA_C_OFFSETS_TX={0x12, 0xcd, [0x1, 0xc72, 0x0, 0x794a, 0x6, 0x6, 0xee]}, @NL80211_ATTR_DONT_WAIT_FOR_ACK={0x4}, @NL80211_ATTR_DONT_WAIT_FOR_ACK={0x4}]}, 0x50}, 0x1, 0x0, 0x0, 0x84}, 0x840)
getsockopt$XDP_MMAP_OFFSETS(0xffffffffffffffff, 0x11b, 0x1, &(0x7f0000000040), &(0x7f00000000c0)=0x80)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r4, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r4, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
sendmsg$NL80211_CMD_STOP_NAN(r4, &(0x7f0000000380)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000340)={&(0x7f00000003c0)=ANY=[@ANYBLOB="14000000", @ANYRES16=r3, @ANYBLOB="00032abd7000ffdbdf2574000000474f88ae055eebb91b69d8d2bee0a407b947331652c890033aa01e3d7c8f2da0d51472632e7e21af2b3419575d7a583cbd975b8385fd797f65c5544f4fd39b"], 0x14}}, 0x1)

06:41:47 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x541b, 0x0)
r1 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x800)
userfaultfd(0x80800)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x100b, 0x2})
r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040), 0x8080, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)

06:41:47 executing program 3:
openat$fb1(0xffffffffffffff9c, &(0x7f0000000040), 0x2d0001, 0x0)
mmap$fb(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x2ba499d965695192, 0xffffffffffffffff, 0x91000)

06:41:47 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
r1 = accept4(0xffffffffffffffff, &(0x7f0000000180)=@xdp, &(0x7f00000000c0)=0x80, 0x800)
getsockopt$XDP_STATISTICS(r1, 0x11b, 0x7, &(0x7f0000000100), &(0x7f0000000140)=0x30)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)

06:41:47 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0xfdfdffff, 0x0, 0x0, 0x0, 0x0, 0x0})

[ 1820.006762][T14920] binder: 14918:14920 ioctl 10 0 returned -22
[ 1820.103160][T14920] binder: 14918:14920 ioctl 10 0 returned -22
[ 1820.112389][T14922] binder: 14921:14922 ioctl 541b 0 returned -22
06:41:47 executing program 5:
r0 = openat$sequencer2(0xffffffffffffff9c, 0x0, 0x101000, 0x0)
ioctl$SNDCTL_TMR_CONTINUE(r0, 0x5404)

[ 1820.191991][T14922] binder: 14921:14922 ioctl 541b 0 returned -22
06:41:48 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000040), 0x0, 0x800)
ioctl$BINDER_WRITE_READ(r0, 0x10, 0x0)
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x2)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080), 0x428b02, 0x0)
setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f0000000100)={&(0x7f0000000900)=""/57, 0x200000, 0x1000, 0xfffffffe, 0x1}, 0x20)

06:41:48 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
openat$zero(0xffffffffffffff9c, &(0x7f0000000080), 0x101800, 0x0)
syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x801)
syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f00000000c0), 0x4241, 0x0)
setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f00000001c0)={&(0x7f0000000180), 0x12000, 0x1000, 0x1, 0x2}, 0x20)
ioctl$BINDER_WRITE_READ(r0, 0x541b, 0x0)
openat$zero(0xffffffffffffff9c, &(0x7f0000000040), 0x80000, 0x0)

06:41:48 executing program 3:
openat$fb1(0xffffffffffffff9c, &(0x7f0000000040), 0x2d0001, 0x0)
mmap$fb(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x2ba499d965695192, 0xffffffffffffffff, 0x91000)

06:41:48 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000040), 0x50282, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)
write$fb(r0, &(0x7f0000000080)="ab85385bdf831fa95f6e77ed80cc5b8a0667501fb7d06ec0e1a4fa7c3704d303e428f6e1dfeaf5f96eafa0dd59096033433e7baed1e1eacef745540844fee8c068f3e9b2c3263dcb14fbc7ea677402ead17a00ad56fcab8777d2ef6f8fcc916a71e8472793191eca67949e388ce6d02af9c38bc5a29b", 0x76)

06:41:48 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0xff000000, 0x0, 0x0, 0x0, 0x0, 0x0})

[ 1820.743208][T14938] binder: 14937:14938 ioctl 10 0 returned -22
[ 1820.767643][T14938] binder: 14937:14938 ioctl 10 0 returned -22
[ 1820.786762][T14939] binder: 14936:14939 ioctl 541b 0 returned -22
06:41:48 executing program 5:
r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
ioctl$SNDCTL_TMR_CONTINUE(r0, 0x5404)

[ 1820.886812][T14947] binder: 14936:14947 ioctl 541b 0 returned -22
06:41:48 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x2)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0)
ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x10, 0x0)

06:41:48 executing program 3:
openat$fb1(0xffffffffffffff9c, &(0x7f0000000040), 0x2d0001, 0x0)
mmap$fb(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x2ba499d965695192, 0xffffffffffffffff, 0x91000)

06:41:48 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)
r1 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000000), 0x40400, 0x0)
ioctl$FBIOPAN_DISPLAY(r1, 0x4606, &(0x7f00000000c0)={0x40, 0x258, 0x578, 0x140, 0x7, 0x6, 0x10, 0x0, {0x4, 0x5, 0x1}, {0x400, 0x80, 0x1}, {0x9, 0x9}, {0x0, 0x6}, 0x2, 0x80, 0x0, 0x1, 0x1, 0x297, 0x9, 0xfffffff8, 0x2, 0xc430, 0x6, 0x9029, 0x20, 0x4, 0x3, 0x1})

06:41:48 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x541b, 0x0)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040), 0x4e4002, 0x0)
ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f0000000080)=0x6)
ioctl$FBIO_WAITFORVSYNC(r1, 0x40044620, 0x0)
r2 = openat$zero(0xffffffffffffff9c, &(0x7f00000000c0), 0xb8541, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r2, 0x11b, 0x5, 0x0, 0x0)
ioctl$DRM_IOCTL_DMA(r2, 0xc0406429, &(0x7f00000001c0)={0x0, 0x5f, &(0x7f00000000c0), &(0x7f0000000100)=[0x5, 0x0, 0x7, 0x93], 0x64, 0x3, 0x2, &(0x7f0000000140)=[0x82, 0xd, 0x7fffffff], &(0x7f0000000180)=[0x4, 0x1ff, 0x7, 0xffffffc1, 0x401, 0x6, 0x0]})

06:41:49 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0xfffffdfd, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:49 executing program 5:
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404)

[ 1821.387417][T14956] binder: 14955:14956 ioctl 10 0 returned -22
[ 1821.530600][T14962] binder: 14958:14962 ioctl 541b 0 returned -22
[ 1821.562861][T14962] binder: 14958:14962 ioctl 541b 0 returned -22
06:41:49 executing program 3:
r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
mmap$fb(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x2ba499d965695192, r0, 0x91000)

06:41:49 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r0, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
sendmsg$NL80211_CMD_TDLS_CHANNEL_SWITCH(r0, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="d8c6aac3151c8a07f8d604", @ANYRES16=r1, @ANYBLOB="200025bd7000ffdbdf256f00000008002201730100000800a00000800000080026008c1400000500d600010000000500d600920000000a0006000802110000010000050018013200000005001801220000000800270003000000050018010b00000008009f000e00000008009f0001000000050018012300000008009f00050000000800a10000000080050019010a0000000500d600010000000500d60080000000080026001117000008009f000300000008002201590300000800a100bc4000000800270000000000050018013100000008002700020000000800a100090000000800a000000000000500d60001000000"], 0xf8}, 0x1, 0x0, 0x0, 0x40408a5}, 0x4044801)
r2 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0x10, 0x0)

06:41:49 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0xc00)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040), 0x442400, 0x0)
ioctl$DRM_IOCTL_RM_CTX(r1, 0xc0086421, &(0x7f00000000c0)={0x0, 0x2})
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100b, 0x10000000})
r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r2, 0x11b, 0x5, 0x0, 0x0)
r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0x541b, 0x0)

06:41:49 executing program 2:
sendmsg$NL80211_CMD_GET_MESH_CONFIG(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x20, 0x0, 0x6fe3989f16dcd681, 0x70bd2a, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x453, 0x7c}}}}, ["", "", ""]}, 0x20}, 0x1, 0x0, 0x0, 0x40d0}, 0x90)
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000140)=@alg, 0x80, &(0x7f00000003c0)=[{&(0x7f00000001c0)=""/71, 0x47}, {&(0x7f0000000240)=""/220, 0xdc}, {&(0x7f0000000340)=""/75, 0x4b}], 0x3}, 0x1a020)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)

06:41:49 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x1000000000000, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:49 executing program 5:
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404)

[ 1821.975931][T14974] binder: 14972:14974 ioctl 10 0 returned -22
[ 1822.045591][T14975] binder: 14972:14975 ioctl 10 0 returned -22
06:41:49 executing program 3:
r0 = openat$zero(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap$fb(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x2ba499d965695192, r0, 0x91000)

06:41:50 executing program 1:
r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, 0x0, 0x0)
ioctl$FBIOPUTCMAP(r0, 0x4605, &(0x7f0000000180)={0x1, 0x2, &(0x7f0000000080)=[0xa43e, 0x7fff], &(0x7f00000000c0)=[0x3, 0x618, 0xa2, 0x3, 0x0, 0xffc1, 0x5, 0x8000], &(0x7f0000000100)=[0x4, 0x2, 0x7], &(0x7f0000000140)=[0x40]})
r1 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040), 0xc0002, 0x0)
ioctl$BINDER_THREAD_EXIT(r2, 0x40046208, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0x10, 0x0)

06:41:50 executing program 2:
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000040)={<r0=>0x0})
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'wlan1\x00', <r2=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x54, r1, 0x10, 0x70bd25, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r2}, @void}}, [@mon_options=[@NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @device_b}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @device_b}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa}], @NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}, @NL80211_ATTR_MESH_ID={0xa}]}, 0x54}, 0x1, 0x0, 0x0, 0x40000}, 0x20000000)
ioctl$DRM_IOCTL_SET_SAREA_CTX(0xffffffffffffffff, 0x4010641c, &(0x7f0000000100)={r0, &(0x7f00000000c0)=""/29})
r3 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
sendmsg$IPVS_CMD_SET_SERVICE(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000340)={0x178, 0x0, 0x400, 0x70bd28, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DEST={0x28, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0xfffffeff}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@local}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x3ff}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x6}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x64ca}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x9}]}, @IPVS_CMD_ATTR_DEST={0x58, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0x2}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0xfffff4fc}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x1}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@multicast1}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xffffff00}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x4}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x5}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x81}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x1f}]}, @IPVS_CMD_ATTR_DEST={0x24, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x8340}, @IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x1}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8}]}, @IPVS_CMD_ATTR_SERVICE={0x60, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e20}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x1d, 0x17}}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@loopback}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x1d}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x8}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x3ff}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x78}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x20}}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0xa}]}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x2}, @IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_SCHED_NAME={0xa, 0x6, 'lblcr\x00'}]}, @IPVS_CMD_ATTR_DEST={0x24, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x3}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x1}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0xcf}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e24}]}]}, 0x178}, 0x1, 0x0, 0x0, 0x40088d1}, 0x0)
openat$fb1(0xffffffffffffff9c, &(0x7f0000000000), 0x10000, 0x0)
ioctl$FBIOGET_CON2FBMAP(r3, 0x460f, 0x0)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r4, 0x11b, 0x5, 0x0, 0x0)
ioctl$FBIOGET_FSCREENINFO(r4, 0x4602, &(0x7f0000000540))

06:41:50 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x100000000000000, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:50 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$sock_inet6_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, &(0x7f0000000040))
ioctl$BINDER_WRITE_READ(r0, 0x541b, 0x0)

06:41:50 executing program 5:
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404)

06:41:50 executing program 3:
r0 = openat$zero(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap$fb(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x2ba499d965695192, r0, 0x91000)

[ 1822.781492][T14993] binder: 14991:14993 ioctl 10 0 returned -22
[ 1822.827626][T14997] binder: 14991:14997 ioctl 10 0 returned -22
[ 1822.873134][T14999] binder: 14995:14999 ioctl 541b 0 returned -22
[ 1822.907872][T15001] binder: 14995:15001 ioctl 541b 0 returned -22
06:41:50 executing program 2:
r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, 0x0, 0x0)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000500), 0x400100, 0x0)
sendmsg$NL80211_CMD_GET_MESH_CONFIG(r1, &(0x7f0000000600)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x1c, 0x0, 0x100, 0x70bd28, 0x25dfdbfe, {{}, {@val={0x8}, @void}}, ["", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x4040800)
ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000100)={&(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff2000/0xe000)=nil, 0x1000})
r2 = syz_open_dev$dri(&(0x7f0000000040), 0x7, 0x8100)
ioctl$DRM_IOCTL_NEW_CTX(r2, 0x40086425, &(0x7f00000000c0))
r3 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r3, 0x460f, 0x0)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), 0xffffffffffffffff)
r4 = socket(0xa, 0x803, 0x7f)
syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r4)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000000)=0x1, 0x4)

06:41:50 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:50 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r0, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
r1 = userfaultfd(0x80000)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000580)={&(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x2000, 0x1})
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan1\x00'})
r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080), 0x1d5400, 0x0)
recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f0000000240)=@hci, 0x80, &(0x7f0000000180)=[{&(0x7f0000000000)=""/34, 0x22}, {&(0x7f0000001600)=""/4096, 0x1000}], 0x2, &(0x7f00000002c0)=""/247, 0xf7}, 0x3)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000700), r0)
socketpair(0x22, 0x80000, 0x5, &(0x7f0000000c00))
ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000c80)={'wlan0\x00'})
sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f0000000800)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000007c0)={&(0x7f0000000740)={0x70, r4, 0x2, 0x70bd2d, 0x25dfdbfd, {{}, {@void, @void}}, [@mon_options=[@NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @device_b}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "d2fcd8adf7861850f51f3522f38fd255c6ad0bd5e3a3c08f"}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @device_b}], @NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}, @NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_MESH_ID={0xa}]}, 0x70}, 0x1, 0x0, 0x0, 0x4000080}, 0x4004088)
r5 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0)
sendmsg$IPVS_CMD_ZERO(r5, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000001c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="2800000080f94ac2be12692ae1f9bbc822109699c391dbaf9fe2068fb247001d29319bb65b40deba099aa5a2cc7b6deccc9d109a1b2b8250b8cdb8c8029aba274b5efd181011860aacb3b3c65d0fb9286856aae3bad8f33697e44a3679fde5c813709b72578255eb2bb1282fc4c98fcb7146bd98c94405e631e6f1deb72049f666a902984c576af5097b7c7cfc749ee785c33a785051c2e78280858717fd9278c1104329db525fe89d23f5eea7e240da4a6b21542fca8c660d712c3511a97d0f4f00"/203, @ANYRES16=0x0, @ANYBLOB="080025bd7000ffdbdf25090000001400028006000b000a238f30495116c6b2a97ded29c90f34005f5f59e197adbd27bb42c17205ed709b26870e096e6d5cf27351d72f94ff0f00008657a850522bfe633bf92559a91bb5dbc1341a43db98f01d5821555cf12505419b6337583d112e5766870c1a8b58eeb905c7eb5e"], 0x28}, 0x1, 0x0, 0x0, 0x4000091}, 0x40088c1)
ioctl$SNDCTL_SEQ_NRSYNTHS(r2, 0x8004510a, &(0x7f00000000c0))
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x10, 0x0)

06:41:50 executing program 5:
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
ioctl$SNDCTL_TMR_CONTINUE(0xffffffffffffffff, 0x5404)

06:41:50 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x541b, 0x0)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040), 0x100, 0x0)
ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0)

06:41:50 executing program 3:
r0 = openat$zero(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mmap$fb(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x2ba499d965695192, r0, 0x91000)

06:41:51 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x300000000000000, 0x0, 0x0, 0x0, 0x0, 0x0})

[ 1823.572109][T15017] binder: 15015:15017 ioctl 541b 0 returned -22
[ 1823.601313][T15017] binder: 15015:15017 ioctl 541b 0 returned -22
06:41:51 executing program 2:
syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff)
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)

06:41:51 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x10, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r1, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r2, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r2, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000200)={'wlan1\x00', <r5=>0x0})
sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="db1e29bd7000fbdbdf250600000008000300", @ANYRES32=r5, @ANYBLOB='\f'], 0x30}}, 0x0)
sendmsg$NL80211_CMD_STOP_NAN(r2, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x28, 0x0, 0x10, 0x70bd27, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r5}, @val={0xc, 0x99, {0x9, 0x3d}}}}, ["", "", "", "", "", "", "", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x4000}, 0x895)
sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
r7 = syz_genetlink_get_family_id$devlink(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_PORT_UNSPLIT(r6, &(0x7f0000000380)={&(0x7f00000001c0), 0xc, &(0x7f0000000340)={&(0x7f0000000480)={0x14, r7, 0x7ff}, 0x14}}, 0x0)
sendmsg$DEVLINK_CMD_RELOAD(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x84, r7, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [{@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_FD={0x8}}, {@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_NETNS_FD={0x8}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_ID={0x8}}]}, 0x84}, 0x1, 0x0, 0x0, 0x800}, 0x800)
sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000180)={&(0x7f0000000080)={0xb8, 0x0, 0x304, 0x70bd2a, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_DEST={0x1c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x101}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x1ff}, @IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x1}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@loopback}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0xbb48}]}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e23}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x2}, @IPVS_CMD_ATTR_DEST={0x2c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_TYPE={0x5}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e21}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x1f8e}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x784}, @IPVS_DEST_ATTR_FWD_METHOD={0x8}]}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x2c}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e20}]}]}, 0xb8}, 0x1, 0x0, 0x0, 0x4000}, 0x1)
write$proc_mixer(0xffffffffffffffff, &(0x7f0000000300)=[{'LINE3', @void}, {'RADIO', @val={' \'', 'Mic Capture Switch'}}, {'RECLEV', @void}, {'LINE', @val={' \'', 'Master Playback'}}, {'BASS', @val={' \'', 'Master'}}, {'DIGITAL1', @void}, {'RADIO', @void}, {'LINE', @void}, {'LINE2', @val={' \'', 'Capture Switch'}}, {'LINE2', @val={' \'', 'Line Capture'}}], 0xf6)

06:41:51 executing program 3:
r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
mmap$fb(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x10, r0, 0x91000)

06:41:51 executing program 0:
r0 = add_key$keyring(&(0x7f0000000080), &(0x7f00000000c0)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffc)
add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x3}, 0x0, 0x0, r0)
keyctl$search(0xa, 0x0, &(0x7f0000000240)='id_resolver\x00', &(0x7f0000000280)={'syz', 0x3}, r0)
timerfd_create(0x7, 0x0)
r1 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0x541b, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000200)={0x73622a85, 0x110a, 0x1})
r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r2, 0x11b, 0x5, 0x0, 0x0)
r3 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x0)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r4, 0x11b, 0x5, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCCHG6RD(0xffffffffffffffff, 0x89fb, &(0x7f00000000c0)={'syztnl1\x00', &(0x7f0000000140)={'syztnl1\x00', <r5=>0x0, 0x2f, 0x5, 0x80, 0x5, 0x48, @private2, @ipv4={'\x00', '\xff\xff', @empty}, 0x20, 0x8040, 0xffffffff, 0x5}})
bpf$MAP_CREATE(0x0, &(0x7f00000001c0)={0x6, 0x0, 0xffffffff, 0xb20, 0x820, r4, 0x9, '\x00', r5, r2, 0x1, 0x2}, 0x40)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000040)={0x2})

06:41:51 executing program 5:
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000040)={<r0=>0x0})
ioctl$DRM_IOCTL_LOCK(0xffffffffffffffff, 0x4008642a, &(0x7f0000000080)={r0, 0x10})
r1 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0x541b, 0x0)
r2 = syz_open_dev$binderN(&(0x7f00000000c0), 0x0, 0x6)
r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000480), 0x8800, 0x0)
r4 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000500), 0x109100, 0x0)
ioctl$FBIOPAN_DISPLAY(r4, 0x4606, &(0x7f0000000540)={0xc80, 0x1da0, 0x640, 0x40, 0x1, 0x6, 0x0, 0x0, {0x2, 0x75b, 0x1}, {0x9, 0x7}, {0x7, 0xfffffe01}, {0x1f, 0x3}, 0x1, 0x0, 0x88, 0x4, 0x0, 0x5de, 0x4d, 0xff, 0x7, 0x101, 0x6, 0x100, 0x28, 0x4, 0x2, 0x4})
ioctl$DRM_IOCTL_UNLOCK(r3, 0x4008642b, &(0x7f00000004c0)={r0, 0x2})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x54, 0x0, &(0x7f00000002c0)=[@decrefs, @decrefs={0x40046307, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000200)={@fda={0x66646185, 0x1, 0x2, 0xa}, @fda={0x66646185, 0x3, 0x0, 0x3a}, @ptr={0x70742a85, 0x1, &(0x7f0000000100)=""/236, 0xec, 0x0, 0x2e}}, &(0x7f0000000280)={0x0, 0x20, 0x40}}}], 0xe4, 0x0, &(0x7f0000000340)="e2e26f2cc357737c4ef27c1ab3eaba40719280725d05b7c45a8172225ee9a04150697856b35aff5535e300d38b55a2a5e3a94af45d3aee9864ebe66e59e5daeec447db4a2c9944af2e5f03e3528cb06d2dd8aed1bc0b3316e7e09675d6c1a2150e7ca698ba6620558c47458d1f69031b148e384662c63932933c949d07ea8dadaf4b89090f2ff8168d87023c6d2bfabe5d2ecad594688061493f4e02ea6ed41e50e1f439eda78b17de945377aaf8f28a56c83d9a88962cc41c44285052448e03d48a50e861cd7cfef1ae8cd8b6dd5539b7a0b897cc83d7a46b8c53896cc6cdc82563f9e4"})

[ 1824.084820][T15028] binder: 15024:15028 ioctl 10 0 returned -22
[ 1824.144989][T15028] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'.
06:41:51 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x400000000000000, 0x0, 0x0, 0x0, 0x0, 0x0})

[ 1824.228365][T15028] binder: 15024:15028 ioctl 10 0 returned -22
06:41:51 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000040), 0x79ca338e55f642dd, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)
r1 = socket(0x15, 0x4, 0x2)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r2, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r3, 0xcd6ccc609280a2c3, 0x0, 0x0, {{}, {@void, @void}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x24}}, 0x0)
sendmsg$NL80211_CMD_STOP_NAN(r1, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, r3, 0x2, 0x70bd26, 0x25dfdbfd, {{}, {@void, @void}}, ["", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x24044000}, 0x20000804)
ioctl$FBIOPUT_CON2FBMAP(r0, 0x4610, &(0x7f0000000000)={0x33})
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r4, 0x11b, 0x5, 0x0, 0x0)
write$fb(r4, &(0x7f00000000c0)="4b6c470975fcbc1f52eafe21986d4e678d09c63bc713d6dbab214b28c7c35d1cbf0c0a89a62c041cc7f7cff60c346e39722724e9319e5daf63fe9456ef3aebf7824d206d8270b0c62fb5c713219b3c21f4b5a6237c68ac1bcca89ec2265eae5122a8223d65972c318015c9ff9a180664eff66965b062529f46b12d060730aadbf561508d5f2a7da148d8adb6bffd8f6d7bbe0aed3117c7c75b7f0f5e00"/177, 0xb1)

[ 1824.300126][T15036] binder: 15030:15036 ioctl 541b 0 returned -22
[ 1824.304906][T15035] binder: 15032:15035 ioctl 541b 0 returned -22
[ 1824.380292][T15036] binder: 15030:15036 ioctl 541b 0 returned -22
06:41:52 executing program 3:
r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
mmap$fb(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x10, r0, 0x91000)

06:41:52 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x10, 0x0)
recvmsg$can_raw(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, <r1=>0xffffffffffffffff, {0x2, 0x0, @dev}}}, 0x80, &(0x7f0000000100)=[{&(0x7f00000000c0)}], 0x1, &(0x7f0000000140)=""/55, 0x37}, 0x0)
sendmsg$IPVS_CMD_GET_INFO(r1, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x24, 0x0, 0x800, 0x70bd28, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x3}]}, 0x24}, 0x1, 0x0, 0x0, 0x4981}, 0x24000000)

06:41:52 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
openat$zero(0xffffffffffffff9c, &(0x7f0000000040), 0x80200, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x541b, 0x0)

06:41:52 executing program 5:
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000040)={<r0=>0x0})
ioctl$DRM_IOCTL_LOCK(0xffffffffffffffff, 0x4008642a, &(0x7f0000000080)={r0, 0x10})
r1 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0x541b, 0x0)
r2 = syz_open_dev$binderN(&(0x7f00000000c0), 0x0, 0x6)
r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000480), 0x8800, 0x0)
r4 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000500), 0x109100, 0x0)
ioctl$FBIOPAN_DISPLAY(r4, 0x4606, &(0x7f0000000540)={0xc80, 0x1da0, 0x640, 0x40, 0x1, 0x6, 0x0, 0x0, {0x2, 0x75b, 0x1}, {0x9, 0x7}, {0x7, 0xfffffe01}, {0x1f, 0x3}, 0x1, 0x0, 0x88, 0x4, 0x0, 0x5de, 0x4d, 0xff, 0x7, 0x101, 0x6, 0x100, 0x28, 0x4, 0x2, 0x4})
ioctl$DRM_IOCTL_UNLOCK(r3, 0x4008642b, &(0x7f00000004c0)={r0, 0x2})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x54, 0x0, &(0x7f00000002c0)=[@decrefs, @decrefs={0x40046307, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000200)={@fda={0x66646185, 0x1, 0x2, 0xa}, @fda={0x66646185, 0x3, 0x0, 0x3a}, @ptr={0x70742a85, 0x1, &(0x7f0000000100)=""/236, 0xec, 0x0, 0x2e}}, &(0x7f0000000280)={0x0, 0x20, 0x40}}}], 0xe4, 0x0, &(0x7f0000000340)="e2e26f2cc357737c4ef27c1ab3eaba40719280725d05b7c45a8172225ee9a04150697856b35aff5535e300d38b55a2a5e3a94af45d3aee9864ebe66e59e5daeec447db4a2c9944af2e5f03e3528cb06d2dd8aed1bc0b3316e7e09675d6c1a2150e7ca698ba6620558c47458d1f69031b148e384662c63932933c949d07ea8dadaf4b89090f2ff8168d87023c6d2bfabe5d2ecad594688061493f4e02ea6ed41e50e1f439eda78b17de945377aaf8f28a56c83d9a88962cc41c44285052448e03d48a50e861cd7cfef1ae8cd8b6dd5539b7a0b897cc83d7a46b8c53896cc6cdc82563f9e4"})

06:41:52 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x500000000000000, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:52 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x202302, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)

[ 1824.913115][T15050] binder: 15049:15050 ioctl 541b 0 returned -22
[ 1824.948396][T15051] binder: 15047:15051 ioctl 541b 0 returned -22
[ 1824.985754][T15052] binder: 15048:15052 ioctl 10 0 returned -22
[ 1824.988904][T15053] binder: 15047:15053 ioctl 541b 0 returned -22
06:41:52 executing program 3:
r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
mmap$fb(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x10, r0, 0x91000)

06:41:52 executing program 5:
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000040)={<r0=>0x0})
ioctl$DRM_IOCTL_LOCK(0xffffffffffffffff, 0x4008642a, &(0x7f0000000080)={r0, 0x10})
r1 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0x541b, 0x0)
r2 = syz_open_dev$binderN(&(0x7f00000000c0), 0x0, 0x6)
r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000480), 0x8800, 0x0)
r4 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000500), 0x109100, 0x0)
ioctl$FBIOPAN_DISPLAY(r4, 0x4606, &(0x7f0000000540)={0xc80, 0x1da0, 0x640, 0x40, 0x1, 0x6, 0x0, 0x0, {0x2, 0x75b, 0x1}, {0x9, 0x7}, {0x7, 0xfffffe01}, {0x1f, 0x3}, 0x1, 0x0, 0x88, 0x4, 0x0, 0x5de, 0x4d, 0xff, 0x7, 0x101, 0x6, 0x100, 0x28, 0x4, 0x2, 0x4})
ioctl$DRM_IOCTL_UNLOCK(r3, 0x4008642b, &(0x7f00000004c0)={r0, 0x2})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x54, 0x0, &(0x7f00000002c0)=[@decrefs, @decrefs={0x40046307, 0x1}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000200)={@fda={0x66646185, 0x1, 0x2, 0xa}, @fda={0x66646185, 0x3, 0x0, 0x3a}, @ptr={0x70742a85, 0x1, &(0x7f0000000100)=""/236, 0xec, 0x0, 0x2e}}, &(0x7f0000000280)={0x0, 0x20, 0x40}}}], 0xe4, 0x0, &(0x7f0000000340)="e2e26f2cc357737c4ef27c1ab3eaba40719280725d05b7c45a8172225ee9a04150697856b35aff5535e300d38b55a2a5e3a94af45d3aee9864ebe66e59e5daeec447db4a2c9944af2e5f03e3528cb06d2dd8aed1bc0b3316e7e09675d6c1a2150e7ca698ba6620558c47458d1f69031b148e384662c63932933c949d07ea8dadaf4b89090f2ff8168d87023c6d2bfabe5d2ecad594688061493f4e02ea6ed41e50e1f439eda78b17de945377aaf8f28a56c83d9a88962cc41c44285052448e03d48a50e861cd7cfef1ae8cd8b6dd5539b7a0b897cc83d7a46b8c53896cc6cdc82563f9e4"})

06:41:52 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x800)
r1 = socket$xdp(0x2c, 0x3, 0x0)
r2 = accept4(r1, &(0x7f0000001280)=@l2={0x1f, 0x0, @fixed}, &(0x7f0000001300)=0x80, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r2, 0x11b, 0x5, 0x0, 0x0)
mmap$binder(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x4)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x541b, 0x0)

06:41:53 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000500)={{{@in6=@empty, @in6=@ipv4={""/10, ""/2, @local}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r1=>0x0}}, {{@in=@initdev}, 0x0, @in6=@initdev}}, &(0x7f0000000600)=0xe8)
clock_gettime(0x0, &(0x7f0000000140)={<r2=>0x0, <r3=>0x0})
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r4, 0x11b, 0x5, 0x0, 0x0)
ioctl$VIDIOC_QUERYBUF(0xffffffffffffffff, 0xc0585609, &(0x7f0000000180)={0x401, 0x1, 0x4, 0x400, 0x7fff, {r2, r3/1000+60000}, {0x4, 0xc, 0xff, 0x9, 0x0, 0x1, "583c4611"}, 0x5, 0x4, @fd=r4, 0x8})
r5 = openat$zero(0xffffffffffffff9c, &(0x7f0000000640), 0x400, 0x0)
getsockopt$inet6_mreq(r5, 0x29, 0x1b, &(0x7f0000000200)={@mcast2}, &(0x7f0000000240)=0x14)
r6 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r6, 0x11b, 0x5, 0x0, 0x0)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_tracing={0x1a, 0x4, &(0x7f0000000040)=@raw=[@ldst={0x1, 0x2, 0x0, 0x3, 0x7, 0x6, 0xffffffffffffffff}, @map_val={0x18, 0x8, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0xffff}, @ldst={0x1, 0x0, 0x3, 0x1, 0x3, 0x2, 0xfffffffffffffffc}], &(0x7f0000000080)='syzkaller\x00', 0x3, 0x3c, &(0x7f00000000c0)=""/60, 0x41000, 0x4, '\x00', r1, 0x17, r5, 0x8, &(0x7f0000000680)={0xa, 0x3}, 0x8, 0x10, &(0x7f00000006c0)={0x9, 0x0, 0x1ff, 0x1}, 0x10, 0x2036b, r6}, 0x78)
ioctl$BINDER_WRITE_READ(r0, 0x10, 0x0)

06:41:53 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x600000000000000, 0x0, 0x0, 0x0, 0x0, 0x0})

[ 1825.381520][T15062] binder: 15059:15062 ioctl 541b 0 returned -22
06:41:53 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
add_key$keyring(&(0x7f0000000040), &(0x7f00000000c0)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x82280, 0x0)

06:41:53 executing program 3:
openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
mmap$fb(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x2ba499d965695192, 0xffffffffffffffff, 0x91000)

06:41:53 executing program 5:
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000040)={<r0=>0x0})
ioctl$DRM_IOCTL_LOCK(0xffffffffffffffff, 0x4008642a, &(0x7f0000000080)={r0, 0x10})
r1 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0x541b, 0x0)
syz_open_dev$binderN(&(0x7f00000000c0), 0x0, 0x6)
r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000480), 0x8800, 0x0)
r3 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000500), 0x109100, 0x0)
ioctl$FBIOPAN_DISPLAY(r3, 0x4606, &(0x7f0000000540)={0xc80, 0x1da0, 0x640, 0x40, 0x1, 0x6, 0x0, 0x0, {0x2, 0x75b, 0x1}, {0x9, 0x7}, {0x7, 0xfffffe01}, {0x1f, 0x3}, 0x1, 0x0, 0x88, 0x4, 0x0, 0x5de, 0x4d, 0xff, 0x7, 0x101, 0x6, 0x100, 0x28, 0x4, 0x2, 0x4})
ioctl$DRM_IOCTL_UNLOCK(r2, 0x4008642b, &(0x7f00000004c0)={r0, 0x2})

[ 1825.727362][T15069] binder: 15065:15069 ioctl 10 0 returned -22
06:41:53 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000040), 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r0, 0x541b, 0x0)
syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x600102)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r1, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x70, r2, 0x300, 0x70bd27, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x10000, 0x35}}}}, [@NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x3}, @NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0x656}, @NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0x15}, @NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0xff}, @NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0xb46}, @NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0xbfa}, @NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0x831}, @NL80211_ATTR_CRIT_PROT_ID={0x6}, @NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6, 0xb4, 0x7e6}, @NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x6}]}, 0x70}, 0x1, 0x0, 0x0, 0x90}, 0x20004005)

06:41:53 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x700000000000000, 0x0, 0x0, 0x0, 0x0, 0x0})

[ 1825.958934][T15078] binder: 15075:15078 ioctl 541b 0 returned -22
06:41:53 executing program 1:
ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000040), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x10, 0x0)

06:41:53 executing program 3:
openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
mmap$fb(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x2ba499d965695192, 0xffffffffffffffff, 0x91000)

06:41:53 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
write$fb(r0, &(0x7f0000000000)="bc630a156048d1a6d4b9cf1b8560a1b69557deaeb9cfef4da4ba92b4211fb1138bf297b791c560233cdbdbb9f72bd0bffc", 0x31)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r1, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), r1)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)

[ 1826.194814][T15082] binder: 15081:15082 ioctl 541b 0 returned -22
[ 1826.273335][T15082] binder: 15081:15082 ioctl 541b 0 returned -22
06:41:54 executing program 5:
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000040)={<r0=>0x0})
ioctl$DRM_IOCTL_LOCK(0xffffffffffffffff, 0x4008642a, &(0x7f0000000080)={r0, 0x10})
r1 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0x541b, 0x0)
syz_open_dev$binderN(&(0x7f00000000c0), 0x0, 0x6)
openat$zero(0xffffffffffffff9c, &(0x7f0000000480), 0x8800, 0x0)
r2 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000500), 0x109100, 0x0)
ioctl$FBIOPAN_DISPLAY(r2, 0x4606, &(0x7f0000000540)={0xc80, 0x1da0, 0x640, 0x40, 0x1, 0x6, 0x0, 0x0, {0x2, 0x75b, 0x1}, {0x9, 0x7}, {0x7, 0xfffffe01}, {0x1f, 0x3}, 0x1, 0x0, 0x88, 0x4, 0x0, 0x5de, 0x4d, 0xff, 0x7, 0x101, 0x6, 0x100, 0x28, 0x4, 0x2, 0x4})

[ 1826.486568][T15089] binder: 15087:15089 ioctl 10 0 returned -22
06:41:54 executing program 0:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0xc00)
r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, 0x0, 0x0)
r1 = syz_open_dev$binderN(&(0x7f0000000040), 0x0, 0x800)
ioctl$BINDER_WRITE_READ(r1, 0x541b, 0x0)

06:41:54 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x800000000000000, 0x0, 0x0, 0x0, 0x0, 0x0})

[ 1826.566530][T15093] binder: 15087:15093 ioctl 10 0 returned -22
06:41:54 executing program 3:
openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
mmap$fb(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x2ba499d965695192, 0xffffffffffffffff, 0x91000)

06:41:54 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)

[ 1826.767601][T15096] binder: 15095:15096 ioctl 541b 0 returned -22
06:41:54 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000040), 0x0, 0xc02)
ioctl$BINDER_WRITE_READ(r0, 0x10, 0x0)

[ 1826.820977][T15099] binder: 15097:15099 ioctl 541b 0 returned -22
[ 1826.846589][T15101] binder: 15097:15101 ioctl 541b 0 returned -22
06:41:54 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x900000000000000, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:54 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x541b, 0x0)
ioctl$BINDER_GET_NODE_INFO_FOR_REF(r0, 0xc018620c, &(0x7f0000000080)={0x1})
r1 = syz_open_dev$binderN(&(0x7f0000000040), 0x0, 0x2)
ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0)

06:41:54 executing program 5:
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000040)={<r0=>0x0})
ioctl$DRM_IOCTL_LOCK(0xffffffffffffffff, 0x4008642a, &(0x7f0000000080)={r0, 0x10})
r1 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0x541b, 0x0)
syz_open_dev$binderN(&(0x7f00000000c0), 0x0, 0x6)
openat$zero(0xffffffffffffff9c, &(0x7f0000000480), 0x8800, 0x0)
ioctl$FBIOPAN_DISPLAY(0xffffffffffffffff, 0x4606, &(0x7f0000000540)={0xc80, 0x1da0, 0x640, 0x40, 0x1, 0x6, 0x0, 0x0, {0x2, 0x75b, 0x1}, {0x9, 0x7}, {0x7, 0xfffffe01}, {0x1f, 0x3}, 0x1, 0x0, 0x88, 0x4, 0x0, 0x5de, 0x4d, 0xff, 0x7, 0x101, 0x6, 0x100, 0x28, 0x4, 0x2, 0x4})

[ 1827.230724][T15110] binder: 15109:15110 ioctl 10 0 returned -22
06:41:54 executing program 3:
r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
mmap$fb(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x2ba499d965695192, r0, 0x0)

06:41:55 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)
ioctl$vim2m_VIDIOC_G_FMT(0xffffffffffffffff, 0xc0d05604, &(0x7f00000000c0)={0x0, @raw_data="f93d0f7014ad74b32bae5453f44272230957f43a34f4f0ae0399bdcf07091cb3a9fc9e21c1dd344f53fe85f9adeeac96bab610e71abb2498b7b75751be00c7fa320d3ac877dd3a4ef3ecb8d2b85042637e302967dc148454e955465dbdaf3d9c093b17aa50da0291c26d2dafae4f5fd8b3c28a7efcca639f51e02d2a271ee0b290386109cf51c86d612775f08d594f6b931924a20d2afd3ad0358718a6089f0e5ff3c542b33404ee401f04023e5d3ed6c1639eb4f86e883f2d616a1bf8a74bce96adf17c117fe738"})

[ 1827.416561][T15115] binder: 15112:15115 ioctl 541b 0 returned -22
[ 1827.468456][T15116] binder: 15113:15116 ioctl 541b 0 returned -22
[ 1827.476857][T15117] binder: 15112:15117 ioctl c018620c 20000080 returned -1
06:41:55 executing program 1:
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000040)={{{@in=@private, @in=@multicast1}}, {{@in=@multicast2}, 0x0, @in6=@private0}}, &(0x7f0000000140)=0xe8)
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x10, 0x0)

[ 1827.530438][T15115] binder: 15112:15115 ioctl 541b 0 returned -22
[ 1827.538431][T15117] binder: 15112:15117 ioctl c018620c 20000080 returned -1
06:41:55 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0xa00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:55 executing program 5:
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000040)={<r0=>0x0})
ioctl$DRM_IOCTL_LOCK(0xffffffffffffffff, 0x4008642a, &(0x7f0000000080)={r0, 0x10})
r1 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0x541b, 0x0)
syz_open_dev$binderN(&(0x7f00000000c0), 0x0, 0x6)
openat$zero(0xffffffffffffff9c, &(0x7f0000000480), 0x8800, 0x0)
ioctl$FBIOPAN_DISPLAY(0xffffffffffffffff, 0x4606, &(0x7f0000000540)={0xc80, 0x1da0, 0x640, 0x40, 0x1, 0x6, 0x0, 0x0, {0x2, 0x75b, 0x1}, {0x9, 0x7}, {0x7, 0xfffffe01}, {0x1f, 0x3}, 0x1, 0x0, 0x88, 0x4, 0x0, 0x5de, 0x4d, 0xff, 0x7, 0x101, 0x6, 0x100, 0x28, 0x4, 0x2, 0x4})

06:41:55 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x2)
r1 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0xc02)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f00000000c0)={0x3})
ioctl$BINDER_WRITE_READ(r0, 0x541b, 0x0)
ioctl$BINDER_GET_NODE_INFO_FOR_REF(0xffffffffffffffff, 0xc018620c, &(0x7f0000000040)={0x2})

[ 1827.839369][T15126] binder: 15125:15126 ioctl 10 0 returned -22
06:41:55 executing program 3:
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000040)={<r0=>0x0})
ioctl$DRM_IOCTL_LOCK(0xffffffffffffffff, 0x4008642a, &(0x7f0000000080)={r0, 0x10})
r1 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0x541b, 0x0)
syz_open_dev$binderN(&(0x7f00000000c0), 0x0, 0x6)
openat$zero(0xffffffffffffff9c, &(0x7f0000000480), 0x8800, 0x0)
r2 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000500), 0x109100, 0x0)
ioctl$FBIOPAN_DISPLAY(r2, 0x4606, &(0x7f0000000540)={0xc80, 0x1da0, 0x640, 0x40, 0x1, 0x6, 0x0, 0x0, {0x2, 0x75b, 0x1}, {0x9, 0x7}, {0x7, 0xfffffe01}, {0x1f, 0x3}, 0x1, 0x0, 0x88, 0x4, 0x0, 0x5de, 0x4d, 0xff, 0x7, 0x101, 0x6, 0x100, 0x28, 0x4, 0x2, 0x4})

06:41:55 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)
openat$fb1(0xffffffffffffff9c, &(0x7f0000000000), 0x100, 0x0)

[ 1828.102301][T15132] binder: 15130:15132 ioctl 541b 0 returned -22
[ 1828.135744][T15133] binder: 15131:15133 ioctl 541b 0 returned -22
06:41:55 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x10, 0x0)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
clock_gettime(0x0, &(0x7f0000000040)={<r2=>0x0, <r3=>0x0})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000140))
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r4, 0x11b, 0x5, 0x0, 0x0)
r5 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r5, 0x11b, 0x5, 0x0, 0x0)
ioctl$VIDIOC_QUERYBUF(r1, 0xc0585609, &(0x7f0000000080)={0xffff, 0x7, 0x4, 0x400, 0x80000000, {r2, r3/1000+60000}, {0x2, 0x8, 0x3, 0x7, 0x5, 0x0, "29c98a96"}, 0x1ff, 0x2, @fd=r4, 0x2, 0x0, r5})

06:41:55 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0xb00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0})

[ 1828.210361][T15133] binder: 15131:15133 ioctl 541b 0 returned -22
[ 1828.275572][T15136] binder: 15134:15136 ioctl 541b 0 returned -22
06:41:56 executing program 5:
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000040)={<r0=>0x0})
ioctl$DRM_IOCTL_LOCK(0xffffffffffffffff, 0x4008642a, &(0x7f0000000080)={r0, 0x10})
r1 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0x541b, 0x0)
syz_open_dev$binderN(&(0x7f00000000c0), 0x0, 0x6)
openat$zero(0xffffffffffffff9c, &(0x7f0000000480), 0x8800, 0x0)
ioctl$FBIOPAN_DISPLAY(0xffffffffffffffff, 0x4606, &(0x7f0000000540)={0xc80, 0x1da0, 0x640, 0x40, 0x1, 0x6, 0x0, 0x0, {0x2, 0x75b, 0x1}, {0x9, 0x7}, {0x7, 0xfffffe01}, {0x1f, 0x3}, 0x1, 0x0, 0x88, 0x4, 0x0, 0x5de, 0x4d, 0xff, 0x7, 0x101, 0x6, 0x100, 0x28, 0x4, 0x2, 0x4})

06:41:56 executing program 0:
r0 = shmget$private(0x0, 0x4000, 0x4, &(0x7f0000ffb000/0x4000)=nil)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
r1 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0x541b, 0x0)
ioctl$SNDCTL_SEQ_NRSYNTHS(0xffffffffffffffff, 0x8004510a, &(0x7f00000000c0))
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x1001, 0x3})
r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080), 0x665eb4fec202797c, 0x0)
ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f0000000100)={0x3})
shmctl$SHM_UNLOCK(r0, 0xc)

06:41:56 executing program 3:
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000040)={<r0=>0x0})
ioctl$DRM_IOCTL_LOCK(0xffffffffffffffff, 0x4008642a, &(0x7f0000000080)={r0, 0x10})
r1 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0x541b, 0x0)
syz_open_dev$binderN(&(0x7f00000000c0), 0x0, 0x6)
openat$zero(0xffffffffffffff9c, &(0x7f0000000480), 0x8800, 0x0)
r2 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000500), 0x109100, 0x0)
ioctl$FBIOPAN_DISPLAY(r2, 0x4606, &(0x7f0000000540)={0xc80, 0x1da0, 0x640, 0x40, 0x1, 0x6, 0x0, 0x0, {0x2, 0x75b, 0x1}, {0x9, 0x7}, {0x7, 0xfffffe01}, {0x1f, 0x3}, 0x1, 0x0, 0x88, 0x4, 0x0, 0x5de, 0x4d, 0xff, 0x7, 0x101, 0x6, 0x100, 0x28, 0x4, 0x2, 0x4})

06:41:56 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
ioctl$FBIOPUTCMAP(r1, 0x4605, &(0x7f0000000140)={0x400, 0x2, &(0x7f0000000000)=[0x0, 0x400], &(0x7f0000000040)=[0x100], &(0x7f00000000c0)=[0x1, 0x80, 0x7, 0x0], &(0x7f0000000100)=[0x6, 0x1, 0x9, 0x200, 0x5, 0x55, 0x8001, 0x4, 0x2]})
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)

[ 1828.618261][T15144] binder: 15141:15144 ioctl 10 0 returned -22
[ 1828.689519][T15144] binder: 15141:15144 ioctl 10 0 returned -22
[ 1828.746446][T15148] binder: 15145:15148 ioctl 541b 0 returned -22
06:41:56 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0xc00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0})

[ 1828.849336][T15150] binder: 15149:15150 ioctl 541b 0 returned -22
[ 1828.912044][T15150] binder: 15149:15150 ioctl c018620c 20000100 returned -22
[ 1828.950069][T15153] binder: 15151:15153 ioctl 541b 0 returned -22
06:41:56 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x10, 0x0)
syz_open_dev$binderN(&(0x7f0000000040), 0x0, 0x2)

[ 1828.988462][T15150] binder: 15149:15150 ioctl 541b 0 returned -22
[ 1829.022505][T15156] binder: 15149:15156 ioctl c018620c 20000100 returned -22
06:41:56 executing program 5:
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000040)={<r0=>0x0})
ioctl$DRM_IOCTL_LOCK(0xffffffffffffffff, 0x4008642a, &(0x7f0000000080)={r0, 0x10})
r1 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0x541b, 0x0)
syz_open_dev$binderN(&(0x7f00000000c0), 0x0, 0x6)
r2 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000500), 0x109100, 0x0)
ioctl$FBIOPAN_DISPLAY(r2, 0x4606, &(0x7f0000000540)={0xc80, 0x1da0, 0x640, 0x40, 0x1, 0x6, 0x0, 0x0, {0x2, 0x75b, 0x1}, {0x9, 0x7}, {0x7, 0xfffffe01}, {0x1f, 0x3}, 0x1, 0x0, 0x88, 0x4, 0x0, 0x5de, 0x4d, 0xff, 0x7, 0x101, 0x6, 0x100, 0x28, 0x4, 0x2, 0x4})

06:41:56 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x4000, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
ioctl$FBIOPUT_CON2FBMAP(r1, 0x4610, &(0x7f0000000000)={0x21, 0x2})

06:41:56 executing program 3:
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000040)={<r0=>0x0})
ioctl$DRM_IOCTL_LOCK(0xffffffffffffffff, 0x4008642a, &(0x7f0000000080)={r0, 0x10})
r1 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0x541b, 0x0)
syz_open_dev$binderN(&(0x7f00000000c0), 0x0, 0x6)
openat$zero(0xffffffffffffff9c, &(0x7f0000000480), 0x8800, 0x0)
r2 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000500), 0x109100, 0x0)
ioctl$FBIOPAN_DISPLAY(r2, 0x4606, &(0x7f0000000540)={0xc80, 0x1da0, 0x640, 0x40, 0x1, 0x6, 0x0, 0x0, {0x2, 0x75b, 0x1}, {0x9, 0x7}, {0x7, 0xfffffe01}, {0x1f, 0x3}, 0x1, 0x0, 0x88, 0x4, 0x0, 0x5de, 0x4d, 0xff, 0x7, 0x101, 0x6, 0x100, 0x28, 0x4, 0x2, 0x4})

06:41:56 executing program 0:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x1002)
r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = socket$inet6_mptcp(0xa, 0x1, 0x106)
setsockopt$inet6_tcp_TLS_TX(r1, 0x6, 0x1, &(0x7f00000000c0)=@ccm_128={{}, "799c237bda7853a6", "17c0c3278a81638e383a0872e91b7333", "ea14f077", "49c702c7944a4506"}, 0x28)
setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, 0x0, 0x0)
r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r2, 0x11b, 0x5, 0x0, 0x0)
syz_open_dev$binderN(&(0x7f0000000040), 0x0, 0x800)
r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, 0x0, 0x0)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r4, 0x11b, 0x5, 0x0, 0x0)
r5 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r5, 0x11b, 0x5, 0x0, 0x0)
r6 = syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x800)
ioctl$BINDER_WRITE_READ(r6, 0x541b, 0x0)

[ 1829.333415][T15163] binder: 15161:15163 ioctl 10 0 returned -22
[ 1829.387767][T15163] binder: 15161:15163 ioctl 10 0 returned -22
[ 1829.390801][T15164] binder: 15162:15164 ioctl 541b 0 returned -22
06:41:57 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0xd00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0})

[ 1829.564503][T15170] binder: 15168:15170 ioctl 541b 0 returned -22
06:41:57 executing program 1:
recvmsg$can_bcm(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000140)=""/149, 0x95}], 0x1, &(0x7f0000000240)=""/226, 0xe2}, 0x20)
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
ioctl$IOC_PR_PREEMPT(r1, 0x401870cb, &(0x7f0000000040)={0x81, 0x1, 0xc9e, 0x8000})
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000000c0)={0x3})
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x1, 0x1})
ioctl$BINDER_WRITE_READ(r0, 0x10, 0x0)

[ 1829.682493][T15173] binder: 15171:15173 ioctl 541b 0 returned -22
06:41:57 executing program 5:
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000040)={<r0=>0x0})
ioctl$DRM_IOCTL_LOCK(0xffffffffffffffff, 0x4008642a, &(0x7f0000000080)={r0, 0x10})
r1 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0x541b, 0x0)
r2 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000500), 0x109100, 0x0)
ioctl$FBIOPAN_DISPLAY(r2, 0x4606, &(0x7f0000000540)={0xc80, 0x1da0, 0x640, 0x40, 0x1, 0x6, 0x0, 0x0, {0x2, 0x75b, 0x1}, {0x9, 0x7}, {0x7, 0xfffffe01}, {0x1f, 0x3}, 0x1, 0x0, 0x88, 0x4, 0x0, 0x5de, 0x4d, 0xff, 0x7, 0x101, 0x6, 0x100, 0x28, 0x4, 0x2, 0x4})

06:41:57 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f00000001c0), 0x280200, 0x0)
mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1000000, 0x110, 0xffffffffffffffff, 0x0)
socket$inet6_mptcp(0xa, 0x1, 0x106)
r1 = socket(0xa, 0x803, 0x7f)
syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r1)
r2 = socket(0xa, 0x803, 0x7f)
syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r2)
getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000200)={{{@in=@loopback, @in6=@loopback}}, {{@in6=@private1}, 0x0, @in6=@mcast1}}, &(0x7f0000000000)=0x137)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)
r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
getsockopt$XDP_STATISTICS(r2, 0x11b, 0x7, &(0x7f0000000040), &(0x7f0000000080)=0x30)
setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, 0x0, 0x0)
ioctl$IOC_PR_PREEMPT(r3, 0x401870cb, &(0x7f0000000180)={0x4, 0x3, 0x7, 0x3})

06:41:57 executing program 3:
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000040)={<r0=>0x0})
ioctl$DRM_IOCTL_LOCK(0xffffffffffffffff, 0x4008642a, &(0x7f0000000080)={r0, 0x10})
r1 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0x541b, 0x0)
syz_open_dev$binderN(&(0x7f00000000c0), 0x0, 0x6)
openat$zero(0xffffffffffffff9c, &(0x7f0000000480), 0x8800, 0x0)
ioctl$FBIOPAN_DISPLAY(0xffffffffffffffff, 0x4606, &(0x7f0000000540)={0xc80, 0x1da0, 0x640, 0x40, 0x1, 0x6, 0x0, 0x0, {0x2, 0x75b, 0x1}, {0x9, 0x7}, {0x7, 0xfffffe01}, {0x1f, 0x3}, 0x1, 0x0, 0x88, 0x4, 0x0, 0x5de, 0x4d, 0xff, 0x7, 0x101, 0x6, 0x100, 0x28, 0x4, 0x2, 0x4})

06:41:57 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_GET_SCAN(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r1, 0x300, 0x70bd2d, 0x25dfdbfc, {{}, {@val={0x8}, @void}}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20024040}, 0x4044045)
ioctl$BINDER_WRITE_READ(r0, 0x541b, 0x0)
ioctl$vim2m_VIDIOC_S_CTRL(0xffffffffffffffff, 0xc008561c, &(0x7f0000000040)={0x7, 0xf33e})
r2 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_QUERYBUF(r2, 0xc0585609, &(0x7f0000000180)={0x0, 0x0, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "56850780"}})
ioctl$vim2m_VIDIOC_ENUM_FMT(r2, 0xc0405602, &(0x7f00000001c0)={0x8, 0x3, 0x3, "f6eed2b0ace9ac6f7964e9449d6d83dc40d7ce999ca44431aa48d2cbb8a68ab7", 0x584e4f53})

06:41:57 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0xe00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0})

[ 1830.067780][T15181] binder: 15178:15181 ioctl 10 0 returned -22
[ 1830.099930][T15182] binder: 15179:15182 ioctl 541b 0 returned -22
[ 1830.240349][T15188] binder: 15186:15188 ioctl 541b 0 returned -22
[ 1830.278966][T15190] binder: 15189:15190 ioctl 541b 0 returned -22
06:41:58 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
openat$fb1(0xffffffffffffff9c, &(0x7f00000000c0), 0x1010c0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)
openat$fb1(0xffffffffffffff9c, &(0x7f0000000000), 0x101101, 0x0)

[ 1830.361689][T15190] binder: 15189:15190 ioctl 541b 0 returned -22
06:41:58 executing program 5:
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000040)={<r0=>0x0})
ioctl$DRM_IOCTL_LOCK(0xffffffffffffffff, 0x4008642a, &(0x7f0000000080)={r0, 0x10})
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r1 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000500), 0x109100, 0x0)
ioctl$FBIOPAN_DISPLAY(r1, 0x4606, &(0x7f0000000540)={0xc80, 0x1da0, 0x640, 0x40, 0x1, 0x6, 0x0, 0x0, {0x2, 0x75b, 0x1}, {0x9, 0x7}, {0x7, 0xfffffe01}, {0x1f, 0x3}, 0x1, 0x0, 0x88, 0x4, 0x0, 0x5de, 0x4d, 0xff, 0x7, 0x101, 0x6, 0x100, 0x28, 0x4, 0x2, 0x4})

06:41:58 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000001080)={0x0}, 0x1, 0x0, 0x0, 0x840}, 0x20000885)
sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$DEVLINK_CMD_PORT_UNSPLIT(r1, &(0x7f0000000380)={&(0x7f00000001c0), 0xc, &(0x7f0000000340)={&(0x7f0000000480)={0x14, r2, 0x7ff}, 0x14}}, 0x0)
sendmsg$DEVLINK_CMD_PORT_UNSPLIT(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0xa8, r2, 0x300, 0x70bd28, 0x25dfdbfc, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}}, {{@pci={{0x8}, {0x11}}, {0x8}}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x1}}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x1}}}]}, 0xa8}, 0x1, 0x0, 0x0, 0x24000040}, 0x10)
r3 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0x10, 0x0)

06:41:58 executing program 0:
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x210440, 0x0)
ioctl$FBIOGET_VSCREENINFO(r0, 0x4600, &(0x7f0000000080))
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
write$fb(r1, &(0x7f0000000140)="bdfe68804867ace061c6b9e6ed3f81b6e6ec4be2d523cf6cfcf728a690cf8802a0b9b8056fe9aeb5705e6b131f657e4569f45d5e2ed67fecfc3de91155416484ce168d620ee91c1bd771cf34b9d21fa1a49e0404d8d62fcb87ef0184171ea7dc727b30abebdd5ee25c523dadf6916c228dc29af4e8ddb69b32bb7c8342883ba6ddbf6b498cc9594fdadcfacada0a4696edfe799a138f64d33afdb3ab5b241e6f3cb73e5dabfad04e9e58106269cfda6c6c515e14083975dd4960bfc8e46ff3145befd7c54cc91e09b711d04492ebf4c06ec1e96461e2876100944c77e70a503b5ef8263b8d5578e59ee0627008a55ab057b0d6704ef60f80ba4994a6ff28a95999a269354b3af0acb0cc62de2e9664d1c88104317317213ce9fd33cecf03a8b2b74cfa9436551c218b9fa54324d2e5ca265998e3a1e007992aa5f231f4cab0464a60029ebd38bdd4b93f40bf68d233ab46c5a7fa0def270e61882289e3aefc98a918d0becdb54b0f838a6e58d4d2e4a18e6fe916e6485754096486a597ea4e2c9d8d5814ada315101d6c5aeeabfdb3d5ada7a63b34ac5544f0115da083518f0b451e193d22cd252b7d4248fa90256dfa68de66a5d3bc9d01d567bf0a291a27fd2290ea613f39c802a20e6b35031fe490d6d7d8f1bdccaa7c3ed6801f24ddc3a315696ca4fa816f6bb4b263b874bd3d699184891f3d04795dfef51b506acc32e7ed4af3a9915705915fd53c6ed2285eb3694c86cc382cfb7482ac34abb093aaaf849e6313fee88928bf163a38dae838fad5a8d15db4bcbf29334a322567450f01398732a0062b23d6318887f5713a5e40abbcdaed1ff4113ec62cc6763f0821f1aaaf45ef61bacf89d51b6e10c86564e285f4faa6e29d214807ab30fe285dd5855b477559ff94fdc8b37477a60a1530b721faec87ea2c90124d077eb030108282ec3a0ab52550c72db5bf461672a3f333a94a22f2145199ac1b7ec660183801df7598895282329ef9531314b59b953db5bfbd85d23ef6d4fbbd1e92aebe3fc6c14f422064bb161b845938a15b296b73b1a18f0480335f55a968685dbfdc932c7a21cfe234190d5318b60f58841f45399f394c5ffbe306344ef21e9e20ddc53dbaa24012d3955735b28652f1c696a45419716d02c4f6854989bd0c8e21422b2497f3fce35eb32ca15d0a96ba3bcbc1f666b110f8819715abdd20c52e871e1a93f8e215f2252710a0c20a290af50ca4d9ea73aee1b90783f6b98608e93d1371181b2f808931fbfebeade8acef54d10d28fbdef42a1739072e286da5a66c70bb5c7a182499aac0a8014a518ec6e68263bbc947933417a44c5f29b5d8482ac46e3c9c4b7909f0a85f611d3789d69b32fdd9904f5fae6f9ada86a85dd9b8aca0eac1da4317d132755407f268180d3dab72147369f67d5511115b0b96b6d825adb876b8cfbbcd264d598ad2ebb162eee4498e95588774b6f0b70f2980751a819f47425b2f23ad9e35ac09d75d5d54a140c25613927a32cfa03fd37389067215a35a476a83dd12fd4665f1fe3c21c403df8095b51c7c1c21632d8aa05325e72508fda9e4b1a4ba89d99ca70bb35c3401af7dcefc4569e12b522284236e3fd4ba88b7535e88d6c2dfa190acb6d0c041c4264b6ceec300de3eedbb27f2f81ad2579ae00f6282119530425cde5fb0f49a17a6cffb0737f211b99ed1e7c776170506eea45565788d8396d174d5354424e8118f2951c291461feb8dc9a869c96788fef9078235d7c5b9ae0398a2391dd580c3c2d0a2e3d52f9fbc5f056654f9e6c93d4e2df400ae73aca2a6d93e11cbddcc4bc8a1eb2003f2ade178e706a650b1117b26e529032de2daf7e88eb0623c952bb616ddfd0219b4f6ec950aa7c7f6ef0b13e00683a556b3dfede6bbc42cab2a629b80170ce9fa875e465c9b0e5a669ae0a1960cfbb684feb0362eb74540b0abaa066b419ce33110a09d900deb9929527c11c7ed37713d573d768287d50b765f066b5fddd0c4cc8b9bb865eb1a69c25ee284ef4ae25feaa75f916b8f183188b3569d199047c0727a922c46ee3afe25df7bb8313ac8de1c291839c93f93f1f1800c11aac88ec81459468b1ac72d5b3e2e62fc82a74480421b771be94c779016b8bc590c2102612902ddf2b632c010dec341f07e1e4bba076ed95f64614fb7e3c0cd4ba109f73b94e38a50ef0502f3ea130791ba053d379a0ce25541da043d2f274d4478ff757963dc5174d16e370e3cf541cba0d8b7401aeae76b409cfc10df032db785f57aec9cd408f0ff41c75be3844f1054f7cfdca4c7aeac9fe76df90cc988c4eb24a1543ef9b4a0ed3ee0c6b5ca2d4a4eae9dcb07deafd54999e548f67ef4bdd41d01c9ec6f26ddb656fa5e12e875a9c5a74754a2df88e11d57e9568b8762c1048500fedb07c8c3bef5306c566fd85e9bc275f9652c036cc8edf9ee5a59e12b35ff370d48fd556a5c4e620231c53b95c9fe27179fd639e81cc77efe1c7ff28847ef950881205a65d6103e6fabe80f563a1b838572be331f4f9491710579dae8c07a2582ad192777304b29c5cfe8c7bcf0f76f6fc9187a5bc5c43b4718d32497bb0bc7cf7ebaf7701fe944cea4b726464bfa344d3f1c8b550d74a854e3bcb8039b43bb8d70b9a74771a6f1f6f7a8417be57af628604877aec93d539238b0cf18b13f17d3ce51a92793a58dbdab1d44aeaa1428cf3618f09c2f9da01d5be18144274bb0b67ffdcb44dff160db380291d5c357c3577dcb5d0c997a83a6897484f6c1d29041dc0025e47c2cb150f06b28f8cd003b85fd8c3df77a0435e118017644a037a6a60906ca947ab3862340d76ba8196d7174658674d7f23159d86137309b7299c2f3a23a8f9ed33630415cff03e2d32a4e80afe1b2c5f4ef42c723028628e782dcf6ff05ea790e8993b65181310c22895842acc652f1b6c43d1a46dcfa72857ec083c90fa39423f22079757acfa73fff8c09ebf6d5e1bd977a5a86611032674e5c5e4f1c0f4287cd84871725ad3721e6fdc3fb4a180ba8c15ed5b7c4f4e285dcb58a0bea9966b4cc313da53f42891eef77b1e0b1a7ea0298e3bce5f861bcad208e8cac878cc20b67abdd129cac211dde8ccba167690be1dc0140de65b917ca3e445f2b85bb5c4e60d5662ad884d8ed90ae34088aacc5cbea26bd197830141d6e54797eb12d2a355bcaebac454bc4f23e03ad85b9dc142e5ffc7da135953fc51a365de48b642a2eec906bc1d7e1f642b9ed65d32a1cacf5bd8dbcc8bec00867d3292a8778a471ba255c9936fb6022eb5d7b42230371b3670777ee1032ad670c5997a13f0131af3f19c66edf8272c370ac955f5a02f8bf5ba2f03df868021696d5080e2a465bacf2fb07264396b84a4eebd4ce1d833c5ed7183f8900f20d6eb14769aadc23c24957d1862dbe7e81e4d9f44c7fa285465e2aef134910cad6fd95e5bff66bd721c6d4466687740b3fadb7e26dcea937dc9a36b4bb8f9acaa04864d96bfd8448aedab2d2d2f9e91fe19f91c066a4a8a233859aa1f20d17f9f1361805647c86b2b2406b58a8d2db5d26db29463e8a916f4e5dc7d67826cc2d8a7210a3f583ab50febc058e3a347f330a59978872b3284198fda4b19219e045cda2c8d2fbc966f80f99d9a70d7e27f1b78e08a25826b6c46f1e75f006749aad3f015991038549ed98eb67ed2bb8c57cdac6d47dcdfc27b3d823e199f228a6101de45d33a0379ae9a0ccf68ce34d3cfc4bd641e555b7efdd0b509c34c32a28cabea0cc2be1d3d408fd4be76acf900b32ff30f80a8915702e14790d95eccd0ab8f106639978158f461a6a514b6989c3e07215fc21efabec41b9df5e4fa0ede9853ea6fc1341bdebb8796467bb3bd3b44802c22f629c67479d54569c11a88abedd02667b474b728f4109e851ccdf984d59830f2590b6442e2e9cb4d94e158dca3d19d4fbb7d3ea111e315ac473b48ac2784fa7519d6e97ea145cdf9807cf199a394ad597dce89d39e49ee75d7a18bdf2651ebb337607045412beda83ff6526f75805d5fd5c1cd7d8e3efa57a40dbb2bae671323f5c3f883e2501c64b646accee5bbba0e00bdab1888bde070f7104b3ff87065f9e4b997362b69696898348ac0cfd04b2a96b0fdd30934ec675f9cdf92589ecaafd486e05d746bb64525f58e0c3b89a0b898fabc916a1dd5492d404cb4f7c7c62b3f9f9d2188706760c428861f2c6f608ea042f1af147eeabdb6575e383a1d08d92d0e25e412816507da7453cc6c2b7b309980d788b0ae6ac28223f66093fc2dc5bc8c6eef8d5a034d86515f063245618f5e486221c4ff571fa3fd68a9909ebd1b769867c21eeb8680e80024e5562c1b380bd9af2e098ef0fb26b00b8397bd8db95fd8190406d69398850882fb6e49b36c097f38eb6065329332bd140831e332f1c3be7ad462741b77bf266a8df445882d535e0ebd93ce207548598ea00f8b4532852bf03f3208983b9a28be5f9cc29cf329915ff6c71506f3e9701709ec48b0d550292c6a29fb2c3b67b6d68a7658b453b00cdb7f36f3223517e181e5c9d7e6f88578bd37defc5bfed84fcaadb6c61d995543193bbb853fc03ef90c55e3d9c38ee40bc1ff7fc988adf9e8f9ead41419db874a4b6663e73fdbb4d37506fc5f2afbd93ad7ea79f83f44114f0491efa462576d3dd55351340f17f41efd9d0d539533ae48f7263d52f53c09b2cbf10d7b0e8e4f92771349b5220244a53b7975725f0161c25e29034ee8c205af5be953be25423e17010d24955bb0568e8d68939f4c1c677dc21bc53bb2c7749b99c7e9df22ee6ef25f8cc7881052a2f7d29212eecaa2043ccca00351c7a0e239f33234bcd4b2f10f0f9e79207e6fdd25f7d4a17875c45399e69122a4cd36ea3bdf8c8a49a886a71d96aaa91442c04922e284e1897cba27b890bddf5357d87bc4b0679183d5f7a6309135e5bf7d530f238fc31e2ccff242ec7934a524fdd7f4b9b9cc263f046a3fd1eecb345c20d83ad98b52799eb3ee526797bfc22a2c65d132dfa0809d07c3e695cc42085f416c846e03fc59b5cf91e6fa5f5dc3b894c3408a3e1a0c7de24586afe80ba51810ab8367eb061e06442b8c65768994aecd0c76a87197a4e0b2e882394b0ec76e117af5fc0fffe58173d1ce9cf69e6727e2d201b584cfadf52e9a54c99f871b1c4b56c4ed452a6696eaa986d6b46e785e190852d7ed38ce2e26c68bb36ac62f045cee60fdcd8affb276349b0a0316650cb903786021662e64d48f439c8547065537fff40e44116fcd3b6c3511f2092eb48c01f6a3a0d6da79b6d0082666248bffc8a0220a64bff2d6b66b23a66fd34e7deb077bbd731c85bb1fe993a2e34049bc18d7481bc39614d70454835c4c08c65097889f1153f1ab2df273fb2de6ceb2e46f44476318998877859d3ca3cd9b4e544e19ac5f0bbac2674f24d4f0361ae30378c3cc4cd011f3dffcc651489f67d52dc61a848d42cf1a27e1db75d7dbea60d48a71dffbaf6de6cfec8c136a13b4f706a232b9fa8dff9447d8d10fa3e047c2664fd6f10f5282134338ccd35bffdcea0048450990ee429565152a3bfdea0e23aa506dbd9e4152ab1d2f8888d9dc6e1517c6528dccd7113914f4a44b9c1737bbc0cd1f9205c8b5056a714bfd05a84a72c92cbc9b8dc62de092bbaa6e849eb9814f073f09c945b3c5952bbb0cc4d6698643a0baea153ca96cc789b76a3334d8f3ccedc82d739224850b8f73837a3405e516e3031327a85defbd6dab622a06e52d1920d0ab81a6458b27d82a3c8bebb", 0x1000)
r2 = openat$fb1(0xffffffffffffff9c, &(0x7f0000001140), 0xd0acebddbcb3656a, 0x0)
ioctl$FBIOGET_CON2FBMAP(r2, 0x460f, &(0x7f0000001180)={0x30, 0x1})
r3 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r3, 0x541b, 0x0)

06:41:58 executing program 3:
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000040)={<r0=>0x0})
ioctl$DRM_IOCTL_LOCK(0xffffffffffffffff, 0x4008642a, &(0x7f0000000080)={r0, 0x10})
r1 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0x541b, 0x0)
syz_open_dev$binderN(&(0x7f00000000c0), 0x0, 0x6)
openat$zero(0xffffffffffffff9c, &(0x7f0000000480), 0x8800, 0x0)
ioctl$FBIOPAN_DISPLAY(0xffffffffffffffff, 0x4606, &(0x7f0000000540)={0xc80, 0x1da0, 0x640, 0x40, 0x1, 0x6, 0x0, 0x0, {0x2, 0x75b, 0x1}, {0x9, 0x7}, {0x7, 0xfffffe01}, {0x1f, 0x3}, 0x1, 0x0, 0x88, 0x4, 0x0, 0x5de, 0x4d, 0xff, 0x7, 0x101, 0x6, 0x100, 0x28, 0x4, 0x2, 0x4})

06:41:58 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x1000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0})

[ 1830.751844][T15199] binder: 15195:15199 ioctl 10 0 returned -22
[ 1830.790773][T15200] binder: 15195:15200 ioctl 10 0 returned -22
06:41:58 executing program 5:
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000040)={<r0=>0x0})
ioctl$DRM_IOCTL_LOCK(0xffffffffffffffff, 0x4008642a, &(0x7f0000000080)={r0, 0x10})
r1 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000500), 0x109100, 0x0)
ioctl$FBIOPAN_DISPLAY(r1, 0x4606, &(0x7f0000000540)={0xc80, 0x1da0, 0x640, 0x40, 0x1, 0x6, 0x0, 0x0, {0x2, 0x75b, 0x1}, {0x9, 0x7}, {0x7, 0xfffffe01}, {0x1f, 0x3}, 0x1, 0x0, 0x88, 0x4, 0x0, 0x5de, 0x4d, 0xff, 0x7, 0x101, 0x6, 0x100, 0x28, 0x4, 0x2, 0x4})

[ 1830.932594][T15205] binder: 15203:15205 ioctl 541b 0 returned -22
[ 1830.964616][T15206] binder: 15202:15206 ioctl 541b 0 returned -22
06:41:58 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x10, 0x0)
ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r1, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000040)={'wlan1\x00'})

06:41:58 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
r1 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000400), 0x80000, 0x0)
write$fb(r1, &(0x7f0000001640)="8ee995e9ae46a4410bce549fb0c63a021b9fd9c6bbb34e41a2d624897831ae3621804dd3950374ab45b4c2e86aee14afe2b83c09e17b671a8daaa8fcb5b9a875a6ffb6871888f0a7aa55506f284bd2a12f92787a6e60ac17c42bf7cba4bcc4dbcd06be1986607419d64487704ccc58cdbd1e121333bb6109532cdc0eed4ea7ef099ada3beb41c30fca62fe6394f79828b72295dd12712e8845f14fe78a", 0x9d)
ioctl$FBIOGET_FSCREENINFO(r0, 0x4602, &(0x7f00000015c0))
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)
r2 = socket(0xa, 0x803, 0x7f)
recvmsg$can_raw(r2, &(0x7f0000001580)={&(0x7f0000000000)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @initdev}}}, 0x80, &(0x7f0000001440)=[{&(0x7f00000000c0)=""/61, 0x3d}, {&(0x7f0000000100)=""/194, 0xc2}, {&(0x7f0000000200)=""/160, 0xa0}, {&(0x7f00000002c0)=""/169, 0xa9}, {&(0x7f0000000380)=""/117, 0x75}, {&(0x7f0000000400)}, {&(0x7f0000000440)=""/4096, 0x1000}], 0x7, &(0x7f00000014c0)=""/153, 0x99}, 0x10000)

[ 1831.109545][T15208] binder: 15202:15208 ioctl 541b 0 returned -22
06:41:58 executing program 3:
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000040)={<r0=>0x0})
ioctl$DRM_IOCTL_LOCK(0xffffffffffffffff, 0x4008642a, &(0x7f0000000080)={r0, 0x10})
r1 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0x541b, 0x0)
syz_open_dev$binderN(&(0x7f00000000c0), 0x0, 0x6)
openat$zero(0xffffffffffffff9c, &(0x7f0000000480), 0x8800, 0x0)
ioctl$FBIOPAN_DISPLAY(0xffffffffffffffff, 0x4606, &(0x7f0000000540)={0xc80, 0x1da0, 0x640, 0x40, 0x1, 0x6, 0x0, 0x0, {0x2, 0x75b, 0x1}, {0x9, 0x7}, {0x7, 0xfffffe01}, {0x1f, 0x3}, 0x1, 0x0, 0x88, 0x4, 0x0, 0x5de, 0x4d, 0xff, 0x7, 0x101, 0x6, 0x100, 0x28, 0x4, 0x2, 0x4})

06:41:59 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x1100000000000000, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:59 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000040), 0x0, 0x1002)
ioctl$BINDER_WRITE_READ(r0, 0x541b, 0x0)
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x802)

[ 1831.429569][T15217] binder: 15214:15217 ioctl 10 0 returned -22
06:41:59 executing program 5:
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000040))
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000500), 0x109100, 0x0)
ioctl$FBIOPAN_DISPLAY(r0, 0x4606, &(0x7f0000000540)={0xc80, 0x1da0, 0x640, 0x40, 0x1, 0x6, 0x0, 0x0, {0x2, 0x75b, 0x1}, {0x9, 0x7}, {0x7, 0xfffffe01}, {0x1f, 0x3}, 0x1, 0x0, 0x88, 0x4, 0x0, 0x5de, 0x4d, 0xff, 0x7, 0x101, 0x6, 0x100, 0x28, 0x4, 0x2, 0x4})

[ 1831.513507][T15217] binder: 15214:15217 ioctl 10 0 returned -22
[ 1831.531721][T15219] binder: 15218:15219 ioctl 541b 0 returned -22
06:41:59 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000000), 0x101000, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, &(0x7f0000000040)={0x1b, 0x2})
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)

[ 1831.721394][T15224] binder: 15222:15224 ioctl 541b 0 returned -22
[ 1831.742765][T15224] binder: 15222:15224 ioctl 541b 0 returned -22
06:41:59 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
write$fb(0xffffffffffffffff, &(0x7f0000000040)="79f1a899cda37ba010e0ec914bff4707164b4e3c554d712d57a778a35134b1b8254d58702f9638ed9e7c724e98659bbf07cc157589f308f5b51ecb0b6e47da761c6809a9336260ea168f271eb9ccc51e7b65b408e8a18f76cfcd33308d99586eaac1fc40a9b43cf0c23222c1b37fe778e69abe560d981ce518eb61eff58bc6a9279fd0517abad00662559a044376cbb7a48d6af5f49336f2277ba35b633a3c9bc62e15ecb12a90a0e805277e1cd48edf442f9f78490194d0f4b524d41bc1d8673016dabf07bc090632b2c49b8c2fd0079295a8f3bd2235ae043b4f8a0d57bf72391aaa", 0xe3)
ioctl$BINDER_WRITE_READ(r0, 0x10, 0x0)
ioctl$FBIOGET_CON2FBMAP(0xffffffffffffffff, 0x460f, &(0x7f0000000140)={0x25})

06:41:59 executing program 3:
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000040)={<r0=>0x0})
ioctl$DRM_IOCTL_LOCK(0xffffffffffffffff, 0x4008642a, &(0x7f0000000080)={r0, 0x10})
r1 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0x541b, 0x0)
syz_open_dev$binderN(&(0x7f00000000c0), 0x0, 0x6)
r2 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000500), 0x109100, 0x0)
ioctl$FBIOPAN_DISPLAY(r2, 0x4606, &(0x7f0000000540)={0xc80, 0x1da0, 0x640, 0x40, 0x1, 0x6, 0x0, 0x0, {0x2, 0x75b, 0x1}, {0x9, 0x7}, {0x7, 0xfffffe01}, {0x1f, 0x3}, 0x1, 0x0, 0x88, 0x4, 0x0, 0x5de, 0x4d, 0xff, 0x7, 0x101, 0x6, 0x100, 0x28, 0x4, 0x2, 0x4})

06:41:59 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x1200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0})

06:41:59 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), 0xffffffffffffffff)
sendmsg$NL80211_CMD_GET_MESH_CONFIG(r1, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010025bd7000ffdbdf251c0000000c009920000000004c000000"], 0x20}, 0x1, 0x0, 0x0, 0x80}, 0x8000)
ioctl$vim2m_VIDIOC_G_FMT(0xffffffffffffffff, 0xc0d05604, &(0x7f0000000040)={0x3, @win={{0x1002, 0x5d, 0x3ff, 0x10000}, 0x9, 0x9, &(0x7f00000001c0)={{0x9, 0x7, 0x2, 0x6}, &(0x7f0000000180)={{0x40, 0x200000, 0x6, 0x6}, &(0x7f0000000140)={{0x5, 0x1, 0x7, 0x759}}}}, 0x4, &(0x7f0000000200)="58db7bd80d3c992d23d91182135b3230ac048a7d4f76bfd34f4ae8e9758c83399511c2ded554ccd98e458ea244b8ea51247f18aea6052016239dc4a8273d181cecd4934a7909bc076df7b0a6052621f95ac78a95ef498cec00189e4c7793ae5cd41411d2efccbea07fc233cc2cb053058ffc3b1243ac506897bacf853376276c2a59d1cb62fea192bd598dfba8e694ca6dc8d51047b9df6672199fcd49f7593de17a8d8b9d2f0d832156976c3bf13397288234d91e9f588305b1116b16807f4f85849ad110174e4715ae5a01d3435bfde7fc8d941608757b0d8a5055aa2dc626bf0f3ef1afab577c8b843441387e", 0xf9}})
ioctl$BINDER_WRITE_READ(r0, 0x541b, 0x0)

06:41:59 executing program 5:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000500), 0x109100, 0x0)
ioctl$FBIOPAN_DISPLAY(r0, 0x4606, &(0x7f0000000540)={0xc80, 0x1da0, 0x640, 0x40, 0x1, 0x6, 0x0, 0x0, {0x2, 0x75b, 0x1}, {0x9, 0x7}, {0x7, 0xfffffe01}, {0x1f, 0x3}, 0x1, 0x0, 0x88, 0x4, 0x0, 0x5de, 0x4d, 0xff, 0x7, 0x101, 0x6, 0x100, 0x28, 0x4, 0x2, 0x4})

[ 1832.104084][T15235] binder: 15234:15235 ioctl 10 0 returned -22
[ 1832.134039][T15236] binder: 15232:15236 ioctl 541b 0 returned -22
[ 1832.182769][T15237] binder: 15234:15237 ioctl 10 0 returned -22
06:41:59 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000040), 0x1050c0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000001380)={0x58, 0x0, &(0x7f0000001200)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x18, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001180)={@ptr={0x70742a85, 0x1, &(0x7f0000000080)=""/225, 0xe1, 0x1, 0x33}, @ptr={0x70742a85, 0x0, &(0x7f0000000180)=""/4096, 0x1000, 0x2, 0x1c}, @flat=@weak_handle={0x77682a85, 0x100, 0x2}}, &(0x7f0000000000)={0x0, 0x28, 0x50}}}, @clear_death={0x400c630f, 0x2}, @exit_looper], 0xe5, 0x0, &(0x7f0000001280)="42d39ae04b520fb5591dc4a7169682c391da6f362a180297822f4036ed2d1115827205f91d2a11556d5a5531651ca4ee6943f9bb2b701663f8aeb3887ac92509204e432f9a3e453ce36fb8b5f1f600a003f6504afb5c446be8e6e46897e94089e3a6131d1ee559705e4740bf97bb873470c4117a4fbd6774fb4d02b20f0ee8206feb5b898ceea3f9e5e6fbe264321f166a8a9e4424ca703e95ad3ca96b891e1f2b51ff0cec508a1a9455eab60d7f502275971fc20720222ea5639bf2062f8d8808155249d99c8be6cc822fbb8354c43f192d8705f2aa93debe2ca51ea9152b25fd6dfa62ba"})

06:42:00 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000040)='/proc/asound/card2/oss_mixer\x00', 0x1, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x10, 0x0)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
ioctl$DRM_IOCTL_UNLOCK(r1, 0x4008642b, &(0x7f0000000080)={0x0, 0x1e})

[ 1832.406446][T15242] binder: 15238:15242 ioctl 541b 0 returned -22
06:42:00 executing program 3:
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000040)={<r0=>0x0})
ioctl$DRM_IOCTL_LOCK(0xffffffffffffffff, 0x4008642a, &(0x7f0000000080)={r0, 0x10})
r1 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0x541b, 0x0)
r2 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000500), 0x109100, 0x0)
ioctl$FBIOPAN_DISPLAY(r2, 0x4606, &(0x7f0000000540)={0xc80, 0x1da0, 0x640, 0x40, 0x1, 0x6, 0x0, 0x0, {0x2, 0x75b, 0x1}, {0x9, 0x7}, {0x7, 0xfffffe01}, {0x1f, 0x3}, 0x1, 0x0, 0x88, 0x4, 0x0, 0x5de, 0x4d, 0xff, 0x7, 0x101, 0x6, 0x100, 0x28, 0x4, 0x2, 0x4})

06:42:00 executing program 5:
r0 = openat$fb1(0xffffffffffffff9c, 0x0, 0x109100, 0x0)
ioctl$FBIOPAN_DISPLAY(r0, 0x4606, &(0x7f0000000540)={0xc80, 0x1da0, 0x640, 0x40, 0x1, 0x6, 0x0, 0x0, {0x2, 0x75b, 0x1}, {0x9, 0x7}, {0x7, 0xfffffe01}, {0x1f, 0x3}, 0x1, 0x0, 0x88, 0x4, 0x0, 0x5de, 0x4d, 0xff, 0x7, 0x101, 0x6, 0x100, 0x28, 0x4, 0x2, 0x4})

06:42:00 executing program 0:
ioctl$UFFDIO_COPY(0xffffffffffffffff, 0xc028aa03, &(0x7f0000000040)={&(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ff9000/0x4000)=nil, 0x3000, 0x1})
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x541b, 0x0)
r1 = syz_open_dev$vim2m(&(0x7f0000000080), 0x4, 0x2)
ioctl$vim2m_VIDIOC_CREATE_BUFS(r1, 0xc100565c, &(0x7f00000000c0)={0x0, 0x7, 0x1, {0x3, @sdr={0x30314742, 0x200}}, 0x2})

[ 1832.688278][T15249] binder: 15248:15249 ioctl 10 0 returned -22
06:42:00 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x2500000000000000, 0x0, 0x0, 0x0, 0x0, 0x0})

[ 1832.758190][T15252] binder: 15248:15252 ioctl 10 0 returned -22
[ 1832.758923][T15251] binder: 15250:15251 ioctl 541b 0 returned -22
06:42:00 executing program 2:
clock_gettime(0x4, &(0x7f0000000040))
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
r1 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x181, 0x0)
r2 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_QUERYBUF(r2, 0xc0585609, &(0x7f0000000180)={0x0, 0x0, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "56850780"}, 0x4})
ioctl$vim2m_VIDIOC_G_FMT(r2, 0xc0d05604, &(0x7f00000000c0)={0x2, @sdr={0xb5315241, 0x9}})
mmap$fb(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x4, 0x50, r1, 0xc2000)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)

[ 1832.987397][T15258] binder: 15256:15258 ioctl 541b 0 returned -22
[ 1833.041732][T15261] binder: 15256:15261 ioctl 541b 0 returned -22
06:42:00 executing program 3:
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000040)={<r0=>0x0})
ioctl$DRM_IOCTL_LOCK(0xffffffffffffffff, 0x4008642a, &(0x7f0000000080)={r0, 0x10})
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r1 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000500), 0x109100, 0x0)
ioctl$FBIOPAN_DISPLAY(r1, 0x4606, &(0x7f0000000540)={0xc80, 0x1da0, 0x640, 0x40, 0x1, 0x6, 0x0, 0x0, {0x2, 0x75b, 0x1}, {0x9, 0x7}, {0x7, 0xfffffe01}, {0x1f, 0x3}, 0x1, 0x0, 0x88, 0x4, 0x0, 0x5de, 0x4d, 0xff, 0x7, 0x101, 0x6, 0x100, 0x28, 0x4, 0x2, 0x4})

06:42:00 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x10, 0x0)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040), 0x80, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x10, 0x0, &(0x7f0000000080)=[@request_death={0x400c630e, 0x1}], 0xae, 0x0, &(0x7f00000000c0)="28551e8d696679b77332b6a2a4dff2dbe172fda107b01a74c75fb67f4aaef0fb6dc85e92b03cd461b39ac71457eda9f0a0eb533c7440c1a8d251c4b3b40e42da934fde428e32b4e631fafe1b6d8ce468171cdf3d80eafd111f7d9083eb46a701e2bf6b8f48f8c34bccde296a819fec4cdc4c89432211b983eda2b9839a65e17e10fd5db314e679732b33b8cb26dadff3039e231a48cf049fd489a51620e71ac49644e5a3207f30fd0b91b1138453"})

06:42:00 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x541b, 0x0)
ioctl$BINDER_GET_NODE_INFO_FOR_REF(r0, 0xc018620c, &(0x7f00000000c0)={0x1})
openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x2000, 0x0)

06:42:00 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x5c00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0})

06:42:01 executing program 5:
r0 = openat$fb1(0xffffffffffffff9c, 0x0, 0x109100, 0x0)
ioctl$FBIOPAN_DISPLAY(r0, 0x4606, &(0x7f0000000540)={0xc80, 0x1da0, 0x640, 0x40, 0x1, 0x6, 0x0, 0x0, {0x2, 0x75b, 0x1}, {0x9, 0x7}, {0x7, 0xfffffe01}, {0x1f, 0x3}, 0x1, 0x0, 0x88, 0x4, 0x0, 0x5de, 0x4d, 0xff, 0x7, 0x101, 0x6, 0x100, 0x28, 0x4, 0x2, 0x4})

06:42:01 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)
socket$xdp(0x2c, 0x3, 0x0)

[ 1833.515321][T15269] binder: 15268:15269 ioctl 10 0 returned -22
[ 1833.581348][T15269] binder: 15268:15269 ioctl 10 0 returned -22
[ 1833.598335][T15274] binder: 15270:15274 ioctl 541b 0 returned -22
06:42:01 executing program 3:
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000040)={<r0=>0x0})
ioctl$DRM_IOCTL_LOCK(0xffffffffffffffff, 0x4008642a, &(0x7f0000000080)={r0, 0x10})
r1 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000500), 0x109100, 0x0)
ioctl$FBIOPAN_DISPLAY(r1, 0x4606, &(0x7f0000000540)={0xc80, 0x1da0, 0x640, 0x40, 0x1, 0x6, 0x0, 0x0, {0x2, 0x75b, 0x1}, {0x9, 0x7}, {0x7, 0xfffffe01}, {0x1f, 0x3}, 0x1, 0x0, 0x88, 0x4, 0x0, 0x5de, 0x4d, 0xff, 0x7, 0x101, 0x6, 0x100, 0x28, 0x4, 0x2, 0x4})

[ 1833.657460][T15278] binder: 15270:15278 ioctl c018620c 200000c0 returned -1
[ 1833.749385][T15274] binder: 15270:15274 ioctl 541b 0 returned -22
[ 1833.759052][T15278] binder: 15270:15278 ioctl c018620c 200000c0 returned -1
06:42:01 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x800)
ioctl$BINDER_WRITE_READ(r0, 0x10, 0x0)

06:42:01 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0xfdfdffff00000000, 0x0, 0x0, 0x0, 0x0, 0x0})

06:42:01 executing program 5:
r0 = openat$fb1(0xffffffffffffff9c, 0x0, 0x109100, 0x0)
ioctl$FBIOPAN_DISPLAY(r0, 0x4606, &(0x7f0000000540)={0xc80, 0x1da0, 0x640, 0x40, 0x1, 0x6, 0x0, 0x0, {0x2, 0x75b, 0x1}, {0x9, 0x7}, {0x7, 0xfffffe01}, {0x1f, 0x3}, 0x1, 0x0, 0x88, 0x4, 0x0, 0x5de, 0x4d, 0xff, 0x7, 0x101, 0x6, 0x100, 0x28, 0x4, 0x2, 0x4})

06:42:01 executing program 2:
ioctl$vim2m_VIDIOC_QUERYCAP(0xffffffffffffffff, 0x80685600, &(0x7f0000000180))
r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x12003, 0x0)
setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f00000000c0)=0x1000000, 0x4)
ioctl$FBIOGET_VSCREENINFO(r0, 0x4600, 0xfffffffffffffffd)
r1 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x214000, 0x0)
mmap$xdp(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x8, 0x104990, r2, 0x100000000)
ioctl$UFFDIO_WAKE(r0, 0x8010aa02, &(0x7f0000000040)={&(0x7f0000ffa000/0x4000)=nil, 0x4000})
ioctl$FBIOGET_CON2FBMAP(r1, 0x460f, 0x0)

06:42:01 executing program 0:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, 0x0, 0x0)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0x541b, 0x0)

06:42:01 executing program 3:
ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000040))
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000500), 0x109100, 0x0)
ioctl$FBIOPAN_DISPLAY(r0, 0x4606, &(0x7f0000000540)={0xc80, 0x1da0, 0x640, 0x40, 0x1, 0x6, 0x0, 0x0, {0x2, 0x75b, 0x1}, {0x9, 0x7}, {0x7, 0xfffffe01}, {0x1f, 0x3}, 0x1, 0x0, 0x88, 0x4, 0x0, 0x5de, 0x4d, 0xff, 0x7, 0x101, 0x6, 0x100, 0x28, 0x4, 0x2, 0x4})

[ 1834.190021][T15289] binder: 15286:15289 ioctl 10 0 returned -22
06:42:02 executing program 5:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0)
ioctl$FBIOPAN_DISPLAY(r0, 0x4606, &(0x7f0000000540)={0xc80, 0x1da0, 0x640, 0x40, 0x1, 0x6, 0x0, 0x0, {0x2, 0x75b, 0x1}, {0x9, 0x7}, {0x7, 0xfffffe01}, {0x1f, 0x3}, 0x1, 0x0, 0x88, 0x4, 0x0, 0x5de, 0x4d, 0xff, 0x7, 0x101, 0x6, 0x100, 0x28, 0x4, 0x2, 0x4})

06:42:02 executing program 1:
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x10, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)

06:42:02 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0xff00000000000000, 0x0, 0x0, 0x0, 0x0, 0x0})

06:42:02 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x410241, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)

06:42:02 executing program 0:
r0 = shmget(0x0, 0x9000, 0x800, &(0x7f0000ff4000/0x9000)=nil)
shmctl$IPC_INFO(r0, 0x3, &(0x7f0000000240)=""/56)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r1, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
sendmsg$IPVS_CMD_SET_SERVICE(r1, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000001c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="d0000000", @ANYRES16=0x0, @ANYBLOB="00032abd7000fbdbdf2502000000340003800800010002000000140006002001000000000000000000000000000114000600000000000000000000000000000000014c001d80060007004a200000080003000200000014000200626f6e6430000000000000000008000008000500e00000021400020063616966300000000000000000000000060007004e2400003c0003801400020076657468305f746f5f7465616d000000060007004e2400656e6576653000"/202], 0xd0}, 0x1, 0x0, 0x0, 0x8002}, 0x80)
add_key$user(0x0, &(0x7f00000002c0)={'syz', 0x2}, &(0x7f0000001600)="f699d6aa9f578036c8b8ce136d5b89ccfbe931eb4ef67c2cf6c86a4cfb154a05cd121f5be3c9ea50788878890a4f6e66eb6cc25016543a3cc5eff833e8e8106763edde12f53a7f9c9fe1fe7373e20abb9c31b9f5803e3edf5c0d0457240cd7b71d670501b86570762ecc5a102f8a5a50e758b4fa6b773f0a6bafa098df7aa3ed8189ccf54d0d428e98511b4e1e7e38395dd94512adcaa94bf80319d6aa36e109a0fd9ca04516da601e473d7a3bc825c3e363d119e31c1bc484e4bd83e0aa2d78230b2cd05b97fa58d34de6c967dd035d917c02fa37e41a7e78376de086fec7209ba82f0d3d52890ebb32a8c9b5beb0e6335be74007ebe2edaeb9d6c7e05a47a2b94ec6abb8fdac840f8c4a57ccd865d57b13b2b0e015e9bdfb44cfa64d6bc18fd9a28acaca87f43c39b0c1cb26298f346e243812b2f665dcccffda0e3b4d345f40d570aafdcf5d028d45e9c8417e30861f2d9647d607eb6c69709a802c799e15e8efc28753c53dab4d86de7edc317f17b8b8a4dbb0e19969dc19d57371e57955b783f440201e946fb69146e5b6bd13fa30198619e3e7133acca778c20d2859c61eff80cc731c282fb0d0dfc954320ae374aad4888a76bdc2db33f2b6c2e62d3d82d50dc6c240795f0f40846f8daf63adf40888ec464c2f2a871d6ac5ba8a3265b491aae778bcb7490e89915d6406770635d593a7142d422d53e81a585ce3596d7f7117ceb97b69a877ca41417dba5e2c2a6597c98143b40fed7e5cda5203ee9d5589b97b8d65fd43c92047a1f13f18e748f8b32b3dba1df65861f8fdb206055c758b2f439ea1f2e72b6c7c1f1bc9e38bba546d56369b461d254d2b9f0878352720f6d7359f563eb424378308dcb6459aff1adb117dd0f13473b7d2da9426374d2ad71488a49a3212f255a2dfc2e04c64c279d30a955a5b5a5eafc42fcdc72576e70f2b7b536383b21cca1aeba418e3f5f7d8f4000bb2fb843db52703d62cea274b7aab8ceefaedec8f354422401d36159536cf793e014be50fafd863ea319ce436c1fed6fa89dac77ba26c8843f2c4903ef9a457b22107b04c27603c9346101704d275d9beef8d60759063552182a63cd0508afaead53fed8d354d22ebab3382385635f3617b9c885dd348c4b85560801a5883f15fa8e4767a3701ce9fb95fb38f7705f17dc6c8d928002aaebc62ed38b75dcc372e808ea1a102335d79626c9dd981002553e22055aa70a4f8776d4db13ad3a7b74b891439f8f4ded1749e461f3c89e4a699720c2be43483f803245aa67262e9c67e0a77fe11cc63dd2df73f8c3a3324d1d9f25de8a0477705aefe4d45a37d5702833fd0ed22b74b4764422ecce5ba5f48c6495d490a1b3403355644a2e0f0555c6d8763ca0564a8b508b973ee988977f097d371017655948f20fd2bcdfdbddae1bd0dc4a66ff3657ab09cb8e28fbfc61773db51b8802cf1b56f9e2a84c2d85bff507bb269946746253c4ebf2911dd174d3b64344f2e11a4dbd14f58278bc0437c4090a623a5c798024eebbb1411c440fbad17f1f2ff0c9466d416bf9588221f1a1ec0f41cc14358879115cf6ca9cf2c85b29729056be343b018d88f9702714a816908f20dd4064bf7fb660ba33af44e351d49cddd5a4095cf108c858e17efb52260b668648ddc3136fe0880d032a2a5886871f1a36b8eeb7ea71182fae1a7895a6c20108335cbe77f7ee3256e3b7bb3f658c1f3f424a6c027fea9dc2de6c1cbdd18b77dd000ddf6c82a6da36e7af478faf7a09a561fa8446b95541e36676c930c4bf22dd0b03a856256457412dc29382e4441c0e0708adf0a939492b0bb84c0d1c96f608e6da830c7e159c675ff6d644af93d68419fd88a874373635460e157554f864943fe07758e0c6e338fe889973d051a5821c6124fdcf5127cfa0eb61bf31db4c73e1a604828ace52ec368fefbdd0aac2169ac24997a093851a0bc34c9165af284b73ab8052f5c4b5ac7ed3864acfd05904fe11dcb034d5ce625fcbde5aedd02bf48145b0e3588704014061ce132e929909164b88aed98ec41382efed9d309f71392a59fec65e113ae5b7ce1cddd3c8d76baf3dac35eedcb946041e333ff806cfbece9037734c545c819b7cb67644f24e3610484d5f9ed851316d063bbf7046e9fab2283867162d5e159698b3d6dffa9dbcd1828403460a48a1890332bbc6d142ee398bbd1444dc160786a1bcc861b27b86baaa2ac661d25fca66655cad2d15d086ea5478e9241b661fcded7d1ee28c088c0999296968c373b314cc26a544ac9c1c7152b8d0079adf50cb9d5cd8fce6f6d486b0b15b7c7d669f19bc3fd4b59bc15b6d1f34ad5c8c961637ed382047a8f41b3c9df94d77eb472e58831b4a43da3293617792019ef0970f8ea3cb993c5cff4bf54a9c1e34c4805c8372637fff3de4551d4bd3f1c026858eb075a838c6a33fd7e75e950043d70abb1ccc66336e52e9b4ac13ed2bec5f96fcf548f1850494d4a552c7fd388c14bd4df086dedc71bb888703e36bad4026e5545b876eb2368f6110a390e012d82e5cfc300f3e6aa8d0f2c1198ffa8be178612c693432a837d6109538958e3d0ed2aef463936f8e53e98f7b948a06bd6d3c193769ade4fc1726cb32816e9b324e75fecc96971e41ce1569038fb1ff5ecdc0049185a85f1af950baa3151f43620940c5db19079a797ff2efedbf09bd2f6118d4c695e000ef789c2fdb48f5b7a8d482c1dc144d529d18bc4d240ba3e6ea045b2435a6f1f6ebabf95c5ef486756152c6b037fae0630d7488d0e0e1f9cd16ec87b0b6dc6330441ac1448f2766d37495454091520d170dd7fefea38377b19ac4f983898e93173603c757e7c688c42201bac1f6b8d3a3ef55208955fb13ab45cf80160dbfce99fd7f1ac4aed28c82453c143a684449249f51a7c88b6a92574e24131404ba5ced0223803c920eb5c5e958aace653a9c643aaf0794df356018da915b643a712a09b480921f9fc3d1e9a585be7d764da56d6542f1217d6ab9c5b16f9c8b85655a7dee3c5bc24a9613b5356906718da4b85415ec4c4ee43ed233883e1f584c8cc5d00c2beb89aa87d9c02f01b0d33b3be29d2df549230a3fc1deebb44a928fb9916c4529113856cd350d5fad881e38f1dd974b983805dda1bd567cfc32277bd547c95ff46b5d5791a35539845326ca731c47f5efec2ca19e5c0430012b5b888e8a2d6eb6cc1a3b317cb529860c17ec1ca9ed6b00465ac95f689a631298ba509a846cd03c547c8e908731e01a4fdca970134e993b536fd1eab68e427bb192faddec71fb42817fafea0f929b253ece20d120804b651d34e8b5fbe1b238efa7b3be3c2178cf83acf797229894ff4ea964c140068b70192923733f7f39cc6b12d90dac6793f4a411c51e5adcadefbc98cb9493b526cf3f2cdbca809fa6bdca22dab1d7609bfc0ce17789cd1f426add13cbdfec5423e5ab671e249e973d6b1af84ce920dea454c08ba478db041d51b3172926d7d33a6a8224c808cc83cb1fa21993e150e890ac42eb2afce51f5fcdb20d30737fb14952d4490c615ec2b6425929bcba83fbb0920fc765975604d8b2d2f77fd5d127361b03f015df2856c984aa31cede039589546c955f4fd4c9ed29c2c0b530fd91d1591d356e886d9e1e77cb06b91cb067596a7fd28738ce3b1397bc52e507e4fa59ea41350327ab9a5784a8c85cc3f8669412cd050b717a1de36d0ae65087521b86a958e9980b42786825054c59336b4d759634b80bb00574ab4e06d35712224bb94bbd3f7c67659900c0f3c1531871a5d8a6fbd12b919069f8418c3f6d7726020fa380dc26e79297b0adcf1784e5e9a0d4b6054b3af00e341cfbd88135f2568621a5863de66e4e8c73b9ed387c7394b61f962cccbadbbdf1ecd1812fbe5c3566d4eceb3719fd307d5d7f15fe9a06437bed34dc7ed0e6217dc4672594559f47b1f0f9b519f7377641b9135552b10132264057435acd4aec77f44192e3339c755f2dc15a4a470ca641b61f514ea60d0a5d863cb674d701dd9722719e8579c554a64745872170d34cfe3c3ee344d17f2543a116047c767fecd51063ac94d4f6b15366ea6d8664640bed307c275b70e4f43257db25d77a2f4d3282a7f1becc6c720478c90606a2b23e57f06cd101b143842d9e4acb6d298bfa00be3f8f24a28398cd0af5ebe487277342a2e7e93feda998aed19350787349803786ff4733d8c4ec6510fdef28ce6a7f3800880ea19ed259ea7ac5b74b4c313aec6c2042a8dd1028bb855eb308974b7b54bfb6f46be195bcd152e1de62b0d71c82d82a82d1de865a6751889bfaa36f7d6ed8ef6f728d767dec06b1856982c24b83a37c2a8e7988d47c80d28c1b5389deb797a66b36c4948515fb70bc75473c2c061f782c91b215ce43a06a85b2d635d483e98b9b4b3ffdc10538470cfcb8d6e815a10f36531ab2966b6eb5162a5b9ed6a659baa56b62e89c3aa7c37fccc6392de907034cdc9c6e76d58b7510846fe7bd6baa5daebacb7cc3db6ee8ab8d4f60ed41efbccfc609a63dde17df7fce84c516519556f7ebf89aea3cdfc80ae756014566afbdce49c74fb51f482a7cf883c5c1e85c9c4b90673412620b45b5ead8c3ef2a76175b65b3c12e133637f533a2b1da3bad6ff1a5b14ec60152812feeaa37a563a63bf661e317a7cc74e3bdf54a437ecd20a73217c7b8273f2d66d3d6eaa1a39a5ab1709574d3fc9f919cff6bd7c15ebf3d90a4a6f21e4ef402bdaf46e7118bcb8928d62992f9fb69f2d6a7d67277a979753576b6980581ab788cd956a907a3a8fb1f2fe0ea87afc20efd50f4342f2891390661e7644cd8e6c2b20fd3653816caf7fc9de907d837ca0c021dc6c97c8ae4086841e2d996cc0d0231e9f7963d7eefdd38d3288020231b10e61a2c608c5f2970d2f191452ef9eef41c5be64e619a26b531ebdce2a9ee51174d4e6f4b51ee75d2c7093f3ecb721cfa6e01f717d0f854805e4b180cd9388b2b015c589d072bdf9757191ca947eebc6e01951ebfacc2887b3c9494295a0bc1074e65b7062d7a584b8f7be40b8bb6795fc55c314eda8b05cc67eb1adca42d383d0c8f923169e9a42259530f77dece776548d83bad02bdcaef803981c72ac9d442c5b6368262763b827d84c7cf4fdb5e4bc14968ad8efa81a40807453cf27ce33414778cb626668c885a91ad576863b6738466e3c67fb2cc0d6384eb7038b969b94ecd636d43efbe716333627d9cee233ab87754f2e5729a5c24fa03f8a7ea6c6797f4b02d6ac1686b6884132641356b521de2c2f348a20038a7360c53db9a58940a36a7851517f3e15aad5eb57ee48624970a14a8794af5791fa3a5adb5910d821af261ded53c92a23f090694d0a49773d69eabb98a490b8c571d12b2e725f68bddc019e3c60e57ef73289d3f1386db990225cbc85b842a0609d94333b0ab0ea3ccbdeff700b2e7921808424eff06388de2f7685610846fcb8dcf16c095f204af6a7c8afd874e6b2ad135fac08d3c2c5562a4606e37c61c7778ef77df670c503209c683bc2c4c2b38e61fcf0d6431aa5a07fb623e69b0b14df8f0068153f8054362f03ea5152ef05cb20a76f9cf3ccc175895b474e90f68d7478cc65c68f6e109e28ee9cc9c6ef7cfd2eb92198a4362e940eeadb7d103cc878b596e9ac6033468b30216f21be9eb069a9e9a593cc25d0aa3edabdfabd01ff08f33b536ed38e088325dd391235d436dcaf28d3c69b2a34f6c0288af5db509db85578926c7ebb58d8df2ff3818a3c9de7df85241a", 0x1000, 0xfffffffffffffffd)
add_key(&(0x7f0000000300)='cifs.spnego\x00', &(0x7f0000000340)={'syz', 0x0}, &(0x7f0000000380)="e28d771611da6c156f11f49080ea5dda57ca5c3d5b0ff654345dd20052b777a3139da3b947f71f01bb6d49a686ebf52500634793c37c00fb997cf756f54cc5e436abb29ba8de88001abe", 0x4a, 0xfffffffffffffffb)
r2 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r2, 0x7fff)
write$fb(0xffffffffffffffff, &(0x7f0000000280)="11a073ef95011c27483ce7dfdbcc411d0b0b8ceefc814fa07d450c8e9656", 0x1e)
r3 = userfaultfd(0x0)
ioctl$UFFDIO_ZEROPAGE(r3, 0xc020aa04, &(0x7f0000000040)={{&(0x7f0000ffe000/0x2000)=nil, 0x2000}, 0x1})
ioctl$BINDER_WRITE_READ(r2, 0x541b, 0x0)

06:42:02 executing program 3:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000500), 0x109100, 0x0)
ioctl$FBIOPAN_DISPLAY(r0, 0x4606, &(0x7f0000000540)={0xc80, 0x1da0, 0x640, 0x40, 0x1, 0x6, 0x0, 0x0, {0x2, 0x75b, 0x1}, {0x9, 0x7}, {0x7, 0xfffffe01}, {0x1f, 0x3}, 0x1, 0x0, 0x88, 0x4, 0x0, 0x5de, 0x4d, 0xff, 0x7, 0x101, 0x6, 0x100, 0x28, 0x4, 0x2, 0x4})

06:42:02 executing program 5:
openat$fb1(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0)
ioctl$FBIOPAN_DISPLAY(0xffffffffffffffff, 0x4606, &(0x7f0000000540)={0xc80, 0x1da0, 0x640, 0x40, 0x1, 0x6, 0x0, 0x0, {0x2, 0x75b, 0x1}, {0x9, 0x7}, {0x7, 0xfffffe01}, {0x1f, 0x3}, 0x1, 0x0, 0x88, 0x4, 0x0, 0x5de, 0x4d, 0xff, 0x7, 0x101, 0x6, 0x100, 0x28, 0x4, 0x2, 0x4})

06:42:02 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x10, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x18, 0x80, 0x7, 0x2, 0x610, 0xffffffffffffffff, 0x6, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x3}, 0x40)

[ 1835.016671][T15309] binder: 15307:15309 ioctl 541b 0 returned -22
06:42:02 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x0, 0x2, 0x0, 0x0, 0x0, 0x0})

06:42:02 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x414000, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, &(0x7f0000000000)={0xa})

06:42:02 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0)
r1 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_QUERYBUF(r1, 0xc0585609, &(0x7f0000000180)={0x0, 0x0, 0x4, 0x0, 0x0, {}, {0x0, 0x2, 0x0, 0x0, 0x0, 0x0, "56850780"}, 0x0, 0x0, @offset, 0x5, 0x0, <r2=>0xffffffffffffffff})
ioctl$MEDIA_IOC_REQUEST_ALLOC(0xffffffffffffffff, 0x80047c05, &(0x7f0000000040)=<r3=>0xffffffffffffffff)
ioctl$vim2m_VIDIOC_PREPARE_BUF(r1, 0xc058565d, &(0x7f0000000080)={0x6, 0x3, 0x4, 0x0, 0x3, {}, {0x6, 0x0, 0x1, 0x6, 0xff, 0x3f, "86db1546"}, 0x8cf, 0x3, @offset=0x4, 0x0, 0x0, r3})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x541b, 0x0)
r4 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
r5 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(r5, 0x40046208, 0x0)
ioctl$vim2m_VIDIOC_QUERYBUF(r1, 0xc0585609, &(0x7f0000000180)={0x0, 0x0, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "56850780"}})
ioctl$vim2m_VIDIOC_QBUF(r1, 0xc058560f, &(0x7f0000000200)={0x3, 0x1, 0x4, 0x4, 0x7f, {0x77359400}, {0x4, 0x4, 0x7, 0x38, 0x2, 0x6, "13f95d26"}, 0x10000, 0x1, @offset=0x2, 0x80, 0x0, <r6=>r2})
ioctl$vim2m_VIDIOC_QBUF(r4, 0xc058560f, &(0x7f0000000280)={0x375, 0x2, 0x4, 0x0, 0x1, {0x0, 0x2710}, {0x5, 0x0, 0x7, 0xff, 0x40, 0x0, "14775696"}, 0x7, 0x2, @offset=0x5, 0xd07, 0x0, r6})

06:42:03 executing program 3:
r0 = openat$fb1(0xffffffffffffff9c, 0x0, 0x109100, 0x0)
ioctl$FBIOPAN_DISPLAY(r0, 0x4606, &(0x7f0000000540)={0xc80, 0x1da0, 0x640, 0x40, 0x1, 0x6, 0x0, 0x0, {0x2, 0x75b, 0x1}, {0x9, 0x7}, {0x7, 0xfffffe01}, {0x1f, 0x3}, 0x1, 0x0, 0x88, 0x4, 0x0, 0x5de, 0x4d, 0xff, 0x7, 0x101, 0x6, 0x100, 0x28, 0x4, 0x2, 0x4})

[ 1835.413548][T15319] binder: 15318:15319 ioctl 10 0 returned -22
06:42:03 executing program 5:
openat$fb1(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0)
ioctl$FBIOPAN_DISPLAY(0xffffffffffffffff, 0x4606, &(0x7f0000000540)={0xc80, 0x1da0, 0x640, 0x40, 0x1, 0x6, 0x0, 0x0, {0x2, 0x75b, 0x1}, {0x9, 0x7}, {0x7, 0xfffffe01}, {0x1f, 0x3}, 0x1, 0x0, 0x88, 0x4, 0x0, 0x5de, 0x4d, 0xff, 0x7, 0x101, 0x6, 0x100, 0x28, 0x4, 0x2, 0x4})

06:42:03 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x0, 0x3, 0x0, 0x0, 0x0, 0x0})

06:42:03 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r0, 0x10, 0x0)
r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x800, 0x0)
ioctl$BLKSECDISCARD(r1, 0x127d, &(0x7f0000000080)=0x8)
setsockopt$XDP_RX_RING(0xffffffffffffffff, 0x11b, 0x2, &(0x7f0000000200)=0x1100000, 0x4)
ioctl$FBIOGETCMAP(0xffffffffffffffff, 0x4604, &(0x7f00000001c0)={0x3ff, 0x3, &(0x7f00000000c0)=[0x0, 0x0, 0x0], &(0x7f0000000100)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000140)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})

06:42:03 executing program 2:
r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x5, 0x2)
ioctl$vim2m_VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000080)={0x0, 0x0, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "ef554b2e"}, 0x0, 0x0, @fd})
r1 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r1, 0x460f, 0x0)

[ 1835.904077][T15335] binder: 15332:15335 ioctl 10 0 returned -22
[ 1835.985952][T15335] binder: 15332:15335 ioctl 10 0 returned -22
06:42:03 executing program 5:
openat$fb1(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0)
ioctl$FBIOPAN_DISPLAY(0xffffffffffffffff, 0x4606, &(0x7f0000000540)={0xc80, 0x1da0, 0x640, 0x40, 0x1, 0x6, 0x0, 0x0, {0x2, 0x75b, 0x1}, {0x9, 0x7}, {0x7, 0xfffffe01}, {0x1f, 0x3}, 0x1, 0x0, 0x88, 0x4, 0x0, 0x5de, 0x4d, 0xff, 0x7, 0x101, 0x6, 0x100, 0x28, 0x4, 0x2, 0x4})

06:42:03 executing program 3:
r0 = openat$fb1(0xffffffffffffff9c, 0x0, 0x109100, 0x0)
ioctl$FBIOPAN_DISPLAY(r0, 0x4606, &(0x7f0000000540)={0xc80, 0x1da0, 0x640, 0x40, 0x1, 0x6, 0x0, 0x0, {0x2, 0x75b, 0x1}, {0x9, 0x7}, {0x7, 0xfffffe01}, {0x1f, 0x3}, 0x1, 0x0, 0x88, 0x4, 0x0, 0x5de, 0x4d, 0xff, 0x7, 0x101, 0x6, 0x100, 0x28, 0x4, 0x2, 0x4})

06:42:03 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x7fffffff)
r1 = syz_open_dev$binderN(&(0x7f0000000440), 0x0, 0x2)
ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f0000000480)=0x2)
r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180), 0x22a200, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x24, 0x0, &(0x7f00000001c0)=[@enter_looper, @clear_death, @request_death={0x400c630e, 0x1}], 0xa2, 0x0, &(0x7f0000000300)="9fcebfa0007a093792114d188d1a0d4aeec97e90f2227511b8ff6233c0b1c08f2da1f51ba0b5d34925a911d4a7a0b31d1f3324af4ec0379624ed1233becd31300455faf374de4df71d85ebd5d3990a99a0637e09612aa26515df6f84855e9c9304f8eced7c3e48d595cb7ac8fa8894b3d358502a555f37e5344b55ff0c9de164d77f07da4aef0e03950e99bdfb028c8d04e891a229b1ca715c408a2fc327b06669e5"})
setsockopt$XDP_UMEM_FILL_RING(r2, 0x11b, 0x5, 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(r2, 0x40046208, 0x0)
r3 = openat$zero(0xffffffffffffff9c, &(0x7f00000000c0), 0x1555c1, 0x0)
ioctl$BINDER_SET_MAX_THREADS(r3, 0x40046205, &(0x7f0000000080)=0x10000)
ioctl$BINDER_WRITE_READ(r0, 0x541b, 0x0)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r4, 0x11b, 0x5, 0x0, 0x0)
ioctl$SNDCTL_SEQ_NRSYNTHS(r4, 0x8004510a, &(0x7f0000000400))
socketpair(0x5, 0x3, 0xfffffff8, &(0x7f0000000780)={<r5=>0xffffffffffffffff})
recvmsg$can_bcm(r5, &(0x7f0000002040)={&(0x7f00000007c0)=@phonet, 0x80, &(0x7f0000001e80)=[{&(0x7f0000000840)=""/142, 0x8e}, {&(0x7f0000000900)=""/179, 0xb3}, {&(0x7f00000009c0)=""/169, 0xa9}, {&(0x7f0000000a80)=""/241, 0xf1}, {&(0x7f0000000b80)=""/121, 0x79}, {&(0x7f0000000c00)=""/4096, 0x1000}, {&(0x7f0000001c00)=""/161, 0xa1}, {&(0x7f0000001cc0)=""/216, 0xd8}, {&(0x7f0000001dc0)=""/188, 0xbc}], 0x9, &(0x7f0000001f40)=""/194, 0xc2}, 0x121)
r6 = socket(0xa, 0x803, 0x7f)
syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r6)
setsockopt$inet6_tcp_TLS_TX(r6, 0x6, 0x1, &(0x7f0000000040)=@ccm_128={{0x303}, "9c50852f7bae06ae", "391d56b458a854b40b0dc0ac0f81f526", "936cd0ec", "06bf7d09f297f133"}, 0x28)

06:42:03 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x0, 0x4, 0x0, 0x0, 0x0, 0x0})

06:42:03 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x10, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r1, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
sendmsg$IPVS_CMD_NEW_DAEMON(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, 0x0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_SERVICE={0x20, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x4}, @IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_SCHED_NAME={0x9, 0x6, 'lblc\x00'}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x40}, 0x4050)

06:42:04 executing program 2:
openat$fb1(0xffffffffffffff9c, &(0x7f0000000000), 0x20, 0x0)
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)

[ 1836.498827][T15348] binder: 15344:15348 ioctl 541b 0 returned -22
[ 1836.598186][T15353] binder: 15351:15353 ioctl 10 0 returned -22
06:42:04 executing program 3:
r0 = openat$fb1(0xffffffffffffff9c, 0x0, 0x109100, 0x0)
ioctl$FBIOPAN_DISPLAY(r0, 0x4606, &(0x7f0000000540)={0xc80, 0x1da0, 0x640, 0x40, 0x1, 0x6, 0x0, 0x0, {0x2, 0x75b, 0x1}, {0x9, 0x7}, {0x7, 0xfffffe01}, {0x1f, 0x3}, 0x1, 0x0, 0x88, 0x4, 0x0, 0x5de, 0x4d, 0xff, 0x7, 0x101, 0x6, 0x100, 0x28, 0x4, 0x2, 0x4})

06:42:04 executing program 5:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0)
ioctl$FBIOPAN_DISPLAY(r0, 0x4606, 0x0)

[ 1836.677601][T15353] binder: 15351:15353 ioctl 10 0 returned -22
[ 1836.744340][T15348] binder: 15344:15348 ioctl 541b 0 returned -22
06:42:04 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x0, 0x5, 0x0, 0x0, 0x0, 0x0})

06:42:04 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)

06:42:04 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_open_dev$binderN(&(0x7f0000000040), 0x0, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)={0x3})
ioctl$BINDER_WRITE_READ(r0, 0x541b, 0x0)

06:42:04 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000040), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x10, 0x0)

06:42:04 executing program 5:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0)
ioctl$FBIOPAN_DISPLAY(r0, 0x4606, 0x0)

06:42:04 executing program 3:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0)
ioctl$FBIOPAN_DISPLAY(r0, 0x4606, &(0x7f0000000540)={0xc80, 0x1da0, 0x640, 0x40, 0x1, 0x6, 0x0, 0x0, {0x2, 0x75b, 0x1}, {0x9, 0x7}, {0x7, 0xfffffe01}, {0x1f, 0x3}, 0x1, 0x0, 0x88, 0x4, 0x0, 0x5de, 0x4d, 0xff, 0x7, 0x101, 0x6, 0x100, 0x28, 0x4, 0x2, 0x4})

[ 1837.336035][T15373] binder: 15371:15373 ioctl 10 0 returned -22
[ 1837.391698][T15375] binder: 15372:15375 ioctl 541b 0 returned -22
06:42:05 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x0, 0x6, 0x0, 0x0, 0x0, 0x0})

06:42:05 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
mmap$fb(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0xb, 0x20010, r0, 0x53000)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)
r1 = socket(0x21, 0x4, 0x0)
setsockopt$XDP_RX_RING(r1, 0x11b, 0x2, &(0x7f0000004440)=0x1012080, 0x4)

06:42:05 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), 0xffffffffffffffff)
sendmsg$IPVS_CMD_NEW_DAEMON(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x24, r1, 0x800, 0x70bd25, 0x2, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7f}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x4008040}, 0x4)
sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f0000000100)={0xf4, r1, 0x400, 0x70bd28, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xffff0000}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x8000}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8}, @IPVS_CMD_ATTR_DEST={0x20, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x8}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@local}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xfffffffb}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x8}, @IPVS_CMD_ATTR_DAEMON={0x2c, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @empty}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @empty}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e22}]}, @IPVS_CMD_ATTR_SERVICE={0x6c, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x1}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x2c}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x20, 0x4}}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x0, 0x3}}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0xa}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@loopback}, @IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@broadcast}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e21}]}]}, 0xf4}, 0x1, 0x0, 0x0, 0x8000}, 0x4000901)
syz_open_dev$binderN(&(0x7f0000000080), 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r0, 0x10, 0x0)

06:42:05 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000200), 0x0, 0x800)
r1 = syz_open_dev$binderN(&(0x7f0000000180), 0x0, 0x802)
ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f00000001c0))
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f0000000080)=0x1ff)
r2 = openat$nullb(0xffffffffffffff9c, &(0x7f00000000c0), 0x200000, 0x0)
ioctl$BLKSECDISCARD(r2, 0x127d, &(0x7f0000000100)=0x401)
syz_open_dev$binderN(&(0x7f0000000040), 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r0, 0x541b, 0x0)
ioctl$IOC_PR_PREEMPT(r2, 0x401870cb, &(0x7f0000000140)={0x2, 0x8, 0x9, 0x7})

06:42:05 executing program 5:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0)
ioctl$FBIOPAN_DISPLAY(r0, 0x4606, 0x0)

06:42:05 executing program 3:
openat$fb1(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0)
ioctl$FBIOPAN_DISPLAY(0xffffffffffffffff, 0x4606, &(0x7f0000000540)={0xc80, 0x1da0, 0x640, 0x40, 0x1, 0x6, 0x0, 0x0, {0x2, 0x75b, 0x1}, {0x9, 0x7}, {0x7, 0xfffffe01}, {0x1f, 0x3}, 0x1, 0x0, 0x88, 0x4, 0x0, 0x5de, 0x4d, 0xff, 0x7, 0x101, 0x6, 0x100, 0x28, 0x4, 0x2, 0x4})

[ 1837.896077][T15386] binder: 15385:15386 ioctl 10 0 returned -22
06:42:05 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x0, 0x7, 0x0, 0x0, 0x0, 0x0})

[ 1838.053130][T15391] binder: 15389:15391 ioctl c018620c 200001c0 returned -1
[ 1838.104631][T15391] binder: 15389:15391 ioctl 541b 0 returned -22
[ 1838.168651][T15394] binder: 15389:15394 ioctl c018620c 200001c0 returned -1
06:42:05 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x10, 0x0)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f0000000080))
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x123080, 0x0)

[ 1838.233859][T15391] binder: 15389:15391 ioctl 541b 0 returned -22
06:42:05 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f00000000c0), 0x100a80, 0x0)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
ioctl$FBIOGET_FSCREENINFO(r1, 0x4602, &(0x7f0000000000))
keyctl$restrict_keyring(0x1d, 0x0, 0x0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)

06:42:06 executing program 5:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0)
ioctl$FBIOPAN_DISPLAY(r0, 0x4606, &(0x7f0000000540)={0x0, 0x1da0, 0x640, 0x40, 0x1, 0x6, 0x0, 0x0, {0x2, 0x75b, 0x1}, {0x9, 0x7}, {0x7, 0xfffffe01}, {0x1f, 0x3}, 0x1, 0x0, 0x88, 0x4, 0x0, 0x5de, 0x4d, 0xff, 0x7, 0x101, 0x6, 0x100, 0x28, 0x4, 0x2, 0x4})

06:42:06 executing program 3:
openat$fb1(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0)
ioctl$FBIOPAN_DISPLAY(0xffffffffffffffff, 0x4606, &(0x7f0000000540)={0xc80, 0x1da0, 0x640, 0x40, 0x1, 0x6, 0x0, 0x0, {0x2, 0x75b, 0x1}, {0x9, 0x7}, {0x7, 0xfffffe01}, {0x1f, 0x3}, 0x1, 0x0, 0x88, 0x4, 0x0, 0x5de, 0x4d, 0xff, 0x7, 0x101, 0x6, 0x100, 0x28, 0x4, 0x2, 0x4})

06:42:06 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000040), 0x0, 0x800)
syz_open_procfs$namespace(0x0, &(0x7f0000000500)='ns/mnt\x00')
syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/pid\x00')
ioctl$BINDER_WRITE_READ(r0, 0x541b, 0x0)

[ 1838.519660][T15401] binder: 15400:15401 ioctl 10 0 returned -22
[ 1838.547363][T15401] binder: 15400:15401 ioctl 10 0 returned -22
06:42:06 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x0, 0x8, 0x0, 0x0, 0x0, 0x0})

[ 1838.852050][T15413] binder: 15408:15413 ioctl 541b 0 returned -22
06:42:06 executing program 1:
syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r0 = syz_open_dev$binderN(&(0x7f0000000040), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x10, 0x0)

06:42:06 executing program 5:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0)
ioctl$FBIOPAN_DISPLAY(r0, 0x4606, &(0x7f0000000540)={0x0, 0x0, 0x640, 0x40, 0x1, 0x6, 0x0, 0x0, {0x2, 0x75b, 0x1}, {0x9, 0x7}, {0x7, 0xfffffe01}, {0x1f, 0x3}, 0x1, 0x0, 0x88, 0x4, 0x0, 0x5de, 0x4d, 0xff, 0x7, 0x101, 0x6, 0x100, 0x28, 0x4, 0x2, 0x4})

06:42:06 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000000), 0x200000, 0x0)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
ioctl$FBIOGETCMAP(r1, 0x4604, &(0x7f0000000140)={0xeb, 0x5, &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000080)=[0x0], &(0x7f00000000c0)=[0x0, 0x0], &(0x7f0000000100)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0]})
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)

06:42:06 executing program 3:
openat$fb1(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0)
ioctl$FBIOPAN_DISPLAY(0xffffffffffffffff, 0x4606, &(0x7f0000000540)={0xc80, 0x1da0, 0x640, 0x40, 0x1, 0x6, 0x0, 0x0, {0x2, 0x75b, 0x1}, {0x9, 0x7}, {0x7, 0xfffffe01}, {0x1f, 0x3}, 0x1, 0x0, 0x88, 0x4, 0x0, 0x5de, 0x4d, 0xff, 0x7, 0x101, 0x6, 0x100, 0x28, 0x4, 0x2, 0x4})

06:42:06 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x0, 0x9, 0x0, 0x0, 0x0, 0x0})

06:42:06 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000040), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x541b, 0x0)

[ 1839.205358][T15418] binder: 15417:15418 ioctl 10 0 returned -22
[ 1839.253203][T15421] binder: 15417:15421 ioctl 10 0 returned -22
[ 1839.500706][T15431] binder: 15428:15431 ioctl 541b 0 returned -22
06:42:07 executing program 1:
r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040), 0x214040, 0x0)
clock_gettime(0x0, &(0x7f0000000080)={<r1=>0x0, <r2=>0x0})
r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, 0x0, 0x0)
r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r3)
sendmsg$NL80211_CMD_FRAME(r3, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x68, r4, 0x200, 0x70bd26, 0x25dfdbfe, {{}, {@val={0x8}, @void}}, [@chandef_params=[@NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x5}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x1}], @NL80211_ATTR_FRAME={0x3c, 0x33, @deauth={@with_ht={{{}, {0x7ffd}, @device_b, @device_b, @initial, {0xf, 0xf80}}, @ver_80211n={0x0, 0x5, 0x2, 0x3, 0x0, 0x3, 0x0, 0x0, 0x0, 0x1}}, 0x40, @val={0x8c, 0x18, {0x46a, "5e0fb6ea2d42", @long="6e1791be122ee64115f449e46f814c92"}}}}]}, 0x68}, 0x1, 0x0, 0x0, 0x40010}, 0x0)
ioctl$vim2m_VIDIOC_QUERYBUF(r0, 0xc0585609, &(0x7f0000000100)={0x2, 0x3, 0x4, 0x2000, 0xa5, {r1, r2/1000+10000}, {0x2, 0x0, 0x1, 0x1, 0x3, 0x1, "68fd89ef"}, 0x3, 0x2, @planes=&(0x7f00000000c0)={0x3, 0xffff0001, @userptr=0x6, 0xffff}, 0x7ca, 0x0, r3})
r5 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r5, 0x10, 0x0)

06:42:07 executing program 5:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0)
ioctl$FBIOPAN_DISPLAY(r0, 0x4606, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x40, 0x1, 0x6, 0x0, 0x0, {0x2, 0x75b, 0x1}, {0x9, 0x7}, {0x7, 0xfffffe01}, {0x1f, 0x3}, 0x1, 0x0, 0x88, 0x4, 0x0, 0x5de, 0x4d, 0xff, 0x7, 0x101, 0x6, 0x100, 0x28, 0x4, 0x2, 0x4})

06:42:07 executing program 3:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0)
ioctl$FBIOPAN_DISPLAY(r0, 0x4606, 0x0)

06:42:07 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x0, 0xa, 0x0, 0x0, 0x0, 0x0})

06:42:07 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
mmap$fb(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000008, 0x20010, r0, 0xfc000)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)

06:42:07 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000040), 0x0, 0x802)
ioctl$BINDER_WRITE_READ(r0, 0x541b, 0x0)
r1 = socket$xdp(0x2c, 0x3, 0x0)
accept4(r1, &(0x7f0000000080)=@l2tp6, &(0x7f0000000000)=0x80, 0x80000)

[ 1839.906156][T15436] binder: 15432:15436 ioctl 10 0 returned -22
[ 1839.972990][T15440] binder: 15432:15440 ioctl 10 0 returned -22
06:42:07 executing program 5:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0)
ioctl$FBIOPAN_DISPLAY(r0, 0x4606, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x1, 0x6, 0x0, 0x0, {0x2, 0x75b, 0x1}, {0x9, 0x7}, {0x7, 0xfffffe01}, {0x1f, 0x3}, 0x1, 0x0, 0x88, 0x4, 0x0, 0x5de, 0x4d, 0xff, 0x7, 0x101, 0x6, 0x100, 0x28, 0x4, 0x2, 0x4})

[ 1840.150743][T15446] binder: 15443:15446 ioctl 541b 0 returned -22
[ 1840.181496][T15446] binder: 15443:15446 ioctl 541b 0 returned -22
06:42:07 executing program 3:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0)
ioctl$FBIOPAN_DISPLAY(r0, 0x4606, 0x0)

06:42:07 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x0, 0xb, 0x0, 0x0, 0x0, 0x0})

06:42:07 executing program 1:
r0 = socket(0xa, 0x3, 0x1000)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f0000000640)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x110}, 0xc, &(0x7f0000000600)={&(0x7f0000000ec0)={0x474, r1, 0x800, 0x70bd2b, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_KEYS={0x118, 0x51, 0x0, 0x1, [{0x68, 0x0, 0x0, 0x1, [@NL80211_KEY_DATA_WEP104={0x11, 0x1, "799c4cdc8ed83aad00aa91509c"}, @NL80211_KEY_SEQ={0xe, 0x4, "4229c6b2be524c7c3e9e"}, @NL80211_KEY_DEFAULT_MGMT={0x4}, @NL80211_KEY_CIPHER={0x8, 0x3, 0x4}, @NL80211_KEY_IDX={0x5, 0x2, 0x4}, @NL80211_KEY_DEFAULT_MGMT={0x4}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "9d764cc118bbec8abec78de822"}, @NL80211_KEY_DEFAULT_MGMT={0x4}, @NL80211_KEY_SEQ={0xd, 0x4, "48fc7f25061b5e3102"}]}, {0x58, 0x0, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPES={0x10, 0x8, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_KEY_SEQ={0x9, 0x4, "8572778d6c"}, @NL80211_KEY_CIPHER={0x8, 0x3, 0xfac05}, @NL80211_KEY_IDX={0x5, 0x2, 0x4}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "e5a54f62079a0b8ca80895a34a"}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "de8aa148c1bbc869a53e629b53"}]}, {0x54, 0x0, 0x0, 0x1, [@NL80211_KEY_DEFAULT_MGMT={0x4}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "5bc552e05794c8b682ba1867ba"}, @NL80211_KEY_IDX={0x5, 0x2, 0x4}, @NL80211_KEY_DEFAULT_MGMT={0x4}, @NL80211_KEY_TYPE={0x8, 0x7, 0x1}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "ef6da1eab4585ac3f93fbcc918"}, @NL80211_KEY_DEFAULT={0x4}, @NL80211_KEY_DEFAULT_TYPES={0xc, 0x8, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}]}]}, @NL80211_ATTR_DISABLE_VHT={0x4}, @fils_params=[@NL80211_ATTR_FILS_ERP_RRK={0xe5, 0xfc, "40ca33e38f748feb7700bc3e9e0939cd379a5516de3fa17ebdbb7e86097c57c9166e9f1ceb4159006ab8065f618015dbb700159ba973a222d0b0cf85774fb50ec27f780518f39afe396c99c2246e2ec060a3cf433b178f7a2f027f8bdef61edd9f30670d27b1718681a586dddf5dae6a5c448a7da3ce5dde8f2b2918e4f2c6a3665640873aa258aa558569704896e991357acc3508d4bbc5f323e115ab662c2cd2d0e31d22ae22da562d3b1b6a886e23d0a56095732c6f94102f85e4eb2b0e88e8782677779584e5539dc027db80baf412fe9cc02ad6abe91ec659b9b053d4ea5c"}, @NL80211_ATTR_FILS_ERP_RRK={0x65, 0xfc, "3c4034bf37a43f0c1c93e58e23f93581a136a59c3ad03773fb919eafd97e73493f68e50efd4005d808e7d0cb0d0154050faffb7489b8ff5a1ceb276443681bb932e5dfdd1371584a59956ac05ebfc05764fe168a5141f1a8eb90bd60d8f76266d0"}, @NL80211_ATTR_FILS_ERP_USERNAME={0x4}, @NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM={0x6, 0xfb, 0x9}, @NL80211_ATTR_FILS_ERP_REALM={0xe0, 0xfa, "c3601f8376812c5b4339e1850e626e5cced1b418d0c29383b031ff89f722e6d939d5dc020494ef1dca542c6730f3e3f5f032368c6ff6f579b79d0e5b28a345bb3148e7c4619ac8b4b610bfa506c35a8bc9213ec8fd944d9088e4300c1d81678de8532e834b62eb6d0546be689d6408165477f827a44d59a9f0aabd35e1c7eae7f1e10c93a0cbdee61eb0cb041676716f5833749920021f0e71034d39965fd69d8af7a53feebe4d3215416c62fcc46f10da944f864b71b36671deedbfda8ece2e66389a260f34b6a6b3759d83ca1c31b33a1626ffe2cd4e6a5eee3856"}, @NL80211_ATTR_FILS_ERP_USERNAME={0xf, 0xf9, "9a321b6ddde05978cd6448"}, @NL80211_ATTR_FILS_ERP_RRK={0x91, 0xfc, "4c85256c0d31ac262035e7435c16fce67737fecac4816cabac4374b8159197b9d98d5f6bfcc2f79d04956bebb397e722b7edaed4dcb09cb890568467ef158cdd18a03e63bfec24dd36b56a33abfff4b504740fe914b6d77bf4eac8b4eaf2a98a94a4d5df443040c12592a250a9a7c06f2f0bbcfe020f65d693fb60c53b52b0730dc806bacbe4d6ea91b648fadd"}], @NL80211_ATTR_DISABLE_VHT={0x4}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x2}, @NL80211_ATTR_WIPHY_FREQ_HINT={0x8, 0xc9, @random=0x16ee}, @NL80211_ATTR_BSS_SELECT={0x24, 0xe3, 0x0, 0x1, [@NL80211_BSS_SELECT_ATTR_BAND_PREF={0x8, 0x2, 0x5840}, @NL80211_BSS_SELECT_ATTR_BAND_PREF={0x8, 0x2, 0xfffff800}, @NL80211_BSS_SELECT_ATTR_RSSI_ADJUST={0x6, 0x3, {0x4, 0xc}}, @NL80211_BSS_SELECT_ATTR_RSSI_ADJUST={0x6, 0x3, {0x9, 0x4}}]}, @NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x2}, @NL80211_ATTR_HT_CAPABILITY={0x1e, 0x1f, {0x4000, 0x2, 0x6, 0x0, {0xfffffffffffffffa, 0x8, 0x0, 0x81, 0x0, 0x1, 0x1, 0x3}, 0x6, 0x4, 0x1}}]}, 0x474}, 0x1, 0x0, 0x0, 0x840}, 0xc080)
r2 = syz_open_dev$vim2m(&(0x7f0000000140), 0x0, 0x2)
ioctl$vim2m_VIDIOC_QUERYBUF(r2, 0xc0585609, &(0x7f0000000180)={0x0, 0x0, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "56850780"}})
ioctl$vim2m_VIDIOC_TRY_FMT(r2, 0xc0d05640, &(0x7f0000000040)={0x2, @sliced={0x9, [0x0, 0x4, 0x19b3, 0x0, 0x5, 0xfffa, 0x400, 0x8, 0x8, 0x3, 0x6, 0x1, 0x0, 0x7, 0x6, 0x5, 0x7ff, 0xe5, 0x1f, 0x99, 0x101, 0x1, 0x1, 0x0, 0x0, 0x0, 0x3, 0x6, 0x7, 0xfff, 0x7, 0x6, 0xff, 0x6, 0x4, 0x6df7, 0x5, 0x5, 0x8, 0x200, 0x0, 0x9, 0x5, 0x1, 0xfff, 0x0, 0x9, 0x3]}})
r3 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r4, 0x11b, 0x5, 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000680)={0x73622a85, 0x100b, 0x3})
ioctl$BINDER_WRITE_READ(r3, 0x10, 0x0)
ioctl$BINDER_THREAD_EXIT(r3, 0x40046208, 0x0)

06:42:08 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, 0x0, 0x0)
ioctl$FBIOPUTCMAP(r1, 0x4605, &(0x7f0000000180)={0x8, 0x7, &(0x7f0000000040)=[0x8, 0x8003, 0x17, 0x8000, 0xb96f, 0x4, 0x3], &(0x7f00000000c0)=[0x4, 0xfff8, 0x97, 0xfff8, 0x8, 0x80, 0xff, 0x9], &(0x7f0000000100), &(0x7f0000000140)=[0x8, 0x100, 0x381]})
ioctl$FBIOGET_CON2FBMAP(0xffffffffffffffff, 0x460f, &(0x7f0000000000)={0xf, 0x2})
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)

06:42:08 executing program 0:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x800)
ioctl$BINDER_WRITE_READ(r0, 0x541b, 0x0)
socketpair(0x27, 0x800, 0xdfc5, &(0x7f0000000040)={<r1=>0xffffffffffffffff})
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000080)=[@timestamp, @timestamp, @window={0x3, 0xfff9, 0x2}, @sack_perm, @window={0x3, 0x4, 0x8}, @sack_perm, @sack_perm], 0x7)

[ 1840.619663][T15455] binder: 15451:15455 ioctl 10 0 returned -22
06:42:08 executing program 5:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0)
ioctl$FBIOPAN_DISPLAY(r0, 0x4606, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, {0x2, 0x75b, 0x1}, {0x9, 0x7}, {0x7, 0xfffffe01}, {0x1f, 0x3}, 0x1, 0x0, 0x88, 0x4, 0x0, 0x5de, 0x4d, 0xff, 0x7, 0x101, 0x6, 0x100, 0x28, 0x4, 0x2, 0x4})

[ 1840.716214][T15460] binder: 15451:15460 ioctl 10 0 returned -22
[ 1840.788090][T15463] binder: 15459:15463 ioctl 541b 0 returned -22
06:42:08 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x0, 0xc, 0x0, 0x0, 0x0, 0x0})

[ 1840.857447][T15463] binder: 15459:15463 ioctl 541b 0 returned -22
06:42:08 executing program 3:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0)
ioctl$FBIOPAN_DISPLAY(r0, 0x4606, 0x0)

06:42:08 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x101400, 0x0)
mmap$fb(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000006, 0x110, r0, 0x61000)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)
r1 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x105900, 0x0)
ioctl$FBIOGET_CON2FBMAP(r1, 0x460f, &(0x7f0000000040)={0xb})

06:42:08 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040), 0x10400, 0x0)
ioctl$UFFDIO_ZEROPAGE(r1, 0xc020aa04, &(0x7f00000000c0)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1})
r2 = openat$zero(0xffffffffffffff9c, &(0x7f00000001c0), 0x800, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)={0x1})
ioctl$BINDER_WRITE_READ(r0, 0x10, 0x0)
ioctl$sock_ipv6_tunnel_SIOCADD6RD(r1, 0x89f9, &(0x7f0000000180)={'ip6tnl0\x00', &(0x7f0000000100)={'ip6gre0\x00', 0x0, 0x29, 0xfd, 0x40, 0x80, 0x18, @private1, @dev={0xfe, 0x80, '\x00', 0x3a}, 0x10, 0x7800, 0x100}})
r3 = syz_open_dev$vim2m(&(0x7f0000000200), 0x8, 0x2)
ioctl$vim2m_VIDIOC_CREATE_BUFS(r3, 0xc100565c, &(0x7f00000003c0)={0xfff, 0xffff, 0x3, {0x3, @win={{0x8, 0x2, 0x7, 0x100}, 0x6, 0x5, &(0x7f0000000280)={{0x7, 0x200, 0x0, 0xffff4143}, &(0x7f0000000240)={{0x1, 0x2e, 0x1, 0x1f}}}, 0x3, &(0x7f00000002c0)="0aadce292eaf6eb2c44419328e155de603c6a876e59fa154f9a487e3fca21c33c12214b4f5286e69f9e1ca38d9969989948fe98a45ea69aa5da82d9f66796a93cf68150cc856030cfc6584d8932f8c77cd9f0ccdb030f66ae6f46435f081b8ce4a1441dcd9402b05fb3870de6482b699c2743b55a28632fcf28159a1e2564400414fc355bfd9598a94b3a54713d10a75258993a1836d89f684f6c057cf81f695a73f78dc0141015f0a818505d3c3cbfbce691812f8f5dc47c460b9ca5b4fe9dba00303edc0f257d7f5cbf3f9f2a15ce58058d398e05adab2c5fe", 0x6}}, 0x4})

06:42:08 executing program 0:
r0 = socket(0x2f, 0x80000, 0x7f)
syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r1, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
sendmsg$IPVS_CMD_DEL_DAEMON(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1400007d2a72d8da212630a8d2735ffbecf8af00", @ANYRES16=0x0, @ANYBLOB="00082dbd7000fddbdf250a000000"], 0x14}, 0x1, 0x0, 0x0, 0x880}, 0x4)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000040)=0x1, 0x4)
r2 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0x541b, 0x0)

06:42:08 executing program 5:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0)
ioctl$FBIOPAN_DISPLAY(r0, 0x4606, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, {0x2, 0x75b, 0x1}, {0x9, 0x7}, {0x7, 0xfffffe01}, {0x1f, 0x3}, 0x1, 0x0, 0x88, 0x4, 0x0, 0x5de, 0x4d, 0xff, 0x7, 0x101, 0x6, 0x100, 0x28, 0x4, 0x2, 0x4})

06:42:09 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x0, 0xd, 0x0, 0x0, 0x0, 0x0})

[ 1841.375797][T15477] binder: 15474:15477 ioctl 10 0 returned -22
[ 1841.399312][T15478] binder: 15476:15478 ioctl 541b 0 returned -22
06:42:09 executing program 3:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0)
ioctl$FBIOPAN_DISPLAY(r0, 0x4606, &(0x7f0000000540)={0x0, 0x1da0, 0x640, 0x40, 0x1, 0x6, 0x0, 0x0, {0x2, 0x75b, 0x1}, {0x9, 0x7}, {0x7, 0xfffffe01}, {0x1f, 0x3}, 0x1, 0x0, 0x88, 0x4, 0x0, 0x5de, 0x4d, 0xff, 0x7, 0x101, 0x6, 0x100, 0x28, 0x4, 0x2, 0x4})

[ 1841.488638][T15482] binder: 15476:15482 ioctl 541b 0 returned -22
[ 1841.490751][T15479] binder: 15474:15479 ioctl 10 0 returned -22
06:42:09 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x509c0, 0x0)
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)
ioctl$FBIOPUT_CON2FBMAP(r0, 0x4610, &(0x7f0000000000)={0x1})
r1 = accept4(0xffffffffffffffff, &(0x7f00000000c0)=@l2tp={0x2, 0x0, @empty}, &(0x7f0000000040)=0x80, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r2, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r3, 0xcd6ccc609280a2c3, 0x0, 0x0, {{}, {@void, @void}}, [@NL80211_ATTR_MAX_CRIT_PROT_DURATION={0x6}, @NL80211_ATTR_CRIT_PROT_ID={0x6}]}, 0x24}}, 0x0)
sendmsg$NL80211_CMD_DEL_STATION(r1, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x58, r3, 0x300, 0x70bd2a, 0x25dfdbfd, {{}, {@void, @void}}, [@NL80211_ATTR_STA_SUPPORTED_RATES={0x18, 0x13, [{0x1}, {0x2, 0x1}, {0x3}, {0x60}, {0x24}, {0xc, 0x1}, {0x9, 0x1}, {0x3, 0x1}, {0x3, 0x1}, {0x4}, {0x9, 0x1}, {0x1, 0x1}, {0x99eafde163a2cb3b, 0x1}, {}, {0xb}, {0x0, 0x1}, {0x3e, 0x1}, {0x1}, {0x6c, 0x1}, {0x4, 0x1}]}, @NL80211_ATTR_STA_TX_POWER={0x6, 0x114, 0x5}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_STA_CAPABILITY={0x6, 0xab, 0x3ae}, @NL80211_ATTR_OPMODE_NOTIF={0x5, 0xc2, 0x1}, @NL80211_ATTR_STA_CAPABILITY={0x6}]}, 0x58}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000040)
ioctl$FBIO_WAITFORVSYNC(r0, 0x40044620, 0x0)

06:42:09 executing program 1:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r2, 0x11b, 0x5, 0x0, 0x0)
ioctl$vim2m_VIDIOC_QBUF(r1, 0xc058560f, &(0x7f00000002c0)={0xfffffff7, 0x0, 0x4, 0x40, 0x7fff, {}, {0x2, 0x1, 0x2, 0x20, 0x1f, 0x5, "4af36bc3"}, 0xfffffffe, 0x1, @userptr=0x80000000, 0x7, 0x0, <r3=>r1})
ioctl$VIDIOC_QUERYBUF(r2, 0xc0585609, &(0x7f0000000340)={0x1e885d21, 0x8, 0x4, 0x10000, 0x2, {0x0, 0x2710}, {0x1, 0x0, 0x81, 0xcc, 0x8, 0x0, "945558f6"}, 0x9, 0x3, @offset=0x9, 0x6, 0x0, r3})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000180)=[@increfs_done={0x40106308, 0x2}], 0xa1, 0x0, &(0x7f00000001c0)="36b1a8337e3a03605da451350c0955442e7fc8bd763d8e31a1e5c10392cbd6677e9b96d8684f6a43ddb6b1c7cb112f553851994e88683acc852496de0c11f8e38051a5fc8f8701024fac6ddb8004e52605d1175f729c84bfc8db0711439cb15d46066672a5ac0b5e961e26c138ff677dd2975f381769aebe04219308276a1f1455a960b90828687ceb59eaa9f896cb87b06546fbbf2c42da6b3d96881e55503623"})
ioctl$BINDER_WRITE_READ(r0, 0x10, 0x0)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
setsockopt$XDP_UMEM_FILL_RING(r4, 0x11b, 0x5, 0x0, 0x0)
ioctl$vim2m_VIDIOC_PREPARE_BUF(r4, 0xc058565d, &(0x7f0000000080)={0x3, 0x3, 0x4, 0x8, 0x401, {0x77359400}, {0x5, 0x1, 0x2, 0xaa, 0x40, 0x4, "686715f1"}, 0x4, 0x3, @fd=r4, 0x8, 0x0, r4})
ioctl$BINDER_SET_MAX_THREADS(r4, 0x40046205, &(0x7f0000000040)=0x1ff)

06:42:09 executing program 0:
socketpair(0x5, 0x5, 0x5, &(0x7f00000003c0)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000480)={&(0x7f0000000400)=""/113, 0x3000, 0x0, 0x7, 0x1}, 0x20)
r1 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
sendmsg$DEVLINK_CMD_TRAP_GET(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYBLOB="b0010000", @ANYRES16=0x0, @ANYBLOB="200026bd7000fddbdf253d0000000e0001006e657464657673696d0000000f0002006e657464657673696d3000001c008200736f750963655f6d61635f69735f6d756c74696361737400080001007063690011000200303030303a30303a31302e30000000001c008200736f757263655f6d61635f69735f6d756c746963617374000e0001006e657464657673696d0000000f0002006e657464400000006d3000001c008200736f757263655f6d61635f69735f6d756c746963617374000e0001006e657464657673696d0000000f0002006e657464657673696d3000001c008200736f757263655f6d61635f69735f6d756c746963617374000e0001006e657464657673696d0000000f0002006e657464657673696d3000001c008200736f757263655f6d61635f69735f6d756c746963617374000e0001006e657464657673696d0000000f0002006e657464657673696d3000001c008200736f757fbe655f6d61635f69735f6d756c74696361737400080001007063690011000200303030303a30309ed63e0fbfa5799a001c008200736f757263655f6d61635f69735f6d546c74696361737400"], 0x1b0}, 0x1, 0x0, 0x0, 0xc000}, 0x24004011)
r2 = openat$fb1(0xffffffffffffff9c, &(0x7f00000002c0), 0x60000, 0x0)
ioctl$FBIOPAN_DISPLAY(r2, 0x4606, &(0x7f0000000300)={0x400, 0x4f8, 0x30, 0x800, 0x4, 0x3, 0x18, 0x2, {0x5, 0xff, 0x1}, {0x27, 0x3f}, {0x3, 0x7ff, 0x1}, {0xfffffffd, 0x1, 0x1}, 0x1, 0x80, 0xfffffffc, 0x3, 0x0, 0x5, 0x97, 0xffffffff, 0x2, 0x5, 0xfffffff7, 0x9, 0x4, 0x100, 0x0, 0x2})
ioctl$BINDER_WRITE_READ(r1, 0x541b, 0x0)
r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r4 = openat$fb1(0xffffffffffffff9c, &(0x7f00000006c0), 0x41, 0x0)
ioctl$FBIOGETCMAP(r4, 0x4604, &(0x7f0000000800)={0x3f, 0x3, &(0x7f0000000700)=[0x0, 0x0, 0x0], &(0x7f0000000740)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000780)=[0x0, 0x0, 0x0], &(0x7f00000007c0)=[0x0, 0x0]})
r5 = accept4(r0, &(0x7f0000000dc0)=@caif=@dbg, &(0x7f0000000e40)=0x80, 0x0)
sendmsg$IPVS_CMD_NEW_DAEMON(r5, &(0x7f0000000f80)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000f40)={&(0x7f0000000ec0)={0x50, 0x0, 0x200, 0x70bd2b, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_SERVICE={0x3c, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e21}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e20}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@private1}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x5c}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x4, 0x4}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x10}, 0x801)
setsockopt$XDP_UMEM_FILL_RING(r3, 0x11b, 0x5, 0x0, 0x0)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r6, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={0x0}}, 0x0)
sendmsg$NL80211_CMD_SET_INTERFACE(r6, &(0x7f00000015c0)={&(0x7f0000001400)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001580)={0x0}}, 0x0)
sendmsg$DEVLINK_CMD_SB_POOL_SET(r6, &(0x7f0000000680)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x820}, 0xc, &(0x7f0000000640)={&(0x7f0000000840)=ANY=[@ANYBLOB="10010000", @ANYRES16=0x0, @ANYBLOB="080026bd7000ffdbdf25100000000e0001006e657464457673696d0000000f0002006e657464657673696d30000008000b00030000000600110069000000080013000500000005001400010000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008000b00080003000000080013000900000005800e6a0700140001007464657673696d0000000f0002006e657464657673696d30000008000b00ff000000060011000101000008001300050000000500140001000000080001007063690011000200303030303a30303a31302e300000000008000b00018000000600110002197400000013000300000005001400000000000000000000d6d7d80fa0960bc0d6046c50bc7841901bb980b48161e3f9ba604f02f0d233fa62a7dfdc62c30a430d4ff313a5ceca4752e0129832cd45cededdd66cac6b0232ff1229c1ff953d8278bce5f9981e75dff63720071821501cea8a114be2ce9e447ab7f0587e84d4eaeb54536b746fd0e1c94701bcfb5e24ebfbb1ea0929ee314d0f70ea6840aac09e813b077ee7798a052bcb8c5a167ce27ebbfb3b517c225d48e6239c1d1a0c5f7c709179185ba8ff35d0b878be66bfa7d2dca70af71160fd62221aee2dd2c7fe979673f4759f61d2e7c67c7d513f"], 0x110}}, 0x0)
ioctl$BINDER_THREAD_EXIT(r3, 0x40046208, 0x0)

06:42:09 executing program 5:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0)
ioctl$FBIOPAN_DISPLAY(r0, 0x4606, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, {0x2, 0x75b, 0x1}, {0x9, 0x7}, {0x7, 0xfffffe01}, {0x1f, 0x3}, 0x1, 0x0, 0x88, 0x4, 0x0, 0x5de, 0x4d, 0xff, 0x7, 0x101, 0x6, 0x100, 0x28, 0x4, 0x2, 0x4})

06:42:09 executing program 4:
r0 = syz_open_dev$binderN(&(0x7f0000000000), 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000180)={0x0, 0xe, 0x0, 0x0, 0x0, 0x0})

06:42:09 executing program 3:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0)
ioctl$FBIOPAN_DISPLAY(r0, 0x4606, &(0x7f0000000540)={0x0, 0x0, 0x640, 0x40, 0x1, 0x6, 0x0, 0x0, {0x2, 0x75b, 0x1}, {0x9, 0x7}, {0x7, 0xfffffe01}, {0x1f, 0x3}, 0x1, 0x0, 0x88, 0x4, 0x0, 0x5de, 0x4d, 0xff, 0x7, 0x101, 0x6, 0x100, 0x28, 0x4, 0x2, 0x4})

[ 1842.129931][T15495] binder: 15493:15495 ioctl 10 0 returned -22
06:42:09 executing program 2:
r0 = openat$fb1(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$FBIOGET_FSCREENINFO(r0, 0x4602, &(0x7f0000000000))
ioctl$FBIOGET_CON2FBMAP(r0, 0x460f, 0x0)

[ 1842.188118][T15498] binder: 15494:15498 ioctl 541b 0 returned -22
[ 1842.206164][T15495] binder: 15493:15495 ioctl 10 0 returned -22
[ 1842.265254][T15503] =====================================================
[ 1842.272223][T15503] BUG: KMSAN: kernel-infoleak in kmsan_copy_to_user+0x9c/0xb0
[ 1842.279720][T15503] CPU: 0 PID: 15503 Comm: syz-executor.0 Not tainted 5.12.0-rc6-syzkaller #0
[ 1842.288495][T15503] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 1842.298584][T15503] Call Trace:
[ 1842.301867][T15503]  dump_stack+0x24c/0x2e0
[ 1842.306218][T15503]  kmsan_report+0xfb/0x1e0
[ 1842.310644][T15503]  kmsan_internal_check_memory+0x469/0x500
[ 1842.316475][T15503]  kmsan_copy_to_user+0x9c/0xb0
[ 1842.321334][T15503]  _copy_to_user+0x1ac/0x270
[ 1842.325934][T15503]  fb_cmap_to_user+0x40a/0x990
[ 1842.330735][T15503]  do_fb_ioctl+0xc53/0x1090
[ 1842.335246][T15503]  ? kmsan_get_metadata+0x116/0x180
[ 1842.340542][T15503]  ? kmsan_get_shadow_origin_ptr+0x84/0xb0
[ 1842.346357][T15503]  ? __msan_metadata_ptr_for_load_2+0x10/0x20
[ 1842.352429][T15503]  ? do_vfs_ioctl+0x117f/0x3510
[ 1842.357492][T15503]  ? kmsan_get_metadata+0x116/0x180
[ 1842.362722][T15503]  fb_ioctl+0x1e4/0x210
[ 1842.366899][T15503]  ? fb_write+0xd80/0xd80
[ 1842.371245][T15503]  __se_sys_ioctl+0x311/0x4d0
[ 1842.375948][T15503]  __x64_sys_ioctl+0x4a/0x70
[ 1842.380577][T15503]  do_syscall_64+0x9f/0x140
[ 1842.385097][T15503]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 1842.391000][T15503] RIP: 0033:0x4665d9
[ 1842.394895][T15503] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 1842.414508][T15503] RSP: 002b:00007f9c08ff0188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 1842.423083][T15503] RAX: ffffffffffffffda RBX: 000000000056c0f0 RCX: 00000000004665d9
[ 1842.431160][T15503] RDX: 0000000020000800 RSI: 0000000000004604 RDI: 0000000000000008
[ 1842.439235][T15503] RBP: 00000000004bfcb9 R08: 0000000000000000 R09: 0000000000000000
[ 1842.447206][T15503] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056c0f0
[ 1842.455201][T15503] R13: 0000000000a9fb1f R14: 00007f9c08ff0300 R15: 0000000000022000
[ 1842.463198][T15503] 
[ 1842.465516][T15503] Uninit was created at:
[ 1842.469758][T15503]  kmsan_internal_poison_shadow+0x66/0xd0
[ 1842.475497][T15503]  kmsan_slab_alloc+0x8e/0xe0
[ 1842.480175][T15503]  __kmalloc+0x387/0x550
[ 1842.484423][T15503]  fb_alloc_cmap_gfp+0x39b/0xa70
[ 1842.489363][T15503]  fb_alloc_cmap+0x95/0xb0
[ 1842.493800][T15503]  drm_fb_helper_alloc_fbi+0x106/0x3f0
[ 1842.499259][T15503]  drm_fb_helper_generic_probe+0x4f3/0xc70
[ 1842.505071][T15503]  __drm_fb_helper_initial_config_and_unlock+0x1cac/0x26c0
[ 1842.512275][T15503]  drm_fbdev_client_hotplug+0xbb8/0xd70
[ 1842.517823][T15503]  drm_fbdev_generic_setup+0x39d/0xa00
[ 1842.523288][T15503]  vkms_init+0x9d6/0xc43
[ 1842.527532][T15503]  do_one_initcall+0x362/0x8d0
[ 1842.532330][T15503]  do_initcall_level+0x1e7/0x35a
[ 1842.537277][T15503]  do_initcalls+0x127/0x1cb
[ 1842.541807][T15503]  do_basic_setup+0x33/0x36
[ 1842.546338][T15503]  kernel_init_freeable+0x287/0x3cc
[ 1842.551539][T15503]  kernel_init+0x1f/0x840
[ 1842.555870][T15503]  ret_from_fork+0x1f/0x30
[ 1842.560290][T15503] 
[ 1842.562603][T15503] Bytes 0-5 of 6 are uninitialized
[ 1842.567704][T15503] Memory access of size 6 starts at ffff888145e0687e
[ 1842.574457][T15503] Data copied to user address 0000000020000700
[ 1842.580603][T15503] =====================================================
[ 1842.587527][T15503] Disabling lock debugging due to kernel taint
[ 1842.593676][T15503] Kernel panic - not syncing: panic_on_kmsan set ...
[ 1842.600341][T15503] CPU: 0 PID: 15503 Comm: syz-executor.0 Tainted: G    B             5.12.0-rc6-syzkaller #0
[ 1842.610511][T15503] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 1842.620566][T15503] Call Trace:
[ 1842.623925][T15503]  dump_stack+0x24c/0x2e0
[ 1842.628273][T15503]  panic+0x4c6/0xea7
[ 1842.632188][T15503]  ? add_taint+0x17c/0x210
[ 1842.636610][T15503]  ? __msan_metadata_ptr_for_store_1+0x13/0x20
[ 1842.642771][T15503]  kmsan_report+0x1de/0x1e0
[ 1842.647278][T15503]  kmsan_internal_check_memory+0x469/0x500
[ 1842.653089][T15503]  kmsan_copy_to_user+0x9c/0xb0
[ 1842.657942][T15503]  _copy_to_user+0x1ac/0x270
[ 1842.662549][T15503]  fb_cmap_to_user+0x40a/0x990
[ 1842.667322][T15503]  do_fb_ioctl+0xc53/0x1090
[ 1842.671832][T15503]  ? kmsan_get_metadata+0x116/0x180
[ 1842.677039][T15503]  ? kmsan_get_shadow_origin_ptr+0x84/0xb0
[ 1842.682944][T15503]  ? __msan_metadata_ptr_for_load_2+0x10/0x20
[ 1842.689030][T15503]  ? do_vfs_ioctl+0x117f/0x3510
[ 1842.693895][T15503]  ? kmsan_get_metadata+0x116/0x180
[ 1842.699102][T15503]  fb_ioctl+0x1e4/0x210
[ 1842.703264][T15503]  ? fb_write+0xd80/0xd80
[ 1842.707596][T15503]  __se_sys_ioctl+0x311/0x4d0
[ 1842.712295][T15503]  __x64_sys_ioctl+0x4a/0x70
[ 1842.716893][T15503]  do_syscall_64+0x9f/0x140
[ 1842.721419][T15503]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 1842.727319][T15503] RIP: 0033:0x4665d9
[ 1842.731212][T15503] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 1842.750827][T15503] RSP: 002b:00007f9c08ff0188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 1842.759246][T15503] RAX: ffffffffffffffda RBX: 000000000056c0f0 RCX: 00000000004665d9
[ 1842.767218][T15503] RDX: 0000000020000800 RSI: 0000000000004604 RDI: 0000000000000008
[ 1842.775366][T15503] RBP: 00000000004bfcb9 R08: 0000000000000000 R09: 0000000000000000
[ 1842.783350][T15503] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056c0f0
[ 1842.791322][T15503] R13: 0000000000a9fb1f R14: 00007f9c08ff0300 R15: 0000000000022000
[ 1842.800632][T15503] Kernel Offset: disabled
[ 1842.804952][T15503] Rebooting in 86400 seconds..