1342] binder: 21340:21342 ioctl c0306201 0 returned -14 15:29:36 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r1, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) r2 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x4) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000000c0)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_NOTIFY(r3, &(0x7f0000000140)={0xf, 0x8, 0xfa00, {r4}}, 0x10) write$RDMA_USER_CM_CMD_NOTIFY(0xffffffffffffffff, &(0x7f0000000000)={0xf, 0x8, 0xfa00, {r4, 0xe}}, 0x10) ioctl$sock_qrtr_SIOCGIFADDR(r2, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) socket$qrtr(0x2a, 0x2, 0x0) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000000c0)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_NOTIFY(r5, &(0x7f0000000140)={0xf, 0x8, 0xfa00, {r6}}, 0x10) write$RDMA_USER_CM_CMD_REJECT(r3, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {r6, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:36 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r0) 15:29:36 executing program 5: r0 = bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) ioctl$LOOP_SET_CAPACITY(r0, 0x4c07) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:29:36 executing program 2: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x10, 0x0, &(0x7f0000000200)=[@request_death={0x400c630e, 0x3}], 0x39, 0x0, &(0x7f0000000240)="df2c06041472c2127b8482ac2aae8b52a1057ba16c0768a0d6ac34e06d1dc3e5e6e80c2c4c7ff8f5c0c272aba9478b5e000a92e5770eaafdfe"}) write$RDMA_USER_CM_CMD_GET_EVENT(r1, &(0x7f0000000000)={0xc, 0x8, 0xfa00, {&(0x7f0000000080)}}, 0x10) ioctl$LOOP_SET_FD(r0, 0x125f, 0xffffffffffffffff) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) (async) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) (async) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x10, 0x0, &(0x7f0000000200)=[@request_death={0x400c630e, 0x3}], 0x39, 0x0, &(0x7f0000000240)="df2c06041472c2127b8482ac2aae8b52a1057ba16c0768a0d6ac34e06d1dc3e5e6e80c2c4c7ff8f5c0c272aba9478b5e000a92e5770eaafdfe"}) (async) write$RDMA_USER_CM_CMD_GET_EVENT(r1, &(0x7f0000000000)={0xc, 0x8, 0xfa00, {&(0x7f0000000080)}}, 0x10) (async) ioctl$LOOP_SET_FD(r0, 0x125f, 0xffffffffffffffff) (async) [ 2972.727195][T21369] binder: 21368:21369 ioctl c0306201 0 returned -14 15:29:37 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c06, r0) 15:29:37 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r1, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) r2 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x4) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000000c0)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_NOTIFY(r3, &(0x7f0000000140)={0xf, 0x8, 0xfa00, {r4}}, 0x10) write$RDMA_USER_CM_CMD_NOTIFY(0xffffffffffffffff, &(0x7f0000000000)={0xf, 0x8, 0xfa00, {r4, 0xe}}, 0x10) ioctl$sock_qrtr_SIOCGIFADDR(r2, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) socket$qrtr(0x2a, 0x2, 0x0) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000000c0)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_REJECT(r3, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {r6, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:37 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c06, r0) 15:29:37 executing program 1: socket(0x0, 0x3, 0x3) 15:29:37 executing program 2: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x911, 0xfff, 0x0, 0x9, 0x1e, 0x8, "8a606ae0ef5a073bc68ce0a868ea753619c7375ce03d3b31828b592a6e0290742c4220e8a77cdb30d9e8dfae72f84f84e5931d59e4220e7f22cb8c248589d726", "fdecd50146485e0572e820fd7c913900a4de5aae5cedd42ed1921b28c27d894ebe51d465546e01b777086716afc854958f6c7a49d3a5b31cddf9e0479735dcec", "41f77ff459fd487fd1d0914eb522c696dd7b252d7560d1c19bfd7ccc6d8c39e6", [0xa1e0, 0x8]}) ioctl$LOOP_SET_FD(r0, 0x125f, 0xffffffffffffffff) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, &(0x7f0000000500)={0x0, {}, 0x0, {}, 0xfffffc01, 0x2, 0x10, 0x0, "92d3885cfcd6cd0901d4bbe146243d9576020ecc492965dbdc94955f739d5c30cf3c35dfbcdb2dd9740e1e50e6c22cada337cddfc0f370e425f7372f9c2e3627", "01486f17813c20a6d31cf28b0cd13bc7571de2c2fa27f10f3b97a0cb7d84c6e9", [0x8, 0x1]}) socketpair(0x15, 0xa, 0x5, &(0x7f0000000080)={0xffffffffffffffff}) sendmsg$TIPC_NL_NODE_GET(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="aec107f70000000000000000468ce7ab40a6a70c45a0b1781281c9f6910a34cda6d378d974e956516a3d9c441e24889aefb99ab0278269df9fe45c0209b12fdb8cb16c7897d91f5fe4f6115dce06abc7158790922d0c1778bcde16f50acebe95d920d6695f22d0a53b573e5a55f8c9fca24b810d268812ae2168e69a7c011c9205bbf842f5e8f87323165e2cd1c2314e75bb36b3e49aae963d5dccd050c6d6786274b6c543574a671cdf8a588dcf3e3432", @ANYRES16=0x0, @ANYBLOB="02002bbd7000470800000d000000140003800800010005000000080001006800000000010580080001007564700014000280080002000000000008000400060000004400028008000300c0c70000080001001f0000000800020007000000080004000600000008000100100000000800010019000000080002000300000008000200400000004c0002800800030000000080080004000900000008000100090000000800030000000000080003000700000008000300feffffff080001000400000008000400030000000800030000000000070001006962000014000280080004000600000008000200aa0d000034000280080004000e74880a080002000400000008000300ee0f000008000200000000800800020009000000080001000f0000003c00098008000200480000000800010009000000080001000100000008000100ff030000080001005f9fffff08000100060000000800020001000000100004800900010073797a3100000000"], 0x174}, 0x1, 0x0, 0x0, 0x24010000}, 0x10000) 15:29:37 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c06, r0) 15:29:37 executing program 2: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x911, 0xfff, 0x0, 0x9, 0x1e, 0x8, "8a606ae0ef5a073bc68ce0a868ea753619c7375ce03d3b31828b592a6e0290742c4220e8a77cdb30d9e8dfae72f84f84e5931d59e4220e7f22cb8c248589d726", "fdecd50146485e0572e820fd7c913900a4de5aae5cedd42ed1921b28c27d894ebe51d465546e01b777086716afc854958f6c7a49d3a5b31cddf9e0479735dcec", "41f77ff459fd487fd1d0914eb522c696dd7b252d7560d1c19bfd7ccc6d8c39e6", [0xa1e0, 0x8]}) ioctl$LOOP_SET_FD(r0, 0x125f, 0xffffffffffffffff) (async) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) (async) ioctl$LOOP_SET_STATUS(r1, 0x4c02, &(0x7f0000000500)={0x0, {}, 0x0, {}, 0xfffffc01, 0x2, 0x10, 0x0, "92d3885cfcd6cd0901d4bbe146243d9576020ecc492965dbdc94955f739d5c30cf3c35dfbcdb2dd9740e1e50e6c22cada337cddfc0f370e425f7372f9c2e3627", "01486f17813c20a6d31cf28b0cd13bc7571de2c2fa27f10f3b97a0cb7d84c6e9", [0x8, 0x1]}) (async) socketpair(0x15, 0xa, 0x5, &(0x7f0000000080)={0xffffffffffffffff}) sendmsg$TIPC_NL_NODE_GET(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="aec107f70000000000000000468ce7ab40a6a70c45a0b1781281c9f6910a34cda6d378d974e956516a3d9c441e24889aefb99ab0278269df9fe45c0209b12fdb8cb16c7897d91f5fe4f6115dce06abc7158790922d0c1778bcde16f50acebe95d920d6695f22d0a53b573e5a55f8c9fca24b810d268812ae2168e69a7c011c9205bbf842f5e8f87323165e2cd1c2314e75bb36b3e49aae963d5dccd050c6d6786274b6c543574a671cdf8a588dcf3e3432", @ANYRES16=0x0, @ANYBLOB="02002bbd7000470800000d000000140003800800010005000000080001006800000000010580080001007564700014000280080002000000000008000400060000004400028008000300c0c70000080001001f0000000800020007000000080004000600000008000100100000000800010019000000080002000300000008000200400000004c0002800800030000000080080004000900000008000100090000000800030000000000080003000700000008000300feffffff080001000400000008000400030000000800030000000000070001006962000014000280080004000600000008000200aa0d000034000280080004000e74880a080002000400000008000300ee0f000008000200000000800800020009000000080001000f0000003c00098008000200480000000800010009000000080001000100000008000100ff030000080001005f9fffff08000100060000000800020001000000100004800900010073797a3100000000"], 0x174}, 0x1, 0x0, 0x0, 0x24010000}, 0x10000) 15:29:37 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r1, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) r2 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x4) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000000c0)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_NOTIFY(r3, &(0x7f0000000140)={0xf, 0x8, 0xfa00, {r4}}, 0x10) write$RDMA_USER_CM_CMD_NOTIFY(0xffffffffffffffff, &(0x7f0000000000)={0xf, 0x8, 0xfa00, {r4, 0xe}}, 0x10) ioctl$sock_qrtr_SIOCGIFADDR(r2, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) socket$qrtr(0x2a, 0x2, 0x0) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000000c0)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_REJECT(r3, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {r6, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:37 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c06, r0) 15:29:37 executing program 1: socket(0x0, 0x3, 0x3) 15:29:37 executing program 5: r0 = bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) ioctl$LOOP_SET_CAPACITY(r0, 0x4c07) (async) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:29:37 executing program 2: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x911, 0xfff, 0x0, 0x9, 0x1e, 0x8, "8a606ae0ef5a073bc68ce0a868ea753619c7375ce03d3b31828b592a6e0290742c4220e8a77cdb30d9e8dfae72f84f84e5931d59e4220e7f22cb8c248589d726", "fdecd50146485e0572e820fd7c913900a4de5aae5cedd42ed1921b28c27d894ebe51d465546e01b777086716afc854958f6c7a49d3a5b31cddf9e0479735dcec", "41f77ff459fd487fd1d0914eb522c696dd7b252d7560d1c19bfd7ccc6d8c39e6", [0xa1e0, 0x8]}) ioctl$LOOP_SET_FD(r0, 0x125f, 0xffffffffffffffff) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, &(0x7f0000000500)={0x0, {}, 0x0, {}, 0xfffffc01, 0x2, 0x10, 0x0, "92d3885cfcd6cd0901d4bbe146243d9576020ecc492965dbdc94955f739d5c30cf3c35dfbcdb2dd9740e1e50e6c22cada337cddfc0f370e425f7372f9c2e3627", "01486f17813c20a6d31cf28b0cd13bc7571de2c2fa27f10f3b97a0cb7d84c6e9", [0x8, 0x1]}) socketpair(0x15, 0xa, 0x5, &(0x7f0000000080)={0xffffffffffffffff}) sendmsg$TIPC_NL_NODE_GET(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="aec107f70000000000000000468ce7ab40a6a70c45a0b1781281c9f6910a34cda6d378d974e956516a3d9c441e24889aefb99ab0278269df9fe45c0209b12fdb8cb16c7897d91f5fe4f6115dce06abc7158790922d0c1778bcde16f50acebe95d920d6695f22d0a53b573e5a55f8c9fca24b810d268812ae2168e69a7c011c9205bbf842f5e8f87323165e2cd1c2314e75bb36b3e49aae963d5dccd050c6d6786274b6c543574a671cdf8a588dcf3e3432", @ANYRES16=0x0, @ANYBLOB="02002bbd7000470800000d000000140003800800010005000000080001006800000000010580080001007564700014000280080002000000000008000400060000004400028008000300c0c70000080001001f0000000800020007000000080004000600000008000100100000000800010019000000080002000300000008000200400000004c0002800800030000000080080004000900000008000100090000000800030000000000080003000700000008000300feffffff080001000400000008000400030000000800030000000000070001006962000014000280080004000600000008000200aa0d000034000280080004000e74880a080002000400000008000300ee0f000008000200000000800800020009000000080001000f0000003c00098008000200480000000800010009000000080001000100000008000100ff030000080001005f9fffff08000100060000000800020001000000100004800900010073797a3100000000"], 0x174}, 0x1, 0x0, 0x0, 0x24010000}, 0x10000) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x911, 0xfff, 0x0, 0x9, 0x1e, 0x8, "8a606ae0ef5a073bc68ce0a868ea753619c7375ce03d3b31828b592a6e0290742c4220e8a77cdb30d9e8dfae72f84f84e5931d59e4220e7f22cb8c248589d726", "fdecd50146485e0572e820fd7c913900a4de5aae5cedd42ed1921b28c27d894ebe51d465546e01b777086716afc854958f6c7a49d3a5b31cddf9e0479735dcec", "41f77ff459fd487fd1d0914eb522c696dd7b252d7560d1c19bfd7ccc6d8c39e6", [0xa1e0, 0x8]}) (async) ioctl$LOOP_SET_FD(r0, 0x125f, 0xffffffffffffffff) (async) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) (async) ioctl$LOOP_SET_STATUS(r1, 0x4c02, &(0x7f0000000500)={0x0, {}, 0x0, {}, 0xfffffc01, 0x2, 0x10, 0x0, "92d3885cfcd6cd0901d4bbe146243d9576020ecc492965dbdc94955f739d5c30cf3c35dfbcdb2dd9740e1e50e6c22cada337cddfc0f370e425f7372f9c2e3627", "01486f17813c20a6d31cf28b0cd13bc7571de2c2fa27f10f3b97a0cb7d84c6e9", [0x8, 0x1]}) (async) socketpair(0x15, 0xa, 0x5, &(0x7f0000000080)) (async) sendmsg$TIPC_NL_NODE_GET(r2, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="aec107f70000000000000000468ce7ab40a6a70c45a0b1781281c9f6910a34cda6d378d974e956516a3d9c441e24889aefb99ab0278269df9fe45c0209b12fdb8cb16c7897d91f5fe4f6115dce06abc7158790922d0c1778bcde16f50acebe95d920d6695f22d0a53b573e5a55f8c9fca24b810d268812ae2168e69a7c011c9205bbf842f5e8f87323165e2cd1c2314e75bb36b3e49aae963d5dccd050c6d6786274b6c543574a671cdf8a588dcf3e3432", @ANYRES16=0x0, @ANYBLOB="02002bbd7000470800000d000000140003800800010005000000080001006800000000010580080001007564700014000280080002000000000008000400060000004400028008000300c0c70000080001001f0000000800020007000000080004000600000008000100100000000800010019000000080002000300000008000200400000004c0002800800030000000080080004000900000008000100090000000800030000000000080003000700000008000300feffffff080001000400000008000400030000000800030000000000070001006962000014000280080004000600000008000200aa0d000034000280080004000e74880a080002000400000008000300ee0f000008000200000000800800020009000000080001000f0000003c00098008000200480000000800010009000000080001000100000008000100ff030000080001005f9fffff08000100060000000800020001000000100004800900010073797a3100000000"], 0x174}, 0x1, 0x0, 0x0, 0x24010000}, 0x10000) (async) 15:29:37 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r1, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) r2 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x4) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000000c0)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_NOTIFY(r3, &(0x7f0000000140)={0xf, 0x8, 0xfa00, {r4}}, 0x10) write$RDMA_USER_CM_CMD_NOTIFY(0xffffffffffffffff, &(0x7f0000000000)={0xf, 0x8, 0xfa00, {r4, 0xe}}, 0x10) ioctl$sock_qrtr_SIOCGIFADDR(r2, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) socket$qrtr(0x2a, 0x2, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_REJECT(r3, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) [ 2973.645192][T21404] binder: 21402:21404 ioctl c0306201 0 returned -14 15:29:38 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c06, r0) 15:29:38 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, 0xffffffffffffffff) 15:29:38 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r1, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) r2 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x4) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000000c0)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_NOTIFY(r3, &(0x7f0000000140)={0xf, 0x8, 0xfa00, {r4}}, 0x10) write$RDMA_USER_CM_CMD_NOTIFY(0xffffffffffffffff, &(0x7f0000000000)={0xf, 0x8, 0xfa00, {r4, 0xe}}, 0x10) ioctl$sock_qrtr_SIOCGIFADDR(r2, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) socket$qrtr(0x2a, 0x2, 0x0) write$RDMA_USER_CM_CMD_REJECT(r3, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:38 executing program 1: socket(0x10, 0x0, 0x3) 15:29:38 executing program 2: socket(0x9, 0x0, 0x0) r0 = gettid() r1 = gettid() sched_rr_get_interval(r1, &(0x7f0000000100)) gettid() gettid() r2 = syz_clone3(&(0x7f0000001200)={0x40000400, &(0x7f0000000000), &(0x7f0000000040), 0x0, {0x1f}, 0x0, 0x0, &(0x7f00000001c0)=""/4096, 0x0}, 0x58) sched_rr_get_interval(r0, &(0x7f0000000140)) write$ppp(0xffffffffffffffff, &(0x7f00000014c0)="00951c69260d783a60ad16dcf1d66dd0bc7282f1962f0ca00422790f9b75b9a87e53ca2d8faf48907d5a06cc35451bf41b9928cda8c93f2c70f7d2c00079b4d6034887dedacce5aabfbdb00872619c3c62b90ff94855cf6f0bbf59145320d0bd02fa70fdc15ac047975d73c837c74e449f86a984262c083ad4fb3450ea235d67cfeb2a1c18a34cbcff46025fb1f032ad6388a3c6be7e04cf7709", 0x89) r3 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r3, 0x4c09, 0x7ff) r4 = gettid() sched_rr_get_interval(r4, &(0x7f0000000100)) r5 = gettid() sched_rr_get_interval(r5, &(0x7f0000000100)) r6 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r6, 0xc01064c2, 0x0) syz_clone3(&(0x7f0000001440)={0x300, &(0x7f0000000180), &(0x7f00000011c0), &(0x7f0000001280), {0x22}, &(0x7f00000012c0)=""/34, 0x22, &(0x7f0000001300)=""/223, &(0x7f0000001400)=[r4, r2, r5, r1], 0x4, {r6}}, 0x58) ioctl$LOOP_SET_FD(r3, 0x125f, r3) 15:29:38 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r1, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) r2 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x4) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000000c0)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_NOTIFY(r3, &(0x7f0000000140)={0xf, 0x8, 0xfa00, {r4}}, 0x10) write$RDMA_USER_CM_CMD_NOTIFY(0xffffffffffffffff, &(0x7f0000000000)={0xf, 0x8, 0xfa00, {r4, 0xe}}, 0x10) ioctl$sock_qrtr_SIOCGIFADDR(r2, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) write$RDMA_USER_CM_CMD_REJECT(r3, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:38 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, 0xffffffffffffffff) 15:29:38 executing program 1: socket(0x10, 0x0, 0x3) 15:29:38 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, 0xffffffffffffffff) 15:29:38 executing program 5: r0 = bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) ioctl$LOOP_SET_CAPACITY(r0, 0x4c07) (async) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:29:38 executing program 1: socket(0x10, 0x0, 0x3) 15:29:38 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r1, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) socket$qrtr(0x2a, 0x2, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x4) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000000c0)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_NOTIFY(r2, &(0x7f0000000140)={0xf, 0x8, 0xfa00, {r3}}, 0x10) write$RDMA_USER_CM_CMD_NOTIFY(0xffffffffffffffff, &(0x7f0000000000)={0xf, 0x8, 0xfa00, {r3, 0xe}}, 0x10) write$RDMA_USER_CM_CMD_REJECT(r2, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:38 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r1, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) r2 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x4) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000000c0)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_NOTIFY(r3, &(0x7f0000000140)={0xf, 0x8, 0xfa00, {r4}}, 0x10) write$RDMA_USER_CM_CMD_NOTIFY(0xffffffffffffffff, &(0x7f0000000000)={0xf, 0x8, 0xfa00, {r4, 0xe}}, 0x10) ioctl$sock_qrtr_SIOCGIFADDR(r2, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) socket$qrtr(0x2a, 0x2, 0x0) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000000c0)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_REJECT(r3, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {r6, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) [ 2974.584067][T21444] binder: 21443:21444 ioctl c0306201 0 returned -14 15:29:39 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) (async) r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c06, r0) 15:29:39 executing program 1: socket(0x10, 0x3, 0x0) 15:29:39 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r1, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) r2 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x4) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000000c0)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_NOTIFY(r3, &(0x7f0000000140)={0xf, 0x8, 0xfa00, {r4}}, 0x10) write$RDMA_USER_CM_CMD_NOTIFY(0xffffffffffffffff, &(0x7f0000000000)={0xf, 0x8, 0xfa00, {r4, 0xe}}, 0x10) ioctl$sock_qrtr_SIOCGIFADDR(r2, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) socket$qrtr(0x2a, 0x2, 0x0) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000000c0)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_REJECT(r3, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {r6, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:39 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r1, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) socket$qrtr(0x2a, 0x2, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x4) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000000c0)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_NOTIFY(r2, &(0x7f0000000140)={0xf, 0x8, 0xfa00, {r3}}, 0x10) write$RDMA_USER_CM_CMD_REJECT(r2, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:39 executing program 2: socket(0x9, 0x0, 0x0) (async) r0 = gettid() (async) r1 = gettid() sched_rr_get_interval(r1, &(0x7f0000000100)) gettid() (async) gettid() (async) r2 = syz_clone3(&(0x7f0000001200)={0x40000400, &(0x7f0000000000), &(0x7f0000000040), 0x0, {0x1f}, 0x0, 0x0, &(0x7f00000001c0)=""/4096, 0x0}, 0x58) (async) sched_rr_get_interval(r0, &(0x7f0000000140)) write$ppp(0xffffffffffffffff, &(0x7f00000014c0)="00951c69260d783a60ad16dcf1d66dd0bc7282f1962f0ca00422790f9b75b9a87e53ca2d8faf48907d5a06cc35451bf41b9928cda8c93f2c70f7d2c00079b4d6034887dedacce5aabfbdb00872619c3c62b90ff94855cf6f0bbf59145320d0bd02fa70fdc15ac047975d73c837c74e449f86a984262c083ad4fb3450ea235d67cfeb2a1c18a34cbcff46025fb1f032ad6388a3c6be7e04cf7709", 0x89) (async, rerun: 64) r3 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) (rerun: 64) ioctl$LOOP_SET_BLOCK_SIZE(r3, 0x4c09, 0x7ff) (async, rerun: 32) r4 = gettid() (rerun: 32) sched_rr_get_interval(r4, &(0x7f0000000100)) (async) r5 = gettid() sched_rr_get_interval(r5, &(0x7f0000000100)) (async) r6 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r6, 0xc01064c2, 0x0) (async) syz_clone3(&(0x7f0000001440)={0x300, &(0x7f0000000180), &(0x7f00000011c0), &(0x7f0000001280), {0x22}, &(0x7f00000012c0)=""/34, 0x22, &(0x7f0000001300)=""/223, &(0x7f0000001400)=[r4, r2, r5, r1], 0x4, {r6}}, 0x58) (async) ioctl$LOOP_SET_FD(r3, 0x125f, r3) 15:29:39 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r1, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) socket$qrtr(0x2a, 0x2, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x4) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000000c0), 0x111}}, 0x20) write$RDMA_USER_CM_CMD_REJECT(r2, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:39 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r1, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) r2 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x4) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000000c0)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_NOTIFY(r3, &(0x7f0000000140)={0xf, 0x8, 0xfa00, {r4}}, 0x10) write$RDMA_USER_CM_CMD_NOTIFY(0xffffffffffffffff, &(0x7f0000000000)={0xf, 0x8, 0xfa00, {r4, 0xe}}, 0x10) ioctl$sock_qrtr_SIOCGIFADDR(r2, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) socket$qrtr(0x2a, 0x2, 0x0) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000000c0)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_REJECT(r3, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {r6, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:39 executing program 1: socket(0x10, 0x3, 0x0) 15:29:39 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x24, 0x0, &(0x7f0000000100)=[@request_death, @acquire, @dead_binder_done], 0x20, 0x0, &(0x7f0000000140)="3889798d58f10fb80a06938a03d3c42e498f27b5d782f87b45e2477069a01932"}) pselect6(0x40, &(0x7f0000000180)={0x0, 0x10000000000, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x68}, 0x0, 0x0) clock_getres(0x1, &(0x7f0000000240)) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, 0x0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f00000000c0), 0x40, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_DESTROY(r3, 0xc00864c0, &(0x7f0000000040)) 15:29:39 executing program 1: socket(0x10, 0x3, 0x0) 15:29:39 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r1, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) socket$qrtr(0x2a, 0x2, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x4) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_REJECT(r2, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:39 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r1, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) r2 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x4) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000000c0)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_NOTIFY(r3, &(0x7f0000000140)={0xf, 0x8, 0xfa00, {r4}}, 0x10) write$RDMA_USER_CM_CMD_NOTIFY(0xffffffffffffffff, &(0x7f0000000000)={0xf, 0x8, 0xfa00, {r4, 0xe}}, 0x10) ioctl$sock_qrtr_SIOCGIFADDR(r2, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) socket$qrtr(0x2a, 0x2, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_REJECT(r3, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) [ 2975.481127][T21469] binder: 21467:21469 ioctl c0306201 0 returned -14 15:29:39 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f0000000180)={0xffffffffffffffff}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:29:39 executing program 1: socket(0x9, 0x0, 0x0) r0 = gettid() r1 = gettid() sched_rr_get_interval(r1, &(0x7f0000000100)) gettid() gettid() r2 = syz_clone3(&(0x7f0000001200)={0x40000400, &(0x7f0000000000), &(0x7f0000000040), 0x0, {0x1f}, 0x0, 0x0, &(0x7f00000001c0)=""/4096, 0x0}, 0x58) sched_rr_get_interval(r0, &(0x7f0000000140)) write$ppp(0xffffffffffffffff, &(0x7f00000014c0)="00951c69260d783a60ad16dcf1d66dd0bc7282f1962f0ca00422790f9b75b9a87e53ca2d8faf48907d5a06cc35451bf41b9928cda8c93f2c70f7d2c00079b4d6034887dedacce5aabfbdb00872619c3c62b90ff94855cf6f0bbf59145320d0bd02fa70fdc15ac047975d73c837c74e449f86a984262c083ad4fb3450ea235d67cfeb2a1c18a34cbcff46025fb1f032ad6388a3c6be7e04cf7709", 0x89) r3 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r3, 0x4c09, 0x7ff) r4 = gettid() sched_rr_get_interval(r4, &(0x7f0000000100)) r5 = gettid() sched_rr_get_interval(r5, &(0x7f0000000100)) r6 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r6, 0xc01064c2, 0x0) syz_clone3(&(0x7f0000001440)={0x300, &(0x7f0000000180), &(0x7f00000011c0), &(0x7f0000001280), {0x22}, &(0x7f00000012c0)=""/34, 0x22, &(0x7f0000001300)=""/223, &(0x7f0000001400)=[r4, r2, r5, r1], 0x4, {r6}}, 0x58) ioctl$LOOP_SET_FD(r3, 0x125f, r3) 15:29:39 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r1, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) socket$qrtr(0x2a, 0x2, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x4) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:39 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r1, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) r2 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x4) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000000c0)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_NOTIFY(r3, &(0x7f0000000140)={0xf, 0x8, 0xfa00, {r4}}, 0x10) write$RDMA_USER_CM_CMD_NOTIFY(0xffffffffffffffff, &(0x7f0000000000)={0xf, 0x8, 0xfa00, {r4, 0xe}}, 0x10) ioctl$sock_qrtr_SIOCGIFADDR(r2, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) socket$qrtr(0x2a, 0x2, 0x0) write$RDMA_USER_CM_CMD_REJECT(r3, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:39 executing program 2: socket(0x9, 0x0, 0x0) (async) r0 = gettid() (async) r1 = gettid() sched_rr_get_interval(r1, &(0x7f0000000100)) gettid() gettid() (async) r2 = syz_clone3(&(0x7f0000001200)={0x40000400, &(0x7f0000000000), &(0x7f0000000040), 0x0, {0x1f}, 0x0, 0x0, &(0x7f00000001c0)=""/4096, 0x0}, 0x58) (async) sched_rr_get_interval(r0, &(0x7f0000000140)) (async) write$ppp(0xffffffffffffffff, &(0x7f00000014c0)="00951c69260d783a60ad16dcf1d66dd0bc7282f1962f0ca00422790f9b75b9a87e53ca2d8faf48907d5a06cc35451bf41b9928cda8c93f2c70f7d2c00079b4d6034887dedacce5aabfbdb00872619c3c62b90ff94855cf6f0bbf59145320d0bd02fa70fdc15ac047975d73c837c74e449f86a984262c083ad4fb3450ea235d67cfeb2a1c18a34cbcff46025fb1f032ad6388a3c6be7e04cf7709", 0x89) r3 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r3, 0x4c09, 0x7ff) (async) r4 = gettid() sched_rr_get_interval(r4, &(0x7f0000000100)) (async) r5 = gettid() sched_rr_get_interval(r5, &(0x7f0000000100)) (async) r6 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r6, 0xc01064c2, 0x0) syz_clone3(&(0x7f0000001440)={0x300, &(0x7f0000000180), &(0x7f00000011c0), &(0x7f0000001280), {0x22}, &(0x7f00000012c0)=""/34, 0x22, &(0x7f0000001300)=""/223, &(0x7f0000001400)=[r4, r2, r5, r1], 0x4, {r6}}, 0x58) (async) ioctl$LOOP_SET_FD(r3, 0x125f, r3) 15:29:40 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r1, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) socket$qrtr(0x2a, 0x2, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x4) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:40 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r1, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) r2 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x4) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000000c0)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_NOTIFY(r3, &(0x7f0000000140)={0xf, 0x8, 0xfa00, {r4}}, 0x10) write$RDMA_USER_CM_CMD_NOTIFY(0xffffffffffffffff, &(0x7f0000000000)={0xf, 0x8, 0xfa00, {r4, 0xe}}, 0x10) ioctl$sock_qrtr_SIOCGIFADDR(r2, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) write$RDMA_USER_CM_CMD_REJECT(r3, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:40 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f0000000180)={0xffffffffffffffff}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:29:40 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) (async) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x24, 0x0, &(0x7f0000000100)=[@request_death, @acquire, @dead_binder_done], 0x20, 0x0, &(0x7f0000000140)="3889798d58f10fb80a06938a03d3c42e498f27b5d782f87b45e2477069a01932"}) (async) pselect6(0x40, &(0x7f0000000180)={0x0, 0x10000000000, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x68}, 0x0, 0x0) (async) clock_getres(0x1, &(0x7f0000000240)) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, 0x0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f00000000c0), 0x40, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_DESTROY(r3, 0xc00864c0, &(0x7f0000000040)) 15:29:40 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r1, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) socket$qrtr(0x2a, 0x2, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x4) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000000c0)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_NOTIFY(r2, &(0x7f0000000140)={0xf, 0x8, 0xfa00, {r3}}, 0x10) write$RDMA_USER_CM_CMD_NOTIFY(0xffffffffffffffff, &(0x7f0000000000)={0xf, 0x8, 0xfa00, {r3, 0xe}}, 0x10) write$RDMA_USER_CM_CMD_REJECT(r2, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:40 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r1, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) socket$qrtr(0x2a, 0x2, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x4) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:40 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f0000000180)={0xffffffffffffffff}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) pipe2$9p(&(0x7f0000000000), 0x0) (async) pselect6(0x40, &(0x7f0000000180)={0xffffffffffffffff}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) (async) [ 2976.432314][T21499] binder: 21497:21499 ioctl c0306201 0 returned -14 15:29:40 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r1, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) socket$qrtr(0x2a, 0x2, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x4) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000000c0)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_NOTIFY(r2, &(0x7f0000000140)={0xf, 0x8, 0xfa00, {r3}}, 0x10) write$RDMA_USER_CM_CMD_REJECT(r2, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:40 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r1, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) r2 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x4) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000000c0)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_NOTIFY(r3, &(0x7f0000000140)={0xf, 0x8, 0xfa00, {r4}}, 0x10) write$RDMA_USER_CM_CMD_NOTIFY(0xffffffffffffffff, &(0x7f0000000000)={0xf, 0x8, 0xfa00, {r4, 0xe}}, 0x10) ioctl$sock_qrtr_SIOCGIFADDR(r2, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) socket$qrtr(0x2a, 0x2, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_REJECT(r3, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:40 executing program 4: syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r0 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r0, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) socket$qrtr(0x2a, 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_REJECT(r1, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:40 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0xffffffffffffff0f, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, 0x0, &(0x7f0000000200)={0x7f, 0x0, 0x2, 0x0, 0x0, 0x9}, 0x0, 0x0) 15:29:40 executing program 2: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x8000) ioctl$LOOP_SET_FD(r0, 0x125f, 0xffffffffffffffff) 15:29:40 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r1, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) socket$qrtr(0x2a, 0x2, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x4) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000000c0), 0x111}}, 0x20) write$RDMA_USER_CM_CMD_REJECT(r2, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:40 executing program 2: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x8000) ioctl$LOOP_SET_FD(r0, 0x125f, 0xffffffffffffffff) 15:29:40 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0xffffffffffffff0f, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, 0x0, &(0x7f0000000200)={0x7f, 0x0, 0x2, 0x0, 0x0, 0x9}, 0x0, 0x0) 15:29:41 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x24, 0x0, &(0x7f0000000100)=[@request_death, @acquire, @dead_binder_done], 0x20, 0x0, &(0x7f0000000140)="3889798d58f10fb80a06938a03d3c42e498f27b5d782f87b45e2477069a01932"}) (async) pselect6(0x40, &(0x7f0000000180)={0x0, 0x10000000000, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x68}, 0x0, 0x0) clock_getres(0x1, &(0x7f0000000240)) (async) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, 0x0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f00000000c0), 0x40, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_DESTROY(r3, 0xc00864c0, &(0x7f0000000040)) 15:29:41 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r1, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) socket$qrtr(0x2a, 0x2, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x4) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_REJECT(r2, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:41 executing program 4: syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r0 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r0, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_REJECT(r1, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:41 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r1, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) r2 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x4) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000000c0)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_NOTIFY(r3, &(0x7f0000000140)={0xf, 0x8, 0xfa00, {r4}}, 0x10) write$RDMA_USER_CM_CMD_NOTIFY(0xffffffffffffffff, &(0x7f0000000000)={0xf, 0x8, 0xfa00, {r4, 0xe}}, 0x10) ioctl$sock_qrtr_SIOCGIFADDR(r2, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) socket$qrtr(0x2a, 0x2, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_REJECT(r3, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:41 executing program 2: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x8000) ioctl$LOOP_SET_FD(r0, 0x125f, 0xffffffffffffffff) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x8000) (async) ioctl$LOOP_SET_FD(r0, 0x125f, 0xffffffffffffffff) (async) 15:29:41 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) (async) pselect6(0x40, &(0x7f0000000180)={0x0, 0xffffffffffffff0f, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, 0x0, &(0x7f0000000200)={0x7f, 0x0, 0x2, 0x0, 0x0, 0x9}, 0x0, 0x0) 15:29:41 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) ioctl$VT_RELDISP(r0, 0x5605) r2 = syz_open_dev$loop(&(0x7f0000000040), 0x2, 0x600800) ioctl$LOOP_SET_FD(r2, 0x125f, 0xffffffffffffffff) 15:29:41 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r1, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) socket$qrtr(0x2a, 0x2, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x4) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:41 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r1, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) r2 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x4) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000000c0)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_NOTIFY(r3, &(0x7f0000000140)={0xf, 0x8, 0xfa00, {r4}}, 0x10) write$RDMA_USER_CM_CMD_NOTIFY(0xffffffffffffffff, &(0x7f0000000000)={0xf, 0x8, 0xfa00, {r4, 0xe}}, 0x10) ioctl$sock_qrtr_SIOCGIFADDR(r2, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) socket$qrtr(0x2a, 0x2, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_REJECT(r3, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:41 executing program 4: syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) socket$qrtr(0x2a, 0x2, 0x0) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:41 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0xfffffffffffffff8, 0x0, 0x100}, 0x0, &(0x7f0000000040)={0x1c, 0x0, 0x0, 0x10001, 0x0, 0x0, 0x8001}, 0x0, 0x0) [ 2977.337548][T21541] binder: 21540:21541 ioctl c0306201 0 returned -14 15:29:41 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) ioctl$VT_RELDISP(r0, 0x5605) r2 = syz_open_dev$loop(&(0x7f0000000040), 0x2, 0x600800) ioctl$LOOP_SET_FD(r2, 0x125f, 0xffffffffffffffff) syz_open_dev$ttys(0xc, 0x2, 0x0) (async) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) (async) ioctl$VT_RELDISP(r0, 0x5605) (async) syz_open_dev$loop(&(0x7f0000000040), 0x2, 0x600800) (async) ioctl$LOOP_SET_FD(r2, 0x125f, 0xffffffffffffffff) (async) 15:29:41 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r1, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) socket$qrtr(0x2a, 0x2, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x4) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:41 executing program 4: syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:41 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r1, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) r2 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x4) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000000c0)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_NOTIFY(r3, &(0x7f0000000140)={0xf, 0x8, 0xfa00, {r4}}, 0x10) write$RDMA_USER_CM_CMD_NOTIFY(0xffffffffffffffff, &(0x7f0000000000)={0xf, 0x8, 0xfa00, {r4, 0xe}}, 0x10) ioctl$sock_qrtr_SIOCGIFADDR(r2, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) socket$qrtr(0x2a, 0x2, 0x0) write$RDMA_USER_CM_CMD_REJECT(r3, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:41 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) read$msr(0xffffffffffffffff, &(0x7f0000000240)=""/4096, 0x1000) ioctl$PPPIOCATTCHAN(0xffffffffffffffff, 0x40047438, &(0x7f0000000040)) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(0xffffffffffffffff, 0xc02864ca, &(0x7f0000000140)={&(0x7f00000000c0)=[0x0, 0x0], &(0x7f0000000100)=[0x10000], 0xe68, 0x2, 0x3}) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) r2 = syz_open_pts(r1, 0x80800) ioctl$TIOCL_SETVESABLANK(r2, 0x541c, &(0x7f00000001c0)) mmap$binder(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x1, 0x11, r1, 0x100) 15:29:41 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) ioctl$VT_RELDISP(r0, 0x5605) r2 = syz_open_dev$loop(&(0x7f0000000040), 0x2, 0x600800) ioctl$LOOP_SET_FD(r2, 0x125f, 0xffffffffffffffff) syz_open_dev$ttys(0xc, 0x2, 0x0) (async) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) (async) ioctl$VT_RELDISP(r0, 0x5605) (async) syz_open_dev$loop(&(0x7f0000000040), 0x2, 0x600800) (async) ioctl$LOOP_SET_FD(r2, 0x125f, 0xffffffffffffffff) (async) [ 2977.520296][T21560] binder: 21555:21560 ioctl c0306201 0 returned -14 15:29:41 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:41 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r1, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) r2 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x4) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000000c0)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_NOTIFY(r3, &(0x7f0000000140)={0xf, 0x8, 0xfa00, {r4}}, 0x10) write$RDMA_USER_CM_CMD_NOTIFY(0xffffffffffffffff, &(0x7f0000000000)={0xf, 0x8, 0xfa00, {r4, 0xe}}, 0x10) ioctl$sock_qrtr_SIOCGIFADDR(r2, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) write$RDMA_USER_CM_CMD_REJECT(r3, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:41 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r1, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) socket$qrtr(0x2a, 0x2, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x4) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:41 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:41 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r1, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) socket$qrtr(0x2a, 0x2, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x4) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000000c0)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_NOTIFY(r2, &(0x7f0000000140)={0xf, 0x8, 0xfa00, {r3}}, 0x10) write$RDMA_USER_CM_CMD_NOTIFY(0xffffffffffffffff, &(0x7f0000000000)={0xf, 0x8, 0xfa00, {r3, 0xe}}, 0x10) write$RDMA_USER_CM_CMD_REJECT(r2, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:42 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) (async) pselect6(0x40, &(0x7f0000000180)={0x0, 0xfffffffffffffff8, 0x0, 0x100}, 0x0, &(0x7f0000000040)={0x1c, 0x0, 0x0, 0x10001, 0x0, 0x0, 0x8001}, 0x0, 0x0) 15:29:42 executing program 2: r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(r0, &(0x7f0000000080)='3\x00', 0x2) r1 = syz_open_dev$loop(&(0x7f0000000000), 0x94, 0x40) ioctl$LOOP_SET_FD(r1, 0x125f, 0xffffffffffffffff) 15:29:42 executing program 0: syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r0 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r0, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) socket$qrtr(0x2a, 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_REJECT(r1, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:42 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:42 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r1, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) socket$qrtr(0x2a, 0x2, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x4) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000000c0)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_NOTIFY(r2, &(0x7f0000000140)={0xf, 0x8, 0xfa00, {r3}}, 0x10) write$RDMA_USER_CM_CMD_REJECT(r2, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:42 executing program 0: syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r0 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r0, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_REJECT(r1, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:42 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:42 executing program 2: r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(r0, &(0x7f0000000080)='3\x00', 0x2) (async) r1 = syz_open_dev$loop(&(0x7f0000000000), 0x94, 0x40) ioctl$LOOP_SET_FD(r1, 0x125f, 0xffffffffffffffff) 15:29:42 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) read$msr(0xffffffffffffffff, &(0x7f0000000240)=""/4096, 0x1000) ioctl$PPPIOCATTCHAN(0xffffffffffffffff, 0x40047438, &(0x7f0000000040)) (async, rerun: 32) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(0xffffffffffffffff, 0xc02864ca, &(0x7f0000000140)={&(0x7f00000000c0)=[0x0, 0x0], &(0x7f0000000100)=[0x10000], 0xe68, 0x2, 0x3}) (async, rerun: 32) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) (async) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) (async) r2 = syz_open_pts(r1, 0x80800) ioctl$TIOCL_SETVESABLANK(r2, 0x541c, &(0x7f00000001c0)) (async) mmap$binder(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x1, 0x11, r1, 0x100) 15:29:42 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r1, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) socket$qrtr(0x2a, 0x2, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x4) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000000c0), 0x111}}, 0x20) write$RDMA_USER_CM_CMD_REJECT(r2, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:42 executing program 4: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:42 executing program 0: syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) socket$qrtr(0x2a, 0x2, 0x0) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) [ 2978.442516][T21606] binder: 21605:21606 ioctl c0306201 0 returned -14 15:29:42 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) (async) pselect6(0x40, &(0x7f0000000180)={0x0, 0xfffffffffffffff8, 0x0, 0x100}, 0x0, &(0x7f0000000040)={0x1c, 0x0, 0x0, 0x10001, 0x0, 0x0, 0x8001}, 0x0, 0x0) 15:29:42 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r1, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) socket$qrtr(0x2a, 0x2, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x4) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_REJECT(r2, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:42 executing program 2: r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(r0, &(0x7f0000000080)='3\x00', 0x2) r1 = syz_open_dev$loop(&(0x7f0000000000), 0x94, 0x40) ioctl$LOOP_SET_FD(r1, 0x125f, 0xffffffffffffffff) openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/clear_refs\x00', 0x1, 0x0) (async) write$sysctl(r0, &(0x7f0000000080)='3\x00', 0x2) (async) syz_open_dev$loop(&(0x7f0000000000), 0x94, 0x40) (async) ioctl$LOOP_SET_FD(r1, 0x125f, 0xffffffffffffffff) (async) 15:29:42 executing program 4: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:42 executing program 0: syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:43 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:43 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r1, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) socket$qrtr(0x2a, 0x2, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x4) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:43 executing program 4: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:43 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) read$msr(0xffffffffffffffff, &(0x7f0000000240)=""/4096, 0x1000) ioctl$PPPIOCATTCHAN(0xffffffffffffffff, 0x40047438, &(0x7f0000000040)) (async) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(0xffffffffffffffff, 0xc02864ca, &(0x7f0000000140)={&(0x7f00000000c0)=[0x0, 0x0], &(0x7f0000000100)=[0x10000], 0xe68, 0x2, 0x3}) (async) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) (async) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) (async) r2 = syz_open_pts(r1, 0x80800) ioctl$TIOCL_SETVESABLANK(r2, 0x541c, &(0x7f00000001c0)) mmap$binder(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x1, 0x11, r1, 0x100) 15:29:43 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) read$msr(0xffffffffffffffff, &(0x7f0000000240)=""/4096, 0x1000) ioctl$PPPIOCATTCHAN(0xffffffffffffffff, 0x40047438, &(0x7f0000000040)) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(0xffffffffffffffff, 0xc02864ca, &(0x7f0000000140)={&(0x7f00000000c0)=[0x0, 0x0], &(0x7f0000000100)=[0x10000], 0xe68, 0x2, 0x3}) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) r2 = syz_open_pts(r1, 0x80800) ioctl$TIOCL_SETVESABLANK(r2, 0x541c, &(0x7f00000001c0)) mmap$binder(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x1, 0x11, r1, 0x100) 15:29:43 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r1, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) socket$qrtr(0x2a, 0x2, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x4) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:43 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_REJECT(r0, 0x0, 0x0) [ 2979.327872][T21635] binder: 21634:21635 ioctl c0306201 0 returned -14 [ 2979.369392][T21639] binder: 21636:21639 ioctl c0306201 0 returned -14 15:29:43 executing program 3: pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:29:43 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:43 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r1, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) socket$qrtr(0x2a, 0x2, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x4) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:43 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_REJECT(r0, 0x0, 0x0) 15:29:43 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:43 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_REJECT(r0, 0x0, 0x0) 15:29:43 executing program 3: pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:29:43 executing program 1: syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r0 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r0, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) socket$qrtr(0x2a, 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_REJECT(r1, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:44 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x416000, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x29bc, 0x4000}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x3}, 0x0, 0x0) 15:29:44 executing program 2: r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(r0, &(0x7f0000000080)='3\x00', 0x2) r1 = syz_open_dev$loop(&(0x7f0000000000), 0x94, 0x40) ioctl$LOOP_SET_FD(r1, 0x125f, 0xffffffffffffffff) 15:29:44 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:44 executing program 1: syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r0 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r0, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_REJECT(r1, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:44 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x0, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:44 executing program 3: pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) (async) 15:29:44 executing program 0: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:44 executing program 2: r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(r0, &(0x7f0000000080)='3\x00', 0x2) r1 = syz_open_dev$loop(&(0x7f0000000000), 0x94, 0x40) ioctl$LOOP_SET_FD(r1, 0x125f, 0xffffffffffffffff) 15:29:44 executing program 4: syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r0 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r0, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) socket$qrtr(0x2a, 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_REJECT(r1, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) [ 2980.305804][T21672] binder: 21670:21672 ioctl c0306201 0 returned -14 15:29:44 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) ioctl$VT_RELDISP(0xffffffffffffffff, 0x5605) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:29:44 executing program 1: syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) socket$qrtr(0x2a, 0x2, 0x0) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:44 executing program 0: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:44 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) (async, rerun: 32) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async, rerun: 32) openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x416000, 0x0) (async) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x29bc, 0x4000}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x3}, 0x0, 0x0) 15:29:44 executing program 4: r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(r0, &(0x7f0000000080)='3\x00', 0x2) r1 = syz_open_dev$loop(&(0x7f0000000000), 0x94, 0x40) ioctl$LOOP_SET_FD(r1, 0x125f, 0xffffffffffffffff) 15:29:44 executing program 1: syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:44 executing program 2: r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(r0, &(0x7f0000000080)='3\x00', 0x2) r1 = syz_open_dev$loop(&(0x7f0000000000), 0x94, 0x40) ioctl$LOOP_SET_FD(r1, 0x125f, 0xffffffffffffffff) 15:29:44 executing program 0: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:44 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_REJECT(r0, 0x0, 0x0) 15:29:45 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:45 executing program 4: r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(r0, &(0x7f0000000080)='3\x00', 0x2) r1 = syz_open_dev$loop(&(0x7f0000000000), 0x94, 0x40) ioctl$LOOP_SET_FD(r1, 0x125f, 0xffffffffffffffff) 15:29:45 executing program 2: r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(r0, &(0x7f0000000080)='3\x00', 0x2) syz_open_dev$loop(&(0x7f0000000000), 0x94, 0x40) 15:29:45 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) (async) ioctl$VT_RELDISP(0xffffffffffffffff, 0x5605) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) [ 2981.219673][T21696] binder: 21695:21696 ioctl c0306201 0 returned -14 15:29:45 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_REJECT(r0, 0x0, 0x0) [ 2981.283002][T21696] binder: 21695:21696 ioctl c0306201 0 returned -14 [ 2981.304961][T21696] binder: 21695:21696 ioctl c0306201 0 returned -14 15:29:45 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) [ 2981.332850][T21696] binder: 21695:21696 ioctl c0306201 0 returned -14 [ 2981.357934][T21696] binder: 21695:21696 ioctl c0306201 0 returned -14 [ 2981.394579][T21696] binder: 21695:21696 ioctl c0306201 0 returned -14 [ 2981.402113][T21696] binder: 21695:21696 ioctl c0306201 0 returned -14 [ 2981.408947][T21696] binder: 21695:21696 ioctl c0306201 0 returned -14 [ 2981.416882][T21696] binder: 21695:21696 ioctl c0306201 0 returned -14 [ 2981.424826][T21696] binder: 21695:21696 ioctl c0306201 0 returned -14 [ 2981.435738][T21696] binder: 21695:21696 ioctl c0306201 0 returned -14 [ 2981.442717][T21696] binder: 21695:21696 ioctl c0306201 0 returned -14 [ 2981.449486][T21696] binder: 21695:21696 ioctl c0306201 0 returned -14 [ 2981.462136][T21696] binder: 21695:21696 ioctl c0306201 0 returned -14 [ 2981.468954][T21696] binder: 21695:21696 ioctl c0306201 0 returned -14 [ 2981.476038][T21696] binder: 21695:21696 ioctl c0306201 0 returned -14 [ 2981.482793][T21696] binder: 21695:21696 ioctl c0306201 0 returned -14 [ 2981.489876][T21696] binder: 21695:21696 ioctl c0306201 0 returned -14 [ 2981.496711][T21696] binder: 21695:21696 ioctl c0306201 0 returned -14 [ 2981.504245][T21696] binder: 21695:21696 ioctl c0306201 0 returned -14 [ 2981.511114][T21696] binder: 21695:21696 ioctl c0306201 0 returned -14 [ 2981.517791][T21696] binder: 21695:21696 ioctl c0306201 0 returned -14 [ 2981.524528][T21696] binder: 21695:21696 ioctl c0306201 0 returned -14 [ 2981.532272][T21696] binder: 21695:21696 ioctl c0306201 0 returned -14 [ 2981.539049][T21696] binder: 21695:21696 ioctl c0306201 0 returned -14 [ 2981.549792][T21696] binder: 21695:21696 ioctl c0306201 0 returned -14 [ 2981.556754][T21696] binder: 21695:21696 ioctl c0306201 0 returned -14 [ 2981.563608][T21696] binder: 21695:21696 ioctl c0306201 0 returned -14 [ 2981.570317][T21696] binder: 21695:21696 ioctl c0306201 0 returned -14 [ 2981.578151][T21696] binder: 21695:21696 ioctl c0306201 0 returned -14 [ 2981.585191][T21696] binder: 21695:21696 ioctl c0306201 0 returned -14 15:29:45 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x416000, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x29bc, 0x4000}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x3}, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x416000, 0x0) (async) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x29bc, 0x4000}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x3}, 0x0, 0x0) (async) 15:29:45 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) (async) ioctl$VT_RELDISP(0xffffffffffffffff, 0x5605) (async) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:29:45 executing program 4: r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(r0, &(0x7f0000000080)='3\x00', 0x2) r1 = syz_open_dev$loop(&(0x7f0000000000), 0x94, 0x40) ioctl$LOOP_SET_FD(r1, 0x125f, 0xffffffffffffffff) 15:29:45 executing program 2: r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(r0, &(0x7f0000000080)='3\x00', 0x2) syz_open_dev$loop(&(0x7f0000000000), 0x94, 0x40) 15:29:45 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_REJECT(r0, 0x0, 0x0) 15:29:45 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) [ 2981.592704][T21696] binder: 21695:21696 ioctl c0306201 0 returned -14 [ 2981.599380][T21696] binder: 21695:21696 ioctl c0306201 0 returned -14 15:29:45 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x0, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:45 executing program 4: r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(r0, &(0x7f0000000080)='3\x00', 0x2) syz_open_dev$loop(&(0x7f0000000000), 0x94, 0x40) 15:29:45 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) [ 2981.664021][T21728] binder: 21716:21728 ioctl c0306201 0 returned -14 15:29:45 executing program 2: r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(r0, &(0x7f0000000080)='3\x00', 0x2) 15:29:45 executing program 0: r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(r0, &(0x7f0000000080)='3\x00', 0x2) syz_open_dev$loop(&(0x7f0000000000), 0x94, 0x40) 15:29:45 executing program 4: r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(r0, &(0x7f0000000080)='3\x00', 0x2) [ 2981.729655][T21732] binder: 21716:21732 ioctl c0306201 0 returned -14 15:29:46 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x4002, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:29:46 executing program 1: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:46 executing program 2: write$sysctl(0xffffffffffffffff, &(0x7f0000000080)='3\x00', 0x2) 15:29:46 executing program 0: r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(r0, &(0x7f0000000080)='3\x00', 0x2) syz_open_dev$loop(&(0x7f0000000000), 0x94, 0x40) 15:29:46 executing program 4: openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/clear_refs\x00', 0x1, 0x0) 15:29:46 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000000c0)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_NOTIFY(r1, &(0x7f0000000140)={0xf, 0x8, 0xfa00, {r2}}, 0x10) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000040)={0x3, 0x40, 0xfa00, {{0xa, 0x4e24, 0x7f, @local, 0x2}, {0xa, 0x4e24, 0x9, @private1, 0x9}, r2, 0x2}}, 0x48) 15:29:46 executing program 1: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:46 executing program 2: write$sysctl(0xffffffffffffffff, &(0x7f0000000080)='3\x00', 0x2) 15:29:46 executing program 4: openat$sysctl(0xffffffffffffff9c, 0x0, 0x1, 0x0) 15:29:46 executing program 0: r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(r0, &(0x7f0000000080)='3\x00', 0x2) syz_open_dev$loop(&(0x7f0000000000), 0x94, 0x40) [ 2982.575645][T21756] binder: 21755:21756 ioctl c0306201 0 returned -14 15:29:46 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) (async, rerun: 64) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x4002, 0x0) (async, rerun: 64) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:29:46 executing program 2: write$sysctl(0xffffffffffffffff, &(0x7f0000000080)='3\x00', 0x2) 15:29:46 executing program 4: openat$sysctl(0xffffffffffffff9c, 0x0, 0x1, 0x0) 15:29:46 executing program 1: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x9, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:46 executing program 0: r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(r0, &(0x7f0000000080)='3\x00', 0x2) 15:29:46 executing program 2: r0 = openat$sysctl(0xffffffffffffff9c, 0x0, 0x1, 0x0) write$sysctl(r0, &(0x7f0000000080)='3\x00', 0x2) 15:29:46 executing program 4: openat$sysctl(0xffffffffffffff9c, 0x0, 0x1, 0x0) [ 2982.724228][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 [ 2982.767291][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 [ 2982.821266][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 [ 2982.838305][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 [ 2982.894933][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 [ 2982.908513][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 [ 2982.922295][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 [ 2982.929220][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 [ 2982.937727][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 [ 2982.947530][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 [ 2982.954962][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 [ 2982.962353][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 [ 2982.969628][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 [ 2982.977101][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 [ 2982.988626][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 [ 2982.999210][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 [ 2983.012680][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 [ 2983.028591][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 [ 2983.035797][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 [ 2983.051627][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 [ 2983.058609][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 [ 2983.076917][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 [ 2983.087967][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 [ 2983.095309][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 [ 2983.102968][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 [ 2983.109912][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 [ 2983.117083][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 [ 2983.125038][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 [ 2983.132082][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 [ 2983.138762][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 [ 2983.145767][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 [ 2983.153088][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 [ 2983.159846][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 [ 2983.167898][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 [ 2983.174778][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 [ 2983.181788][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 [ 2983.189056][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 [ 2983.195930][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 [ 2983.203137][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 [ 2983.210001][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 [ 2983.217531][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 [ 2983.225518][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 [ 2983.232962][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 [ 2983.239868][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 [ 2983.246864][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 [ 2983.253773][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 [ 2983.260469][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 [ 2983.267302][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 [ 2983.274030][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 [ 2983.280871][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 [ 2983.287586][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 [ 2983.294696][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 [ 2983.303824][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 [ 2983.311132][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 [ 2983.317855][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 [ 2983.324735][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 [ 2983.332939][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 [ 2983.339711][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 [ 2983.346531][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 15:29:47 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000000c0)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_NOTIFY(r1, &(0x7f0000000140)={0xf, 0x8, 0xfa00, {r2}}, 0x10) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000040)={0x3, 0x40, 0xfa00, {{0xa, 0x4e24, 0x7f, @local, 0x2}, {0xa, 0x4e24, 0x9, @private1, 0x9}, r2, 0x2}}, 0x48) pipe2$9p(&(0x7f0000000000), 0x0) (async) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) (async) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000000c0), 0x111}}, 0x20) (async) write$RDMA_USER_CM_CMD_NOTIFY(r1, &(0x7f0000000140)={0xf, 0x8, 0xfa00, {r2}}, 0x10) (async) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000040)={0x3, 0x40, 0xfa00, {{0xa, 0x4e24, 0x7f, @local, 0x2}, {0xa, 0x4e24, 0x9, @private1, 0x9}, r2, 0x2}}, 0x48) (async) 15:29:47 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_REJECT(r0, 0x0, 0x0) 15:29:47 executing program 0: write$sysctl(0xffffffffffffffff, &(0x7f0000000080)='3\x00', 0x2) 15:29:47 executing program 2: r0 = openat$sysctl(0xffffffffffffff9c, 0x0, 0x1, 0x0) write$sysctl(r0, &(0x7f0000000080)='3\x00', 0x2) 15:29:47 executing program 4: r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(r0, &(0x7f0000000080)='3\x00', 0x2) [ 2983.353352][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 [ 2983.360215][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 [ 2983.367043][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 [ 2983.373870][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 [ 2983.381131][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 [ 2983.391448][T21768] binder: 21766:21768 ioctl c0306201 0 returned -14 15:29:47 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x4002, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x4002, 0x0) (async) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) (async) 15:29:47 executing program 0: write$sysctl(0xffffffffffffffff, &(0x7f0000000080)='3\x00', 0x2) 15:29:47 executing program 2: r0 = openat$sysctl(0xffffffffffffff9c, 0x0, 0x1, 0x0) write$sysctl(r0, &(0x7f0000000080)='3\x00', 0x2) 15:29:47 executing program 4: r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(r0, &(0x7f0000000080)='3\x00', 0x2) 15:29:47 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_REJECT(r0, 0x0, 0x0) 15:29:47 executing program 0: write$sysctl(0xffffffffffffffff, &(0x7f0000000080)='3\x00', 0x2) 15:29:47 executing program 2: openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(0xffffffffffffffff, &(0x7f0000000080)='3\x00', 0x2) [ 2983.545108][T21804] binder: 21793:21804 ioctl c0306201 0 returned -14 [ 2983.584424][T21808] binder: 21793:21808 ioctl c0306201 0 returned -14 15:29:48 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) (async) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) (async) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) (async) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000000c0)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_NOTIFY(r1, &(0x7f0000000140)={0xf, 0x8, 0xfa00, {r2}}, 0x10) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000040)={0x3, 0x40, 0xfa00, {{0xa, 0x4e24, 0x7f, @local, 0x2}, {0xa, 0x4e24, 0x9, @private1, 0x9}, r2, 0x2}}, 0x48) 15:29:48 executing program 4: r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(r0, &(0x7f0000000080)='3\x00', 0x2) 15:29:48 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_REJECT(r0, 0x0, 0x0) 15:29:48 executing program 0: r0 = openat$sysctl(0xffffffffffffff9c, 0x0, 0x1, 0x0) write$sysctl(r0, &(0x7f0000000080)='3\x00', 0x2) 15:29:48 executing program 2: openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(0xffffffffffffffff, &(0x7f0000000080)='3\x00', 0x2) 15:29:48 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r1 = syz_open_dev$ttys(0xc, 0x2, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, 0x0) ioctl$KDSKBENT(r2, 0x4b47, &(0x7f0000000240)={0x5, 0x1, 0x3}) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) r3 = bpf$ITER_CREATE(0x21, &(0x7f0000000040)={r2}, 0x8) ioctl$VT_RELDISP(r3, 0x5605) ioctl$KDSKBENT(r1, 0x4b47, &(0x7f0000000280)={0xeb, 0x20, 0x9}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x20, 0x0, &(0x7f0000000040)=ANY=[], 0x97, 0x0, &(0x7f00000000c0)="b0a07a3ec35ff9cf59f93a2247c4e88d1f2551dde6d0b79d24a6c5f0608604541aa48c236fa233e879128d6fcc34602362586f5a66d8f705b4e20a4c410184c52b24f983ab5a10a94f810e73cfa7b9a99f0aa7df80579274c75dff98ae58dd6e97b76afd5d1dcd7f2abb7e2654476585b9955eda3705fd52c1431c284e48e8bfd6dfadc092320e86f0e267d6e999d45f6f94987463c98b"}) 15:29:48 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x0, "23e4a2", "37c623ef13b414b88000955fdc5fa1ff84efe0db2545a7a15b03fc6fc639e3681464c56d548e4e41a180e097c7eba8d612aa577c82a606ae10147de2f5651723db02e0a2ee710e098881d9864e4160eee477ad16d3e1bc38d2cc691e70410fdfe7cd47abbc5fdf10690bbc7ca6d73a80841646558f0c2919a7ac7bc32f54e2628a5b0202b2eee77b7600e211d7cefea4f4aab16352daac6fe59fc827bbc2b39f37f2e61edb63ee2c15da771defad8c653b3cd2d958d498617bfc45156528d8b4fac51259cf32b4dafcd0f51fec6b3746e8e68f2ad5bc0197e1f98e57b9678b77c30852932ab7abf055e8782908ba8397f430871c3186d08f3f57e8acf818555a"}}, 0x110) 15:29:48 executing program 0: r0 = openat$sysctl(0xffffffffffffff9c, 0x0, 0x1, 0x0) write$sysctl(r0, &(0x7f0000000080)='3\x00', 0x2) 15:29:48 executing program 2: openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(0xffffffffffffffff, &(0x7f0000000080)='3\x00', 0x2) 15:29:48 executing program 4: write$sysctl(0xffffffffffffffff, &(0x7f0000000080)='3\x00', 0x2) 15:29:48 executing program 3: pipe2$9p(&(0x7f0000000000), 0x4800) r0 = gettid() r1 = gettid() sched_rr_get_interval(r1, &(0x7f0000000100)) syz_clone3(&(0x7f0000000300)={0x100000000, &(0x7f0000000040), &(0x7f0000000080), &(0x7f00000000c0), {0x29}, &(0x7f0000000240)=""/190, 0xbe, &(0x7f0000000100)=""/63, &(0x7f0000000140)=[r0, 0x0, r1], 0x3}, 0x58) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:29:48 executing program 0: r0 = openat$sysctl(0xffffffffffffff9c, 0x0, 0x1, 0x0) write$sysctl(r0, &(0x7f0000000080)='3\x00', 0x2) 15:29:48 executing program 1: r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(r0, &(0x7f0000000080)='3\x00', 0x2) 15:29:48 executing program 4: write$sysctl(0xffffffffffffffff, &(0x7f0000000080)='3\x00', 0x2) [ 2984.456040][T21835] binder: 21833:21835 ioctl c0306201 0 returned -14 15:29:48 executing program 2: r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(r0, 0x0, 0x0) 15:29:48 executing program 0: openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(0xffffffffffffffff, &(0x7f0000000080)='3\x00', 0x2) 15:29:48 executing program 4: write$sysctl(0xffffffffffffffff, &(0x7f0000000080)='3\x00', 0x2) 15:29:49 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r1 = syz_open_dev$ttys(0xc, 0x2, 0x0) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, 0x0) ioctl$KDSKBENT(r2, 0x4b47, &(0x7f0000000240)={0x5, 0x1, 0x3}) (async) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) (async) r3 = bpf$ITER_CREATE(0x21, &(0x7f0000000040)={r2}, 0x8) ioctl$VT_RELDISP(r3, 0x5605) (async) ioctl$KDSKBENT(r1, 0x4b47, &(0x7f0000000280)={0xeb, 0x20, 0x9}) (async) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x20, 0x0, &(0x7f0000000040)=ANY=[], 0x97, 0x0, &(0x7f00000000c0)="b0a07a3ec35ff9cf59f93a2247c4e88d1f2551dde6d0b79d24a6c5f0608604541aa48c236fa233e879128d6fcc34602362586f5a66d8f705b4e20a4c410184c52b24f983ab5a10a94f810e73cfa7b9a99f0aa7df80579274c75dff98ae58dd6e97b76afd5d1dcd7f2abb7e2654476585b9955eda3705fd52c1431c284e48e8bfd6dfadc092320e86f0e267d6e999d45f6f94987463c98b"}) 15:29:49 executing program 1: r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(r0, &(0x7f0000000080)='3\x00', 0x2) 15:29:49 executing program 2: r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(r0, 0x0, 0x0) 15:29:49 executing program 4: r0 = openat$sysctl(0xffffffffffffff9c, 0x0, 0x1, 0x0) write$sysctl(r0, &(0x7f0000000080)='3\x00', 0x2) 15:29:49 executing program 0: openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(0xffffffffffffffff, &(0x7f0000000080)='3\x00', 0x2) 15:29:49 executing program 3: pipe2$9p(&(0x7f0000000000), 0x4800) r0 = gettid() r1 = gettid() sched_rr_get_interval(r1, &(0x7f0000000100)) syz_clone3(&(0x7f0000000300)={0x100000000, &(0x7f0000000040), &(0x7f0000000080), &(0x7f00000000c0), {0x29}, &(0x7f0000000240)=""/190, 0xbe, &(0x7f0000000100)=""/63, &(0x7f0000000140)=[r0, 0x0, r1], 0x3}, 0x58) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) pipe2$9p(&(0x7f0000000000), 0x4800) (async) gettid() (async) gettid() (async) sched_rr_get_interval(r1, &(0x7f0000000100)) (async) syz_clone3(&(0x7f0000000300)={0x100000000, &(0x7f0000000040), &(0x7f0000000080), &(0x7f00000000c0), {0x29}, &(0x7f0000000240)=""/190, 0xbe, &(0x7f0000000100)=""/63, &(0x7f0000000140)=[r0, 0x0, r1], 0x3}, 0x58) (async) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) (async) 15:29:49 executing program 4: r0 = openat$sysctl(0xffffffffffffff9c, 0x0, 0x1, 0x0) write$sysctl(r0, &(0x7f0000000080)='3\x00', 0x2) 15:29:49 executing program 0: openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(0xffffffffffffffff, &(0x7f0000000080)='3\x00', 0x2) 15:29:49 executing program 2: r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(r0, 0x0, 0x0) 15:29:49 executing program 1: r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(r0, &(0x7f0000000080)='3\x00', 0x2) [ 2985.376626][T21860] binder: 21859:21860 ioctl c0306201 0 returned -14 15:29:49 executing program 0: r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(r0, 0x0, 0x0) 15:29:49 executing program 4: r0 = openat$sysctl(0xffffffffffffff9c, 0x0, 0x1, 0x0) write$sysctl(r0, &(0x7f0000000080)='3\x00', 0x2) 15:29:49 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) (async) r1 = syz_open_dev$ttys(0xc, 0x2, 0x0) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, 0x0) ioctl$KDSKBENT(r2, 0x4b47, &(0x7f0000000240)={0x5, 0x1, 0x3}) (async) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) r3 = bpf$ITER_CREATE(0x21, &(0x7f0000000040)={r2}, 0x8) ioctl$VT_RELDISP(r3, 0x5605) (async) ioctl$KDSKBENT(r1, 0x4b47, &(0x7f0000000280)={0xeb, 0x20, 0x9}) (async) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x20, 0x0, &(0x7f0000000040)=ANY=[], 0x97, 0x0, &(0x7f00000000c0)="b0a07a3ec35ff9cf59f93a2247c4e88d1f2551dde6d0b79d24a6c5f0608604541aa48c236fa233e879128d6fcc34602362586f5a66d8f705b4e20a4c410184c52b24f983ab5a10a94f810e73cfa7b9a99f0aa7df80579274c75dff98ae58dd6e97b76afd5d1dcd7f2abb7e2654476585b9955eda3705fd52c1431c284e48e8bfd6dfadc092320e86f0e267d6e999d45f6f94987463c98b"}) 15:29:49 executing program 2: r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(r0, 0x0, 0x0) 15:29:49 executing program 0: r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(r0, 0x0, 0x0) 15:29:49 executing program 1: write$sysctl(0xffffffffffffffff, &(0x7f0000000080)='3\x00', 0x2) 15:29:49 executing program 4: openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(0xffffffffffffffff, &(0x7f0000000080)='3\x00', 0x2) 15:29:50 executing program 3: pipe2$9p(&(0x7f0000000000), 0x4800) r0 = gettid() r1 = gettid() sched_rr_get_interval(r1, &(0x7f0000000100)) syz_clone3(&(0x7f0000000300)={0x100000000, &(0x7f0000000040), &(0x7f0000000080), &(0x7f00000000c0), {0x29}, &(0x7f0000000240)=""/190, 0xbe, &(0x7f0000000100)=""/63, &(0x7f0000000140)=[r0, 0x0, r1], 0x3}, 0x58) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) pipe2$9p(&(0x7f0000000000), 0x4800) (async) gettid() (async) gettid() (async) sched_rr_get_interval(r1, &(0x7f0000000100)) (async) syz_clone3(&(0x7f0000000300)={0x100000000, &(0x7f0000000040), &(0x7f0000000080), &(0x7f00000000c0), {0x29}, &(0x7f0000000240)=""/190, 0xbe, &(0x7f0000000100)=""/63, &(0x7f0000000140)=[r0, 0x0, r1], 0x3}, 0x58) (async) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) (async) 15:29:50 executing program 1: write$sysctl(0xffffffffffffffff, &(0x7f0000000080)='3\x00', 0x2) 15:29:50 executing program 0: r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(r0, 0x0, 0x0) 15:29:50 executing program 2: r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(r0, 0x0, 0x0) 15:29:50 executing program 4: openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(0xffffffffffffffff, &(0x7f0000000080)='3\x00', 0x2) [ 2986.281750][T21892] binder: 21891:21892 ioctl c0306201 0 returned -14 15:29:50 executing program 2: r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(r0, 0x0, 0x0) 15:29:50 executing program 4: openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(0xffffffffffffffff, &(0x7f0000000080)='3\x00', 0x2) 15:29:50 executing program 0: r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(r0, &(0x7f0000000080)='3\x00', 0x2) 15:29:50 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x200200, 0x0) 15:29:50 executing program 2: write$sysctl(0xffffffffffffffff, 0x0, 0x0) 15:29:50 executing program 4: r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(r0, 0x0, 0x0) 15:29:50 executing program 1: write$sysctl(0xffffffffffffffff, &(0x7f0000000080)='3\x00', 0x2) 15:29:50 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_BSS(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, 0x0, 0x4, 0x70bd2c, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_BSS_HT_OPMODE={0x6}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_BSS_CTS_PROT={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_CTWINDOW={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x80}, 0x4000) eventfd2(0xb4, 0x1) pipe2$9p(&(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) syz_genetlink_get_family_id$smc(&(0x7f00000001c0), r1) 15:29:50 executing program 2: write$sysctl(0xffffffffffffffff, 0x0, 0x0) 15:29:50 executing program 4: r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(r0, 0x0, 0x0) 15:29:51 executing program 1: r0 = openat$sysctl(0xffffffffffffff9c, 0x0, 0x1, 0x0) write$sysctl(r0, &(0x7f0000000080)='3\x00', 0x2) 15:29:51 executing program 0: r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(r0, &(0x7f0000000080)='3\x00', 0x2) syz_open_dev$loop(&(0x7f0000000000), 0x94, 0x40) [ 2987.180271][T21923] binder: 21920:21923 ioctl c0306201 0 returned -14 15:29:51 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x200200, 0x0) 15:29:51 executing program 2: write$sysctl(0xffffffffffffffff, 0x0, 0x0) 15:29:51 executing program 1: r0 = openat$sysctl(0xffffffffffffff9c, 0x0, 0x1, 0x0) write$sysctl(r0, &(0x7f0000000080)='3\x00', 0x2) 15:29:51 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c06, r0) 15:29:51 executing program 4: r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(r0, 0x0, 0x0) [ 2987.299543][T21936] binder: 21935:21936 ioctl c0306201 0 returned -14 15:29:51 executing program 2: r0 = openat$sysctl(0xffffffffffffff9c, 0x0, 0x1, 0x0) write$sysctl(r0, 0x0, 0x0) 15:29:51 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x200200, 0x0) [ 2987.410104][T21948] binder: 21946:21948 ioctl c0306201 0 returned -14 15:29:51 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_BSS(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, 0x0, 0x4, 0x70bd2c, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_BSS_HT_OPMODE={0x6}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_BSS_CTS_PROT={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_CTWINDOW={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x80}, 0x4000) eventfd2(0xb4, 0x1) pipe2$9p(&(0x7f0000000000), 0x0) (async) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) (async) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) (async) syz_genetlink_get_family_id$smc(&(0x7f00000001c0), r1) 15:29:51 executing program 1: r0 = openat$sysctl(0xffffffffffffff9c, 0x0, 0x1, 0x0) write$sysctl(r0, &(0x7f0000000080)='3\x00', 0x2) 15:29:51 executing program 0: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040), 0x40000, 0x0) io_uring_setup(0x6686, &(0x7f00000000c0)={0x0, 0x9314, 0x2, 0x3, 0x398, 0x0, r0}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:29:51 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x20, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="10"], 0x45, 0x0, &(0x7f00000000c0)="e7907848adcd111a161266dd08268c0255193b9a62e88bb88ac1fd70f785010342549fe93e2748232fd1e22ecaeaabdbdc769a5294459aa737c8ee4ee1209e154ed6b8af35"}) 15:29:51 executing program 2: r0 = openat$sysctl(0xffffffffffffff9c, 0x0, 0x1, 0x0) write$sysctl(r0, 0x0, 0x0) 15:29:51 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x8, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00000000000000006031fa547121e96ee482ac9f275b8a4300"], 0x0, 0x0, &(0x7f0000000240)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) write$RDMA_USER_CM_CMD_JOIN_MCAST(r1, &(0x7f00000000c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000040), 0x4, 0xffffffffffffffff, 0x10, 0x1, @in={0x2, 0x4e22, @rand_addr=0x64010101}}}, 0xa0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:29:51 executing program 1: openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(0xffffffffffffffff, &(0x7f0000000080)='3\x00', 0x2) 15:29:51 executing program 2: r0 = openat$sysctl(0xffffffffffffff9c, 0x0, 0x1, 0x0) write$sysctl(r0, 0x0, 0x0) [ 2988.106680][T21955] binder: 21953:21955 ioctl c0306201 0 returned -14 [ 2988.111176][T21962] binder: 21954:21962 unknown command 16 [ 2988.119843][T21960] binder: 21959:21960 unknown command 0 [ 2988.126454][T21962] binder: 21954:21962 ioctl c0306201 20000140 returned -22 [ 2988.134101][T21960] binder: 21959:21960 ioctl c0306201 20000240 returned -22 15:29:52 executing program 2: openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(0xffffffffffffffff, 0x0, 0x0) 15:29:52 executing program 0: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040), 0x40000, 0x0) io_uring_setup(0x6686, &(0x7f00000000c0)={0x0, 0x9314, 0x2, 0x3, 0x398, 0x0, r0}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) [ 2988.161237][T21960] binder: 21959:21960 ioctl c0306201 0 returned -14 15:29:52 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x8, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00000000000000006031fa547121e96ee482ac9f275b8a4300"], 0x0, 0x0, &(0x7f0000000240)}) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) write$RDMA_USER_CM_CMD_JOIN_MCAST(r1, &(0x7f00000000c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000040), 0x4, 0xffffffffffffffff, 0x10, 0x1, @in={0x2, 0x4e22, @rand_addr=0x64010101}}}, 0xa0) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async, rerun: 32) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) (rerun: 32) 15:29:52 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_BSS(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, 0x0, 0x4, 0x70bd2c, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_BSS_HT_OPMODE={0x6}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_BSS_CTS_PROT={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_CTWINDOW={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x80}, 0x4000) eventfd2(0xb4, 0x1) pipe2$9p(&(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) syz_genetlink_get_family_id$smc(&(0x7f00000001c0), r1) [ 2988.276863][T21976] binder: 21975:21976 unknown command 0 [ 2988.284272][T21972] binder: 21971:21972 ioctl c0306201 0 returned -14 [ 2988.291686][T21980] binder: 21975:21980 ioctl c0306201 0 returned -14 [ 2988.297424][T21976] binder: 21975:21976 ioctl c0306201 20000240 returned -22 15:29:52 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_BSS(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, 0x0, 0x4, 0x70bd2c, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_BSS_HT_OPMODE={0x6}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_BSS_CTS_PROT={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_CTWINDOW={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x80}, 0x4000) (async) eventfd2(0xb4, 0x1) (async) pipe2$9p(&(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) (async) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) (async) syz_genetlink_get_family_id$smc(&(0x7f00000001c0), r1) 15:29:52 executing program 1: openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(0xffffffffffffffff, &(0x7f0000000080)='3\x00', 0x2) 15:29:52 executing program 2: openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(0xffffffffffffffff, 0x0, 0x0) 15:29:52 executing program 0: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040), 0x40000, 0x0) io_uring_setup(0x6686, &(0x7f00000000c0)={0x0, 0x9314, 0x2, 0x3, 0x398, 0x0, r0}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:29:52 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x8, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00000000000000006031fa547121e96ee482ac9f275b8a4300"], 0x0, 0x0, &(0x7f0000000240)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) write$RDMA_USER_CM_CMD_JOIN_MCAST(r1, &(0x7f00000000c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000040), 0x4, 0xffffffffffffffff, 0x10, 0x1, @in={0x2, 0x4e22, @rand_addr=0x64010101}}}, 0xa0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x8, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00000000000000006031fa547121e96ee482ac9f275b8a4300"], 0x0, 0x0, &(0x7f0000000240)}) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) (async) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) (async) write$RDMA_USER_CM_CMD_JOIN_MCAST(r1, &(0x7f00000000c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000040), 0x4, 0xffffffffffffffff, 0x10, 0x1, @in={0x2, 0x4e22, @rand_addr=0x64010101}}}, 0xa0) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) (async) 15:29:52 executing program 1: openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(0xffffffffffffffff, &(0x7f0000000080)='3\x00', 0x2) 15:29:52 executing program 2: openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(0xffffffffffffffff, 0x0, 0x0) [ 2988.994765][T21988] binder: 21986:21988 unknown command 0 [ 2989.003874][T21991] binder: 21984:21991 ioctl c0306201 0 returned -14 [ 2989.010650][T21988] binder: 21986:21988 ioctl c0306201 20000240 returned -22 [ 2989.036777][T21988] binder: 21986:21988 ioctl c0306201 0 returned -14 [ 2989.060381][T21999] binder: 21986:21999 unknown command 0 15:29:52 executing program 2: openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(0xffffffffffffffff, &(0x7f0000000080)='3\x00', 0x2) 15:29:52 executing program 1: r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(r0, 0x0, 0x0) 15:29:52 executing program 0: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040), 0x40000, 0x0) io_uring_setup(0x6686, &(0x7f00000000c0)={0x0, 0x9314, 0x2, 0x3, 0x398, 0x0, r0}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:29:52 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_BSS(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, 0x0, 0x4, 0x70bd2c, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_BSS_HT_OPMODE={0x6}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_BSS_CTS_PROT={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_CTWINDOW={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x80}, 0x4000) eventfd2(0xb4, 0x1) pipe2$9p(&(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) syz_genetlink_get_family_id$smc(&(0x7f00000001c0), r1) [ 2989.090923][T21999] binder: 21986:21999 ioctl c0306201 20000240 returned -22 15:29:52 executing program 5: socket(0x2, 0x1, 0x106) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0xd, 0x0) read$msr(r1, &(0x7f0000000240)=""/212, 0xd4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pipe2$9p(&(0x7f0000000040), 0x0) eventfd(0x0) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETSF(r2, 0x5404, &(0x7f00000001c0)={0x7ff, 0x2, 0x8, 0x6, 0xb, "1ef288b2106becde0720bb0e113e33bafb66fe"}) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) sendmsg$IPVS_CMD_SET_CONFIG(r3, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x24, 0x0, 0x100, 0x70bd2a, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x80}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8000}]}, 0x24}, 0x1, 0x0, 0x0, 0x20044010}, 0x20000800) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r4, 0xc01064c2, 0x0) ioctl$PPPIOCGNPMODE(r4, 0xc008744c, &(0x7f0000000140)={0x21, 0x3}) write$RDMA_USER_CM_CMD_NOTIFY(r4, &(0x7f00000000c0)={0xf, 0x8, 0xfa00, {0xffffffffffffffff, 0x11}}, 0x10) [ 2989.178728][T22011] binder: 22008:22011 ioctl c0306201 0 returned -14 [ 2989.218226][T22018] binder: 22017:22018 ioctl c0306201 0 returned -14 15:29:53 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) pipe2$9p(&(0x7f0000000040), 0x800) ioctl$ASHMEM_GET_PIN_STATUS(0xffffffffffffffff, 0x7709, 0x0) pselect6(0x40, &(0x7f0000000180)={0x6}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0x0) 15:29:53 executing program 2: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x44c00, 0x0) ioctl$PPPIOCATTCHAN(r0, 0x40047438, &(0x7f00000000c0)=0x4) r1 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0xf369bf33e08836a1) write$eventfd(0xffffffffffffffff, &(0x7f0000000000), 0x8) ioctl$LOOP_SET_FD(r1, 0x301, 0xffffffffffffffff) 15:29:53 executing program 0: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040), 0x40000, 0x0) io_uring_setup(0x6686, &(0x7f00000000c0)={0x0, 0x9314, 0x2, 0x3, 0x398, 0x0, r0}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:29:53 executing program 1: r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(r0, 0x0, 0x0) 15:29:53 executing program 1: r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(r0, 0x0, 0x0) 15:29:53 executing program 0: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040), 0x40000, 0x0) io_uring_setup(0x6686, &(0x7f00000000c0)={0x0, 0x9314, 0x2, 0x3, 0x398, 0x0, r0}) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:29:53 executing program 2: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040), 0x40000, 0x0) io_uring_setup(0x6686, &(0x7f00000000c0)={0x0, 0x9314, 0x2, 0x3, 0x398, 0x0, r0}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:29:53 executing program 1: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040), 0x40000, 0x0) io_uring_setup(0x6686, &(0x7f00000000c0)={0x0, 0x9314, 0x2, 0x3, 0x398, 0x0, r0}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:29:53 executing program 0: openat$vcs(0xffffffffffffff9c, &(0x7f0000000040), 0x40000, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:29:53 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_BSS(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, 0x0, 0x4, 0x70bd2c, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_BSS_HT_OPMODE={0x6}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_BSS_CTS_PROT={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_CTWINDOW={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x80}, 0x4000) eventfd2(0xb4, 0x1) pipe2$9p(&(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) syz_genetlink_get_family_id$smc(&(0x7f00000001c0), r1) [ 2989.986923][T22035] binder: 22033:22035 ioctl c0306201 0 returned -14 15:29:53 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x20, 0x0, 0x0, 0x45, 0x0, &(0x7f00000000c0)="e7907848adcd111a161266dd08268c0255193b9a62e88bb88ac1fd70f785010342549fe93e2748232fd1e22ecaeaabdbdc769a5294459aa737c8ee4ee1209e154ed6b8af35"}) 15:29:53 executing program 5: socket(0x2, 0x1, 0x106) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) (async) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0xd, 0x0) read$msr(r1, &(0x7f0000000240)=""/212, 0xd4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pipe2$9p(&(0x7f0000000040), 0x0) (async) eventfd(0x0) (async) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETSF(r2, 0x5404, &(0x7f00000001c0)={0x7ff, 0x2, 0x8, 0x6, 0xb, "1ef288b2106becde0720bb0e113e33bafb66fe"}) (async) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) (async) sendmsg$IPVS_CMD_SET_CONFIG(r3, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x24, 0x0, 0x100, 0x70bd2a, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x80}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8000}]}, 0x24}, 0x1, 0x0, 0x0, 0x20044010}, 0x20000800) (async) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r4, 0xc01064c2, 0x0) (async) ioctl$PPPIOCGNPMODE(r4, 0xc008744c, &(0x7f0000000140)={0x21, 0x3}) (async) write$RDMA_USER_CM_CMD_NOTIFY(r4, &(0x7f00000000c0)={0xf, 0x8, 0xfa00, {0xffffffffffffffff, 0x11}}, 0x10) [ 2990.092392][T22043] binder: 22038:22043 ioctl c0306201 0 returned -14 [ 2990.097293][T22046] binder: 22045:22046 ioctl c0306201 20000140 returned -14 [ 2990.129431][T22048] binder: 22047:22048 ioctl c0306201 0 returned -14 15:29:54 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) pipe2$9p(&(0x7f0000000040), 0x800) (async) ioctl$ASHMEM_GET_PIN_STATUS(0xffffffffffffffff, 0x7709, 0x0) pselect6(0x40, &(0x7f0000000180)={0x6}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0x0) 15:29:54 executing program 0: openat$vcs(0xffffffffffffff9c, &(0x7f0000000040), 0x40000, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:29:54 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x20, 0x0, 0x0, 0x45, 0x0, &(0x7f00000000c0)="e7907848adcd111a161266dd08268c0255193b9a62e88bb88ac1fd70f785010342549fe93e2748232fd1e22ecaeaabdbdc769a5294459aa737c8ee4ee1209e154ed6b8af35"}) 15:29:54 executing program 1: socket(0x2, 0x1, 0x106) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0xd, 0x0) read$msr(r1, &(0x7f0000000240)=""/212, 0xd4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pipe2$9p(&(0x7f0000000040), 0x0) eventfd(0x0) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETSF(r2, 0x5404, &(0x7f00000001c0)={0x7ff, 0x2, 0x8, 0x6, 0xb, "1ef288b2106becde0720bb0e113e33bafb66fe"}) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) sendmsg$IPVS_CMD_SET_CONFIG(r3, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x24, 0x0, 0x100, 0x70bd2a, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x80}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8000}]}, 0x24}, 0x1, 0x0, 0x0, 0x20044010}, 0x20000800) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r4, 0xc01064c2, 0x0) ioctl$PPPIOCGNPMODE(r4, 0xc008744c, &(0x7f0000000140)={0x21, 0x3}) write$RDMA_USER_CM_CMD_NOTIFY(r4, &(0x7f00000000c0)={0xf, 0x8, 0xfa00, {0xffffffffffffffff, 0x11}}, 0x10) 15:29:54 executing program 0: openat$vcs(0xffffffffffffff9c, &(0x7f0000000040), 0x40000, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:29:54 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x20, 0x0, 0x0, 0x45, 0x0, &(0x7f00000000c0)="e7907848adcd111a161266dd08268c0255193b9a62e88bb88ac1fd70f785010342549fe93e2748232fd1e22ecaeaabdbdc769a5294459aa737c8ee4ee1209e154ed6b8af35"}) [ 2990.781099][T22057] binder: 22054:22057 ioctl c0306201 20000140 returned -14 [ 2990.784240][T22056] binder: 22055:22056 ioctl c0306201 0 returned -14 15:29:54 executing program 0: io_uring_setup(0x6686, &(0x7f00000000c0)={0x0, 0x9314, 0x2, 0x3, 0x398}) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:29:54 executing program 2: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x20, 0x0, 0x0, 0x45, 0x0, &(0x7f00000000c0)="e7907848adcd111a161266dd08268c0255193b9a62e88bb88ac1fd70f785010342549fe93e2748232fd1e22ecaeaabdbdc769a5294459aa737c8ee4ee1209e154ed6b8af35"}) [ 2990.865813][T22065] binder: 22064:22065 ioctl c0306201 20000140 returned -14 15:29:54 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_BSS(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, 0x0, 0x4, 0x70bd2c, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_BSS_HT_OPMODE={0x6}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_BSS_CTS_PROT={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_CTWINDOW={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x80}, 0x4000) eventfd2(0xb4, 0x1) pipe2$9p(&(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) 15:29:54 executing program 0: io_uring_setup(0x6686, &(0x7f00000000c0)={0x0, 0x9314, 0x2, 0x3, 0x398}) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:29:54 executing program 2: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x20, 0x0, 0x0, 0x45, 0x0, &(0x7f00000000c0)="e7907848adcd111a161266dd08268c0255193b9a62e88bb88ac1fd70f785010342549fe93e2748232fd1e22ecaeaabdbdc769a5294459aa737c8ee4ee1209e154ed6b8af35"}) 15:29:54 executing program 5: socket(0x2, 0x1, 0x106) (async) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0xd, 0x0) read$msr(r1, &(0x7f0000000240)=""/212, 0xd4) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) pipe2$9p(&(0x7f0000000040), 0x0) (async) eventfd(0x0) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETSF(r2, 0x5404, &(0x7f00000001c0)={0x7ff, 0x2, 0x8, 0x6, 0xb, "1ef288b2106becde0720bb0e113e33bafb66fe"}) (async) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) (async) sendmsg$IPVS_CMD_SET_CONFIG(r3, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x24, 0x0, 0x100, 0x70bd2a, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x80}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8000}]}, 0x24}, 0x1, 0x0, 0x0, 0x20044010}, 0x20000800) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r4, 0xc01064c2, 0x0) (async) ioctl$PPPIOCGNPMODE(r4, 0xc008744c, &(0x7f0000000140)={0x21, 0x3}) (async) write$RDMA_USER_CM_CMD_NOTIFY(r4, &(0x7f00000000c0)={0xf, 0x8, 0xfa00, {0xffffffffffffffff, 0x11}}, 0x10) [ 2991.009775][T22080] binder: 22077:22080 ioctl c0306201 0 returned -14 15:29:55 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) pipe2$9p(&(0x7f0000000040), 0x800) ioctl$ASHMEM_GET_PIN_STATUS(0xffffffffffffffff, 0x7709, 0x0) pselect6(0x40, &(0x7f0000000180)={0x6}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0x0) pipe2$9p(&(0x7f0000000000), 0x0) (async) pipe2$9p(&(0x7f0000000040), 0x800) (async) ioctl$ASHMEM_GET_PIN_STATUS(0xffffffffffffffff, 0x7709, 0x0) (async) pselect6(0x40, &(0x7f0000000180)={0x6}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0x0) (async) 15:29:55 executing program 0: io_uring_setup(0x6686, &(0x7f00000000c0)={0x0, 0x9314, 0x2, 0x3, 0x398}) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:29:55 executing program 2: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x20, 0x0, 0x0, 0x45, 0x0, &(0x7f00000000c0)="e7907848adcd111a161266dd08268c0255193b9a62e88bb88ac1fd70f785010342549fe93e2748232fd1e22ecaeaabdbdc769a5294459aa737c8ee4ee1209e154ed6b8af35"}) 15:29:55 executing program 1: socket(0x2, 0x1, 0x106) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0xd, 0x0) read$msr(r1, &(0x7f0000000240)=""/212, 0xd4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pipe2$9p(&(0x7f0000000040), 0x0) eventfd(0x0) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETSF(r2, 0x5404, &(0x7f00000001c0)={0x7ff, 0x2, 0x8, 0x6, 0xb, "1ef288b2106becde0720bb0e113e33bafb66fe"}) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) sendmsg$IPVS_CMD_SET_CONFIG(r3, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x24, 0x0, 0x100, 0x70bd2a, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x80}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8000}]}, 0x24}, 0x1, 0x0, 0x0, 0x20044010}, 0x20000800) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r4, 0xc01064c2, 0x0) ioctl$PPPIOCGNPMODE(r4, 0xc008744c, &(0x7f0000000140)={0x21, 0x3}) write$RDMA_USER_CM_CMD_NOTIFY(r4, &(0x7f00000000c0)={0xf, 0x8, 0xfa00, {0xffffffffffffffff, 0x11}}, 0x10) 15:29:55 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x20, 0x0, 0x0, 0x45, 0x0, &(0x7f00000000c0)="e7907848adcd111a161266dd08268c0255193b9a62e88bb88ac1fd70f785010342549fe93e2748232fd1e22ecaeaabdbdc769a5294459aa737c8ee4ee1209e154ed6b8af35"}) 15:29:55 executing program 0: r0 = openat$vcs(0xffffffffffffff9c, 0x0, 0x40000, 0x0) io_uring_setup(0x6686, &(0x7f00000000c0)={0x0, 0x9314, 0x2, 0x3, 0x398, 0x0, r0}) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) [ 2991.676003][T22090] binder: 22088:22090 ioctl c0306201 0 returned -14 15:29:55 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x20, 0x0, 0x0, 0x45, 0x0, &(0x7f00000000c0)="e7907848adcd111a161266dd08268c0255193b9a62e88bb88ac1fd70f785010342549fe93e2748232fd1e22ecaeaabdbdc769a5294459aa737c8ee4ee1209e154ed6b8af35"}) 15:29:55 executing program 0: r0 = openat$vcs(0xffffffffffffff9c, 0x0, 0x40000, 0x0) io_uring_setup(0x6686, &(0x7f00000000c0)={0x0, 0x9314, 0x2, 0x3, 0x398, 0x0, r0}) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:29:55 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_BSS(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, 0x0, 0x4, 0x70bd2c, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_BSS_HT_OPMODE={0x6}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_BSS_CTS_PROT={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_CTWINDOW={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x80}, 0x4000) eventfd2(0xb4, 0x1) pipe2$9p(&(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) 15:29:55 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x20, 0x0, 0x0, 0x45, 0x0, &(0x7f00000000c0)="e7907848adcd111a161266dd08268c0255193b9a62e88bb88ac1fd70f785010342549fe93e2748232fd1e22ecaeaabdbdc769a5294459aa737c8ee4ee1209e154ed6b8af35"}) 15:29:55 executing program 0: r0 = openat$vcs(0xffffffffffffff9c, 0x0, 0x40000, 0x0) io_uring_setup(0x6686, &(0x7f00000000c0)={0x0, 0x9314, 0x2, 0x3, 0x398, 0x0, r0}) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:29:55 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) r1 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000040), 0x23a043, 0x0) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETSF(r2, 0x5404, &(0x7f00000000c0)={0x3, 0x884, 0xffffff00, 0x9, 0x10, "5cb74045f3d15a4edaa0fef750c689dee8dbc8"}) ioctl$VT_RELDISP(r1, 0x5605) [ 2991.906872][T22116] binder: 22115:22116 ioctl c0306201 0 returned -14 15:29:56 executing program 2: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x20, 0x0, 0x0, 0x45, 0x0, &(0x7f00000000c0)="e7907848adcd111a161266dd08268c0255193b9a62e88bb88ac1fd70f785010342549fe93e2748232fd1e22ecaeaabdbdc769a5294459aa737c8ee4ee1209e154ed6b8af35"}) 15:29:56 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f0000000180)={0x5, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) 15:29:56 executing program 0: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) io_uring_setup(0x6686, &(0x7f00000000c0)={0x0, 0x9314, 0x2, 0x3, 0x398, 0x0, r0}) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:29:56 executing program 1: socket(0x2, 0x1, 0x106) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0xd, 0x0) read$msr(r1, &(0x7f0000000240)=""/212, 0xd4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pipe2$9p(&(0x7f0000000040), 0x0) eventfd(0x0) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETSF(r2, 0x5404, &(0x7f00000001c0)={0x7ff, 0x2, 0x8, 0x6, 0xb, "1ef288b2106becde0720bb0e113e33bafb66fe"}) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) sendmsg$IPVS_CMD_SET_CONFIG(r3, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x24, 0x0, 0x100, 0x70bd2a, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x80}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8000}]}, 0x24}, 0x1, 0x0, 0x0, 0x20044010}, 0x20000800) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r4, 0xc01064c2, 0x0) ioctl$PPPIOCGNPMODE(r4, 0xc008744c, &(0x7f0000000140)={0x21, 0x3}) write$RDMA_USER_CM_CMD_NOTIFY(r4, &(0x7f00000000c0)={0xf, 0x8, 0xfa00, {0xffffffffffffffff, 0x11}}, 0x10) 15:29:56 executing program 2: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x20, 0x0, 0x0, 0x45, 0x0, &(0x7f00000000c0)="e7907848adcd111a161266dd08268c0255193b9a62e88bb88ac1fd70f785010342549fe93e2748232fd1e22ecaeaabdbdc769a5294459aa737c8ee4ee1209e154ed6b8af35"}) 15:29:56 executing program 0: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) io_uring_setup(0x0, &(0x7f00000000c0)={0x0, 0x9314, 0x2, 0x3, 0x398, 0x0, r0}) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:29:56 executing program 0: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) io_uring_setup(0x0, &(0x7f00000000c0)={0x0, 0x9314, 0x2, 0x3, 0x398, 0x0, r0}) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:29:56 executing program 2: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x20, 0x0, 0x0, 0x45, 0x0, &(0x7f00000000c0)="e7907848adcd111a161266dd08268c0255193b9a62e88bb88ac1fd70f785010342549fe93e2748232fd1e22ecaeaabdbdc769a5294459aa737c8ee4ee1209e154ed6b8af35"}) [ 2992.585373][T22123] binder: 22121:22123 ioctl c0306201 0 returned -14 15:29:56 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_BSS(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, 0x0, 0x4, 0x70bd2c, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_BSS_HT_OPMODE={0x6}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_BSS_CTS_PROT={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_CTWINDOW={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x80}, 0x4000) eventfd2(0xb4, 0x1) pipe2$9p(&(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:29:56 executing program 0: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) io_uring_setup(0x0, &(0x7f00000000c0)={0x0, 0x9314, 0x2, 0x3, 0x398, 0x0, r0}) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:29:56 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 15:29:56 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) r1 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000040), 0x23a043, 0x0) (async) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETSF(r2, 0x5404, &(0x7f00000000c0)={0x3, 0x884, 0xffffff00, 0x9, 0x10, "5cb74045f3d15a4edaa0fef750c689dee8dbc8"}) (async, rerun: 64) ioctl$VT_RELDISP(r1, 0x5605) (rerun: 64) 15:29:56 executing program 0: openat$vcs(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) io_uring_setup(0x6686, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) [ 2992.749906][T22143] binder: 22142:22143 ioctl c0306201 0 returned -14 [ 2992.795831][T22147] binder: 22145:22147 ioctl c0306201 0 returned -14 15:29:57 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f0000000180)={0x5, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) pipe2$9p(&(0x7f0000000000), 0x0) (async) pselect6(0x40, &(0x7f0000000180)={0x5, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) 15:29:57 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 15:29:57 executing program 0: openat$vcs(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) io_uring_setup(0x6686, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:29:57 executing program 1: socket(0x2, 0x1, 0x106) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0xd, 0x0) read$msr(r1, &(0x7f0000000240)=""/212, 0xd4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pipe2$9p(&(0x7f0000000040), 0x0) eventfd(0x0) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETSF(r2, 0x5404, &(0x7f00000001c0)={0x7ff, 0x2, 0x8, 0x6, 0xb, "1ef288b2106becde0720bb0e113e33bafb66fe"}) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) sendmsg$IPVS_CMD_SET_CONFIG(r3, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x24, 0x0, 0x100, 0x70bd2a, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x80}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8000}]}, 0x24}, 0x1, 0x0, 0x0, 0x20044010}, 0x20000800) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r4, 0xc01064c2, 0x0) ioctl$PPPIOCGNPMODE(r4, 0xc008744c, &(0x7f0000000140)={0x21, 0x3}) 15:29:57 executing program 0: openat$vcs(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) io_uring_setup(0x6686, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:29:57 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 2993.441481][T22153] binder: 22150:22153 ioctl c0306201 0 returned -14 [ 2993.459411][T22155] binder: 22154:22155 ioctl c0306201 0 returned -14 15:29:57 executing program 0: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) io_uring_setup(0x6686, &(0x7f00000000c0)={0x0, 0x0, 0x2, 0x3, 0x398, 0x0, r0}) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:29:57 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_BSS(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, 0x0, 0x4, 0x70bd2c, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_BSS_HT_OPMODE={0x6}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_BSS_CTS_PROT={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_CTWINDOW={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x80}, 0x4000) eventfd2(0xb4, 0x1) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:29:57 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x20, 0x0, 0x0, 0x0, 0x0, 0x0}) 15:29:57 executing program 0: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) io_uring_setup(0x6686, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x3, 0x398, 0x0, r0}) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) [ 2993.524262][T22163] binder: 22160:22163 ioctl c0306201 0 returned -14 15:29:57 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) r1 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000040), 0x23a043, 0x0) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETSF(r2, 0x5404, &(0x7f00000000c0)={0x3, 0x884, 0xffffff00, 0x9, 0x10, "5cb74045f3d15a4edaa0fef750c689dee8dbc8"}) ioctl$VT_RELDISP(r1, 0x5605) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) (async) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000040), 0x23a043, 0x0) (async) syz_open_dev$ttys(0xc, 0x2, 0x0) (async) ioctl$TCSETSF(r2, 0x5404, &(0x7f00000000c0)={0x3, 0x884, 0xffffff00, 0x9, 0x10, "5cb74045f3d15a4edaa0fef750c689dee8dbc8"}) (async) ioctl$VT_RELDISP(r1, 0x5605) (async) 15:29:57 executing program 0: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) io_uring_setup(0x6686, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x398, 0x0, r0}) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) [ 2993.591521][T22169] binder: 22168:22169 ioctl c0306201 20000140 returned -14 [ 2993.676842][T22176] binder: 22175:22176 ioctl c0306201 0 returned -14 [ 2993.743172][T22179] binder: 22175:22179 ioctl c0306201 0 returned -14 15:29:58 executing program 2: r0 = openat$vcs(0xffffffffffffff9c, 0x0, 0x40000, 0x0) io_uring_setup(0x6686, &(0x7f00000000c0)={0x0, 0x9314, 0x2, 0x3, 0x398, 0x0, r0}) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:29:58 executing program 1: socket(0x2, 0x1, 0x106) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0xd, 0x0) read$msr(r1, &(0x7f0000000240)=""/212, 0xd4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pipe2$9p(&(0x7f0000000040), 0x0) eventfd(0x0) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETSF(r2, 0x5404, &(0x7f00000001c0)={0x7ff, 0x2, 0x8, 0x6, 0xb, "1ef288b2106becde0720bb0e113e33bafb66fe"}) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) sendmsg$IPVS_CMD_SET_CONFIG(r3, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x24, 0x0, 0x100, 0x70bd2a, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x80}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8000}]}, 0x24}, 0x1, 0x0, 0x0, 0x20044010}, 0x20000800) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r4, 0xc01064c2, 0x0) 15:29:58 executing program 0: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) io_uring_setup(0x6686, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0}) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:29:58 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) (async) pselect6(0x40, &(0x7f0000000180)={0x5, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) 15:29:58 executing program 0: openat$vcs(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) io_uring_setup(0x6686, &(0x7f00000000c0)) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:29:58 executing program 2: r0 = openat$vcs(0xffffffffffffff9c, 0x0, 0x40000, 0x0) io_uring_setup(0x6686, &(0x7f00000000c0)={0x0, 0x9314, 0x2, 0x3, 0x398, 0x0, r0}) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) [ 2994.356726][T22188] binder: 22184:22188 ioctl c0306201 0 returned -14 15:29:58 executing program 0: openat$vcs(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) io_uring_setup(0x6686, &(0x7f00000000c0)) pselect6(0x0, 0x0, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:29:58 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_BSS(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, 0x0, 0x4, 0x70bd2c, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_BSS_HT_OPMODE={0x6}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_BSS_CTS_PROT={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_CTWINDOW={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x80}, 0x4000) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:29:58 executing program 2: socket(0x2, 0x1, 0x106) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0xd, 0x0) read$msr(r1, &(0x7f0000000240)=""/212, 0xd4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pipe2$9p(&(0x7f0000000040), 0x0) eventfd(0x0) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETSF(r2, 0x5404, &(0x7f00000001c0)={0x7ff, 0x2, 0x8, 0x6, 0xb, "1ef288b2106becde0720bb0e113e33bafb66fe"}) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) sendmsg$IPVS_CMD_SET_CONFIG(r3, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x24, 0x0, 0x100, 0x70bd2a, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x80}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8000}]}, 0x24}, 0x1, 0x0, 0x0, 0x20044010}, 0x20000800) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r4, 0xc01064c2, 0x0) ioctl$PPPIOCGNPMODE(r4, 0xc008744c, &(0x7f0000000140)={0x21, 0x3}) write$RDMA_USER_CM_CMD_NOTIFY(r4, &(0x7f00000000c0)={0xf, 0x8, 0xfa00, {0xffffffffffffffff, 0x11}}, 0x10) 15:29:58 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_BSS(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, 0x0, 0x4, 0x70bd2c, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_BSS_HT_OPMODE={0x6}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_BSS_CTS_PROT={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_CTWINDOW={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x80}, 0x4000) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:29:58 executing program 5: ioctl$VT_RESIZEX(0xffffffffffffffff, 0x560a, &(0x7f0000000080)={0xffff, 0xaf3, 0x7f, 0x0, 0x9ea, 0x4}) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x8000, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0xa) ioctl$TCSETSW(r1, 0x5403, &(0x7f00000000c0)={0x9, 0x5, 0x0, 0x3, 0x8, "a7ac14c276e8dbc22c21c54236ee638060269c"}) ioctl$PPPIOCSACTIVE(0xffffffffffffffff, 0x40107446, &(0x7f00000001c0)={0x9, &(0x7f0000000100)=[{0x7, 0x3, 0x0, 0xba11}, {0x1, 0x7f, 0x0, 0x9}, {0x5d, 0x1, 0x4, 0x7}, {0x3, 0x7f, 0x80, 0x3c8}, {0x1, 0xca, 0x7, 0x400}, {0x7, 0x7, 0x2, 0x2}, {0x7, 0x1, 0x4, 0x1}, {0x1000, 0x9, 0x0, 0x7}, {0x4, 0x20, 0x0, 0x5}]}) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) [ 2994.476395][T22202] binder: 22201:22202 ioctl c0306201 0 returned -14 15:29:58 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_BSS(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, 0x0, 0x4, 0x70bd2c, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_BSS_HT_OPMODE={0x6}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_BSS_CTS_PROT={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_CTWINDOW={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x80}, 0x4000) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:29:58 executing program 4: socket$nl_generic(0x10, 0x3, 0x10) eventfd2(0xb4, 0x1) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) [ 2994.550328][T22208] binder: 22207:22208 ioctl c0306201 0 returned -14 15:29:58 executing program 3: pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x3}, 0x0, 0x0) 15:29:58 executing program 1: socket(0x2, 0x1, 0x106) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0xd, 0x0) read$msr(r1, &(0x7f0000000240)=""/212, 0xd4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pipe2$9p(&(0x7f0000000040), 0x0) eventfd(0x0) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETSF(r2, 0x5404, &(0x7f00000001c0)={0x7ff, 0x2, 0x8, 0x6, 0xb, "1ef288b2106becde0720bb0e113e33bafb66fe"}) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) sendmsg$IPVS_CMD_SET_CONFIG(r3, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x24, 0x0, 0x100, 0x70bd2a, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x80}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8000}]}, 0x24}, 0x1, 0x0, 0x0, 0x20044010}, 0x20000800) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) 15:29:59 executing program 3: pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x3}, 0x0, 0x0) 15:29:59 executing program 3: pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x3}, 0x0, 0x0) [ 2995.219099][T22215] binder: 22214:22215 ioctl c0306201 0 returned -14 15:29:59 executing program 0: openat$vcs(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) io_uring_setup(0x6686, &(0x7f00000000c0)) pselect6(0x0, 0x0, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:29:59 executing program 2: socket(0x2, 0x1, 0x106) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0xd, 0x0) read$msr(r1, &(0x7f0000000240)=""/212, 0xd4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pipe2$9p(&(0x7f0000000040), 0x0) eventfd(0x0) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETSF(r2, 0x5404, &(0x7f00000001c0)={0x7ff, 0x2, 0x8, 0x6, 0xb, "1ef288b2106becde0720bb0e113e33bafb66fe"}) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) sendmsg$IPVS_CMD_SET_CONFIG(r3, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x24, 0x0, 0x100, 0x70bd2a, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x80}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8000}]}, 0x24}, 0x1, 0x0, 0x0, 0x20044010}, 0x20000800) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r4, 0xc01064c2, 0x0) ioctl$PPPIOCGNPMODE(r4, 0xc008744c, &(0x7f0000000140)={0x21, 0x3}) write$RDMA_USER_CM_CMD_NOTIFY(r4, &(0x7f00000000c0)={0xf, 0x8, 0xfa00, {0xffffffffffffffff, 0x11}}, 0x10) 15:29:59 executing program 5: ioctl$VT_RESIZEX(0xffffffffffffffff, 0x560a, &(0x7f0000000080)={0xffff, 0xaf3, 0x7f, 0x0, 0x9ea, 0x4}) (async) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) (async) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x8000, 0x0) (async) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0xa) ioctl$TCSETSW(r1, 0x5403, &(0x7f00000000c0)={0x9, 0x5, 0x0, 0x3, 0x8, "a7ac14c276e8dbc22c21c54236ee638060269c"}) (async) ioctl$PPPIOCSACTIVE(0xffffffffffffffff, 0x40107446, &(0x7f00000001c0)={0x9, &(0x7f0000000100)=[{0x7, 0x3, 0x0, 0xba11}, {0x1, 0x7f, 0x0, 0x9}, {0x5d, 0x1, 0x4, 0x7}, {0x3, 0x7f, 0x80, 0x3c8}, {0x1, 0xca, 0x7, 0x400}, {0x7, 0x7, 0x2, 0x2}, {0x7, 0x1, 0x4, 0x1}, {0x1000, 0x9, 0x0, 0x7}, {0x4, 0x20, 0x0, 0x5}]}) (async) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:29:59 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c, 0x20000004, 0xe6}, 0x0, 0x0) write$RDMA_USER_CM_CMD_BIND(0xffffffffffffffff, &(0x7f00000002c0)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x1c, 0x0, @ib={0x1b, 0x80, 0xfc000000, {"0be17a83b4b4e14c8d2fde2b96b80482"}, 0x7, 0x59137713, 0x4}}}, 0x90) r0 = syz_open_dev$loop(&(0x7f0000000040), 0x5, 0x210003) r1 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r1, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000080)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f00000000c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000100)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000140)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(0xffffffffffffffff, 0xc01864cd, &(0x7f0000000280)={&(0x7f00000001c0)=[0x0, r2, r3, 0x0, 0x0, 0x0, r4, 0x0, 0x0, r5], &(0x7f0000000240)=[0x4, 0x0, 0x5], 0xa, 0x1}) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) socket$nl_generic(0x10, 0x3, 0x10) [ 2995.387503][T22226] binder: 22225:22226 ioctl c0306201 0 returned -14 15:29:59 executing program 4: socket$nl_generic(0x10, 0x3, 0x10) eventfd2(0xb4, 0x1) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) [ 2995.453846][T22231] binder: 22229:22231 ioctl c0306201 0 returned -14 15:29:59 executing program 1: socket(0x2, 0x1, 0x106) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0xd, 0x0) read$msr(r1, &(0x7f0000000240)=""/212, 0xd4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pipe2$9p(&(0x7f0000000040), 0x0) eventfd(0x0) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETSF(r2, 0x5404, &(0x7f00000001c0)={0x7ff, 0x2, 0x8, 0x6, 0xb, "1ef288b2106becde0720bb0e113e33bafb66fe"}) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) sendmsg$IPVS_CMD_SET_CONFIG(r3, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x24, 0x0, 0x100, 0x70bd2a, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x80}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8000}]}, 0x24}, 0x1, 0x0, 0x0, 0x20044010}, 0x20000800) [ 2996.083117][T22239] binder: 22238:22239 ioctl c0306201 0 returned -14 15:29:59 executing program 0: openat$vcs(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) io_uring_setup(0x6686, &(0x7f00000000c0)) pselect6(0x0, 0x0, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:29:59 executing program 2: socket(0x2, 0x1, 0x106) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0xd, 0x0) read$msr(r1, &(0x7f0000000240)=""/212, 0xd4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pipe2$9p(&(0x7f0000000040), 0x0) eventfd(0x0) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETSF(r2, 0x5404, &(0x7f00000001c0)={0x7ff, 0x2, 0x8, 0x6, 0xb, "1ef288b2106becde0720bb0e113e33bafb66fe"}) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) sendmsg$IPVS_CMD_SET_CONFIG(r3, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x24, 0x0, 0x100, 0x70bd2a, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x80}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8000}]}, 0x24}, 0x1, 0x0, 0x0, 0x20044010}, 0x20000800) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r4, 0xc01064c2, 0x0) ioctl$PPPIOCGNPMODE(r4, 0xc008744c, &(0x7f0000000140)={0x21, 0x3}) write$RDMA_USER_CM_CMD_NOTIFY(r4, &(0x7f00000000c0)={0xf, 0x8, 0xfa00, {0xffffffffffffffff, 0x11}}, 0x10) 15:30:00 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) (async) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c, 0x20000004, 0xe6}, 0x0, 0x0) write$RDMA_USER_CM_CMD_BIND(0xffffffffffffffff, &(0x7f00000002c0)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x1c, 0x0, @ib={0x1b, 0x80, 0xfc000000, {"0be17a83b4b4e14c8d2fde2b96b80482"}, 0x7, 0x59137713, 0x4}}}, 0x90) r0 = syz_open_dev$loop(&(0x7f0000000040), 0x5, 0x210003) (async) r1 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r1, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) (async) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000080)={0x0}) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f00000000c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000100)={0x0}) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000140)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(0xffffffffffffffff, 0xc01864cd, &(0x7f0000000280)={&(0x7f00000001c0)=[0x0, r2, r3, 0x0, 0x0, 0x0, r4, 0x0, 0x0, r5], &(0x7f0000000240)=[0x4, 0x0, 0x5], 0xa, 0x1}) (async, rerun: 32) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) (async, rerun: 32) socket$nl_generic(0x10, 0x3, 0x10) [ 2996.230823][T22244] binder: 22243:22244 ioctl c0306201 0 returned -14 15:30:00 executing program 5: ioctl$VT_RESIZEX(0xffffffffffffffff, 0x560a, &(0x7f0000000080)={0xffff, 0xaf3, 0x7f, 0x0, 0x9ea, 0x4}) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x8000, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0xa) (async) ioctl$TCSETSW(r1, 0x5403, &(0x7f00000000c0)={0x9, 0x5, 0x0, 0x3, 0x8, "a7ac14c276e8dbc22c21c54236ee638060269c"}) (async) ioctl$PPPIOCSACTIVE(0xffffffffffffffff, 0x40107446, &(0x7f00000001c0)={0x9, &(0x7f0000000100)=[{0x7, 0x3, 0x0, 0xba11}, {0x1, 0x7f, 0x0, 0x9}, {0x5d, 0x1, 0x4, 0x7}, {0x3, 0x7f, 0x80, 0x3c8}, {0x1, 0xca, 0x7, 0x400}, {0x7, 0x7, 0x2, 0x2}, {0x7, 0x1, 0x4, 0x1}, {0x1000, 0x9, 0x0, 0x7}, {0x4, 0x20, 0x0, 0x5}]}) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:00 executing program 4: socket$nl_generic(0x10, 0x3, 0x10) eventfd2(0xb4, 0x1) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) [ 2996.347370][T22250] binder: 22249:22250 ioctl c0306201 0 returned -14 15:30:00 executing program 1: socket(0x2, 0x1, 0x106) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0xd, 0x0) read$msr(r1, &(0x7f0000000240)=""/212, 0xd4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pipe2$9p(&(0x7f0000000040), 0x0) eventfd(0x0) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETSF(r2, 0x5404, &(0x7f00000001c0)={0x7ff, 0x2, 0x8, 0x6, 0xb, "1ef288b2106becde0720bb0e113e33bafb66fe"}) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) [ 2996.945775][T22258] binder: 22257:22258 ioctl c0306201 0 returned -14 15:30:00 executing program 0: openat$vcs(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) io_uring_setup(0x6686, &(0x7f00000000c0)) pselect6(0x40, &(0x7f0000000180), 0x0, 0x0, 0x0, 0x0) 15:30:00 executing program 2: socket(0x2, 0x1, 0x106) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0xd, 0x0) read$msr(r1, &(0x7f0000000240)=""/212, 0xd4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pipe2$9p(&(0x7f0000000040), 0x0) eventfd(0x0) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETSF(r2, 0x5404, &(0x7f00000001c0)={0x7ff, 0x2, 0x8, 0x6, 0xb, "1ef288b2106becde0720bb0e113e33bafb66fe"}) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) sendmsg$IPVS_CMD_SET_CONFIG(r3, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x24, 0x0, 0x100, 0x70bd2a, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x80}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8000}]}, 0x24}, 0x1, 0x0, 0x0, 0x20044010}, 0x20000800) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r4, 0xc01064c2, 0x0) ioctl$PPPIOCGNPMODE(r4, 0xc008744c, &(0x7f0000000140)={0x21, 0x3}) [ 2997.089035][T22263] binder: 22262:22263 ioctl c0306201 0 returned -14 15:30:00 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c, 0x20000004, 0xe6}, 0x0, 0x0) write$RDMA_USER_CM_CMD_BIND(0xffffffffffffffff, &(0x7f00000002c0)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x1c, 0x0, @ib={0x1b, 0x80, 0xfc000000, {"0be17a83b4b4e14c8d2fde2b96b80482"}, 0x7, 0x59137713, 0x4}}}, 0x90) (async) r0 = syz_open_dev$loop(&(0x7f0000000040), 0x5, 0x210003) (async) r1 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r1, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) (async) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000080)={0x0}) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f00000000c0)={0x0}) (async, rerun: 32) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000100)={0x0}) (async, rerun: 32) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000140)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(0xffffffffffffffff, 0xc01864cd, &(0x7f0000000280)={&(0x7f00000001c0)=[0x0, r2, r3, 0x0, 0x0, 0x0, r4, 0x0, 0x0, r5], &(0x7f0000000240)=[0x4, 0x0, 0x5], 0xa, 0x1}) (async) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) (async) socket$nl_generic(0x10, 0x3, 0x10) 15:30:00 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$TIOCSISO7816(0xffffffffffffffff, 0xc0285443, &(0x7f0000000040)={0x5, 0x80000000, 0x8001, 0x800, 0xbced}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) ioctl$TIOCNOTTY(r1, 0x5422) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:01 executing program 4: sendmsg$NL80211_CMD_SET_BSS(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, 0x0, 0x4, 0x70bd2c, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_BSS_HT_OPMODE={0x6}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_BSS_CTS_PROT={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_CTWINDOW={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x80}, 0x4000) eventfd2(0xb4, 0x1) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:01 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) (async) ioctl$TIOCSISO7816(0xffffffffffffffff, 0xc0285443, &(0x7f0000000040)={0x5, 0x80000000, 0x8001, 0x800, 0xbced}) (async) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) (async) ioctl$TIOCNOTTY(r1, 0x5422) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:01 executing program 4: sendmsg$NL80211_CMD_SET_BSS(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, 0x0, 0x4, 0x70bd2c, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_BSS_HT_OPMODE={0x6}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_BSS_CTS_PROT={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_CTWINDOW={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x80}, 0x4000) eventfd2(0xb4, 0x1) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) [ 2997.210248][T22268] binder: 22267:22268 ioctl c0306201 0 returned -14 15:30:01 executing program 4: sendmsg$NL80211_CMD_SET_BSS(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, 0x0, 0x4, 0x70bd2c, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_BSS_HT_OPMODE={0x6}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_BSS_CTS_PROT={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_CTWINDOW={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x80}, 0x4000) eventfd2(0xb4, 0x1) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:01 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) (async) ioctl$TIOCSISO7816(0xffffffffffffffff, 0xc0285443, &(0x7f0000000040)={0x5, 0x80000000, 0x8001, 0x800, 0xbced}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) ioctl$TIOCNOTTY(r1, 0x5422) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) [ 2997.273539][T22277] binder: 22276:22277 ioctl c0306201 0 returned -14 15:30:01 executing program 4: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_BSS(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, 0x0, 0x4, 0x70bd2c, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_BSS_HT_OPMODE={0x6}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_BSS_CTS_PROT={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_CTWINDOW={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x80}, 0x4000) eventfd2(0xb4, 0x1) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:01 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r2 = bpf$ITER_CREATE(0x21, &(0x7f00000000c0)={r1}, 0x8) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r2) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), r2) sendmsg$NL80211_CMD_SET_BSS(r2, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x2c, r3, 0x4, 0x70bd28, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_BSS_SHORT_SLOT_TIME={0x5, 0x1e, 0xeb}, @NL80211_ATTR_AP_ISOLATE={0x5, 0x60, 0x8}, @NL80211_ATTR_P2P_OPPPS={0x5, 0xa3, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000080}, 0x2040000) pselect6(0x40, &(0x7f0000000180)={0x0, 0xa01, 0x0, 0x0, 0x400000000, 0x6d46, 0x1fb}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x7}, 0x0, 0x0) [ 2997.350419][T22287] binder: 22286:22287 ioctl c0306201 0 returned -14 [ 2997.396884][T22293] binder: 22292:22293 ioctl c0306201 0 returned -14 15:30:01 executing program 1: socket(0x2, 0x1, 0x106) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0xd, 0x0) read$msr(r1, &(0x7f0000000240)=""/212, 0xd4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pipe2$9p(&(0x7f0000000040), 0x0) eventfd(0x0) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETSF(r2, 0x5404, &(0x7f00000001c0)={0x7ff, 0x2, 0x8, 0x6, 0xb, "1ef288b2106becde0720bb0e113e33bafb66fe"}) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) [ 2997.807946][T22295] binder: 22294:22295 ioctl c0306201 0 returned -14 15:30:01 executing program 0: openat$vcs(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) io_uring_setup(0x6686, &(0x7f00000000c0)) pselect6(0x40, &(0x7f0000000180), 0x0, 0x0, 0x0, 0x0) 15:30:01 executing program 2: socket(0x2, 0x1, 0x106) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0xd, 0x0) read$msr(r1, &(0x7f0000000240)=""/212, 0xd4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pipe2$9p(&(0x7f0000000040), 0x0) eventfd(0x0) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETSF(r2, 0x5404, &(0x7f00000001c0)={0x7ff, 0x2, 0x8, 0x6, 0xb, "1ef288b2106becde0720bb0e113e33bafb66fe"}) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) sendmsg$IPVS_CMD_SET_CONFIG(r3, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x24, 0x0, 0x100, 0x70bd2a, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x80}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8000}]}, 0x24}, 0x1, 0x0, 0x0, 0x20044010}, 0x20000800) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r4, 0xc01064c2, 0x0) [ 2997.949446][T22300] binder: 22299:22300 ioctl c0306201 0 returned -14 15:30:01 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x2c, r0, 0x10, 0x70bd2a, 0x25dfdbfd, {}, [@BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x7}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0xfffffffb}, @BATADV_ATTR_HARD_IFINDEX={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000081}, 0x4040040) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x3c, r1, 0x800, 0x70bd26, 0x25dfdbfc, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x80000001}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x81}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x10) 15:30:01 executing program 4: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_BSS(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, 0x0, 0x4, 0x70bd2c, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_BSS_HT_OPMODE={0x6}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_BSS_CTS_PROT={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_CTWINDOW={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x80}, 0x4000) eventfd2(0xb4, 0x1) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:02 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r2 = bpf$ITER_CREATE(0x21, &(0x7f00000000c0)={r1}, 0x8) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r2) (async) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), r2) sendmsg$NL80211_CMD_SET_BSS(r2, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x2c, r3, 0x4, 0x70bd28, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_BSS_SHORT_SLOT_TIME={0x5, 0x1e, 0xeb}, @NL80211_ATTR_AP_ISOLATE={0x5, 0x60, 0x8}, @NL80211_ATTR_P2P_OPPPS={0x5, 0xa3, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000080}, 0x2040000) pselect6(0x40, &(0x7f0000000180)={0x0, 0xa01, 0x0, 0x0, 0x400000000, 0x6d46, 0x1fb}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x7}, 0x0, 0x0) [ 2998.253357][T22308] binder: 22307:22308 ioctl c0306201 0 returned -14 15:30:02 executing program 1: socket(0x2, 0x1, 0x106) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0xd, 0x0) read$msr(r1, &(0x7f0000000240)=""/212, 0xd4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pipe2$9p(&(0x7f0000000040), 0x0) eventfd(0x0) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETSF(r2, 0x5404, &(0x7f00000001c0)={0x7ff, 0x2, 0x8, 0x6, 0xb, "1ef288b2106becde0720bb0e113e33bafb66fe"}) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) [ 2998.674654][T22311] binder: 22310:22311 ioctl c0306201 0 returned -14 15:30:02 executing program 0: openat$vcs(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) io_uring_setup(0x6686, &(0x7f00000000c0)) pselect6(0x40, &(0x7f0000000180), 0x0, 0x0, 0x0, 0x0) 15:30:02 executing program 2: socket(0x2, 0x1, 0x106) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0xd, 0x0) read$msr(r1, &(0x7f0000000240)=""/212, 0xd4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pipe2$9p(&(0x7f0000000040), 0x0) eventfd(0x0) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETSF(r2, 0x5404, &(0x7f00000001c0)={0x7ff, 0x2, 0x8, 0x6, 0xb, "1ef288b2106becde0720bb0e113e33bafb66fe"}) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) sendmsg$IPVS_CMD_SET_CONFIG(r3, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x24, 0x0, 0x100, 0x70bd2a, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x80}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8000}]}, 0x24}, 0x1, 0x0, 0x0, 0x20044010}, 0x20000800) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) [ 2998.813525][T22315] binder: 22314:22315 ioctl c0306201 0 returned -14 15:30:02 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0) (async) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x2c, r0, 0x10, 0x70bd2a, 0x25dfdbfd, {}, [@BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x7}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0xfffffffb}, @BATADV_ATTR_HARD_IFINDEX={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000081}, 0x4040040) (async) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x3c, r1, 0x800, 0x70bd26, 0x25dfdbfc, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x80000001}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x81}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x10) 15:30:02 executing program 4: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_BSS(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, 0x0, 0x4, 0x70bd2c, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_BSS_HT_OPMODE={0x6}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_BSS_CTS_PROT={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_CTWINDOW={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x80}, 0x4000) eventfd2(0xb4, 0x1) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:02 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r2 = bpf$ITER_CREATE(0x21, &(0x7f00000000c0)={r1}, 0x8) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r2) (async) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), r2) sendmsg$NL80211_CMD_SET_BSS(r2, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x2c, r3, 0x4, 0x70bd28, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_BSS_SHORT_SLOT_TIME={0x5, 0x1e, 0xeb}, @NL80211_ATTR_AP_ISOLATE={0x5, 0x60, 0x8}, @NL80211_ATTR_P2P_OPPPS={0x5, 0xa3, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000080}, 0x2040000) (async) pselect6(0x40, &(0x7f0000000180)={0x0, 0xa01, 0x0, 0x0, 0x400000000, 0x6d46, 0x1fb}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x7}, 0x0, 0x0) [ 2999.115128][T22324] binder: 22323:22324 ioctl c0306201 0 returned -14 15:30:03 executing program 1: socket(0x2, 0x1, 0x106) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0xd, 0x0) read$msr(r1, &(0x7f0000000240)=""/212, 0xd4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pipe2$9p(&(0x7f0000000040), 0x0) eventfd(0x0) syz_open_dev$ttys(0xc, 0x2, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:03 executing program 0: openat$vcs(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) io_uring_setup(0x6686, &(0x7f00000000c0)) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200), 0x0, 0x0) [ 2999.533380][T22327] binder: 22326:22327 ioctl c0306201 0 returned -14 15:30:03 executing program 2: socket(0x2, 0x1, 0x106) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0xd, 0x0) read$msr(r1, &(0x7f0000000240)=""/212, 0xd4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pipe2$9p(&(0x7f0000000040), 0x0) eventfd(0x0) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETSF(r2, 0x5404, &(0x7f00000001c0)={0x7ff, 0x2, 0x8, 0x6, 0xb, "1ef288b2106becde0720bb0e113e33bafb66fe"}) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) sendmsg$IPVS_CMD_SET_CONFIG(r3, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x24, 0x0, 0x100, 0x70bd2a, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x80}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8000}]}, 0x24}, 0x1, 0x0, 0x0, 0x20044010}, 0x20000800) [ 2999.680150][T22331] binder: 22330:22331 ioctl c0306201 0 returned -14 15:30:03 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0) (async) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x2c, r0, 0x10, 0x70bd2a, 0x25dfdbfd, {}, [@BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x7}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0xfffffffb}, @BATADV_ATTR_HARD_IFINDEX={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000081}, 0x4040040) (async) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x3c, r1, 0x800, 0x70bd26, 0x25dfdbfc, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x80000001}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x81}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x10) 15:30:03 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_BSS(r0, 0x0, 0x4000) eventfd2(0xb4, 0x1) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:03 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_SYNC_FILE(0xffffffffffffffff, 0xc01064c1, &(0x7f00000001c0)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x48, 0x0, &(0x7f00000000c0)=[@register_looper, @clear_death={0x400c630f, 0x1}, @register_looper, @acquire, @free_buffer, @dead_binder_done, @request_death={0x400c630e, 0x1000}], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) [ 2999.984052][T22340] binder: 22339:22340 ioctl c0306201 0 returned -14 15:30:04 executing program 1: socket(0x2, 0x1, 0x106) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0xd, 0x0) read$msr(r1, &(0x7f0000000240)=""/212, 0xd4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pipe2$9p(&(0x7f0000000040), 0x0) eventfd(0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:04 executing program 0: openat$vcs(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) io_uring_setup(0x6686, &(0x7f00000000c0)) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200), 0x0, 0x0) [ 3000.394799][T22343] binder: 22342:22343 ioctl c0306201 0 returned -14 15:30:04 executing program 2: socket(0x2, 0x1, 0x106) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0xd, 0x0) read$msr(r1, &(0x7f0000000240)=""/212, 0xd4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pipe2$9p(&(0x7f0000000040), 0x0) eventfd(0x0) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETSF(r2, 0x5404, &(0x7f00000001c0)={0x7ff, 0x2, 0x8, 0x6, 0xb, "1ef288b2106becde0720bb0e113e33bafb66fe"}) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) [ 3000.550311][T22347] binder: 22346:22347 ioctl c0306201 0 returned -14 15:30:04 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) setsockopt$SO_RDS_TRANSPORT(0xffffffffffffffff, 0x114, 0x8, &(0x7f0000000040)=0xae7f0540eeab1cfc, 0x4) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:04 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_BSS(r0, 0x0, 0x4000) eventfd2(0xb4, 0x1) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:04 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_SYNC_FILE(0xffffffffffffffff, 0xc01064c1, &(0x7f00000001c0)) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x48, 0x0, &(0x7f00000000c0)=[@register_looper, @clear_death={0x400c630f, 0x1}, @register_looper, @acquire, @free_buffer, @dead_binder_done, @request_death={0x400c630e, 0x1000}], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) [ 3000.847315][T22355] binder: 22353:22355 ioctl c0306201 0 returned -14 15:30:05 executing program 1: socket(0x2, 0x1, 0x106) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0xd, 0x0) read$msr(r1, &(0x7f0000000240)=""/212, 0xd4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pipe2$9p(&(0x7f0000000040), 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:05 executing program 0: openat$vcs(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) io_uring_setup(0x6686, &(0x7f00000000c0)) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200), 0x0, 0x0) [ 3001.257029][T22358] binder: 22357:22358 ioctl c0306201 0 returned -14 15:30:05 executing program 2: socket(0x2, 0x1, 0x106) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0xd, 0x0) read$msr(r1, &(0x7f0000000240)=""/212, 0xd4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pipe2$9p(&(0x7f0000000040), 0x0) eventfd(0x0) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETSF(r2, 0x5404, &(0x7f00000001c0)={0x7ff, 0x2, 0x8, 0x6, 0xb, "1ef288b2106becde0720bb0e113e33bafb66fe"}) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) [ 3001.410108][T22362] binder: 22361:22362 ioctl c0306201 0 returned -14 15:30:05 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) (async, rerun: 64) setsockopt$SO_RDS_TRANSPORT(0xffffffffffffffff, 0x114, 0x8, &(0x7f0000000040)=0xae7f0540eeab1cfc, 0x4) (async, rerun: 64) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:05 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_BSS(r0, 0x0, 0x4000) eventfd2(0xb4, 0x1) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:05 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_SYNC_FILE(0xffffffffffffffff, 0xc01064c1, &(0x7f00000001c0)) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x48, 0x0, &(0x7f00000000c0)=[@register_looper, @clear_death={0x400c630f, 0x1}, @register_looper, @acquire, @free_buffer, @dead_binder_done, @request_death={0x400c630e, 0x1000}], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) [ 3001.708566][T22372] binder: 22370:22372 ioctl c0306201 0 returned -14 15:30:05 executing program 1: socket(0x2, 0x1, 0x106) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0xd, 0x0) read$msr(r1, &(0x7f0000000240)=""/212, 0xd4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:05 executing program 0: socket(0x2, 0x1, 0x106) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0xd, 0x0) read$msr(r1, &(0x7f0000000240)=""/212, 0xd4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pipe2$9p(&(0x7f0000000040), 0x0) eventfd(0x0) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETSF(r2, 0x5404, &(0x7f00000001c0)={0x7ff, 0x2, 0x8, 0x6, 0xb, "1ef288b2106becde0720bb0e113e33bafb66fe"}) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) [ 3002.122936][T22377] binder: 22376:22377 ioctl c0306201 0 returned -14 [ 3002.190485][T22379] binder: 22378:22379 ioctl c0306201 0 returned -14 15:30:06 executing program 2: socket(0x2, 0x1, 0x106) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0xd, 0x0) read$msr(r1, &(0x7f0000000240)=""/212, 0xd4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pipe2$9p(&(0x7f0000000040), 0x0) eventfd(0x0) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETSF(r2, 0x5404, &(0x7f00000001c0)={0x7ff, 0x2, 0x8, 0x6, 0xb, "1ef288b2106becde0720bb0e113e33bafb66fe"}) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) [ 3002.278315][T22382] binder: 22381:22382 ioctl c0306201 0 returned -14 15:30:06 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) (async) setsockopt$SO_RDS_TRANSPORT(0xffffffffffffffff, 0x114, 0x8, &(0x7f0000000040)=0xae7f0540eeab1cfc, 0x4) (async, rerun: 32) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) (rerun: 32) 15:30:06 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_BSS(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, 0x0, 0x4, 0x70bd2c, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_BSS_HT_OPMODE={0x6}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_BSS_CTS_PROT={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_CTWINDOW={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x80}, 0x4000) eventfd2(0xb4, 0x1) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:06 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) getpeername$qrtr(0xffffffffffffffff, &(0x7f0000000040), &(0x7f00000000c0)=0xc) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0xc000, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x1, 0x40}, 0x0, 0x0) [ 3002.573622][T22389] binder: 22388:22389 ioctl c0306201 0 returned -14 15:30:06 executing program 1: socket(0x2, 0x1, 0x106) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0xd, 0x0) read$msr(r1, &(0x7f0000000240)=""/212, 0xd4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:06 executing program 0: socket(0x2, 0x1, 0x106) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0xd, 0x0) read$msr(r1, &(0x7f0000000240)=""/212, 0xd4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pipe2$9p(&(0x7f0000000040), 0x0) eventfd(0x0) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETSF(r2, 0x5404, &(0x7f00000001c0)={0x7ff, 0x2, 0x8, 0x6, 0xb, "1ef288b2106becde0720bb0e113e33bafb66fe"}) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) [ 3002.989904][T22391] binder: 22390:22391 ioctl c0306201 0 returned -14 [ 3003.050443][T22393] binder: 22392:22393 ioctl c0306201 0 returned -14 15:30:06 executing program 2: socket(0x2, 0x1, 0x106) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0xd, 0x0) read$msr(r1, &(0x7f0000000240)=""/212, 0xd4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pipe2$9p(&(0x7f0000000040), 0x0) eventfd(0x0) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETSF(r2, 0x5404, &(0x7f00000001c0)={0x7ff, 0x2, 0x8, 0x6, 0xb, "1ef288b2106becde0720bb0e113e33bafb66fe"}) 15:30:06 executing program 2: socket(0x2, 0x1, 0x106) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0xd, 0x0) read$msr(r1, &(0x7f0000000240)=""/212, 0xd4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pipe2$9p(&(0x7f0000000040), 0x0) eventfd(0x0) syz_open_dev$ttys(0xc, 0x2, 0x0) [ 3003.132737][T22396] binder: 22395:22396 ioctl c0306201 0 returned -14 15:30:06 executing program 2: socket(0x2, 0x1, 0x106) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0xd, 0x0) read$msr(r1, &(0x7f0000000240)=""/212, 0xd4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pipe2$9p(&(0x7f0000000040), 0x0) eventfd(0x0) 15:30:06 executing program 3: pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) [ 3003.174819][T22398] binder: 22397:22398 ioctl c0306201 0 returned -14 15:30:07 executing program 3: pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:07 executing program 3: pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) [ 3003.237757][T22401] binder: 22400:22401 ioctl c0306201 0 returned -14 15:30:07 executing program 2: socket(0x2, 0x1, 0x106) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0xd, 0x0) read$msr(r1, &(0x7f0000000240)=""/212, 0xd4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pipe2$9p(&(0x7f0000000040), 0x0) 15:30:07 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) pselect6(0x40, &(0x7f0000000040)={0x101, 0x1, 0xff, 0x7, 0x2, 0x3, 0x10000, 0x6}, &(0x7f0000000080)={0x401, 0xca, 0x4, 0xff, 0x400, 0x3, 0x6, 0x10001}, &(0x7f00000000c0)={0x8, 0x6, 0x4, 0x0, 0x7, 0x800, 0x5, 0x3}, &(0x7f0000000140)={r0, r1+60000000}, &(0x7f0000000240)={&(0x7f00000001c0)={[0x8001]}, 0x8}) ioctl$KDSKBENT(0xffffffffffffffff, 0x4b47, &(0x7f0000000280)={0x1f, 0x0, 0x7f}) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), r2) 15:30:07 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_BSS(r0, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x80}, 0x4000) eventfd2(0xb4, 0x1) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) [ 3003.318012][T22408] binder: 22407:22408 ioctl c0306201 0 returned -14 15:30:07 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) getpeername$qrtr(0xffffffffffffffff, &(0x7f0000000040), &(0x7f00000000c0)=0xc) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0xc000, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x1, 0x40}, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) (async) getpeername$qrtr(0xffffffffffffffff, &(0x7f0000000040), &(0x7f00000000c0)=0xc) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0xc000, 0x0) (async) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x1, 0x40}, 0x0, 0x0) (async) [ 3003.428416][T22415] binder: 22414:22415 ioctl c0306201 0 returned -14 [ 3003.489901][T22416] binder: 22414:22416 ioctl c0306201 0 returned -14 15:30:07 executing program 1: socket(0x2, 0x1, 0x106) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000100), 0xd, 0x0) read$msr(r0, &(0x7f0000000240)=""/212, 0xd4) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:07 executing program 0: socket(0x2, 0x1, 0x106) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0xd, 0x0) read$msr(r1, &(0x7f0000000240)=""/212, 0xd4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pipe2$9p(&(0x7f0000000040), 0x0) eventfd(0x0) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETSF(r2, 0x5404, &(0x7f00000001c0)={0x7ff, 0x2, 0x8, 0x6, 0xb, "1ef288b2106becde0720bb0e113e33bafb66fe"}) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) 15:30:07 executing program 2: socket(0x2, 0x1, 0x106) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0xd, 0x0) read$msr(r1, &(0x7f0000000240)=""/212, 0xd4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) 15:30:07 executing program 2: socket(0x2, 0x1, 0x106) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0xd, 0x0) read$msr(r1, &(0x7f0000000240)=""/212, 0xd4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 3003.900887][T22423] binder: 22422:22423 ioctl c0306201 0 returned -14 [ 3003.920096][T22425] binder: 22424:22425 ioctl c0306201 0 returned -14 15:30:07 executing program 2: socket(0x2, 0x1, 0x106) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000100), 0xd, 0x0) read$msr(r0, &(0x7f0000000240)=""/212, 0xd4) 15:30:07 executing program 2: socket(0x2, 0x1, 0x106) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) syz_open_dev$MSR(&(0x7f0000000100), 0xd, 0x0) [ 3003.953954][T22427] binder: 22426:22427 ioctl c0306201 0 returned -14 15:30:07 executing program 2: socket(0x2, 0x1, 0x106) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) syz_open_dev$MSR(&(0x7f0000000100), 0xd, 0x0) 15:30:07 executing program 2: socket(0x2, 0x1, 0x106) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) 15:30:07 executing program 2: socket(0x2, 0x1, 0x106) 15:30:07 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) (async) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) pselect6(0x40, &(0x7f0000000040)={0x101, 0x1, 0xff, 0x7, 0x2, 0x3, 0x10000, 0x6}, &(0x7f0000000080)={0x401, 0xca, 0x4, 0xff, 0x400, 0x3, 0x6, 0x10001}, &(0x7f00000000c0)={0x8, 0x6, 0x4, 0x0, 0x7, 0x800, 0x5, 0x3}, &(0x7f0000000140)={r0, r1+60000000}, &(0x7f0000000240)={&(0x7f00000001c0)={[0x8001]}, 0x8}) ioctl$KDSKBENT(0xffffffffffffffff, 0x4b47, &(0x7f0000000280)={0x1f, 0x0, 0x7f}) (async) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, 0x0) (async) syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), r2) 15:30:08 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_BSS(r0, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x80}, 0x4000) eventfd2(0xb4, 0x1) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:08 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) getpeername$qrtr(0xffffffffffffffff, &(0x7f0000000040), &(0x7f00000000c0)=0xc) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0xc000, 0x0) (async) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x1, 0x40}, 0x0, 0x0) [ 3004.287137][T22447] binder: 22445:22447 ioctl c0306201 0 returned -14 15:30:08 executing program 1: socket(0x2, 0x1, 0x106) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) syz_open_dev$MSR(&(0x7f0000000100), 0xd, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:08 executing program 0: socket(0x2, 0x1, 0x106) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0xd, 0x0) read$msr(r1, &(0x7f0000000240)=""/212, 0xd4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pipe2$9p(&(0x7f0000000040), 0x0) eventfd(0x0) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETSF(r2, 0x5404, &(0x7f00000001c0)={0x7ff, 0x2, 0x8, 0x6, 0xb, "1ef288b2106becde0720bb0e113e33bafb66fe"}) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) 15:30:08 executing program 2: socket(0x0, 0x1, 0x106) 15:30:08 executing program 2: socket(0x0, 0x1, 0x106) [ 3004.815234][T22455] binder: 22454:22455 ioctl c0306201 0 returned -14 15:30:08 executing program 2: socket(0x0, 0x1, 0x106) 15:30:08 executing program 2: socket(0x2, 0x0, 0x106) 15:30:08 executing program 2: socket(0x2, 0x0, 0x106) 15:30:08 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) (async) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) (async) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) pselect6(0x40, &(0x7f0000000040)={0x101, 0x1, 0xff, 0x7, 0x2, 0x3, 0x10000, 0x6}, &(0x7f0000000080)={0x401, 0xca, 0x4, 0xff, 0x400, 0x3, 0x6, 0x10001}, &(0x7f00000000c0)={0x8, 0x6, 0x4, 0x0, 0x7, 0x800, 0x5, 0x3}, &(0x7f0000000140)={r0, r1+60000000}, &(0x7f0000000240)={&(0x7f00000001c0)={[0x8001]}, 0x8}) ioctl$KDSKBENT(0xffffffffffffffff, 0x4b47, &(0x7f0000000280)={0x1f, 0x0, 0x7f}) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), r2) 15:30:08 executing program 2: socket(0x2, 0x0, 0x106) 15:30:08 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_BSS(r0, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x80}, 0x4000) eventfd2(0xb4, 0x1) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:08 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KDSKBENT(r1, 0x4b47, &(0x7f0000000040)={0x20, 0x20, 0xffc0}) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:09 executing program 2: socket(0x2, 0x1, 0x0) [ 3005.163745][T22481] binder: 22480:22481 ioctl c0306201 0 returned -14 15:30:09 executing program 1: socket(0x2, 0x1, 0x106) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:09 executing program 0: socket(0x2, 0x1, 0x106) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0xd, 0x0) read$msr(r1, &(0x7f0000000240)=""/212, 0xd4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pipe2$9p(&(0x7f0000000040), 0x0) eventfd(0x0) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETSF(r2, 0x5404, &(0x7f00000001c0)={0x7ff, 0x2, 0x8, 0x6, 0xb, "1ef288b2106becde0720bb0e113e33bafb66fe"}) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:09 executing program 2: socket(0x2, 0x1, 0x0) 15:30:09 executing program 2: socket(0x2, 0x1, 0x0) 15:30:09 executing program 2: socket(0x2, 0x0, 0x106) [ 3005.688627][T22490] binder: 22489:22490 ioctl c0306201 0 returned -14 15:30:09 executing program 2: socket(0x2, 0x0, 0x106) 15:30:09 executing program 2: socket(0x2, 0x1, 0x106) 15:30:09 executing program 2: socket(0x2, 0x1, 0x106) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) syz_open_dev$MSR(&(0x7f0000000100), 0xd, 0x0) 15:30:09 executing program 3: pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000040), 0x10000, 0x8100) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000080)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f00000000c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_DESTROY(r1, 0xc00864c0, &(0x7f0000000280)) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r1, 0xc01864cb, &(0x7f00000001c0)={&(0x7f0000000100)=[0x0, r2, r3], &(0x7f0000000140)=[0x3ff, 0x8f4f, 0x100000001, 0x4, 0x100, 0x0, 0x7, 0x74], 0x3}) 15:30:09 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_BSS(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000) eventfd2(0xb4, 0x1) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:09 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) (async) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KDSKBENT(r1, 0x4b47, &(0x7f0000000040)={0x20, 0x20, 0xffc0}) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:09 executing program 2: socket(0x2, 0x1, 0x106) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0xd, 0x0) read$msr(r1, &(0x7f0000000240)=""/212, 0xd4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pipe2$9p(&(0x7f0000000040), 0x0) [ 3006.047380][T22510] binder: 22509:22510 ioctl c0306201 0 returned -14 [ 3006.064057][T22513] binder: 22511:22513 ioctl c0306201 0 returned -14 15:30:10 executing program 1: socket(0x2, 0x1, 0x106) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:10 executing program 0: socket(0x2, 0x1, 0x106) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0xd, 0x0) read$msr(r1, &(0x7f0000000240)=""/212, 0xd4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pipe2$9p(&(0x7f0000000040), 0x0) eventfd(0x0) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETSF(r2, 0x5404, &(0x7f00000001c0)={0x7ff, 0x2, 0x8, 0x6, 0xb, "1ef288b2106becde0720bb0e113e33bafb66fe"}) 15:30:10 executing program 2: socket(0x2, 0x1, 0x106) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0xd, 0x0) read$msr(r1, &(0x7f0000000240)=""/212, 0xd4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pipe2$9p(&(0x7f0000000040), 0x0) eventfd(0x0) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETSF(r2, 0x5404, &(0x7f00000001c0)={0x7ff, 0x2, 0x8, 0x6, 0xb, "1ef288b2106becde0720bb0e113e33bafb66fe"}) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:10 executing program 1: socket(0x2, 0x1, 0x106) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:10 executing program 1: socket(0x2, 0x1, 0x106) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:10 executing program 0: socket(0x2, 0x1, 0x106) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0xd, 0x0) read$msr(r1, &(0x7f0000000240)=""/212, 0xd4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pipe2$9p(&(0x7f0000000040), 0x0) eventfd(0x0) syz_open_dev$ttys(0xc, 0x2, 0x0) 15:30:10 executing program 1: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) [ 3006.536159][T22518] binder: 22517:22518 ioctl c0306201 0 returned -14 [ 3006.561244][T22521] binder: 22519:22521 ioctl c0306201 0 returned -14 15:30:10 executing program 1: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) [ 3006.631804][T22526] binder: 22525:22526 ioctl c0306201 0 returned -14 15:30:10 executing program 3: pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000040), 0x10000, 0x8100) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000080)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f00000000c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_DESTROY(r1, 0xc00864c0, &(0x7f0000000280)) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r1, 0xc01864cb, &(0x7f00000001c0)={&(0x7f0000000100)=[0x0, r2, r3], &(0x7f0000000140)=[0x3ff, 0x8f4f, 0x100000001, 0x4, 0x100, 0x0, 0x7, 0x74], 0x3}) 15:30:10 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_BSS(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000) eventfd2(0xb4, 0x1) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:10 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KDSKBENT(r1, 0x4b47, &(0x7f0000000040)={0x20, 0x20, 0xffc0}) (async) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:10 executing program 0: socket(0x2, 0x1, 0x106) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0xd, 0x0) read$msr(r1, &(0x7f0000000240)=""/212, 0xd4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pipe2$9p(&(0x7f0000000040), 0x0) eventfd(0x0) 15:30:10 executing program 1: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:10 executing program 1: socket(0x0, 0x1, 0x106) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) [ 3006.930996][T22537] binder: 22535:22537 ioctl c0306201 0 returned -14 [ 3006.934153][T22542] binder: 22541:22542 ioctl c0306201 0 returned -14 15:30:11 executing program 2: pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000040), 0x10000, 0x8100) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000080)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f00000000c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_DESTROY(r1, 0xc00864c0, &(0x7f0000000280)) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r1, 0xc01864cb, &(0x7f00000001c0)={&(0x7f0000000100)=[0x0, r2, r3], &(0x7f0000000140)=[0x3ff, 0x8f4f, 0x100000001, 0x4, 0x100, 0x0, 0x7, 0x74], 0x3}) 15:30:11 executing program 0: socket(0x2, 0x1, 0x106) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0xd, 0x0) read$msr(r1, &(0x7f0000000240)=""/212, 0xd4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pipe2$9p(&(0x7f0000000040), 0x0) 15:30:11 executing program 1: socket(0x0, 0x1, 0x106) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:11 executing program 0: socket(0x2, 0x1, 0x106) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0xd, 0x0) read$msr(r1, &(0x7f0000000240)=""/212, 0xd4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) [ 3007.390409][T22549] binder: 22547:22549 ioctl c0306201 0 returned -14 15:30:11 executing program 1: socket(0x0, 0x1, 0x106) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:11 executing program 0: socket(0x2, 0x1, 0x106) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0xd, 0x0) read$msr(r1, &(0x7f0000000240)=""/212, 0xd4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 3007.454440][T22556] binder: 22554:22556 ioctl c0306201 0 returned -14 [ 3007.529069][T22562] binder: 22561:22562 ioctl c0306201 0 returned -14 15:30:11 executing program 3: pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000040), 0x10000, 0x8100) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000080)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f00000000c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_DESTROY(r1, 0xc00864c0, &(0x7f0000000280)) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r1, 0xc01864cb, &(0x7f00000001c0)={&(0x7f0000000100)=[0x0, r2, r3], &(0x7f0000000140)=[0x3ff, 0x8f4f, 0x100000001, 0x4, 0x100, 0x0, 0x7, 0x74], 0x3}) pipe2$9p(&(0x7f0000000000), 0x0) (async) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) (async) syz_open_dev$dri(&(0x7f0000000040), 0x10000, 0x8100) (async) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000080)) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f00000000c0)) (async) ioctl$DRM_IOCTL_SYNCOBJ_DESTROY(r1, 0xc00864c0, &(0x7f0000000280)) (async) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r1, 0xc01864cb, &(0x7f00000001c0)={&(0x7f0000000100)=[0x0, r2, r3], &(0x7f0000000140)=[0x3ff, 0x8f4f, 0x100000001, 0x4, 0x100, 0x0, 0x7, 0x74], 0x3}) (async) 15:30:11 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_BSS(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x4000) eventfd2(0xb4, 0x1) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:11 executing program 0: socket(0x2, 0x1, 0x106) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000100), 0xd, 0x0) read$msr(r0, &(0x7f0000000240)=""/212, 0xd4) 15:30:11 executing program 1: socket(0x2, 0x0, 0x106) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:11 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000140)=0x0, &(0x7f00000001c0)=0x4) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, 0x0) ioctl$X86_IOC_RDMSR_REGS(r2, 0xc02063a0, &(0x7f0000000380)=[0x3, 0x8, 0x497, 0x800, 0x80000000, 0x0, 0xffff0000, 0x1aab]) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_ext={0x1c, 0x3, &(0x7f0000000040)=@raw=[@call={0x85, 0x0, 0x0, 0xbf}, @call={0x85, 0x0, 0x0, 0x6f}, @ldst={0x3, 0x2, 0x6, 0x0, 0x0, 0x2, 0xfffffffffffffff0}], &(0x7f00000000c0)='GPL\x00', 0x80, 0x26, &(0x7f0000000100)=""/38, 0xf7b47911898efaec, 0x8, '\x00', r1, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000240)={0x5, 0x2}, 0x8, 0x10, &(0x7f0000000280)={0x0, 0xe, 0x3, 0x80000001}, 0x10, 0xd1c3, 0xffffffffffffffff, 0x0, &(0x7f00000002c0)=[r2, 0x1]}, 0x80) 15:30:11 executing program 0: socket(0x2, 0x1, 0x106) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) syz_open_dev$MSR(&(0x7f0000000100), 0xd, 0x0) [ 3007.828685][T22578] binder: 22576:22578 ioctl c0306201 0 returned -14 15:30:12 executing program 2: pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000040), 0x10000, 0x8100) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000080)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f00000000c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_DESTROY(r1, 0xc00864c0, &(0x7f0000000280)) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r1, 0xc01864cb, &(0x7f00000001c0)={&(0x7f0000000100)=[0x0, r2, r3], &(0x7f0000000140)=[0x3ff, 0x8f4f, 0x100000001, 0x4, 0x100, 0x0, 0x7, 0x74], 0x3}) 15:30:12 executing program 0: socket(0x2, 0x1, 0x106) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) 15:30:12 executing program 1: socket(0x2, 0x0, 0x106) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:12 executing program 0: socket(0x2, 0x1, 0x106) 15:30:12 executing program 0: socket(0x0, 0x1, 0x106) 15:30:12 executing program 1: socket(0x2, 0x0, 0x106) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:12 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) r1 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r0) setsockopt$RDS_GET_MR_FOR_DEST(r0, 0x114, 0x7, &(0x7f0000000240)={@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x3, 0x2, 0x0, 0x4, {0xa, 0x4e24, 0x9, @dev={0xfe, 0x80, '\x00', 0x39}, 0x7ba}}}, {&(0x7f0000000040)=""/224, 0xe0}, &(0x7f0000000140), 0x1}, 0xa0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:12 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_BSS(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, 0x0, 0x0, 0x70bd2c, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_BSS_HT_OPMODE={0x6}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_BSS_CTS_PROT={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_CTWINDOW={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x80}, 0x4000) eventfd2(0xb4, 0x1) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:12 executing program 0: socket(0x0, 0x1, 0x106) 15:30:12 executing program 1: socket(0x2, 0x1, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:12 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000140)=0x0, &(0x7f00000001c0)=0x4) (async) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, 0x0) (async) ioctl$X86_IOC_RDMSR_REGS(r2, 0xc02063a0, &(0x7f0000000380)=[0x3, 0x8, 0x497, 0x800, 0x80000000, 0x0, 0xffff0000, 0x1aab]) (async) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_ext={0x1c, 0x3, &(0x7f0000000040)=@raw=[@call={0x85, 0x0, 0x0, 0xbf}, @call={0x85, 0x0, 0x0, 0x6f}, @ldst={0x3, 0x2, 0x6, 0x0, 0x0, 0x2, 0xfffffffffffffff0}], &(0x7f00000000c0)='GPL\x00', 0x80, 0x26, &(0x7f0000000100)=""/38, 0xf7b47911898efaec, 0x8, '\x00', r1, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000240)={0x5, 0x2}, 0x8, 0x10, &(0x7f0000000280)={0x0, 0xe, 0x3, 0x80000001}, 0x10, 0xd1c3, 0xffffffffffffffff, 0x0, &(0x7f00000002c0)=[r2, 0x1]}, 0x80) 15:30:12 executing program 0: socket(0x0, 0x1, 0x106) [ 3008.695923][T22617] binder: 22616:22617 ioctl c0306201 0 returned -14 15:30:12 executing program 2: pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000040), 0x10000, 0x8100) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000080)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f00000000c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_DESTROY(r1, 0xc00864c0, &(0x7f0000000280)) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r1, 0xc01864cb, &(0x7f00000001c0)={&(0x7f0000000100)=[0x0, r2, r3], &(0x7f0000000140)=[0x3ff, 0x8f4f, 0x100000001, 0x4, 0x100, 0x0, 0x7, 0x74], 0x3}) 15:30:12 executing program 0: socket(0x2, 0x0, 0x106) 15:30:12 executing program 0: socket(0x2, 0x0, 0x106) 15:30:13 executing program 0: socket(0x2, 0x0, 0x106) 15:30:13 executing program 0: socket(0x2, 0x1, 0x0) 15:30:13 executing program 0: socket(0x2, 0x1, 0x0) 15:30:13 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) r1 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r0) setsockopt$RDS_GET_MR_FOR_DEST(r0, 0x114, 0x7, &(0x7f0000000240)={@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x3, 0x2, 0x0, 0x4, {0xa, 0x4e24, 0x9, @dev={0xfe, 0x80, '\x00', 0x39}, 0x7ba}}}, {&(0x7f0000000040)=""/224, 0xe0}, &(0x7f0000000140), 0x1}, 0xa0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) pipe2$9p(&(0x7f0000000000), 0x0) (async) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) (async) socket$isdn_base(0x22, 0x3, 0x0) (async) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r0) (async) setsockopt$RDS_GET_MR_FOR_DEST(r0, 0x114, 0x7, &(0x7f0000000240)={@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x3, 0x2, 0x0, 0x4, {0xa, 0x4e24, 0x9, @dev={0xfe, 0x80, '\x00', 0x39}, 0x7ba}}}, {&(0x7f0000000040)=""/224, 0xe0}, &(0x7f0000000140), 0x1}, 0xa0) (async) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) (async) 15:30:13 executing program 0: socket(0x2, 0x1, 0x0) 15:30:13 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_BSS(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, 0x0, 0x0, 0x70bd2c, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_BSS_HT_OPMODE={0x6}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_BSS_CTS_PROT={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_CTWINDOW={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x80}, 0x4000) eventfd2(0xb4, 0x1) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:13 executing program 1: socket(0x2, 0x1, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:13 executing program 0: socket(0x2, 0x1, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:13 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000140)=0x0, &(0x7f00000001c0)=0x4) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, 0x0) ioctl$X86_IOC_RDMSR_REGS(r2, 0xc02063a0, &(0x7f0000000380)=[0x3, 0x8, 0x497, 0x800, 0x80000000, 0x0, 0xffff0000, 0x1aab]) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_ext={0x1c, 0x3, &(0x7f0000000040)=@raw=[@call={0x85, 0x0, 0x0, 0xbf}, @call={0x85, 0x0, 0x0, 0x6f}, @ldst={0x3, 0x2, 0x6, 0x0, 0x0, 0x2, 0xfffffffffffffff0}], &(0x7f00000000c0)='GPL\x00', 0x80, 0x26, &(0x7f0000000100)=""/38, 0xf7b47911898efaec, 0x8, '\x00', r1, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000240)={0x5, 0x2}, 0x8, 0x10, &(0x7f0000000280)={0x0, 0xe, 0x3, 0x80000001}, 0x10, 0xd1c3, 0xffffffffffffffff, 0x0, &(0x7f00000002c0)=[r2, 0x1]}, 0x80) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) (async) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000140), &(0x7f00000001c0)=0x4) (async) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, 0x0) (async) ioctl$X86_IOC_RDMSR_REGS(r2, 0xc02063a0, &(0x7f0000000380)=[0x3, 0x8, 0x497, 0x800, 0x80000000, 0x0, 0xffff0000, 0x1aab]) (async) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_ext={0x1c, 0x3, &(0x7f0000000040)=@raw=[@call={0x85, 0x0, 0x0, 0xbf}, @call={0x85, 0x0, 0x0, 0x6f}, @ldst={0x3, 0x2, 0x6, 0x0, 0x0, 0x2, 0xfffffffffffffff0}], &(0x7f00000000c0)='GPL\x00', 0x80, 0x26, &(0x7f0000000100)=""/38, 0xf7b47911898efaec, 0x8, '\x00', r1, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000240)={0x5, 0x2}, 0x8, 0x10, &(0x7f0000000280)={0x0, 0xe, 0x3, 0x80000001}, 0x10, 0xd1c3, 0xffffffffffffffff, 0x0, &(0x7f00000002c0)=[r2, 0x1]}, 0x80) (async) [ 3009.559878][T22656] binder: 22655:22656 ioctl c0306201 0 returned -14 [ 3009.629173][T22658] binder: 22655:22658 ioctl c0306201 0 returned -14 15:30:13 executing program 2: pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000040), 0x10000, 0x8100) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000080)) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f00000000c0)) ioctl$DRM_IOCTL_SYNCOBJ_DESTROY(r1, 0xc00864c0, &(0x7f0000000280)) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) 15:30:13 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/custom1\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) clock_getres(0x5, &(0x7f00000000c0)) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$KDSKBMODE(r1, 0x4b45, &(0x7f0000000040)=0x3) pselect6(0x40, &(0x7f0000000100)={0x8, 0x10, 0x1, 0x5, 0xffff, 0x8001, 0x100000000, 0xfffffffffffff186}, &(0x7f0000000140)={0xfffffffffffffff7, 0xfffffffffffffffd, 0x5, 0x9, 0x38cd, 0x4, 0x2, 0x7fff}, &(0x7f00000001c0)={0x7, 0x1f, 0x8e, 0x4, 0x1, 0xfffffffffffffffd, 0x4, 0x5}, &(0x7f0000000240)={0x77359400}, &(0x7f00000002c0)={&(0x7f0000000280)={[0x6]}, 0x8}) 15:30:13 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/custom1\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) clock_getres(0x5, &(0x7f00000000c0)) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$KDSKBMODE(r1, 0x4b45, &(0x7f0000000040)=0x3) pselect6(0x40, &(0x7f0000000100)={0x8, 0x10, 0x1, 0x5, 0xffff, 0x8001, 0x100000000, 0xfffffffffffff186}, &(0x7f0000000140)={0xfffffffffffffff7, 0xfffffffffffffffd, 0x5, 0x9, 0x38cd, 0x4, 0x2, 0x7fff}, &(0x7f00000001c0)={0x7, 0x1f, 0x8e, 0x4, 0x1, 0xfffffffffffffffd, 0x4, 0x5}, &(0x7f0000000240)={0x77359400}, &(0x7f00000002c0)={&(0x7f0000000280)={[0x6]}, 0x8}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/custom1\x00', 0x2, 0x0) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) (async) clock_getres(0x5, &(0x7f00000000c0)) (async) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) (async) ioctl$KDSKBMODE(r1, 0x4b45, &(0x7f0000000040)=0x3) (async) pselect6(0x40, &(0x7f0000000100)={0x8, 0x10, 0x1, 0x5, 0xffff, 0x8001, 0x100000000, 0xfffffffffffff186}, &(0x7f0000000140)={0xfffffffffffffff7, 0xfffffffffffffffd, 0x5, 0x9, 0x38cd, 0x4, 0x2, 0x7fff}, &(0x7f00000001c0)={0x7, 0x1f, 0x8e, 0x4, 0x1, 0xfffffffffffffffd, 0x4, 0x5}, &(0x7f0000000240)={0x77359400}, &(0x7f00000002c0)={&(0x7f0000000280)={[0x6]}, 0x8}) (async) 15:30:13 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/custom1\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) (async) clock_getres(0x5, &(0x7f00000000c0)) (async) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$KDSKBMODE(r1, 0x4b45, &(0x7f0000000040)=0x3) pselect6(0x40, &(0x7f0000000100)={0x8, 0x10, 0x1, 0x5, 0xffff, 0x8001, 0x100000000, 0xfffffffffffff186}, &(0x7f0000000140)={0xfffffffffffffff7, 0xfffffffffffffffd, 0x5, 0x9, 0x38cd, 0x4, 0x2, 0x7fff}, &(0x7f00000001c0)={0x7, 0x1f, 0x8e, 0x4, 0x1, 0xfffffffffffffffd, 0x4, 0x5}, &(0x7f0000000240)={0x77359400}, &(0x7f00000002c0)={&(0x7f0000000280)={[0x6]}, 0x8}) 15:30:13 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) timer_create(0x0, 0x0, &(0x7f0000000b40)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x77359400}}, 0x0) timer_gettime(0x0, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) ioctl$TCSETSF(r1, 0x5404, &(0x7f0000000040)={0x80000000, 0x81, 0x3, 0x45f, 0xf, "26e3cfbafddd89c566e8fe442f7db3b60a8d13"}) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) pipe2$9p(&(0x7f00000000c0), 0x80000) [ 3010.145497][T22685] binder: 22684:22685 ioctl c0306201 0 returned -14 15:30:14 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) r1 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r0) setsockopt$RDS_GET_MR_FOR_DEST(r0, 0x114, 0x7, &(0x7f0000000240)={@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x3, 0x2, 0x0, 0x4, {0xa, 0x4e24, 0x9, @dev={0xfe, 0x80, '\x00', 0x39}, 0x7ba}}}, {&(0x7f0000000040)=""/224, 0xe0}, &(0x7f0000000140), 0x1}, 0xa0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) pipe2$9p(&(0x7f0000000000), 0x0) (async) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) (async) socket$isdn_base(0x22, 0x3, 0x0) (async) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r0) (async) setsockopt$RDS_GET_MR_FOR_DEST(r0, 0x114, 0x7, &(0x7f0000000240)={@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x3, 0x2, 0x0, 0x4, {0xa, 0x4e24, 0x9, @dev={0xfe, 0x80, '\x00', 0x39}, 0x7ba}}}, {&(0x7f0000000040)=""/224, 0xe0}, &(0x7f0000000140), 0x1}, 0xa0) (async) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) (async) 15:30:14 executing program 1: socket(0x2, 0x1, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:14 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_BSS(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, 0x0, 0x0, 0x70bd2c, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_BSS_HT_OPMODE={0x6}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_BSS_CTS_PROT={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_CTWINDOW={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x80}, 0x4000) eventfd2(0xb4, 0x1) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:14 executing program 0: socket(0x2, 0x1, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:14 executing program 2: pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000040), 0x10000, 0x8100) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000080)) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f00000000c0)) ioctl$DRM_IOCTL_SYNCOBJ_DESTROY(r1, 0xc00864c0, &(0x7f0000000280)) 15:30:14 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) timer_create(0x0, 0x0, &(0x7f0000000b40)) (async) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x77359400}}, 0x0) (async) timer_gettime(0x0, &(0x7f0000000040)) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) ioctl$TCSETSF(r1, 0x5404, &(0x7f0000000040)={0x80000000, 0x81, 0x3, 0x45f, 0xf, "26e3cfbafddd89c566e8fe442f7db3b60a8d13"}) (async) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) (async) pipe2$9p(&(0x7f00000000c0), 0x80000) [ 3011.006307][T22704] binder: 22702:22704 ioctl c0306201 0 returned -14 15:30:14 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000040), 0x4002, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:14 executing program 1: socket(0x2, 0x1, 0x106) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:15 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_BSS(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, 0x0, 0x4, 0x0, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_BSS_HT_OPMODE={0x6}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_BSS_CTS_PROT={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_CTWINDOW={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x80}, 0x4000) eventfd2(0xb4, 0x1) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:15 executing program 1: socket(0x2, 0x1, 0x106) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:15 executing program 0: socket(0x2, 0x1, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:15 executing program 1: socket(0x2, 0x1, 0x106) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:15 executing program 1: socket(0x2, 0x1, 0x106) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x0, 0x0, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:15 executing program 2: pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000040), 0x10000, 0x8100) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000080)) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f00000000c0)) 15:30:15 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) (async) timer_create(0x0, 0x0, &(0x7f0000000b40)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x77359400}, {0x77359400}}, 0x0) (async) timer_gettime(0x0, &(0x7f0000000040)) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) (async) ioctl$TCSETSF(r1, 0x5404, &(0x7f0000000040)={0x80000000, 0x81, 0x3, 0x45f, 0xf, "26e3cfbafddd89c566e8fe442f7db3b60a8d13"}) (async) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) pipe2$9p(&(0x7f00000000c0), 0x80000) 15:30:15 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) sendmsg$TIPC_NL_NODE_GET(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000400)={&(0x7f00000001c0)={0x214, 0x0, 0x100, 0x70bd25, 0x25dfdbfb, {}, [@TIPC_NLA_MEDIA={0x8c, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffff8001}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2b}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x10000}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2328}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}]}, @TIPC_NLA_BEARER={0x48, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x6}, @TIPC_NLA_BEARER_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x800}]}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffc}]}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8}]}]}, @TIPC_NLA_BEARER={0x118, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e21, @loopback}}, {0x20, 0x2, @in6={0xa, 0x4e23, 0xe91c, @local, 0xbd6}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x9}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e21, 0x200, @mcast2, 0x882}}, {0x14, 0x2, @in={0x2, 0x4e24, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}]}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_PROP={0x44, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffc}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x17}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4040}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}]}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}]}]}, @TIPC_NLA_NODE={0x14, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xd546}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0xac}]}]}, 0x214}, 0x1, 0x0, 0x0, 0x80}, 0x24000880) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x2, 0x200000000cf, 0x80000000, 0xffffffffffffffff, 0x75, 0xfffffffffffffffd}, 0x0, &(0x7f0000000140)={0x80, 0x3ff, 0x0, 0x0, 0x800, 0xfffffffffffffe00, 0x2, 0x47}, 0x0, 0x0) write$RDMA_USER_CM_CMD_DESTROY_ID(0xffffffffffffffff, &(0x7f00000000c0)={0x1, 0x10, 0xfa00, {&(0x7f0000000040)}}, 0x18) [ 3011.916557][T22730] binder: 22729:22730 ioctl c0306201 0 returned -14 15:30:15 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000040), 0x4002, 0x0) (async) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:15 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_BSS(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, 0x0, 0x4, 0x0, 0x0, {{}, {@void, @void}}, [@NL80211_ATTR_BSS_HT_OPMODE={0x6}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_BSS_CTS_PROT={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_CTWINDOW={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x80}, 0x4000) eventfd2(0xb4, 0x1) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:15 executing program 0: socket(0x2, 0x1, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:15 executing program 0: socket(0x2, 0x1, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:15 executing program 0: socket(0x2, 0x1, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:15 executing program 1: socket(0x2, 0x1, 0x106) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x0, 0x0, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:16 executing program 0: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:16 executing program 0: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:16 executing program 0: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:16 executing program 2: pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000040), 0x10000, 0x8100) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000080)) 15:30:16 executing program 0: socket(0x0, 0x1, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:16 executing program 0: socket(0x0, 0x1, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:16 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) (async) openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000040), 0x4002, 0x0) (async) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:16 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_BSS(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x44, 0x0, 0x4, 0x0, 0x0, {{}, {@void, @void}}, [@NL80211_ATTR_BSS_HT_OPMODE={0x6}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_BSS_CTS_PROT={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}]}, 0x44}, 0x1, 0x0, 0x0, 0x80}, 0x4000) eventfd2(0xb4, 0x1) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:16 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) (async) sendmsg$TIPC_NL_NODE_GET(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000400)={&(0x7f00000001c0)={0x214, 0x0, 0x100, 0x70bd25, 0x25dfdbfb, {}, [@TIPC_NLA_MEDIA={0x8c, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffff8001}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2b}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x10000}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2328}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}]}, @TIPC_NLA_BEARER={0x48, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x6}, @TIPC_NLA_BEARER_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x800}]}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffc}]}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8}]}]}, @TIPC_NLA_BEARER={0x118, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e21, @loopback}}, {0x20, 0x2, @in6={0xa, 0x4e23, 0xe91c, @local, 0xbd6}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x9}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e21, 0x200, @mcast2, 0x882}}, {0x14, 0x2, @in={0x2, 0x4e24, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}]}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_PROP={0x44, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffc}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x17}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4040}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}]}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}]}]}, @TIPC_NLA_NODE={0x14, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xd546}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0xac}]}]}, 0x214}, 0x1, 0x0, 0x0, 0x80}, 0x24000880) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x2, 0x200000000cf, 0x80000000, 0xffffffffffffffff, 0x75, 0xfffffffffffffffd}, 0x0, &(0x7f0000000140)={0x80, 0x3ff, 0x0, 0x0, 0x800, 0xfffffffffffffe00, 0x2, 0x47}, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(0xffffffffffffffff, &(0x7f00000000c0)={0x1, 0x10, 0xfa00, {&(0x7f0000000040)}}, 0x18) 15:30:16 executing program 0: socket(0x0, 0x1, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:16 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) socketpair(0x2, 0x1, 0x3, &(0x7f0000000040)={0xffffffffffffffff}) getpeername$qrtr(r0, &(0x7f0000000080), &(0x7f00000000c0)=0xc) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) [ 3012.988682][T22769] binder: 22766:22769 ioctl c0306201 0 returned -14 15:30:16 executing program 1: socket(0x2, 0x1, 0x106) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x0, 0x0, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:16 executing program 0: socket(0x2, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:16 executing program 0: socket(0x2, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:17 executing program 0: socket(0x2, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:17 executing program 2: pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000080)) 15:30:17 executing program 0: socket(0x2, 0x1, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:17 executing program 0: socket(0x2, 0x1, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:17 executing program 0: socket(0x2, 0x1, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:17 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_BSS(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x3c, 0x0, 0x4, 0x0, 0x0, {{}, {@void, @void}}, [@NL80211_ATTR_BSS_HT_OPMODE={0x6}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_BSS_CTS_PROT={0x5}]}, 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0x4000) eventfd2(0xb4, 0x1) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:17 executing program 0: socket(0x2, 0x1, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x0, 0x0, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:17 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) socketpair(0x2, 0x1, 0x3, &(0x7f0000000040)={0xffffffffffffffff}) getpeername$qrtr(r0, &(0x7f0000000080), &(0x7f00000000c0)=0xc) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:17 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) sendmsg$TIPC_NL_NODE_GET(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000400)={&(0x7f00000001c0)={0x214, 0x0, 0x100, 0x70bd25, 0x25dfdbfb, {}, [@TIPC_NLA_MEDIA={0x8c, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffff8001}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2b}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x10000}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2328}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}]}, @TIPC_NLA_BEARER={0x48, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x6}, @TIPC_NLA_BEARER_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x800}]}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffc}]}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8}]}]}, @TIPC_NLA_BEARER={0x118, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e21, @loopback}}, {0x20, 0x2, @in6={0xa, 0x4e23, 0xe91c, @local, 0xbd6}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x9}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e21, 0x200, @mcast2, 0x882}}, {0x14, 0x2, @in={0x2, 0x4e24, @multicast1}}}}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}]}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_PROP={0x44, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffc}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x17}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4040}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}]}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}]}]}, @TIPC_NLA_NODE={0x14, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xd546}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0xac}]}]}, 0x214}, 0x1, 0x0, 0x0, 0x80}, 0x24000880) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) pselect6(0x40, &(0x7f0000000100)={0x2, 0x200000000cf, 0x80000000, 0xffffffffffffffff, 0x75, 0xfffffffffffffffd}, 0x0, &(0x7f0000000140)={0x80, 0x3ff, 0x0, 0x0, 0x800, 0xfffffffffffffe00, 0x2, 0x47}, 0x0, 0x0) write$RDMA_USER_CM_CMD_DESTROY_ID(0xffffffffffffffff, &(0x7f00000000c0)={0x1, 0x10, 0xfa00, {&(0x7f0000000040)}}, 0x18) [ 3013.885929][T22811] binder: 22807:22811 ioctl c0306201 0 returned -14 15:30:17 executing program 1: socket(0x2, 0x1, 0x106) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:18 executing program 2: pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f0000000080)) 15:30:18 executing program 2: ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000080)) 15:30:18 executing program 2: ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000080)) 15:30:18 executing program 2: ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000080)) 15:30:18 executing program 2: pipe2$9p(0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000080)) 15:30:18 executing program 2: pipe2$9p(0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000080)) 15:30:18 executing program 2: pipe2$9p(0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000080)) 15:30:18 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_BSS(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x34, 0x0, 0x4, 0x0, 0x0, {{}, {@void, @void}}, [@NL80211_ATTR_BSS_HT_OPMODE={0x6}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x80}, 0x4000) eventfd2(0xb4, 0x1) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:18 executing program 2: pipe2$9p(&(0x7f0000000000), 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000080)) 15:30:18 executing program 0: socket(0x2, 0x1, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x0, 0x0, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:18 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) socketpair(0x2, 0x1, 0x3, &(0x7f0000000040)={0xffffffffffffffff}) getpeername$qrtr(r0, &(0x7f0000000080), &(0x7f00000000c0)=0xc) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) pipe2$9p(&(0x7f0000000000), 0x0) (async) socketpair(0x2, 0x1, 0x3, &(0x7f0000000040)) (async) getpeername$qrtr(r0, &(0x7f0000000080), &(0x7f00000000c0)=0xc) (async) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) (async) 15:30:18 executing program 1: socket(0x2, 0x1, 0x106) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, 0x0, 0x0, 0x0) 15:30:18 executing program 5: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000004c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_PROBE_CLIENT(r0, &(0x7f00000005c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000500)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="040026bd7000fddbdf255400000008000300", @ANYRES32=0x0, @ANYBLOB="0a000600ffffffffffff00000a00060008021103000000000000000001000100000000000a000600ffffffffffff0000"], 0x4c}, 0x1, 0x0, 0x0, 0x4005}, 0x44800) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000600)={0x0, 0x1, r3}) syz_open_dev$MSR(&(0x7f0000000640), 0x800, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x60, 0x0, &(0x7f0000000340)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f00000000c0)={@fda={0x66646185, 0x0, 0x1, 0x26}, @ptr={0x70742a85, 0x1, &(0x7f0000000240)=""/208, 0xd0}, @flat=@handle={0x73682a85, 0x100b}}, &(0x7f0000000040)={0x0, 0x20, 0x48}}, 0x1000}, @increfs_done={0x40106308, 0x1}], 0xe8, 0x0, &(0x7f00000003c0)="0be9c6d966b40ba8b65972300ec907e5fb0d847e52e3f257933bc7decdf067495ddb146fa07292e93613ac99e921bfca400120ce281008ed1e7f63f282ed9f073f41ac7b0d3f56c1c47ca6e6e0baaf14b382705f8393afb57ee4bf43a93fdc6bbe3a25c68d7b411301462ba1d2d6f940971ae7c36fda104215d75c24f10d304006e360dd7f22086a967fdf37600c75f10784c62aaf02f9ced592e68f71c1d4c9919097656d92270f5d2ebd68165b06e244e722f4b245ca47e70e0b2bd906b12810ee8879660cee86e272f3df1c1e7262eb3cfa2a806bdcab476a843a6bde03de58e613eee9f5bdaf"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:18 executing program 2: pipe2$9p(&(0x7f0000000000), 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000080)) 15:30:18 executing program 2: pipe2$9p(&(0x7f0000000000), 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000080)) [ 3014.854748][T22848] binder: 22844:22848 ioctl c0306201 0 returned -14 15:30:18 executing program 5: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000004c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_PROBE_CLIENT(r0, &(0x7f00000005c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000500)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="040026bd7000fddbdf255400000008000300", @ANYRES32=0x0, @ANYBLOB="0a000600ffffffffffff00000a00060008021103000000000000000001000100000000000a000600ffffffffffff0000"], 0x4c}, 0x1, 0x0, 0x0, 0x4005}, 0x44800) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000600)={0x0, 0x1, r3}) syz_open_dev$MSR(&(0x7f0000000640), 0x800, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x60, 0x0, &(0x7f0000000340)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f00000000c0)={@fda={0x66646185, 0x0, 0x1, 0x26}, @ptr={0x70742a85, 0x1, &(0x7f0000000240)=""/208, 0xd0}, @flat=@handle={0x73682a85, 0x100b}}, &(0x7f0000000040)={0x0, 0x20, 0x48}}, 0x1000}, @increfs_done={0x40106308, 0x1}], 0xe8, 0x0, &(0x7f00000003c0)="0be9c6d966b40ba8b65972300ec907e5fb0d847e52e3f257933bc7decdf067495ddb146fa07292e93613ac99e921bfca400120ce281008ed1e7f63f282ed9f073f41ac7b0d3f56c1c47ca6e6e0baaf14b382705f8393afb57ee4bf43a93fdc6bbe3a25c68d7b411301462ba1d2d6f940971ae7c36fda104215d75c24f10d304006e360dd7f22086a967fdf37600c75f10784c62aaf02f9ced592e68f71c1d4c9919097656d92270f5d2ebd68165b06e244e722f4b245ca47e70e0b2bd906b12810ee8879660cee86e272f3df1c1e7262eb3cfa2a806bdcab476a843a6bde03de58e613eee9f5bdaf"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) (async) syz_genetlink_get_family_id$nl80211(&(0x7f00000004c0), 0xffffffffffffffff) (async) sendmsg$NL80211_CMD_PROBE_CLIENT(r0, &(0x7f00000005c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000500)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="040026bd7000fddbdf255400000008000300", @ANYRES32=0x0, @ANYBLOB="0a000600ffffffffffff00000a00060008021103000000000000000001000100000000000a000600ffffffffffff0000"], 0x4c}, 0x1, 0x0, 0x0, 0x4005}, 0x44800) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) (async) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000600)={0x0, 0x1, r3}) (async) syz_open_dev$MSR(&(0x7f0000000640), 0x800, 0x0) (async) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x60, 0x0, &(0x7f0000000340)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f00000000c0)={@fda={0x66646185, 0x0, 0x1, 0x26}, @ptr={0x70742a85, 0x1, &(0x7f0000000240)=""/208, 0xd0}, @flat=@handle={0x73682a85, 0x100b}}, &(0x7f0000000040)={0x0, 0x20, 0x48}}, 0x1000}, @increfs_done={0x40106308, 0x1}], 0xe8, 0x0, &(0x7f00000003c0)="0be9c6d966b40ba8b65972300ec907e5fb0d847e52e3f257933bc7decdf067495ddb146fa07292e93613ac99e921bfca400120ce281008ed1e7f63f282ed9f073f41ac7b0d3f56c1c47ca6e6e0baaf14b382705f8393afb57ee4bf43a93fdc6bbe3a25c68d7b411301462ba1d2d6f940971ae7c36fda104215d75c24f10d304006e360dd7f22086a967fdf37600c75f10784c62aaf02f9ced592e68f71c1d4c9919097656d92270f5d2ebd68165b06e244e722f4b245ca47e70e0b2bd906b12810ee8879660cee86e272f3df1c1e7262eb3cfa2a806bdcab476a843a6bde03de58e613eee9f5bdaf"}) (async) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) (async) 15:30:18 executing program 2: pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) [ 3014.979892][T22860] binder: 22859:22860 ioctl c0306201 0 returned -14 15:30:18 executing program 5: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000004c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_PROBE_CLIENT(r0, &(0x7f00000005c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000500)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="040026bd7000fddbdf255400000008000300", @ANYRES32=0x0, @ANYBLOB="0a000600ffffffffffff00000a00060008021103000000000000000001000100000000000a000600ffffffffffff0000"], 0x4c}, 0x1, 0x0, 0x0, 0x4005}, 0x44800) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000600)={0x0, 0x1, r3}) syz_open_dev$MSR(&(0x7f0000000640), 0x800, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x60, 0x0, &(0x7f0000000340)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f00000000c0)={@fda={0x66646185, 0x0, 0x1, 0x26}, @ptr={0x70742a85, 0x1, &(0x7f0000000240)=""/208, 0xd0}, @flat=@handle={0x73682a85, 0x100b}}, &(0x7f0000000040)={0x0, 0x20, 0x48}}, 0x1000}, @increfs_done={0x40106308, 0x1}], 0xe8, 0x0, &(0x7f00000003c0)="0be9c6d966b40ba8b65972300ec907e5fb0d847e52e3f257933bc7decdf067495ddb146fa07292e93613ac99e921bfca400120ce281008ed1e7f63f282ed9f073f41ac7b0d3f56c1c47ca6e6e0baaf14b382705f8393afb57ee4bf43a93fdc6bbe3a25c68d7b411301462ba1d2d6f940971ae7c36fda104215d75c24f10d304006e360dd7f22086a967fdf37600c75f10784c62aaf02f9ced592e68f71c1d4c9919097656d92270f5d2ebd68165b06e244e722f4b245ca47e70e0b2bd906b12810ee8879660cee86e272f3df1c1e7262eb3cfa2a806bdcab476a843a6bde03de58e613eee9f5bdaf"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) (async) syz_genetlink_get_family_id$nl80211(&(0x7f00000004c0), 0xffffffffffffffff) (async) sendmsg$NL80211_CMD_PROBE_CLIENT(r0, &(0x7f00000005c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000500)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="040026bd7000fddbdf255400000008000300", @ANYRES32=0x0, @ANYBLOB="0a000600ffffffffffff00000a00060008021103000000000000000001000100000000000a000600ffffffffffff0000"], 0x4c}, 0x1, 0x0, 0x0, 0x4005}, 0x44800) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) (async) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000600)={0x0, 0x1, r3}) (async) syz_open_dev$MSR(&(0x7f0000000640), 0x800, 0x0) (async) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x60, 0x0, &(0x7f0000000340)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f00000000c0)={@fda={0x66646185, 0x0, 0x1, 0x26}, @ptr={0x70742a85, 0x1, &(0x7f0000000240)=""/208, 0xd0}, @flat=@handle={0x73682a85, 0x100b}}, &(0x7f0000000040)={0x0, 0x20, 0x48}}, 0x1000}, @increfs_done={0x40106308, 0x1}], 0xe8, 0x0, &(0x7f00000003c0)="0be9c6d966b40ba8b65972300ec907e5fb0d847e52e3f257933bc7decdf067495ddb146fa07292e93613ac99e921bfca400120ce281008ed1e7f63f282ed9f073f41ac7b0d3f56c1c47ca6e6e0baaf14b382705f8393afb57ee4bf43a93fdc6bbe3a25c68d7b411301462ba1d2d6f940971ae7c36fda104215d75c24f10d304006e360dd7f22086a967fdf37600c75f10784c62aaf02f9ced592e68f71c1d4c9919097656d92270f5d2ebd68165b06e244e722f4b245ca47e70e0b2bd906b12810ee8879660cee86e272f3df1c1e7262eb3cfa2a806bdcab476a843a6bde03de58e613eee9f5bdaf"}) (async) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) (async) 15:30:18 executing program 2: pipe2$9p(0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000080)) [ 3015.089330][T22874] binder: 22873:22874 ioctl c0306201 0 returned -14 15:30:19 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_BSS(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x2c, 0x0, 0x4, 0x0, 0x0, {{}, {@void, @void}}, [@NL80211_ATTR_BSS_HT_OPMODE={0x6}, @NL80211_ATTR_P2P_OPPPS={0x5}, @NL80211_ATTR_P2P_OPPPS={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x80}, 0x4000) eventfd2(0xb4, 0x1) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:19 executing program 2: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:19 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x240, 0x0) r1 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x80400, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r1, 0xc0285700, &(0x7f00000000c0)={0x3, "8e112dc464a9971bdcf3761bf5b5ad6bf88d75e9c0b770deba871b4be78e746f"}) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, 0x0) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), 0xffffffffffffffff) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f00000001c0)=0x0, &(0x7f0000000240)=0x4) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(r2, &(0x7f0000000300)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x24, r3, 0x4, 0x70bd28, 0x25dfdbff, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r4}]}, 0x24}, 0x1, 0x0, 0x0, 0x40054}, 0x20004000) openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000340), 0x80800, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:19 executing program 0: socket(0x2, 0x1, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x0, 0x0, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) [ 3015.650478][T22884] binder: 22882:22884 ioctl c0306201 0 returned -14 15:30:19 executing program 1: socket(0x2, 0x1, 0x106) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, 0x0, 0x0, 0x0) 15:30:19 executing program 3: socket(0x2, 0x1, 0x106) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x0, 0x0, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:19 executing program 2: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:19 executing program 2: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:19 executing program 2: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) 15:30:19 executing program 2: openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) 15:30:19 executing program 2: openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) 15:30:19 executing program 2: openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) 15:30:20 executing program 2: pipe2$9p(&(0x7f0000000000), 0x0) openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000040), 0x4002, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:20 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_BSS(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x24, 0x0, 0x4, 0x0, 0x0, {{}, {@void, @void}}, [@NL80211_ATTR_BSS_HT_OPMODE={0x6}, @NL80211_ATTR_P2P_OPPPS={0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x80}, 0x4000) eventfd2(0xb4, 0x1) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:20 executing program 0: socket(0x2, 0x1, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:20 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x240, 0x0) r1 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x80400, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r1, 0xc0285700, &(0x7f00000000c0)={0x3, "8e112dc464a9971bdcf3761bf5b5ad6bf88d75e9c0b770deba871b4be78e746f"}) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, 0x0) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), 0xffffffffffffffff) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f00000001c0)=0x0, &(0x7f0000000240)=0x4) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(r2, &(0x7f0000000300)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x24, r3, 0x4, 0x70bd28, 0x25dfdbff, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r4}]}, 0x24}, 0x1, 0x0, 0x0, 0x40054}, 0x20004000) openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000340), 0x80800, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x240, 0x0) (async) openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x80400, 0x0) (async) ioctl$SW_SYNC_IOC_CREATE_FENCE(r1, 0xc0285700, &(0x7f00000000c0)={0x3, "8e112dc464a9971bdcf3761bf5b5ad6bf88d75e9c0b770deba871b4be78e746f"}) (async) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, 0x0) (async) syz_genetlink_get_family_id$batadv(&(0x7f0000000140), 0xffffffffffffffff) (async) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f00000001c0), &(0x7f0000000240)=0x4) (async) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(r2, &(0x7f0000000300)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x24, r3, 0x4, 0x70bd28, 0x25dfdbff, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r4}]}, 0x24}, 0x1, 0x0, 0x0, 0x40054}, 0x20004000) (async) openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000340), 0x80800, 0x0) (async) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) (async) 15:30:20 executing program 3: socket(0x2, 0x1, 0x106) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x0, 0x0, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:20 executing program 1: socket(0x2, 0x1, 0x106) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, 0x0, 0x0, 0x0) [ 3016.545653][T22910] binder: 22908:22910 ioctl c0306201 0 returned -14 15:30:20 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x240, 0x0) (async) r1 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x80400, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r1, 0xc0285700, &(0x7f00000000c0)={0x3, "8e112dc464a9971bdcf3761bf5b5ad6bf88d75e9c0b770deba871b4be78e746f"}) (async) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, 0x0) (async) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), 0xffffffffffffffff) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f00000001c0)=0x0, &(0x7f0000000240)=0x4) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(r2, &(0x7f0000000300)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x24, r3, 0x4, 0x70bd28, 0x25dfdbff, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r4}]}, 0x24}, 0x1, 0x0, 0x0, 0x40054}, 0x20004000) (async) openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000340), 0x80800, 0x0) (async) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) [ 3016.619524][T22918] binder: 22908:22918 ioctl c0306201 0 returned -14 [ 3016.657177][T22929] binder: 22928:22929 ioctl c0306201 0 returned -14 15:30:21 executing program 2: socket(0x2, 0x1, 0x106) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:21 executing program 0: socket(0x2, 0x1, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, 0x0, 0x0, 0x0) 15:30:21 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_BSS(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x1c, 0x0, 0x4, 0x0, 0x0, {{}, {@void, @void}}, [@NL80211_ATTR_BSS_HT_OPMODE={0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x4000) eventfd2(0xb4, 0x1) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:21 executing program 2: socket(0x2, 0x1, 0x106) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:21 executing program 1: socket(0x2, 0x1, 0x106) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:21 executing program 3: socket(0x2, 0x1, 0x106) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x0, 0x0, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:21 executing program 5: ioctl$KDSIGACCEPT(0xffffffffffffffff, 0x4b4e, 0x1a) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/custom1\x00', 0x802, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r2 = eventfd(0x0) read$eventfd(r2, &(0x7f0000000000), 0x8) syz_open_pts(r1, 0x3) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, 0x0, 0x400, 0x70bd26, 0x25dfdbfe, {}, [@BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0xf0000000}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x40004) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x81, 0x0, 0x80000, 0x0, 0x1}, 0x0, &(0x7f0000000200)={0x1c, 0x4, 0x20000000000, 0x0, 0x40, 0x200000000000}, 0x0, 0x0) 15:30:21 executing program 2: socket(0x2, 0x1, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:22 executing program 0: socket(0x2, 0x1, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, 0x0, 0x0, 0x0) 15:30:22 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_BSS(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x14, 0x0, 0x4, 0x0, 0x0, {{}, {@void, @void}}}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x4000) eventfd2(0xb4, 0x1) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:22 executing program 1: socket(0x2, 0x1, 0x106) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:22 executing program 3: socket(0x2, 0x1, 0x106) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:22 executing program 5: ioctl$KDSIGACCEPT(0xffffffffffffffff, 0x4b4e, 0x1a) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/custom1\x00', 0x802, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) (async) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) r2 = eventfd(0x0) read$eventfd(r2, &(0x7f0000000000), 0x8) (async) syz_open_pts(r1, 0x3) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, 0x0, 0x400, 0x70bd26, 0x25dfdbfe, {}, [@BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0xf0000000}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x40004) (async) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x81, 0x0, 0x80000, 0x0, 0x1}, 0x0, &(0x7f0000000200)={0x1c, 0x4, 0x20000000000, 0x0, 0x40, 0x200000000000}, 0x0, 0x0) 15:30:22 executing program 2: ioctl$KDSIGACCEPT(0xffffffffffffffff, 0x4b4e, 0x1a) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/custom1\x00', 0x802, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r2 = eventfd(0x0) read$eventfd(r2, &(0x7f0000000000), 0x8) syz_open_pts(r1, 0x3) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, 0x0, 0x400, 0x70bd26, 0x25dfdbfe, {}, [@BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0xf0000000}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x40004) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x81, 0x0, 0x80000, 0x0, 0x1}, 0x0, &(0x7f0000000200)={0x1c, 0x4, 0x20000000000, 0x0, 0x40, 0x200000000000}, 0x0, 0x0) 15:30:22 executing program 0: socket(0x2, 0x1, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, 0x0, 0x0, 0x0) 15:30:22 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_BSS(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x14, 0x0, 0x4, 0x0, 0x0, {{}, {@void, @void}}}, 0x14}}, 0x4000) eventfd2(0xb4, 0x1) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:23 executing program 3: socket(0x0, 0x1, 0x106) 15:30:23 executing program 1: socket(0x2, 0x1, 0x106) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:23 executing program 5: ioctl$KDSIGACCEPT(0xffffffffffffffff, 0x4b4e, 0x1a) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/custom1\x00', 0x802, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) r2 = eventfd(0x0) read$eventfd(r2, &(0x7f0000000000), 0x8) (async) syz_open_pts(r1, 0x3) (async) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, 0x0, 0x400, 0x70bd26, 0x25dfdbfe, {}, [@BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0xf0000000}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x40004) (async) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x81, 0x0, 0x80000, 0x0, 0x1}, 0x0, &(0x7f0000000200)={0x1c, 0x4, 0x20000000000, 0x0, 0x40, 0x200000000000}, 0x0, 0x0) 15:30:23 executing program 2: ioctl$KDSIGACCEPT(0xffffffffffffffff, 0x4b4e, 0x1a) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/custom1\x00', 0x802, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r2 = eventfd(0x0) read$eventfd(r2, &(0x7f0000000000), 0x8) syz_open_pts(r1, 0x3) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, 0x0, 0x400, 0x70bd26, 0x25dfdbfe, {}, [@BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0xf0000000}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x40004) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x81, 0x0, 0x80000, 0x0, 0x1}, 0x0, &(0x7f0000000200)={0x1c, 0x4, 0x20000000000, 0x0, 0x40, 0x200000000000}, 0x0, 0x0) 15:30:23 executing program 3: socket(0x2, 0x1, 0x106) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0xd, 0x0) read$msr(r1, &(0x7f0000000240)=""/212, 0xd4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pipe2$9p(&(0x7f0000000040), 0x0) eventfd(0x0) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETSF(r2, 0x5404, &(0x7f00000001c0)={0x7ff, 0x2, 0x8, 0x6, 0xb, "1ef288b2106becde0720bb0e113e33bafb66fe"}) 15:30:23 executing program 3: socket(0x2, 0x1, 0x106) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0xd, 0x0) read$msr(r1, &(0x7f0000000240)=""/212, 0xd4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pipe2$9p(&(0x7f0000000040), 0x0) eventfd(0x0) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETSF(r2, 0x5404, &(0x7f00000001c0)={0x7ff, 0x2, 0x8, 0x6, 0xb, "1ef288b2106becde0720bb0e113e33bafb66fe"}) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) [ 3019.376870][T22983] binder: 22982:22983 ioctl c0306201 0 returned -14 [ 3019.425253][T22986] binder: 22985:22986 ioctl c0306201 0 returned -14 15:30:23 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_BSS(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x14, 0x0, 0x4, 0x0, 0x0, {{}, {@void, @void}}}, 0x14}}, 0x0) eventfd2(0xb4, 0x1) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:23 executing program 0: socket(0x2, 0x1, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:23 executing program 1: socket(0x2, 0x1, 0x106) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:23 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r2 = syz_open_pts(r1, 0x109000) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, r2) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:23 executing program 2: ioctl$KDSIGACCEPT(0xffffffffffffffff, 0x4b4e, 0x1a) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/custom1\x00', 0x802, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r2 = eventfd(0x0) read$eventfd(r2, &(0x7f0000000000), 0x8) syz_open_pts(r1, 0x3) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, 0x0, 0x400, 0x70bd26, 0x25dfdbfe, {}, [@BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0xf0000000}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x40004) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x81, 0x0, 0x80000, 0x0, 0x1}, 0x0, &(0x7f0000000200)={0x1c, 0x4, 0x20000000000, 0x0, 0x40, 0x200000000000}, 0x0, 0x0) 15:30:24 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_SYNC_FILE(0xffffffffffffffff, 0xc01064c1, &(0x7f00000001c0)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x48, 0x0, &(0x7f00000000c0)=[@register_looper, @clear_death={0x400c630f, 0x1}, @register_looper, @acquire, @free_buffer, @dead_binder_done, @request_death={0x400c630e, 0x1000}], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) [ 3020.190456][T22995] binder: 22994:22995 ioctl c0306201 0 returned -14 [ 3020.212483][ T1224] ieee802154 phy0 wpan0: encryption failed: -22 [ 3020.218851][ T1224] ieee802154 phy1 wpan1: encryption failed: -22 [ 3020.284603][T23000] binder: 22998:23000 ioctl c0306201 0 returned -14 15:30:24 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_BSS(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x14, 0x0, 0x4, 0x0, 0x0, {{}, {@void, @void}}}, 0x14}}, 0x0) eventfd2(0x0, 0x1) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:24 executing program 0: socket(0x2, 0x1, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:24 executing program 1: openat$vcs(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) io_uring_setup(0x6686, &(0x7f00000000c0)) pselect6(0x40, &(0x7f0000000180), 0x0, 0x0, 0x0, 0x0) 15:30:24 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r2 = syz_open_pts(r1, 0x109000) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, r2) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) syz_open_pts(r1, 0x109000) (async) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, r2) (async) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) (async) 15:30:24 executing program 2: ioctl$KDSIGACCEPT(0xffffffffffffffff, 0x4b4e, 0x1a) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/custom1\x00', 0x802, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r2 = eventfd(0x0) read$eventfd(r2, &(0x7f0000000000), 0x8) syz_open_pts(r1, 0x3) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x81, 0x0, 0x80000, 0x0, 0x1}, 0x0, &(0x7f0000000200)={0x1c, 0x4, 0x20000000000, 0x0, 0x40, 0x200000000000}, 0x0, 0x0) [ 3021.062265][T23009] binder: 23008:23009 ioctl c0306201 0 returned -14 15:30:24 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_SYNC_FILE(0xffffffffffffffff, 0xc01064c1, &(0x7f00000001c0)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x48, 0x0, &(0x7f00000000c0)=[@register_looper, @clear_death={0x400c630f, 0x1}, @register_looper, @acquire, @free_buffer, @dead_binder_done, @request_death={0x400c630e, 0x1000}], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) [ 3021.122402][T23013] binder: 23008:23013 ioctl c0306201 0 returned -14 [ 3021.150301][T23017] binder: 23016:23017 ioctl c0306201 0 returned -14 15:30:25 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_BSS(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x14, 0x0, 0x4, 0x0, 0x0, {{}, {@void, @void}}}, 0x14}}, 0x0) eventfd2(0x0, 0x1) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:25 executing program 0: socket(0x2, 0x1, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:30:25 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_BSS(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x14, 0x0, 0x4, 0x0, 0x0, {{}, {@void, @void}}}, 0x14}}, 0x0) eventfd2(0x0, 0x1) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:25 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r2 = syz_open_pts(r1, 0x109000) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, r2) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:25 executing program 2: ioctl$KDSIGACCEPT(0xffffffffffffffff, 0x4b4e, 0x1a) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/custom1\x00', 0x802, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = eventfd(0x0) read$eventfd(r1, &(0x7f0000000000), 0x8) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x81, 0x0, 0x80000, 0x0, 0x1}, 0x0, &(0x7f0000000200)={0x1c, 0x4, 0x20000000000, 0x0, 0x40, 0x200000000000}, 0x0, 0x0) 15:30:25 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_SYNC_FILE(0xffffffffffffffff, 0xc01064c1, &(0x7f00000001c0)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x48, 0x0, &(0x7f00000000c0)=[@register_looper, @clear_death={0x400c630f, 0x1}, @register_looper, @acquire, @free_buffer, @dead_binder_done, @request_death={0x400c630e, 0x1000}], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) [ 3021.933981][T23027] binder: 23026:23027 ioctl c0306201 0 returned -14 [ 3022.007678][T23031] binder: 23030:23031 ioctl c0306201 0 returned -14 15:30:26 executing program 0: socket(0x2, 0x1, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:26 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_BSS(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x14, 0x0, 0x4, 0x0, 0x0, {{}, {@void, @void}}}, 0x14}}, 0x0) eventfd2(0x0, 0x1) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:26 executing program 1: pipe2$9p(&(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x2c, r0, 0x10, 0x70bd2a, 0x25dfdbfd, {}, [@BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x7}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0xfffffffb}, @BATADV_ATTR_HARD_IFINDEX={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000081}, 0x4040040) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x3c, r1, 0x800, 0x70bd26, 0x25dfdbfc, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x80000001}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x81}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x10) 15:30:26 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x2, 0x7, 0xffffffffffffffff, 0x0, 0x5, 0x0, 0x200, 0x2d1c6bbf}, 0x0, &(0x7f0000000200)={0x1c, 0xfffffffffffffffd, 0x1f, 0xfffffffffffbfffd, 0xfffffffffffffff7, 0x0, 0x1, 0x101}, 0x0, 0x0) r1 = syz_clone3(&(0x7f0000000340)={0xa0000, &(0x7f0000000040), &(0x7f00000000c0), &(0x7f0000000100), {0x21}, &(0x7f0000000240)=""/121, 0x79, &(0x7f00000002c0)=""/87, &(0x7f0000000140)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0], 0x9}, 0x58) sched_rr_get_interval(r1, &(0x7f00000001c0)) 15:30:26 executing program 2: ioctl$KDSIGACCEPT(0xffffffffffffffff, 0x4b4e, 0x1a) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/custom1\x00', 0x802, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) eventfd(0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x81, 0x0, 0x80000, 0x0, 0x1}, 0x0, &(0x7f0000000200)={0x1c, 0x4, 0x20000000000, 0x0, 0x40, 0x200000000000}, 0x0, 0x0) 15:30:26 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_SYNC_FILE(0xffffffffffffffff, 0xc01064c1, &(0x7f00000001c0)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x48, 0x0, &(0x7f00000000c0)=[@register_looper, @clear_death={0x400c630f, 0x1}, @register_looper, @acquire, @free_buffer, @dead_binder_done, @request_death={0x400c630e, 0x1000}], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) [ 3022.793576][T23041] binder: 23040:23041 ioctl c0306201 0 returned -14 [ 3022.880216][T23047] binder: 23046:23047 ioctl c0306201 0 returned -14 15:30:27 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r2 = bpf$ITER_CREATE(0x21, &(0x7f00000000c0)={r1}, 0x8) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r2) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), r2) sendmsg$NL80211_CMD_SET_BSS(r2, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x2c, r3, 0x4, 0x70bd28, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_BSS_SHORT_SLOT_TIME={0x5, 0x1e, 0xeb}, @NL80211_ATTR_AP_ISOLATE={0x5, 0x60, 0x8}, @NL80211_ATTR_P2P_OPPPS={0x5, 0xa3, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000080}, 0x2040000) pselect6(0x40, &(0x7f0000000180)={0x0, 0xa01, 0x0, 0x0, 0x400000000, 0x6d46, 0x1fb}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x7}, 0x0, 0x0) 15:30:27 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_BSS(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x14, 0x0, 0x4, 0x0, 0x0, {{}, {@void, @void}}}, 0x14}}, 0x0) eventfd2(0xb4, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:27 executing program 1: pipe2$9p(&(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x2c, r0, 0x10, 0x70bd2a, 0x25dfdbfd, {}, [@BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x7}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0xfffffffb}, @BATADV_ATTR_HARD_IFINDEX={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000081}, 0x4040040) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x3c, r1, 0x800, 0x70bd26, 0x25dfdbfc, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x80000001}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x81}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x10) [ 3023.565652][T23050] binder: 23049:23050 ioctl c0306201 0 returned -14 15:30:27 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x2, 0x7, 0xffffffffffffffff, 0x0, 0x5, 0x0, 0x200, 0x2d1c6bbf}, 0x0, &(0x7f0000000200)={0x1c, 0xfffffffffffffffd, 0x1f, 0xfffffffffffbfffd, 0xfffffffffffffff7, 0x0, 0x1, 0x101}, 0x0, 0x0) r1 = syz_clone3(&(0x7f0000000340)={0xa0000, &(0x7f0000000040), &(0x7f00000000c0), &(0x7f0000000100), {0x21}, &(0x7f0000000240)=""/121, 0x79, &(0x7f00000002c0)=""/87, &(0x7f0000000140)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0], 0x9}, 0x58) sched_rr_get_interval(r1, &(0x7f00000001c0)) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) pselect6(0x40, &(0x7f0000000180)={0x2, 0x7, 0xffffffffffffffff, 0x0, 0x5, 0x0, 0x200, 0x2d1c6bbf}, 0x0, &(0x7f0000000200)={0x1c, 0xfffffffffffffffd, 0x1f, 0xfffffffffffbfffd, 0xfffffffffffffff7, 0x0, 0x1, 0x101}, 0x0, 0x0) (async) syz_clone3(&(0x7f0000000340)={0xa0000, &(0x7f0000000040), &(0x7f00000000c0), &(0x7f0000000100), {0x21}, &(0x7f0000000240)=""/121, 0x79, &(0x7f00000002c0)=""/87, &(0x7f0000000140)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0], 0x9}, 0x58) (async) sched_rr_get_interval(r1, &(0x7f00000001c0)) (async) 15:30:27 executing program 2: ioctl$KDSIGACCEPT(0xffffffffffffffff, 0x4b4e, 0x1a) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/custom1\x00', 0x802, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x81, 0x0, 0x80000, 0x0, 0x1}, 0x0, &(0x7f0000000200)={0x1c, 0x4, 0x20000000000, 0x0, 0x40, 0x200000000000}, 0x0, 0x0) 15:30:27 executing program 2: ioctl$KDSIGACCEPT(0xffffffffffffffff, 0x4b4e, 0x1a) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/custom1\x00', 0x802, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x81, 0x0, 0x80000, 0x0, 0x1}, 0x0, &(0x7f0000000200)={0x1c, 0x4, 0x20000000000, 0x0, 0x40, 0x200000000000}, 0x0, 0x0) [ 3023.662144][T23056] binder: 23055:23056 ioctl c0306201 0 returned -14 15:30:27 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_SYNC_FILE(0xffffffffffffffff, 0xc01064c1, &(0x7f00000001c0)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x48, 0x0, &(0x7f00000000c0)=[@register_looper, @clear_death={0x400c630f, 0x1}, @register_looper, @acquire, @free_buffer, @dead_binder_done, @request_death={0x400c630e, 0x1000}], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:27 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x2, 0x7, 0xffffffffffffffff, 0x0, 0x5, 0x0, 0x200, 0x2d1c6bbf}, 0x0, &(0x7f0000000200)={0x1c, 0xfffffffffffffffd, 0x1f, 0xfffffffffffbfffd, 0xfffffffffffffff7, 0x0, 0x1, 0x101}, 0x0, 0x0) r1 = syz_clone3(&(0x7f0000000340)={0xa0000, &(0x7f0000000040), &(0x7f00000000c0), &(0x7f0000000100), {0x21}, &(0x7f0000000240)=""/121, 0x79, &(0x7f00000002c0)=""/87, &(0x7f0000000140)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0], 0x9}, 0x58) sched_rr_get_interval(r1, &(0x7f00000001c0)) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) pselect6(0x40, &(0x7f0000000180)={0x2, 0x7, 0xffffffffffffffff, 0x0, 0x5, 0x0, 0x200, 0x2d1c6bbf}, 0x0, &(0x7f0000000200)={0x1c, 0xfffffffffffffffd, 0x1f, 0xfffffffffffbfffd, 0xfffffffffffffff7, 0x0, 0x1, 0x101}, 0x0, 0x0) (async) syz_clone3(&(0x7f0000000340)={0xa0000, &(0x7f0000000040), &(0x7f00000000c0), &(0x7f0000000100), {0x21}, &(0x7f0000000240)=""/121, 0x79, &(0x7f00000002c0)=""/87, &(0x7f0000000140)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0], 0x9}, 0x58) (async) sched_rr_get_interval(r1, &(0x7f00000001c0)) (async) 15:30:27 executing program 2: ioctl$KDSIGACCEPT(0xffffffffffffffff, 0x4b4e, 0x1a) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/custom1\x00', 0x802, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x81, 0x0, 0x80000, 0x0, 0x1}, 0x0, &(0x7f0000000200)={0x1c, 0x4, 0x20000000000, 0x0, 0x40, 0x200000000000}, 0x0, 0x0) 15:30:27 executing program 2: ioctl$KDSIGACCEPT(0xffffffffffffffff, 0x4b4e, 0x1a) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/custom1\x00', 0x802, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) eventfd(0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x81, 0x0, 0x80000, 0x0, 0x1}, 0x0, &(0x7f0000000200)={0x1c, 0x4, 0x20000000000, 0x0, 0x40, 0x200000000000}, 0x0, 0x0) [ 3023.783519][T23069] binder: 23068:23069 ioctl c0306201 0 returned -14 [ 3023.808547][T23071] binder: 23070:23071 ioctl c0306201 0 returned -14 15:30:27 executing program 2: ioctl$KDSIGACCEPT(0xffffffffffffffff, 0x4b4e, 0x1a) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/custom1\x00', 0x802, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) eventfd(0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x81, 0x0, 0x80000, 0x0, 0x1}, 0x0, &(0x7f0000000200)={0x1c, 0x4, 0x20000000000, 0x0, 0x40, 0x200000000000}, 0x0, 0x0) 15:30:27 executing program 2: ioctl$KDSIGACCEPT(0xffffffffffffffff, 0x4b4e, 0x1a) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/custom1\x00', 0x802, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) eventfd(0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x81, 0x0, 0x80000, 0x0, 0x1}, 0x0, &(0x7f0000000200)={0x1c, 0x4, 0x20000000000, 0x0, 0x40, 0x200000000000}, 0x0, 0x0) [ 3023.906374][T23079] binder: 23070:23079 ioctl c0306201 0 returned -14 15:30:28 executing program 0: socket(0x2, 0x1, 0x106) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0xd, 0x0) read$msr(r1, &(0x7f0000000240)=""/212, 0xd4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pipe2$9p(&(0x7f0000000040), 0x0) eventfd(0x0) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETSF(r2, 0x5404, &(0x7f00000001c0)={0x7ff, 0x2, 0x8, 0x6, 0xb, "1ef288b2106becde0720bb0e113e33bafb66fe"}) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) sendmsg$IPVS_CMD_SET_CONFIG(r3, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x24, 0x0, 0x100, 0x70bd2a, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x80}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8000}]}, 0x24}, 0x1, 0x0, 0x0, 0x20044010}, 0x20000800) 15:30:28 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_BSS(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x14, 0x0, 0x4, 0x0, 0x0, {{}, {@void, @void}}}, 0x14}}, 0x0) eventfd2(0xb4, 0x0) pselect6(0x0, 0x0, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:28 executing program 1: pipe2$9p(&(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x2c, r0, 0x10, 0x70bd2a, 0x25dfdbfd, {}, [@BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x7}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0xfffffffb}, @BATADV_ATTR_HARD_IFINDEX={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000081}, 0x4040040) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x3c, r1, 0x800, 0x70bd26, 0x25dfdbfc, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x80000001}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x81}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x10) 15:30:28 executing program 2: ioctl$KDSIGACCEPT(0xffffffffffffffff, 0x4b4e, 0x1a) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/custom1\x00', 0x802, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) eventfd(0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x81, 0x0, 0x80000, 0x0, 0x1}, 0x0, &(0x7f0000000200)={0x1c, 0x4, 0x20000000000, 0x0, 0x40, 0x200000000000}, 0x0, 0x0) [ 3024.443452][T23085] binder: 23084:23085 ioctl c0306201 0 returned -14 15:30:28 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x48, 0x0, &(0x7f00000000c0)=[@register_looper, @clear_death={0x400c630f, 0x1}, @register_looper, @acquire, @free_buffer, @dead_binder_done, @request_death={0x400c630e, 0x1000}], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:28 executing program 5: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0, 0x0) [ 3024.637019][T23095] binder: 23094:23095 ioctl c0306201 0 returned -14 15:30:29 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_SYNC_FILE(0xffffffffffffffff, 0xc01064c1, &(0x7f00000001c0)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x48, 0x0, &(0x7f00000000c0)=[@register_looper, @clear_death={0x400c630f, 0x1}, @register_looper, @acquire, @free_buffer, @dead_binder_done, @request_death={0x400c630e, 0x1000}], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:29 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_BSS(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x14, 0x0, 0x4, 0x0, 0x0, {{}, {@void, @void}}}, 0x14}}, 0x0) eventfd2(0xb4, 0x0) pselect6(0x0, 0x0, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:29 executing program 1: pipe2$9p(&(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x2c, r0, 0x10, 0x70bd2a, 0x25dfdbfd, {}, [@BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x7}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0xfffffffb}, @BATADV_ATTR_HARD_IFINDEX={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000081}, 0x4040040) syz_genetlink_get_family_id$batadv(&(0x7f0000000240), 0xffffffffffffffff) 15:30:29 executing program 2: ioctl$KDSIGACCEPT(0xffffffffffffffff, 0x4b4e, 0x1a) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) eventfd(0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x81, 0x0, 0x80000, 0x0, 0x1}, 0x0, &(0x7f0000000200)={0x1c, 0x4, 0x20000000000, 0x0, 0x40, 0x200000000000}, 0x0, 0x0) [ 3025.316974][T23099] binder: 23098:23099 ioctl c0306201 0 returned -14 15:30:29 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x48, 0x0, &(0x7f00000000c0)=[@register_looper, @clear_death={0x400c630f, 0x1}, @register_looper, @acquire, @free_buffer, @dead_binder_done, @request_death={0x400c630e, 0x1000}], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:29 executing program 5: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0, 0x0) 15:30:29 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x48, 0x0, &(0x7f00000000c0)=[@register_looper, @clear_death={0x400c630f, 0x1}, @register_looper, @acquire, @free_buffer, @dead_binder_done, @request_death={0x400c630e, 0x1000}], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:29 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x48, 0x0, &(0x7f00000000c0)=[@register_looper, @clear_death={0x400c630f, 0x1}, @register_looper, @acquire, @free_buffer, @dead_binder_done, @request_death={0x400c630e, 0x1000}], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:29 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x48, 0x0, &(0x7f00000000c0)=[@register_looper, @clear_death={0x400c630f, 0x1}, @register_looper, @acquire, @free_buffer, @dead_binder_done, @request_death={0x400c630e, 0x1000}], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) [ 3025.615084][T23117] binder: 23116:23117 ioctl c0306201 0 returned -14 15:30:29 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x48, 0x0, &(0x7f00000000c0)=[@register_looper, @clear_death={0x400c630f, 0x1}, @register_looper, @acquire, @free_buffer, @dead_binder_done, @request_death={0x400c630e, 0x1000}], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:29 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x48, 0x0, &(0x7f00000000c0)=[@register_looper, @clear_death={0x400c630f, 0x1}, @register_looper, @acquire, @free_buffer, @dead_binder_done, @request_death={0x400c630e, 0x1000}], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:29 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_BSS(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x14, 0x0, 0x4, 0x0, 0x0, {{}, {@void, @void}}}, 0x14}}, 0x0) eventfd2(0xb4, 0x0) pselect6(0x0, 0x0, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:30 executing program 1: pipe2$9p(&(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x2c, r0, 0x10, 0x70bd2a, 0x25dfdbfd, {}, [@BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x7}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0xfffffffb}, @BATADV_ATTR_HARD_IFINDEX={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000081}, 0x4040040) 15:30:30 executing program 2: openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) eventfd(0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x81, 0x0, 0x80000, 0x0, 0x1}, 0x0, &(0x7f0000000200)={0x1c, 0x4, 0x20000000000, 0x0, 0x40, 0x200000000000}, 0x0, 0x0) 15:30:30 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x48, 0x0, &(0x7f00000000c0)=[@register_looper, @clear_death={0x400c630f, 0x1}, @register_looper, @acquire, @free_buffer, @dead_binder_done, @request_death={0x400c630e, 0x1000}], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:30 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x48, 0x0, &(0x7f00000000c0)=[@register_looper, @clear_death={0x400c630f, 0x1}, @register_looper, @acquire, @free_buffer, @dead_binder_done, @request_death={0x400c630e, 0x1000}], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:30 executing program 0: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x48, 0x0, &(0x7f00000000c0)=[@register_looper, @clear_death={0x400c630f, 0x1}, @register_looper, @acquire, @free_buffer, @dead_binder_done, @request_death={0x400c630e, 0x1000}], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:30 executing program 5: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0, 0x0) 15:30:30 executing program 0: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x48, 0x0, &(0x7f00000000c0)=[@register_looper, @clear_death={0x400c630f, 0x1}, @register_looper, @acquire, @free_buffer, @dead_binder_done, @request_death={0x400c630e, 0x1000}], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:30 executing program 0: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x48, 0x0, &(0x7f00000000c0)=[@register_looper, @clear_death={0x400c630f, 0x1}, @register_looper, @acquire, @free_buffer, @dead_binder_done, @request_death={0x400c630e, 0x1000}], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:30 executing program 3: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x48, 0x0, &(0x7f00000000c0)=[@register_looper, @clear_death={0x400c630f, 0x1}, @register_looper, @acquire, @free_buffer, @dead_binder_done, @request_death={0x400c630e, 0x1000}], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:30 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x48, 0x0, &(0x7f00000000c0)=[@register_looper, @clear_death={0x400c630f, 0x1}, @register_looper, @acquire, @free_buffer, @dead_binder_done, @request_death={0x400c630e, 0x1000}], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:30 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x48, 0x0, &(0x7f00000000c0)=[@register_looper, @clear_death={0x400c630f, 0x1}, @register_looper, @acquire, @free_buffer, @dead_binder_done, @request_death={0x400c630e, 0x1000}], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:30 executing program 3: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x48, 0x0, &(0x7f00000000c0)=[@register_looper, @clear_death={0x400c630f, 0x1}, @register_looper, @acquire, @free_buffer, @dead_binder_done, @request_death={0x400c630e, 0x1000}], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:30 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x48, 0x0, &(0x7f00000000c0)=[@register_looper, @clear_death={0x400c630f, 0x1}, @register_looper, @acquire, @free_buffer, @dead_binder_done, @request_death={0x400c630e, 0x1000}], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:30 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_BSS(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x14, 0x0, 0x4, 0x0, 0x0, {{}, {@void, @void}}}, 0x14}}, 0x0) eventfd2(0xb4, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, 0x0, 0x0, 0x0) 15:30:30 executing program 3: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x48, 0x0, &(0x7f00000000c0)=[@register_looper, @clear_death={0x400c630f, 0x1}, @register_looper, @acquire, @free_buffer, @dead_binder_done, @request_death={0x400c630e, 0x1000}], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:30 executing program 2: openat$ttyS3(0xffffffffffffff9c, 0x0, 0x0, 0x0) eventfd(0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x81, 0x0, 0x80000, 0x0, 0x1}, 0x0, &(0x7f0000000200)={0x1c, 0x4, 0x20000000000, 0x0, 0x40, 0x200000000000}, 0x0, 0x0) 15:30:30 executing program 1: pipe2$9p(&(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x2c, r0, 0x10, 0x70bd2a, 0x25dfdbfd, {}, [@BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x7}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0xfffffffb}, @BATADV_ATTR_HARD_IFINDEX={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000081}, 0x4040040) 15:30:31 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) socket$l2tp(0x2, 0x2, 0x73) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) setsockopt$RDS_CANCEL_SENT_TO(0xffffffffffffffff, 0x114, 0x1, &(0x7f0000000040)={0x2, 0x4e24, @local}, 0x10) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:31 executing program 0: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x48, 0x0, &(0x7f00000000c0)=[@register_looper, @clear_death={0x400c630f, 0x1}, @register_looper, @acquire, @free_buffer, @dead_binder_done, @request_death={0x400c630e, 0x1000}], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:31 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x48, 0x0, &(0x7f00000000c0)=[@register_looper, @clear_death={0x400c630f, 0x1}, @register_looper, @acquire, @free_buffer, @dead_binder_done, @request_death={0x400c630e, 0x1000}], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:31 executing program 2: openat$ttyS3(0xffffffffffffff9c, 0x0, 0x0, 0x0) eventfd(0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x81, 0x0, 0x80000, 0x0, 0x1}, 0x0, &(0x7f0000000200)={0x1c, 0x4, 0x20000000000, 0x0, 0x40, 0x200000000000}, 0x0, 0x0) 15:30:31 executing program 0: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x48, 0x0, &(0x7f00000000c0)=[@register_looper, @clear_death={0x400c630f, 0x1}, @register_looper, @acquire, @free_buffer, @dead_binder_done, @request_death={0x400c630e, 0x1000}], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:31 executing program 2: openat$ttyS3(0xffffffffffffff9c, 0x0, 0x0, 0x0) eventfd(0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x81, 0x0, 0x80000, 0x0, 0x1}, 0x0, &(0x7f0000000200)={0x1c, 0x4, 0x20000000000, 0x0, 0x40, 0x200000000000}, 0x0, 0x0) 15:30:31 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x48, 0x0, &(0x7f00000000c0)=[@register_looper, @clear_death={0x400c630f, 0x1}, @register_looper, @acquire, @free_buffer, @dead_binder_done, @request_death={0x400c630e, 0x1000}], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) [ 3027.296918][T23168] binder: 23167:23168 ioctl c0306201 0 returned -14 15:30:31 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x48, 0x0, &(0x7f00000000c0)=[@register_looper, @clear_death={0x400c630f, 0x1}, @register_looper, @acquire, @free_buffer, @dead_binder_done, @request_death={0x400c630e, 0x1000}], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:31 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_BSS(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x14, 0x0, 0x4, 0x0, 0x0, {{}, {@void, @void}}}, 0x14}}, 0x0) eventfd2(0xb4, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, 0x0, 0x0, 0x0) 15:30:31 executing program 0: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x48, 0x0, &(0x7f00000000c0)=[@register_looper, @clear_death={0x400c630f, 0x1}, @register_looper, @acquire, @free_buffer, @dead_binder_done, @request_death={0x400c630e, 0x1000}], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:31 executing program 2: openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) eventfd(0x0) pselect6(0x0, 0x0, 0x0, &(0x7f0000000200)={0x1c, 0x4, 0x20000000000, 0x0, 0x40, 0x200000000000}, 0x0, 0x0) 15:30:31 executing program 1: pipe2$9p(&(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x2c, r0, 0x10, 0x70bd2a, 0x25dfdbfd, {}, [@BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x7}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0xfffffffb}, @BATADV_ATTR_HARD_IFINDEX={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000081}, 0x4040040) 15:30:31 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) socket$l2tp(0x2, 0x2, 0x73) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) (async) setsockopt$RDS_CANCEL_SENT_TO(0xffffffffffffffff, 0x114, 0x1, &(0x7f0000000040)={0x2, 0x4e24, @local}, 0x10) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:31 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x48, 0x0, &(0x7f00000000c0)=[@register_looper, @clear_death={0x400c630f, 0x1}, @register_looper, @acquire, @free_buffer, @dead_binder_done, @request_death={0x400c630e, 0x1000}], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:31 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 15:30:31 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x48, 0x0, &(0x7f00000000c0)=[@register_looper, @clear_death={0x400c630f, 0x1}, @register_looper, @acquire, @free_buffer, @dead_binder_done, @request_death={0x400c630e, 0x1000}], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:31 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 15:30:32 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x48, 0x0, &(0x7f00000000c0)=[@register_looper, @clear_death={0x400c630f, 0x1}, @register_looper, @acquire, @free_buffer, @dead_binder_done, @request_death={0x400c630e, 0x1000}], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) [ 3028.150837][T23189] binder: 23188:23189 ioctl c0306201 0 returned -14 [ 3028.169810][T23192] binder: 23190:23192 ioctl c0306201 0 returned -14 15:30:32 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x48, 0x0, &(0x7f00000000c0)=[@register_looper, @clear_death={0x400c630f, 0x1}, @register_looper, @acquire, @free_buffer, @dead_binder_done, @request_death={0x400c630e, 0x1000}], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:32 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 3028.237556][T23197] binder: 23196:23197 ioctl c0306201 0 returned -14 [ 3028.286566][T23201] binder: 23200:23201 ioctl c0306201 0 returned -14 [ 3028.289157][T23203] binder: 23202:23203 ioctl c0306201 0 returned -14 15:30:32 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x48, 0x0, &(0x7f00000000c0)=[@register_looper, @clear_death={0x400c630f, 0x1}, @register_looper, @acquire, @free_buffer, @dead_binder_done, @request_death={0x400c630e, 0x1000}], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:32 executing program 2: openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) eventfd(0x0) pselect6(0x0, 0x0, 0x0, &(0x7f0000000200)={0x1c, 0x4, 0x20000000000, 0x0, 0x40, 0x200000000000}, 0x0, 0x0) 15:30:32 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_BSS(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x14, 0x0, 0x4, 0x0, 0x0, {{}, {@void, @void}}}, 0x14}}, 0x0) eventfd2(0xb4, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, 0x0, 0x0, 0x0) 15:30:32 executing program 1: pipe2$9p(&(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) syz_genetlink_get_family_id$batadv(&(0x7f0000000240), 0xffffffffffffffff) [ 3028.892094][T23206] binder: 23204:23206 ioctl c0306201 0 returned -14 15:30:32 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) socket$l2tp(0x2, 0x2, 0x73) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) (async) setsockopt$RDS_CANCEL_SENT_TO(0xffffffffffffffff, 0x114, 0x1, &(0x7f0000000040)={0x2, 0x4e24, @local}, 0x10) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:32 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:32 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x48, 0x0, &(0x7f00000000c0)=[@register_looper, @clear_death={0x400c630f, 0x1}, @register_looper, @acquire, @free_buffer, @dead_binder_done, @request_death={0x400c630e, 0x1000}], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:32 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:32 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 3029.031513][T23216] binder: 23214:23216 ioctl c0306201 0 returned -14 [ 3029.038313][T23219] binder: 23215:23219 ioctl c0306201 0 returned -14 15:30:32 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:32 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 3029.091933][T23226] binder: 23224:23226 ioctl c0306201 0 returned -14 [ 3029.099102][T23226] binder: 23224:23226 ioctl c0306201 0 returned -14 15:30:32 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 15:30:32 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x38, 0x0, &(0x7f00000000c0)=[@register_looper, @clear_death={0x400c630f, 0x1}, @register_looper, @acquire, @free_buffer, @dead_binder_done], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) [ 3029.141843][T23228] binder: 23227:23228 ioctl c0306201 0 returned -14 [ 3029.148994][T23228] binder: 23227:23228 ioctl c0306201 0 returned -14 [ 3029.198655][T23233] binder: 23232:23233 ioctl c0306201 0 returned -14 [ 3029.206318][T23233] binder: 23232:23233 ioctl c0306201 0 returned -14 15:30:33 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_BSS(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x14, 0x0, 0x4, 0x0, 0x0, {{}, {@void, @void}}}, 0x14}}, 0x0) eventfd2(0xb4, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200), 0x0, 0x0) 15:30:33 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x2c, 0x0, &(0x7f00000000c0)=[@register_looper, @clear_death={0x400c630f, 0x1}, @register_looper, @acquire, @free_buffer], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:33 executing program 1: pipe2$9p(&(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000240), 0xffffffffffffffff) 15:30:33 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) sendmsg$L2TP_CMD_SESSION_MODIFY(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x4060}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x100, 0x70bd27, 0x20b9c2f9, {}, [@L2TP_ATTR_RECV_SEQ={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x5}, 0x40) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x20000}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x4, 0x8, 0xfffffffffffffffe, 0x7, 0x9, 0x1, 0x3ff, 0x2}, &(0x7f0000000100)={0x80000000, 0x1, 0x7, 0x8, 0x6, 0x1ff, 0x9, 0x7}, &(0x7f0000000140)={0x40, 0x7, 0xaf9f, 0x24, 0xfe2f, 0xfff, 0x7fffffff, 0x42f5}, &(0x7f0000000180)={0x0, 0x989680}, &(0x7f0000000240)={&(0x7f00000001c0)={[0xffff]}, 0x8}) 15:30:33 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:33 executing program 2: openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) eventfd(0x0) pselect6(0x0, 0x0, 0x0, &(0x7f0000000200)={0x1c, 0x4, 0x20000000000, 0x0, 0x40, 0x200000000000}, 0x0, 0x0) 15:30:33 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x2c, 0x0, &(0x7f00000000c0)=[@register_looper, @clear_death={0x400c630f, 0x1}, @register_looper, @acquire, @free_buffer], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:33 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x2c, 0x0, &(0x7f00000000c0)=[@register_looper, @clear_death={0x400c630f, 0x1}, @register_looper, @acquire, @free_buffer], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:33 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x2c, 0x0, &(0x7f00000000c0)=[@register_looper, @clear_death={0x400c630f, 0x1}, @register_looper, @acquire, @dead_binder_done], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) [ 3029.897910][T23247] binder: 23243:23247 ioctl c0306201 0 returned -14 [ 3029.937641][T23251] binder: 23249:23251 ioctl c0306201 0 returned -14 15:30:33 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x24, 0x0, &(0x7f00000000c0)=[@register_looper, @clear_death={0x400c630f, 0x1}, @register_looper, @dead_binder_done], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:33 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x24, 0x0, &(0x7f00000000c0)=[@register_looper, @clear_death={0x400c630f, 0x1}, @register_looper, @dead_binder_done], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:33 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x24, 0x0, &(0x7f00000000c0)=[@register_looper, @clear_death={0x400c630f, 0x1}, @register_looper, @dead_binder_done], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:34 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_BSS(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x14, 0x0, 0x4, 0x0, 0x0, {{}, {@void, @void}}}, 0x14}}, 0x0) eventfd2(0xb4, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200), 0x0, 0x0) 15:30:34 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x28, 0x0, &(0x7f00000000c0)=[@register_looper, @clear_death={0x400c630f, 0x1}, @acquire, @dead_binder_done], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:34 executing program 1: pipe2$9p(&(0x7f0000000000), 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000240), 0xffffffffffffffff) 15:30:34 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) sendmsg$L2TP_CMD_SESSION_MODIFY(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x4060}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x100, 0x70bd27, 0x20b9c2f9, {}, [@L2TP_ATTR_RECV_SEQ={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x5}, 0x40) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x20000}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x4, 0x8, 0xfffffffffffffffe, 0x7, 0x9, 0x1, 0x3ff, 0x2}, &(0x7f0000000100)={0x80000000, 0x1, 0x7, 0x8, 0x6, 0x1ff, 0x9, 0x7}, &(0x7f0000000140)={0x40, 0x7, 0xaf9f, 0x24, 0xfe2f, 0xfff, 0x7fffffff, 0x42f5}, &(0x7f0000000180)={0x0, 0x989680}, &(0x7f0000000240)={&(0x7f00000001c0)={[0xffff]}, 0x8}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) (async) sendmsg$L2TP_CMD_SESSION_MODIFY(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x4060}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x100, 0x70bd27, 0x20b9c2f9, {}, [@L2TP_ATTR_RECV_SEQ={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x5}, 0x40) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) pselect6(0x40, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x20000}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) (async) pselect6(0x40, &(0x7f00000000c0)={0x4, 0x8, 0xfffffffffffffffe, 0x7, 0x9, 0x1, 0x3ff, 0x2}, &(0x7f0000000100)={0x80000000, 0x1, 0x7, 0x8, 0x6, 0x1ff, 0x9, 0x7}, &(0x7f0000000140)={0x40, 0x7, 0xaf9f, 0x24, 0xfe2f, 0xfff, 0x7fffffff, 0x42f5}, &(0x7f0000000180)={0x0, 0x989680}, &(0x7f0000000240)={&(0x7f00000001c0)={[0xffff]}, 0x8}) (async) 15:30:34 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@register_looper, @acquire, @dead_binder_done], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:34 executing program 1: pipe2$9p(0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000240), 0xffffffffffffffff) 15:30:34 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:34 executing program 2: openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) eventfd(0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x1}, 0x0, &(0x7f0000000200)={0x1c, 0x4, 0x20000000000, 0x0, 0x40, 0x200000000000}, 0x0, 0x0) [ 3030.796511][T23274] binder: 23270:23274 ioctl c0306201 0 returned -14 15:30:34 executing program 1: pipe2$9p(0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000240), 0xffffffffffffffff) 15:30:34 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x14, 0x0, &(0x7f00000000c0)=[@acquire, @dead_binder_done], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:34 executing program 1: pipe2$9p(0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000240), 0xffffffffffffffff) [ 3030.837888][T23278] binder: 23277:23278 ioctl c0306201 0 returned -14 15:30:34 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x14, 0x0, &(0x7f00000000c0)=[@acquire, @dead_binder_done], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) [ 3030.912787][T23286] binder: 23277:23286 ioctl c0306201 0 returned -14 15:30:35 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_BSS(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x14, 0x0, 0x4, 0x0, 0x0, {{}, {@void, @void}}}, 0x14}}, 0x0) eventfd2(0xb4, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200), 0x0, 0x0) 15:30:35 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) sendmsg$L2TP_CMD_SESSION_MODIFY(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x4060}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x100, 0x70bd27, 0x20b9c2f9, {}, [@L2TP_ATTR_RECV_SEQ={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x5}, 0x40) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x20000}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0)={0x4, 0x8, 0xfffffffffffffffe, 0x7, 0x9, 0x1, 0x3ff, 0x2}, &(0x7f0000000100)={0x80000000, 0x1, 0x7, 0x8, 0x6, 0x1ff, 0x9, 0x7}, &(0x7f0000000140)={0x40, 0x7, 0xaf9f, 0x24, 0xfe2f, 0xfff, 0x7fffffff, 0x42f5}, &(0x7f0000000180)={0x0, 0x989680}, &(0x7f0000000240)={&(0x7f00000001c0)={[0xffff]}, 0x8}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) (async) sendmsg$L2TP_CMD_SESSION_MODIFY(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x4060}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x100, 0x70bd27, 0x20b9c2f9, {}, [@L2TP_ATTR_RECV_SEQ={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x5}, 0x40) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) pselect6(0x40, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x20000}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) (async) pselect6(0x40, &(0x7f00000000c0)={0x4, 0x8, 0xfffffffffffffffe, 0x7, 0x9, 0x1, 0x3ff, 0x2}, &(0x7f0000000100)={0x80000000, 0x1, 0x7, 0x8, 0x6, 0x1ff, 0x9, 0x7}, &(0x7f0000000140)={0x40, 0x7, 0xaf9f, 0x24, 0xfe2f, 0xfff, 0x7fffffff, 0x42f5}, &(0x7f0000000180)={0x0, 0x989680}, &(0x7f0000000240)={&(0x7f00000001c0)={[0xffff]}, 0x8}) (async) 15:30:35 executing program 1: pipe2$9p(&(0x7f0000000000), 0x0) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) 15:30:35 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x14, 0x0, &(0x7f00000000c0)=[@acquire, @dead_binder_done], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:35 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@register_looper, @acquire, @dead_binder_done], 0x0, 0x0, 0x0}) 15:30:35 executing program 1: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) [ 3031.526943][T23300] binder: 23293:23300 ioctl c0306201 0 returned -14 15:30:35 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:35 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@register_looper, @acquire, @dead_binder_done], 0x0, 0x0, 0x0}) 15:30:35 executing program 5: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000100), 0x181002, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0), r0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x2, "b81da4", "4438d05d538a2a09de85d2d44936cc7ce999752574adb3238d0eb9d89b8cf2b03ad3253c78a9b7dcc57196b31b732bb6f74627b1d549106a61ccce89e1b153bd11781ea56cda0b12fb247843e35578cdc564935be14ae3ee93becf635921a8db2d259ab345e0c5c50ba56b8bcc79ef15ca566c4b48934f25e7fba4557c04b83489a38a4dcac2f1ba9ec2f03f66269a21badadde499e1d3c76c0ef453e4f87e8eeeaead5e3acdc2d97d7d019e1ba3148147c9d39c2f4e8dab2c232042a0f45d81d8e06534904cdfc4f30237aba4ec85b124748e48a94acc246afe28a216cc8053f4df28f6461bf79d6fed1f62e356935320f5b550f8cbabf1fa379b586395f03a"}}, 0x110) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000380)={0x0, 0x18, 0xfa00, {0x7, &(0x7f0000000440)={0xffffffffffffffff}, 0x13f, 0x6}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r2, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e22, 0x7, @remote, 0x4}, {0xa, 0x4e23, 0x10001, @remote, 0x6}, r3, 0x7fff}}, 0x48) r4 = syz_open_pts(r0, 0x4e500) r5 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000540)={0x0, 0x0, r0}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(r5, 0xc02864ca, &(0x7f0000000640)={&(0x7f0000000580)=[0x0, 0x0, 0x0, 0x0, r6, 0x0], &(0x7f00000005c0)=[0x100000000, 0x2, 0x7fffffff, 0x0, 0x8000, 0x3, 0x2, 0x9, 0x1c02e094], 0x2, 0x6, 0x2}) ioctl$GIO_UNIMAP(r4, 0x4b66, &(0x7f0000000500)={0x4, &(0x7f00000004c0)=[{}, {}, {}, {}]}) openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000140), 0x84900, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0xc2e4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) r7 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_LISTEN(r7, &(0x7f0000000480)={0x7, 0x8, 0xfa00, {r3, 0x1f}}, 0x10) 15:30:35 executing program 2: openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) eventfd(0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, &(0x7f0000000200)={0x1c, 0x4, 0x20000000000, 0x0, 0x40, 0x200000000000}, 0x0, 0x0) [ 3031.584551][T23304] binder: 23303:23304 ioctl c0306201 0 returned -14 [ 3031.605516][T23306] binder: 23293:23306 ioctl c0306201 0 returned -14 15:30:35 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@register_looper, @acquire, @dead_binder_done], 0x0, 0x0, 0x0}) 15:30:35 executing program 5: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000100), 0x181002, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) (async) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0), r0) (async) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x2, "b81da4", "4438d05d538a2a09de85d2d44936cc7ce999752574adb3238d0eb9d89b8cf2b03ad3253c78a9b7dcc57196b31b732bb6f74627b1d549106a61ccce89e1b153bd11781ea56cda0b12fb247843e35578cdc564935be14ae3ee93becf635921a8db2d259ab345e0c5c50ba56b8bcc79ef15ca566c4b48934f25e7fba4557c04b83489a38a4dcac2f1ba9ec2f03f66269a21badadde499e1d3c76c0ef453e4f87e8eeeaead5e3acdc2d97d7d019e1ba3148147c9d39c2f4e8dab2c232042a0f45d81d8e06534904cdfc4f30237aba4ec85b124748e48a94acc246afe28a216cc8053f4df28f6461bf79d6fed1f62e356935320f5b550f8cbabf1fa379b586395f03a"}}, 0x110) (async) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000380)={0x0, 0x18, 0xfa00, {0x7, &(0x7f0000000440)={0xffffffffffffffff}, 0x13f, 0x6}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r2, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e22, 0x7, @remote, 0x4}, {0xa, 0x4e23, 0x10001, @remote, 0x6}, r3, 0x7fff}}, 0x48) (async) r4 = syz_open_pts(r0, 0x4e500) r5 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000540)={0x0, 0x0, r0}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(r5, 0xc02864ca, &(0x7f0000000640)={&(0x7f0000000580)=[0x0, 0x0, 0x0, 0x0, r6, 0x0], &(0x7f00000005c0)=[0x100000000, 0x2, 0x7fffffff, 0x0, 0x8000, 0x3, 0x2, 0x9, 0x1c02e094], 0x2, 0x6, 0x2}) ioctl$GIO_UNIMAP(r4, 0x4b66, &(0x7f0000000500)={0x4, &(0x7f00000004c0)=[{}, {}, {}, {}]}) openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000140), 0x84900, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0xc2e4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) r7 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_LISTEN(r7, &(0x7f0000000480)={0x7, 0x8, 0xfa00, {r3, 0x1f}}, 0x10) [ 3031.688227][T23317] binder: 23314:23317 ioctl c0306201 0 returned -14 [ 3031.696902][T23318] binder: 23315:23318 ioctl c0306201 0 returned -14 [ 3031.768895][T23322] binder: 23321:23322 ioctl c0306201 0 returned -14 15:30:36 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@register_looper, @acquire, @dead_binder_done], 0x0, 0x0, &(0x7f0000000240)}) 15:30:36 executing program 5: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000100), 0x181002, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0), r0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x2, "b81da4", "4438d05d538a2a09de85d2d44936cc7ce999752574adb3238d0eb9d89b8cf2b03ad3253c78a9b7dcc57196b31b732bb6f74627b1d549106a61ccce89e1b153bd11781ea56cda0b12fb247843e35578cdc564935be14ae3ee93becf635921a8db2d259ab345e0c5c50ba56b8bcc79ef15ca566c4b48934f25e7fba4557c04b83489a38a4dcac2f1ba9ec2f03f66269a21badadde499e1d3c76c0ef453e4f87e8eeeaead5e3acdc2d97d7d019e1ba3148147c9d39c2f4e8dab2c232042a0f45d81d8e06534904cdfc4f30237aba4ec85b124748e48a94acc246afe28a216cc8053f4df28f6461bf79d6fed1f62e356935320f5b550f8cbabf1fa379b586395f03a"}}, 0x110) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000380)={0x0, 0x18, 0xfa00, {0x7, &(0x7f0000000440)={0xffffffffffffffff}, 0x13f, 0x6}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r2, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e22, 0x7, @remote, 0x4}, {0xa, 0x4e23, 0x10001, @remote, 0x6}, r3, 0x7fff}}, 0x48) r4 = syz_open_pts(r0, 0x4e500) r5 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000540)={0x0, 0x0, r0}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(r5, 0xc02864ca, &(0x7f0000000640)={&(0x7f0000000580)=[0x0, 0x0, 0x0, 0x0, r6, 0x0], &(0x7f00000005c0)=[0x100000000, 0x2, 0x7fffffff, 0x0, 0x8000, 0x3, 0x2, 0x9, 0x1c02e094], 0x2, 0x6, 0x2}) ioctl$GIO_UNIMAP(r4, 0x4b66, &(0x7f0000000500)={0x4, &(0x7f00000004c0)=[{}, {}, {}, {}]}) openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000140), 0x84900, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0xc2e4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) r7 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_LISTEN(r7, &(0x7f0000000480)={0x7, 0x8, 0xfa00, {r3, 0x1f}}, 0x10) openat$vcs(0xffffffffffffff9c, &(0x7f0000000100), 0x181002, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) (async) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0), r0) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) (async) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) (async) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x2, "b81da4", "4438d05d538a2a09de85d2d44936cc7ce999752574adb3238d0eb9d89b8cf2b03ad3253c78a9b7dcc57196b31b732bb6f74627b1d549106a61ccce89e1b153bd11781ea56cda0b12fb247843e35578cdc564935be14ae3ee93becf635921a8db2d259ab345e0c5c50ba56b8bcc79ef15ca566c4b48934f25e7fba4557c04b83489a38a4dcac2f1ba9ec2f03f66269a21badadde499e1d3c76c0ef453e4f87e8eeeaead5e3acdc2d97d7d019e1ba3148147c9d39c2f4e8dab2c232042a0f45d81d8e06534904cdfc4f30237aba4ec85b124748e48a94acc246afe28a216cc8053f4df28f6461bf79d6fed1f62e356935320f5b550f8cbabf1fa379b586395f03a"}}, 0x110) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000380)={0x0, 0x18, 0xfa00, {0x7, &(0x7f0000000440), 0x13f, 0x6}}, 0x20) (async) write$RDMA_USER_CM_CMD_RESOLVE_IP(r2, &(0x7f00000003c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e22, 0x7, @remote, 0x4}, {0xa, 0x4e23, 0x10001, @remote, 0x6}, r3, 0x7fff}}, 0x48) (async) syz_open_pts(r0, 0x4e500) (async) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000540)={0x0, 0x0, r0}) (async) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(r5, 0xc02864ca, &(0x7f0000000640)={&(0x7f0000000580)=[0x0, 0x0, 0x0, 0x0, r6, 0x0], &(0x7f00000005c0)=[0x100000000, 0x2, 0x7fffffff, 0x0, 0x8000, 0x3, 0x2, 0x9, 0x1c02e094], 0x2, 0x6, 0x2}) (async) ioctl$GIO_UNIMAP(r4, 0x4b66, &(0x7f0000000500)={0x4, &(0x7f00000004c0)=[{}, {}, {}, {}]}) (async) openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000140), 0x84900, 0x0) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) pselect6(0x40, &(0x7f0000000180)={0xc2e4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) (async) openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_LISTEN(r7, &(0x7f0000000480)={0x7, 0x8, 0xfa00, {r3, 0x1f}}, 0x10) (async) 15:30:36 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 15:30:36 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@register_looper, @acquire, @dead_binder_done], 0x0, 0x0, &(0x7f0000000240)}) 15:30:36 executing program 1: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) [ 3032.396990][T23327] binder: 23325:23327 ioctl c0306201 0 returned -14 [ 3032.409292][T23330] binder: 23329:23330 ioctl c0306201 0 returned -14 [ 3032.433253][T23330] binder: 23329:23330 ioctl c0306201 0 returned -14 15:30:36 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@register_looper, @acquire, @dead_binder_done], 0x0, 0x0, &(0x7f0000000240)}) [ 3032.452146][T23332] binder: 23325:23332 ioctl c0306201 0 returned -14 [ 3032.480796][T23345] binder: 23342:23345 ioctl c0306201 0 returned -14 15:30:36 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x38, 0x0, &(0x7f00000000c0)=[@register_looper, @clear_death={0x400c630f, 0x1}, @register_looper, @acquire, @free_buffer, @dead_binder_done], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:36 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:36 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@register_looper, @acquire, @dead_binder_done], 0x3d, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4b"}) 15:30:36 executing program 2: openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) eventfd(0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c, 0x4, 0x20000000000, 0x0, 0x40, 0x200000000000}, 0x0, 0x0) 15:30:36 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) bpf$LINK_DETACH(0x22, &(0x7f0000000040), 0x4) 15:30:36 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@register_looper, @acquire, @dead_binder_done], 0x0, 0x0, &(0x7f0000000240)}) 15:30:36 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@register_looper, @acquire, @dead_binder_done], 0x1, 0x0, &(0x7f0000000240)="a1"}) [ 3032.583924][T23354] binder: 23352:23354 ioctl c0306201 0 returned -14 15:30:36 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@register_looper, @acquire, @dead_binder_done], 0x0, 0x0, &(0x7f0000000240)}) 15:30:36 executing program 4: pipe2$9p(&(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x2c, r0, 0x10, 0x70bd2a, 0x25dfdbfd, {}, [@BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x7}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0xfffffffb}, @BATADV_ATTR_HARD_IFINDEX={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000081}, 0x4040040) [ 3032.640037][T23358] binder: 23356:23358 ioctl c0306201 0 returned -14 15:30:36 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@register_looper, @acquire, @dead_binder_done], 0x0, 0x0, &(0x7f0000000240)}) 15:30:37 executing program 1: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:37 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@register_looper, @acquire, @dead_binder_done], 0x0, 0x0, &(0x7f0000000240)}) [ 3033.346517][T23376] binder: 23375:23376 ioctl c0306201 0 returned -14 15:30:37 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x2c, 0x0, &(0x7f00000000c0)=[@register_looper, @clear_death={0x400c630f, 0x1}, @register_looper, @acquire, @free_buffer], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:37 executing program 0: pipe2$9p(&(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0) r0 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x2c, r0, 0x10, 0x70bd2a, 0x25dfdbfd, {}, [@BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x7}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0xfffffffb}, @BATADV_ATTR_HARD_IFINDEX={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000081}, 0x4040040) syz_genetlink_get_family_id$batadv(&(0x7f0000000240), 0xffffffffffffffff) 15:30:37 executing program 2: openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) eventfd(0x0) pselect6(0x40, &(0x7f0000000180), 0x0, 0x0, 0x0, 0x0) 15:30:37 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) bpf$LINK_DETACH(0x22, &(0x7f0000000040), 0x4) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) (async) bpf$LINK_DETACH(0x22, &(0x7f0000000040), 0x4) (async) [ 3033.438554][T23380] binder: 23379:23380 ioctl c0306201 0 returned -14 15:30:37 executing program 4: socket(0x2, 0x1, 0x106) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0xd, 0x0) read$msr(r1, &(0x7f0000000240)=""/212, 0xd4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pipe2$9p(&(0x7f0000000040), 0x0) eventfd(0x0) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETSF(r2, 0x5404, &(0x7f00000001c0)={0x7ff, 0x2, 0x8, 0x6, 0xb, "1ef288b2106becde0720bb0e113e33bafb66fe"}) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) sendmsg$IPVS_CMD_SET_CONFIG(r3, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x24, 0x0, 0x100, 0x70bd2a, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x80}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8000}]}, 0x24}, 0x1, 0x0, 0x0, 0x20044010}, 0x20000800) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) [ 3033.500612][T23385] binder: 23384:23385 ioctl c0306201 0 returned -14 [ 3033.556760][T23387] binder: 23386:23387 ioctl c0306201 0 returned -14 [ 3033.563938][T23390] binder: 23384:23390 ioctl c0306201 0 returned -14 15:30:37 executing program 1: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:38 executing program 1: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:38 executing program 1: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:38 executing program 0: socket(0x2, 0x1, 0x106) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000100), 0xd, 0x0) read$msr(r1, &(0x7f0000000240)=""/212, 0xd4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pipe2$9p(&(0x7f0000000040), 0x0) eventfd(0x0) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETSF(r2, 0x5404, &(0x7f00000001c0)={0x7ff, 0x2, 0x8, 0x6, 0xb, "1ef288b2106becde0720bb0e113e33bafb66fe"}) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) sendmsg$IPVS_CMD_SET_CONFIG(r3, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x24, 0x0, 0x100, 0x70bd2a, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x80}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8000}]}, 0x24}, 0x1, 0x0, 0x0, 0x20044010}, 0x20000800) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r4, 0xc01064c2, 0x0) 15:30:38 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x2c, 0x0, &(0x7f00000000c0)=[@register_looper, @clear_death={0x400c630f, 0x1}, @register_looper, @acquire, @free_buffer], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:38 executing program 1: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:38 executing program 2: openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) eventfd(0x0) pselect6(0x40, &(0x7f0000000180), 0x0, 0x0, 0x0, 0x0) 15:30:38 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) (async) bpf$LINK_DETACH(0x22, &(0x7f0000000040), 0x4) 15:30:38 executing program 1: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) [ 3034.324641][T23402] binder: 23401:23402 ioctl c0306201 0 returned -14 [ 3034.344481][T23406] binder: 23404:23406 ioctl c0306201 0 returned -14 15:30:38 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x2c, 0x0, &(0x7f00000000c0)=[@register_looper, @clear_death={0x400c630f, 0x1}, @register_looper, @acquire, @free_buffer], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:38 executing program 1: ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:38 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000040)={r1}, 0x8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) ioctl$TIOCVHANGUP(r2, 0x5437, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) [ 3034.415395][T23413] binder: 23411:23413 ioctl c0306201 0 returned -14 [ 3034.450031][T23417] binder: 23416:23417 ioctl c0306201 0 returned -14 15:30:38 executing program 1: r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:38 executing program 1: r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:38 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000040)={r1}, 0x8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) ioctl$TIOCVHANGUP(r2, 0x5437, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) (async) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) (async) bpf$ITER_CREATE(0x21, &(0x7f0000000040)={r1}, 0x8) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) (async) ioctl$TIOCVHANGUP(r2, 0x5437, 0x0) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) (async) [ 3034.487598][T23421] binder: 23420:23421 ioctl c0306201 0 returned -14 [ 3034.566548][T23427] binder: 23426:23427 ioctl c0306201 0 returned -14 [ 3034.579853][T23431] binder: 23426:23431 ioctl c0306201 0 returned -14 15:30:38 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000040)={r1}, 0x8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) ioctl$TIOCVHANGUP(r2, 0x5437, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) 15:30:38 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x2c, 0x0, &(0x7f00000000c0)=[@register_looper, @clear_death={0x400c630f, 0x1}, @register_looper, @acquire, @free_buffer], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:38 executing program 1: r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) [ 3035.170333][T23438] binder: 23437:23438 ioctl c0306201 0 returned -14 15:30:39 executing program 2: openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) eventfd(0x0) pselect6(0x40, &(0x7f0000000180), 0x0, 0x0, 0x0, 0x0) 15:30:39 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) (async) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000040)={r1}, 0x8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) (async) ioctl$TIOCVHANGUP(r2, 0x5437, 0x0) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) 15:30:39 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000040)={r1}, 0x8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) ioctl$TIOCVHANGUP(r2, 0x5437, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) 15:30:39 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f00000007c0), r1) sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000880)={&(0x7f0000000800)={0x60, r2, 0x2, 0x70bd2a, 0x25dfdbff, {}, [@L2TP_ATTR_COOKIE={0xc, 0xf, 0x9}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x3}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e20}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}]}, 0x60}, 0x1, 0x0, 0x0, 0x48000}, 0x4000011) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000540)={0xa0, 0x0, &(0x7f0000000380)=[@transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f00000000c0)={@fda={0x66646185, 0x1, 0x1, 0x24}, @fd={0x66642a85, 0x0, r0}, @flat=@weak_handle={0x77682a85, 0x1100, 0x2}}, &(0x7f0000000040)={0x0, 0x20, 0x38}}}, @release, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000300)={@ptr={0x70742a85, 0x1, &(0x7f0000000140)=""/37, 0x25, 0x1, 0x15}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x1, &(0x7f0000000240)=""/137, 0x89, 0x0, 0xb}}, &(0x7f00000001c0)={0x0, 0x28, 0x40}}, 0x1000}], 0xc5, 0x0, &(0x7f0000000440)="50941d214d8b71be7bbcc610420752db4358b60a6cb899383caedbcac83f63acf686dd02b019869d066d45ff8f32954178719a00d38922aaed4a2d0d734bbcb2bd0ae7e5fbcb1f325c272df6d422c4908a96be91e045aba8e27c1d181233e9b21495f8a4c8e68ae02d7a6a07f626e9f3fc2e4ba13cdd5cddcec211f891bfc356919c83c9f22f6daf143e8f311e6ac6a990d72b60710a8df4ee4cf88093a001d6ffff645726aa09735f233a526f8cd8dfe13c65acfab15f89a5e109c9e50bbfdcb723479a29"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$KDDISABIO(r4, 0x4b37) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r4, 0xc01064c2, 0x0) ioctl$KDSKBMODE(r4, 0x4b45, &(0x7f00000006c0)) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(r1, &(0x7f0000000580)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x20, '2h1', "c4aefca2661e717f265aae4c49033ca6ed14989d466239c61decdb9bc8f7611d002890acba6060596f4d22795f722ada227f88421978dbf17d185d37fa856265b1e47d2aef84f8e848c6afb823300776646aeae7264891f940119c6e69305a9cb98d961d4509b3d7cb61bf3781ceb630364ae77575bde2b601629a4b8d71a624d8be561a9a9a47ea82c03215f0678b23fe51784b512220c44b4fabc106cef3bb475388a9c7a0313209ed95ad37db70392784d0a2abad12b110db9b0bb89af449748d1a777f8ae3b5c0073346960ce6004f88a7d99992dfe360bea83fe8c9d0778c8fcb5e7424a62f8a16d680a89f611800248b1cbdd825cdc3f9a2dbb60fd1d1"}}, 0x110) pselect6(0x40, &(0x7f0000000180)={0x0, 0x8000}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) r5 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r5, 0xc01064c2, 0x0) read$eventfd(r1, &(0x7f0000000700), 0x8) ioctl$VT_RELDISP(r5, 0x5605) 15:30:39 executing program 1: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) [ 3035.242624][T23443] binder: 23442:23443 ioctl c0306201 0 returned -14 [ 3035.262670][T23446] binder: 23444:23446 ioctl c0306201 0 returned -14 [ 3035.275658][T23447] binder: 23445:23447 ioctl c0306201 0 returned -14 15:30:39 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1263, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wlan1\x00'}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) ioctl$ASHMEM_GET_PROT_MASK(r1, 0x7706, &(0x7f0000000080)) 15:30:39 executing program 5: bpf$ITER_CREATE(0x21, &(0x7f00000000c0), 0x8) r0 = syz_open_dev$loop(&(0x7f0000000280), 0x5, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x4) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="f1e9e29d650c4000"/19], 0x0, 0x0, 0x0}) r3 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000300), 0x101001, 0x0) ioctl$TIOCGRS485(r3, 0x542e, &(0x7f0000000340)) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/custom1\x00', 0x802, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:39 executing program 1: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) [ 3035.357717][T23457] binder: 23456:23457 ioctl c0306201 0 returned -14 [ 3035.389379][T23461] binder: 23460:23461 ioctl c0306201 0 returned -14 15:30:39 executing program 0: r0 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r0, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) bind$qrtr(r0, &(0x7f0000000000)={0x2a, 0xffffffff, 0xfffffffe}, 0xc) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) 15:30:39 executing program 1: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) [ 3035.408664][T23461] binder: 23460:23461 unknown command -1646073359 [ 3035.418051][T23461] binder: 23460:23461 ioctl c0306201 20000440 returned -22 15:30:39 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x2c, 0x0, &(0x7f00000000c0)=[@register_looper, @clear_death={0x400c630f, 0x1}, @register_looper, @acquire, @dead_binder_done], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:39 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f00000007c0), r1) sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000880)={&(0x7f0000000800)={0x60, r2, 0x2, 0x70bd2a, 0x25dfdbff, {}, [@L2TP_ATTR_COOKIE={0xc, 0xf, 0x9}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x3}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e20}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}]}, 0x60}, 0x1, 0x0, 0x0, 0x48000}, 0x4000011) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000540)={0xa0, 0x0, &(0x7f0000000380)=[@transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f00000000c0)={@fda={0x66646185, 0x1, 0x1, 0x24}, @fd={0x66642a85, 0x0, r0}, @flat=@weak_handle={0x77682a85, 0x1100, 0x2}}, &(0x7f0000000040)={0x0, 0x20, 0x38}}}, @release, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000300)={@ptr={0x70742a85, 0x1, &(0x7f0000000140)=""/37, 0x25, 0x1, 0x15}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x1, &(0x7f0000000240)=""/137, 0x89, 0x0, 0xb}}, &(0x7f00000001c0)={0x0, 0x28, 0x40}}, 0x1000}], 0xc5, 0x0, &(0x7f0000000440)="50941d214d8b71be7bbcc610420752db4358b60a6cb899383caedbcac83f63acf686dd02b019869d066d45ff8f32954178719a00d38922aaed4a2d0d734bbcb2bd0ae7e5fbcb1f325c272df6d422c4908a96be91e045aba8e27c1d181233e9b21495f8a4c8e68ae02d7a6a07f626e9f3fc2e4ba13cdd5cddcec211f891bfc356919c83c9f22f6daf143e8f311e6ac6a990d72b60710a8df4ee4cf88093a001d6ffff645726aa09735f233a526f8cd8dfe13c65acfab15f89a5e109c9e50bbfdcb723479a29"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$KDDISABIO(r4, 0x4b37) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r4, 0xc01064c2, 0x0) ioctl$KDSKBMODE(r4, 0x4b45, &(0x7f00000006c0)) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(r1, &(0x7f0000000580)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x20, '2h1', "c4aefca2661e717f265aae4c49033ca6ed14989d466239c61decdb9bc8f7611d002890acba6060596f4d22795f722ada227f88421978dbf17d185d37fa856265b1e47d2aef84f8e848c6afb823300776646aeae7264891f940119c6e69305a9cb98d961d4509b3d7cb61bf3781ceb630364ae77575bde2b601629a4b8d71a624d8be561a9a9a47ea82c03215f0678b23fe51784b512220c44b4fabc106cef3bb475388a9c7a0313209ed95ad37db70392784d0a2abad12b110db9b0bb89af449748d1a777f8ae3b5c0073346960ce6004f88a7d99992dfe360bea83fe8c9d0778c8fcb5e7424a62f8a16d680a89f611800248b1cbdd825cdc3f9a2dbb60fd1d1"}}, 0x110) pselect6(0x40, &(0x7f0000000180)={0x0, 0x8000}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) r5 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r5, 0xc01064c2, 0x0) read$eventfd(r1, &(0x7f0000000700), 0x8) ioctl$VT_RELDISP(r5, 0x5605) 15:30:39 executing program 2: openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) eventfd(0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x0, 0x4, 0x20000000000, 0x0, 0x40, 0x200000000000}, 0x0, 0x0) 15:30:39 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x125f, 0xffffffffffffffff) ioctl$LOOP_GET_STATUS64(r0, 0x4c05, &(0x7f0000000280)) io_uring_setup(0x6a19, &(0x7f0000000080)={0x0, 0xd269, 0x8, 0x3, 0x30b}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000180), 0x8) sendmsg$NL80211_CMD_SET_BSS(r1, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="080026bd7000ffdbdf251900000005001d00ff000000a4b3231278f8d735bd73770c757e59bec7be9d6ed2955b96"], 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x90) ioctl$X86_IOC_RDMSR_REGS(0xffffffffffffffff, 0xc02063a0, &(0x7f0000000000)=[0x9039, 0xf3, 0x9, 0x8, 0xfffffffc, 0x3, 0x200]) 15:30:39 executing program 1: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:39 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f00000007c0), r1) sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000880)={&(0x7f0000000800)={0x60, r2, 0x2, 0x70bd2a, 0x25dfdbff, {}, [@L2TP_ATTR_COOKIE={0xc, 0xf, 0x9}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x3}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e20}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}]}, 0x60}, 0x1, 0x0, 0x0, 0x48000}, 0x4000011) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000540)={0xa0, 0x0, &(0x7f0000000380)=[@transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f00000000c0)={@fda={0x66646185, 0x1, 0x1, 0x24}, @fd={0x66642a85, 0x0, r0}, @flat=@weak_handle={0x77682a85, 0x1100, 0x2}}, &(0x7f0000000040)={0x0, 0x20, 0x38}}}, @release, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000300)={@ptr={0x70742a85, 0x1, &(0x7f0000000140)=""/37, 0x25, 0x1, 0x15}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x1, &(0x7f0000000240)=""/137, 0x89, 0x0, 0xb}}, &(0x7f00000001c0)={0x0, 0x28, 0x40}}, 0x1000}], 0xc5, 0x0, &(0x7f0000000440)="50941d214d8b71be7bbcc610420752db4358b60a6cb899383caedbcac83f63acf686dd02b019869d066d45ff8f32954178719a00d38922aaed4a2d0d734bbcb2bd0ae7e5fbcb1f325c272df6d422c4908a96be91e045aba8e27c1d181233e9b21495f8a4c8e68ae02d7a6a07f626e9f3fc2e4ba13cdd5cddcec211f891bfc356919c83c9f22f6daf143e8f311e6ac6a990d72b60710a8df4ee4cf88093a001d6ffff645726aa09735f233a526f8cd8dfe13c65acfab15f89a5e109c9e50bbfdcb723479a29"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$KDDISABIO(r4, 0x4b37) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r4, 0xc01064c2, 0x0) ioctl$KDSKBMODE(r4, 0x4b45, &(0x7f00000006c0)) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(r1, &(0x7f0000000580)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x20, '2h1', "c4aefca2661e717f265aae4c49033ca6ed14989d466239c61decdb9bc8f7611d002890acba6060596f4d22795f722ada227f88421978dbf17d185d37fa856265b1e47d2aef84f8e848c6afb823300776646aeae7264891f940119c6e69305a9cb98d961d4509b3d7cb61bf3781ceb630364ae77575bde2b601629a4b8d71a624d8be561a9a9a47ea82c03215f0678b23fe51784b512220c44b4fabc106cef3bb475388a9c7a0313209ed95ad37db70392784d0a2abad12b110db9b0bb89af449748d1a777f8ae3b5c0073346960ce6004f88a7d99992dfe360bea83fe8c9d0778c8fcb5e7424a62f8a16d680a89f611800248b1cbdd825cdc3f9a2dbb60fd1d1"}}, 0x110) pselect6(0x40, &(0x7f0000000180)={0x0, 0x8000}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) r5 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r5, 0xc01064c2, 0x0) read$eventfd(r1, &(0x7f0000000700), 0x8) ioctl$VT_RELDISP(r5, 0x5605) [ 3036.089321][T23469] binder: 23468:23469 ioctl c0306201 0 returned -14 [ 3036.112460][T23471] binder: 23470:23471 ioctl c0306201 0 returned -14 15:30:39 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x2c, 0x0, &(0x7f00000000c0)=[@register_looper, @clear_death={0x400c630f, 0x1}, @register_looper, @acquire, @free_buffer], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) [ 3036.153323][T23475] binder: 23472:23475 ioctl c0306201 0 returned -14 [ 3036.186374][T23477] binder: 23476:23477 ioctl c0306201 0 returned -14 15:30:40 executing program 1: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:40 executing program 5: bpf$ITER_CREATE(0x21, &(0x7f00000000c0), 0x8) r0 = syz_open_dev$loop(&(0x7f0000000280), 0x5, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x4) (async, rerun: 32) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) (rerun: 32) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) (async) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="f1e9e29d650c4000"/19], 0x0, 0x0, 0x0}) (async) r3 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000300), 0x101001, 0x0) ioctl$TIOCGRS485(r3, 0x542e, &(0x7f0000000340)) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async, rerun: 64) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/custom1\x00', 0x802, 0x0) (async, rerun: 64) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:40 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f00000007c0), r1) sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000880)={&(0x7f0000000800)={0x60, r2, 0x2, 0x70bd2a, 0x25dfdbff, {}, [@L2TP_ATTR_COOKIE={0xc, 0xf, 0x9}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x3}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e20}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}]}, 0x60}, 0x1, 0x0, 0x0, 0x48000}, 0x4000011) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000540)={0xa0, 0x0, &(0x7f0000000380)=[@transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f00000000c0)={@fda={0x66646185, 0x1, 0x1, 0x24}, @fd={0x66642a85, 0x0, r0}, @flat=@weak_handle={0x77682a85, 0x1100, 0x2}}, &(0x7f0000000040)={0x0, 0x20, 0x38}}}, @release, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000300)={@ptr={0x70742a85, 0x1, &(0x7f0000000140)=""/37, 0x25, 0x1, 0x15}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x1, &(0x7f0000000240)=""/137, 0x89, 0x0, 0xb}}, &(0x7f00000001c0)={0x0, 0x28, 0x40}}, 0x1000}], 0xc5, 0x0, &(0x7f0000000440)="50941d214d8b71be7bbcc610420752db4358b60a6cb899383caedbcac83f63acf686dd02b019869d066d45ff8f32954178719a00d38922aaed4a2d0d734bbcb2bd0ae7e5fbcb1f325c272df6d422c4908a96be91e045aba8e27c1d181233e9b21495f8a4c8e68ae02d7a6a07f626e9f3fc2e4ba13cdd5cddcec211f891bfc356919c83c9f22f6daf143e8f311e6ac6a990d72b60710a8df4ee4cf88093a001d6ffff645726aa09735f233a526f8cd8dfe13c65acfab15f89a5e109c9e50bbfdcb723479a29"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$KDDISABIO(r4, 0x4b37) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r4, 0xc01064c2, 0x0) ioctl$KDSKBMODE(r4, 0x4b45, &(0x7f00000006c0)) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(r1, &(0x7f0000000580)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x20, '2h1', "c4aefca2661e717f265aae4c49033ca6ed14989d466239c61decdb9bc8f7611d002890acba6060596f4d22795f722ada227f88421978dbf17d185d37fa856265b1e47d2aef84f8e848c6afb823300776646aeae7264891f940119c6e69305a9cb98d961d4509b3d7cb61bf3781ceb630364ae77575bde2b601629a4b8d71a624d8be561a9a9a47ea82c03215f0678b23fe51784b512220c44b4fabc106cef3bb475388a9c7a0313209ed95ad37db70392784d0a2abad12b110db9b0bb89af449748d1a777f8ae3b5c0073346960ce6004f88a7d99992dfe360bea83fe8c9d0778c8fcb5e7424a62f8a16d680a89f611800248b1cbdd825cdc3f9a2dbb60fd1d1"}}, 0x110) pselect6(0x40, &(0x7f0000000180)={0x0, 0x8000}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) r5 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r5, 0xc01064c2, 0x0) read$eventfd(r1, &(0x7f0000000700), 0x8) [ 3036.216180][T23481] binder: 23480:23481 ioctl c0306201 0 returned -14 [ 3036.259626][T23483] binder: 23482:23483 ioctl c0306201 0 returned -14 [ 3036.289060][T23488] binder: 23485:23488 ioctl c0306201 0 returned -14 [ 3036.302155][T23486] binder: 23484:23486 ioctl c0306201 0 returned -14 15:30:40 executing program 1: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:40 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f00000007c0), r1) sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000880)={&(0x7f0000000800)={0x60, r2, 0x2, 0x70bd2a, 0x25dfdbff, {}, [@L2TP_ATTR_COOKIE={0xc, 0xf, 0x9}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x3}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e20}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}]}, 0x60}, 0x1, 0x0, 0x0, 0x48000}, 0x4000011) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000540)={0xa0, 0x0, &(0x7f0000000380)=[@transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f00000000c0)={@fda={0x66646185, 0x1, 0x1, 0x24}, @fd={0x66642a85, 0x0, r0}, @flat=@weak_handle={0x77682a85, 0x1100, 0x2}}, &(0x7f0000000040)={0x0, 0x20, 0x38}}}, @release, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000300)={@ptr={0x70742a85, 0x1, &(0x7f0000000140)=""/37, 0x25, 0x1, 0x15}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x1, &(0x7f0000000240)=""/137, 0x89, 0x0, 0xb}}, &(0x7f00000001c0)={0x0, 0x28, 0x40}}, 0x1000}], 0xc5, 0x0, &(0x7f0000000440)="50941d214d8b71be7bbcc610420752db4358b60a6cb899383caedbcac83f63acf686dd02b019869d066d45ff8f32954178719a00d38922aaed4a2d0d734bbcb2bd0ae7e5fbcb1f325c272df6d422c4908a96be91e045aba8e27c1d181233e9b21495f8a4c8e68ae02d7a6a07f626e9f3fc2e4ba13cdd5cddcec211f891bfc356919c83c9f22f6daf143e8f311e6ac6a990d72b60710a8df4ee4cf88093a001d6ffff645726aa09735f233a526f8cd8dfe13c65acfab15f89a5e109c9e50bbfdcb723479a29"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$KDDISABIO(r4, 0x4b37) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r4, 0xc01064c2, 0x0) ioctl$KDSKBMODE(r4, 0x4b45, &(0x7f00000006c0)) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(r1, &(0x7f0000000580)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x20, '2h1', "c4aefca2661e717f265aae4c49033ca6ed14989d466239c61decdb9bc8f7611d002890acba6060596f4d22795f722ada227f88421978dbf17d185d37fa856265b1e47d2aef84f8e848c6afb823300776646aeae7264891f940119c6e69305a9cb98d961d4509b3d7cb61bf3781ceb630364ae77575bde2b601629a4b8d71a624d8be561a9a9a47ea82c03215f0678b23fe51784b512220c44b4fabc106cef3bb475388a9c7a0313209ed95ad37db70392784d0a2abad12b110db9b0bb89af449748d1a777f8ae3b5c0073346960ce6004f88a7d99992dfe360bea83fe8c9d0778c8fcb5e7424a62f8a16d680a89f611800248b1cbdd825cdc3f9a2dbb60fd1d1"}}, 0x110) pselect6(0x40, &(0x7f0000000180)={0x0, 0x8000}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) read$eventfd(r1, &(0x7f0000000700), 0x8) [ 3036.302833][T23487] binder: 23484:23487 unknown command -1646073359 [ 3036.326278][T23487] binder: 23484:23487 ioctl c0306201 20000440 returned -22 [ 3036.349018][T23491] binder: 23490:23491 ioctl c0306201 0 returned -14 [ 3036.400487][T23493] binder: 23492:23493 ioctl c0306201 0 returned -14 15:30:40 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x24, 0x0, &(0x7f00000000c0)=[@register_looper, @clear_death={0x400c630f, 0x1}, @register_looper, @dead_binder_done], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:40 executing program 1: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 15:30:40 executing program 2: openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) eventfd(0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x0, 0x4, 0x20000000000, 0x0, 0x40, 0x200000000000}, 0x0, 0x0) 15:30:40 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f00000007c0), r1) sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000880)={&(0x7f0000000800)={0x60, r2, 0x2, 0x70bd2a, 0x25dfdbff, {}, [@L2TP_ATTR_COOKIE={0xc, 0xf, 0x9}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x3}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e20}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}]}, 0x60}, 0x1, 0x0, 0x0, 0x48000}, 0x4000011) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000540)={0xa0, 0x0, &(0x7f0000000380)=[@transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f00000000c0)={@fda={0x66646185, 0x1, 0x1, 0x24}, @fd={0x66642a85, 0x0, r0}, @flat=@weak_handle={0x77682a85, 0x1100, 0x2}}, &(0x7f0000000040)={0x0, 0x20, 0x38}}}, @release, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000300)={@ptr={0x70742a85, 0x1, &(0x7f0000000140)=""/37, 0x25, 0x1, 0x15}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x1, &(0x7f0000000240)=""/137, 0x89, 0x0, 0xb}}, &(0x7f00000001c0)={0x0, 0x28, 0x40}}, 0x1000}], 0xc5, 0x0, &(0x7f0000000440)="50941d214d8b71be7bbcc610420752db4358b60a6cb899383caedbcac83f63acf686dd02b019869d066d45ff8f32954178719a00d38922aaed4a2d0d734bbcb2bd0ae7e5fbcb1f325c272df6d422c4908a96be91e045aba8e27c1d181233e9b21495f8a4c8e68ae02d7a6a07f626e9f3fc2e4ba13cdd5cddcec211f891bfc356919c83c9f22f6daf143e8f311e6ac6a990d72b60710a8df4ee4cf88093a001d6ffff645726aa09735f233a526f8cd8dfe13c65acfab15f89a5e109c9e50bbfdcb723479a29"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$KDDISABIO(r4, 0x4b37) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r4, 0xc01064c2, 0x0) ioctl$KDSKBMODE(r4, 0x4b45, &(0x7f00000006c0)) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(r1, &(0x7f0000000580)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x20, '2h1', "c4aefca2661e717f265aae4c49033ca6ed14989d466239c61decdb9bc8f7611d002890acba6060596f4d22795f722ada227f88421978dbf17d185d37fa856265b1e47d2aef84f8e848c6afb823300776646aeae7264891f940119c6e69305a9cb98d961d4509b3d7cb61bf3781ceb630364ae77575bde2b601629a4b8d71a624d8be561a9a9a47ea82c03215f0678b23fe51784b512220c44b4fabc106cef3bb475388a9c7a0313209ed95ad37db70392784d0a2abad12b110db9b0bb89af449748d1a777f8ae3b5c0073346960ce6004f88a7d99992dfe360bea83fe8c9d0778c8fcb5e7424a62f8a16d680a89f611800248b1cbdd825cdc3f9a2dbb60fd1d1"}}, 0x110) pselect6(0x40, &(0x7f0000000180)={0x0, 0x8000}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) read$eventfd(r1, &(0x7f0000000700), 0x8) 15:30:40 executing program 1: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 3036.968317][T23495] binder: 23494:23495 ioctl c0306201 0 returned -14 [ 3036.980280][T23495] binder: 23494:23495 ioctl c0306201 0 returned -14 [ 3036.987563][T23497] binder: 23496:23497 ioctl c0306201 0 returned -14 15:30:40 executing program 0: bpf$ITER_CREATE(0x21, &(0x7f00000000c0), 0x8) r0 = syz_open_dev$loop(&(0x7f0000000280), 0x5, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x4) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="f1e9e29d650c4000"/19], 0x0, 0x0, 0x0}) r3 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000300), 0x101001, 0x0) ioctl$TIOCGRS485(r3, 0x542e, &(0x7f0000000340)) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/custom1\x00', 0x802, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) [ 3037.040338][T23499] binder: 23498:23499 ioctl c0306201 0 returned -14 [ 3037.065667][T23503] binder: 23502:23503 ioctl c0306201 0 returned -14 15:30:40 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f00000007c0), r1) sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000880)={&(0x7f0000000800)={0x60, r2, 0x2, 0x70bd2a, 0x25dfdbff, {}, [@L2TP_ATTR_COOKIE={0xc, 0xf, 0x9}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x3}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e20}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}]}, 0x60}, 0x1, 0x0, 0x0, 0x48000}, 0x4000011) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000540)={0xa0, 0x0, &(0x7f0000000380)=[@transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f00000000c0)={@fda={0x66646185, 0x1, 0x1, 0x24}, @fd={0x66642a85, 0x0, r0}, @flat=@weak_handle={0x77682a85, 0x1100, 0x2}}, &(0x7f0000000040)={0x0, 0x20, 0x38}}}, @release, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000300)={@ptr={0x70742a85, 0x1, &(0x7f0000000140)=""/37, 0x25, 0x1, 0x15}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x1, &(0x7f0000000240)=""/137, 0x89, 0x0, 0xb}}, &(0x7f00000001c0)={0x0, 0x28, 0x40}}, 0x1000}], 0xc5, 0x0, &(0x7f0000000440)="50941d214d8b71be7bbcc610420752db4358b60a6cb899383caedbcac83f63acf686dd02b019869d066d45ff8f32954178719a00d38922aaed4a2d0d734bbcb2bd0ae7e5fbcb1f325c272df6d422c4908a96be91e045aba8e27c1d181233e9b21495f8a4c8e68ae02d7a6a07f626e9f3fc2e4ba13cdd5cddcec211f891bfc356919c83c9f22f6daf143e8f311e6ac6a990d72b60710a8df4ee4cf88093a001d6ffff645726aa09735f233a526f8cd8dfe13c65acfab15f89a5e109c9e50bbfdcb723479a29"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$KDDISABIO(r4, 0x4b37) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r4, 0xc01064c2, 0x0) ioctl$KDSKBMODE(r4, 0x4b45, &(0x7f00000006c0)) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(r1, &(0x7f0000000580)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x20, '2h1', "c4aefca2661e717f265aae4c49033ca6ed14989d466239c61decdb9bc8f7611d002890acba6060596f4d22795f722ada227f88421978dbf17d185d37fa856265b1e47d2aef84f8e848c6afb823300776646aeae7264891f940119c6e69305a9cb98d961d4509b3d7cb61bf3781ceb630364ae77575bde2b601629a4b8d71a624d8be561a9a9a47ea82c03215f0678b23fe51784b512220c44b4fabc106cef3bb475388a9c7a0313209ed95ad37db70392784d0a2abad12b110db9b0bb89af449748d1a777f8ae3b5c0073346960ce6004f88a7d99992dfe360bea83fe8c9d0778c8fcb5e7424a62f8a16d680a89f611800248b1cbdd825cdc3f9a2dbb60fd1d1"}}, 0x110) read$eventfd(r1, &(0x7f0000000700), 0x8) [ 3037.093816][T23505] binder: 23504:23505 ioctl c0306201 0 returned -14 [ 3037.100127][T23503] binder: 23502:23503 ioctl c0306201 0 returned -14 [ 3037.102727][T23505] binder: 23504:23505 unknown command -1646073359 15:30:40 executing program 5: bpf$ITER_CREATE(0x21, &(0x7f00000000c0), 0x8) r0 = syz_open_dev$loop(&(0x7f0000000280), 0x5, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x4) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="f1e9e29d650c4000"/19], 0x0, 0x0, 0x0}) r3 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000300), 0x101001, 0x0) ioctl$TIOCGRS485(r3, 0x542e, &(0x7f0000000340)) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/custom1\x00', 0x802, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) bpf$ITER_CREATE(0x21, &(0x7f00000000c0), 0x8) (async) syz_open_dev$loop(&(0x7f0000000280), 0x5, 0x0) (async) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x4) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) (async) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) (async) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="f1e9e29d650c4000"/19], 0x0, 0x0, 0x0}) (async) openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000300), 0x101001, 0x0) (async) ioctl$TIOCGRS485(r3, 0x542e, &(0x7f0000000340)) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/custom1\x00', 0x802, 0x0) (async) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) (async) 15:30:40 executing program 1: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 3037.143549][T23505] binder: 23504:23505 ioctl c0306201 20000440 returned -22 [ 3037.195300][T23510] binder: 23508:23510 ioctl c0306201 0 returned -14 [ 3037.204026][T23509] binder: 23507:23509 ioctl c0306201 0 returned -14 [ 3037.205196][T23510] binder: 23508:23510 ioctl c0306201 0 returned -14 [ 3037.219573][T23512] binder: 23511:23512 ioctl c0306201 0 returned -14 15:30:41 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f00000007c0), r1) sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000880)={&(0x7f0000000800)={0x60, r2, 0x2, 0x70bd2a, 0x25dfdbff, {}, [@L2TP_ATTR_COOKIE={0xc, 0xf, 0x9}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x3}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e20}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}]}, 0x60}, 0x1, 0x0, 0x0, 0x48000}, 0x4000011) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000540)={0xa0, 0x0, &(0x7f0000000380)=[@transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f00000000c0)={@fda={0x66646185, 0x1, 0x1, 0x24}, @fd={0x66642a85, 0x0, r0}, @flat=@weak_handle={0x77682a85, 0x1100, 0x2}}, &(0x7f0000000040)={0x0, 0x20, 0x38}}}, @release, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000300)={@ptr={0x70742a85, 0x1, &(0x7f0000000140)=""/37, 0x25, 0x1, 0x15}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x1, &(0x7f0000000240)=""/137, 0x89, 0x0, 0xb}}, &(0x7f00000001c0)={0x0, 0x28, 0x40}}, 0x1000}], 0xc5, 0x0, &(0x7f0000000440)="50941d214d8b71be7bbcc610420752db4358b60a6cb899383caedbcac83f63acf686dd02b019869d066d45ff8f32954178719a00d38922aaed4a2d0d734bbcb2bd0ae7e5fbcb1f325c272df6d422c4908a96be91e045aba8e27c1d181233e9b21495f8a4c8e68ae02d7a6a07f626e9f3fc2e4ba13cdd5cddcec211f891bfc356919c83c9f22f6daf143e8f311e6ac6a990d72b60710a8df4ee4cf88093a001d6ffff645726aa09735f233a526f8cd8dfe13c65acfab15f89a5e109c9e50bbfdcb723479a29"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$KDDISABIO(r4, 0x4b37) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r4, 0xc01064c2, 0x0) ioctl$KDSKBMODE(r4, 0x4b45, &(0x7f00000006c0)) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(r1, &(0x7f0000000580)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x20, '2h1', "c4aefca2661e717f265aae4c49033ca6ed14989d466239c61decdb9bc8f7611d002890acba6060596f4d22795f722ada227f88421978dbf17d185d37fa856265b1e47d2aef84f8e848c6afb823300776646aeae7264891f940119c6e69305a9cb98d961d4509b3d7cb61bf3781ceb630364ae77575bde2b601629a4b8d71a624d8be561a9a9a47ea82c03215f0678b23fe51784b512220c44b4fabc106cef3bb475388a9c7a0313209ed95ad37db70392784d0a2abad12b110db9b0bb89af449748d1a777f8ae3b5c0073346960ce6004f88a7d99992dfe360bea83fe8c9d0778c8fcb5e7424a62f8a16d680a89f611800248b1cbdd825cdc3f9a2dbb60fd1d1"}}, 0x110) read$eventfd(r1, &(0x7f0000000700), 0x8) 15:30:41 executing program 1: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 15:30:41 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f00000007c0), r1) sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000880)={&(0x7f0000000800)={0x60, r2, 0x2, 0x70bd2a, 0x25dfdbff, {}, [@L2TP_ATTR_COOKIE={0xc, 0xf, 0x9}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x3}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e20}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}]}, 0x60}, 0x1, 0x0, 0x0, 0x48000}, 0x4000011) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000540)={0xa0, 0x0, &(0x7f0000000380)=[@transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f00000000c0)={@fda={0x66646185, 0x1, 0x1, 0x24}, @fd={0x66642a85, 0x0, r0}, @flat=@weak_handle={0x77682a85, 0x1100, 0x2}}, &(0x7f0000000040)={0x0, 0x20, 0x38}}}, @release, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000300)={@ptr={0x70742a85, 0x1, &(0x7f0000000140)=""/37, 0x25, 0x1, 0x15}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x1, &(0x7f0000000240)=""/137, 0x89, 0x0, 0xb}}, &(0x7f00000001c0)={0x0, 0x28, 0x40}}, 0x1000}], 0xc5, 0x0, &(0x7f0000000440)="50941d214d8b71be7bbcc610420752db4358b60a6cb899383caedbcac83f63acf686dd02b019869d066d45ff8f32954178719a00d38922aaed4a2d0d734bbcb2bd0ae7e5fbcb1f325c272df6d422c4908a96be91e045aba8e27c1d181233e9b21495f8a4c8e68ae02d7a6a07f626e9f3fc2e4ba13cdd5cddcec211f891bfc356919c83c9f22f6daf143e8f311e6ac6a990d72b60710a8df4ee4cf88093a001d6ffff645726aa09735f233a526f8cd8dfe13c65acfab15f89a5e109c9e50bbfdcb723479a29"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$KDDISABIO(r4, 0x4b37) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r4, 0xc01064c2, 0x0) ioctl$KDSKBMODE(r4, 0x4b45, &(0x7f00000006c0)) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(r1, &(0x7f0000000580)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x20, '2h1', "c4aefca2661e717f265aae4c49033ca6ed14989d466239c61decdb9bc8f7611d002890acba6060596f4d22795f722ada227f88421978dbf17d185d37fa856265b1e47d2aef84f8e848c6afb823300776646aeae7264891f940119c6e69305a9cb98d961d4509b3d7cb61bf3781ceb630364ae77575bde2b601629a4b8d71a624d8be561a9a9a47ea82c03215f0678b23fe51784b512220c44b4fabc106cef3bb475388a9c7a0313209ed95ad37db70392784d0a2abad12b110db9b0bb89af449748d1a777f8ae3b5c0073346960ce6004f88a7d99992dfe360bea83fe8c9d0778c8fcb5e7424a62f8a16d680a89f611800248b1cbdd825cdc3f9a2dbb60fd1d1"}}, 0x110) read$eventfd(r1, &(0x7f0000000700), 0x8) [ 3037.241475][T23512] binder: 23511:23512 unknown command -1646073359 [ 3037.258522][T23512] binder: 23511:23512 ioctl c0306201 20000440 returned -22 [ 3037.272653][T23514] binder: 23513:23514 ioctl c0306201 0 returned -14 [ 3037.288581][T23516] binder: 23515:23516 ioctl c0306201 0 returned -14 [ 3037.319894][T23518] binder: 23517:23518 ioctl c0306201 0 returned -14 [ 3037.331982][T23523] binder: 23511:23523 unknown command -1646073359 [ 3037.334740][T23522] binder: 23511:23522 ioctl c0306201 0 returned -14 [ 3037.348103][T23523] binder: 23511:23523 ioctl c0306201 20000440 returned -22 15:30:41 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x24, 0x0, &(0x7f00000000c0)=[@register_looper, @clear_death={0x400c630f, 0x1}, @register_looper, @dead_binder_done], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:41 executing program 1: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 3037.841617][T23530] binder: 23529:23530 ioctl c0306201 0 returned -14 [ 3037.849807][T23532] binder: 23531:23532 ioctl c0306201 0 returned -14 15:30:41 executing program 2: openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) eventfd(0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x0, 0x4, 0x20000000000, 0x0, 0x40, 0x200000000000}, 0x0, 0x0) 15:30:41 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f00000007c0), r1) sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000880)={&(0x7f0000000800)={0x60, r2, 0x2, 0x70bd2a, 0x25dfdbff, {}, [@L2TP_ATTR_COOKIE={0xc, 0xf, 0x9}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x3}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e20}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}]}, 0x60}, 0x1, 0x0, 0x0, 0x48000}, 0x4000011) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000540)={0xa0, 0x0, &(0x7f0000000380)=[@transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f00000000c0)={@fda={0x66646185, 0x1, 0x1, 0x24}, @fd={0x66642a85, 0x0, r0}, @flat=@weak_handle={0x77682a85, 0x1100, 0x2}}, &(0x7f0000000040)={0x0, 0x20, 0x38}}}, @release, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000300)={@ptr={0x70742a85, 0x1, &(0x7f0000000140)=""/37, 0x25, 0x1, 0x15}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x1, &(0x7f0000000240)=""/137, 0x89, 0x0, 0xb}}, &(0x7f00000001c0)={0x0, 0x28, 0x40}}, 0x1000}], 0xc5, 0x0, &(0x7f0000000440)="50941d214d8b71be7bbcc610420752db4358b60a6cb899383caedbcac83f63acf686dd02b019869d066d45ff8f32954178719a00d38922aaed4a2d0d734bbcb2bd0ae7e5fbcb1f325c272df6d422c4908a96be91e045aba8e27c1d181233e9b21495f8a4c8e68ae02d7a6a07f626e9f3fc2e4ba13cdd5cddcec211f891bfc356919c83c9f22f6daf143e8f311e6ac6a990d72b60710a8df4ee4cf88093a001d6ffff645726aa09735f233a526f8cd8dfe13c65acfab15f89a5e109c9e50bbfdcb723479a29"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$KDDISABIO(r4, 0x4b37) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r4, 0xc01064c2, 0x0) ioctl$KDSKBMODE(r4, 0x4b45, &(0x7f00000006c0)) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x8000}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) read$eventfd(r1, &(0x7f0000000700), 0x8) 15:30:41 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) pselect6(0x40, &(0x7f0000000040)={0x0, 0x20, 0x4, 0x7, 0x7fff, 0x8, 0xc4, 0xfb9c}, &(0x7f00000000c0)={0x6, 0x3f, 0x91d, 0x4, 0x1000, 0x8, 0xffffffffffffffe1}, &(0x7f0000000100)={0xe4, 0x7, 0x4, 0x9, 0xffff0000, 0x4, 0x4}, &(0x7f0000000140), &(0x7f0000000240)={&(0x7f00000001c0), 0x8}) 15:30:41 executing program 1: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 15:30:41 executing program 0: bpf$ITER_CREATE(0x21, &(0x7f00000000c0), 0x8) r0 = syz_open_dev$loop(&(0x7f0000000280), 0x5, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x4) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="f1e9e29d650c4000"/19], 0x0, 0x0, 0x0}) r3 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000300), 0x101001, 0x0) ioctl$TIOCGRS485(r3, 0x542e, &(0x7f0000000340)) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/custom1\x00', 0x802, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:41 executing program 1: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)}) [ 3037.915768][T23534] binder: 23533:23534 ioctl c0306201 0 returned -14 [ 3037.924049][T23536] binder: 23535:23536 ioctl c0306201 0 returned -14 [ 3037.952292][T23540] binder: 23538:23540 ioctl c0306201 0 returned -14 15:30:41 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f00000007c0), r1) sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000880)={&(0x7f0000000800)={0x60, r2, 0x2, 0x70bd2a, 0x25dfdbff, {}, [@L2TP_ATTR_COOKIE={0xc, 0xf, 0x9}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x3}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e20}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}]}, 0x60}, 0x1, 0x0, 0x0, 0x48000}, 0x4000011) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000540)={0xa0, 0x0, &(0x7f0000000380)=[@transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f00000000c0)={@fda={0x66646185, 0x1, 0x1, 0x24}, @fd={0x66642a85, 0x0, r0}, @flat=@weak_handle={0x77682a85, 0x1100, 0x2}}, &(0x7f0000000040)={0x0, 0x20, 0x38}}}, @release, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000300)={@ptr={0x70742a85, 0x1, &(0x7f0000000140)=""/37, 0x25, 0x1, 0x15}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x1, &(0x7f0000000240)=""/137, 0x89, 0x0, 0xb}}, &(0x7f00000001c0)={0x0, 0x28, 0x40}}, 0x1000}], 0xc5, 0x0, &(0x7f0000000440)="50941d214d8b71be7bbcc610420752db4358b60a6cb899383caedbcac83f63acf686dd02b019869d066d45ff8f32954178719a00d38922aaed4a2d0d734bbcb2bd0ae7e5fbcb1f325c272df6d422c4908a96be91e045aba8e27c1d181233e9b21495f8a4c8e68ae02d7a6a07f626e9f3fc2e4ba13cdd5cddcec211f891bfc356919c83c9f22f6daf143e8f311e6ac6a990d72b60710a8df4ee4cf88093a001d6ffff645726aa09735f233a526f8cd8dfe13c65acfab15f89a5e109c9e50bbfdcb723479a29"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$KDDISABIO(r4, 0x4b37) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r4, 0xc01064c2, 0x0) ioctl$KDSKBMODE(r4, 0x4b45, &(0x7f00000006c0)) pselect6(0x40, &(0x7f0000000180)={0x0, 0x8000}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) read$eventfd(r1, &(0x7f0000000700), 0x8) [ 3037.993777][T23542] binder: 23541:23542 ioctl c0306201 0 returned -14 [ 3038.019815][T23542] binder: 23541:23542 unknown command -1646073359 [ 3038.027268][T23542] binder: 23541:23542 ioctl c0306201 20000440 returned -22 [ 3038.028639][T23544] binder: 23543:23544 ioctl c0306201 0 returned -14 15:30:41 executing program 1: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)}) 15:30:41 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f00000007c0), r1) sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000880)={&(0x7f0000000800)={0x60, r2, 0x2, 0x70bd2a, 0x25dfdbff, {}, [@L2TP_ATTR_COOKIE={0xc, 0xf, 0x9}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x3}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e20}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}]}, 0x60}, 0x1, 0x0, 0x0, 0x48000}, 0x4000011) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000540)={0xa0, 0x0, &(0x7f0000000380)=[@transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f00000000c0)={@fda={0x66646185, 0x1, 0x1, 0x24}, @fd={0x66642a85, 0x0, r0}, @flat=@weak_handle={0x77682a85, 0x1100, 0x2}}, &(0x7f0000000040)={0x0, 0x20, 0x38}}}, @release, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000300)={@ptr={0x70742a85, 0x1, &(0x7f0000000140)=""/37, 0x25, 0x1, 0x15}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x1, &(0x7f0000000240)=""/137, 0x89, 0x0, 0xb}}, &(0x7f00000001c0)={0x0, 0x28, 0x40}}, 0x1000}], 0xc5, 0x0, &(0x7f0000000440)="50941d214d8b71be7bbcc610420752db4358b60a6cb899383caedbcac83f63acf686dd02b019869d066d45ff8f32954178719a00d38922aaed4a2d0d734bbcb2bd0ae7e5fbcb1f325c272df6d422c4908a96be91e045aba8e27c1d181233e9b21495f8a4c8e68ae02d7a6a07f626e9f3fc2e4ba13cdd5cddcec211f891bfc356919c83c9f22f6daf143e8f311e6ac6a990d72b60710a8df4ee4cf88093a001d6ffff645726aa09735f233a526f8cd8dfe13c65acfab15f89a5e109c9e50bbfdcb723479a29"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$KDDISABIO(r4, 0x4b37) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r4, 0xc01064c2, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x8000}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) read$eventfd(r1, &(0x7f0000000700), 0x8) [ 3038.044364][T23547] binder: 23546:23547 ioctl c0306201 0 returned -14 15:30:41 executing program 1: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)}) [ 3038.098066][T23550] binder: 23548:23550 ioctl c0306201 0 returned -14 [ 3038.106271][T23551] binder: 23549:23551 ioctl c0306201 0 returned -14 [ 3038.158805][T23553] binder: 23552:23553 ioctl c0306201 0 returned -14 15:30:42 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x24, 0x0, &(0x7f00000000c0)=[@register_looper, @clear_death={0x400c630f, 0x1}, @register_looper, @dead_binder_done], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:42 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f00000007c0), r1) sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000880)={&(0x7f0000000800)={0x60, r2, 0x2, 0x70bd2a, 0x25dfdbff, {}, [@L2TP_ATTR_COOKIE={0xc, 0xf, 0x9}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x3}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e20}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}]}, 0x60}, 0x1, 0x0, 0x0, 0x48000}, 0x4000011) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000540)={0xa0, 0x0, &(0x7f0000000380)=[@transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f00000000c0)={@fda={0x66646185, 0x1, 0x1, 0x24}, @fd={0x66642a85, 0x0, r0}, @flat=@weak_handle={0x77682a85, 0x1100, 0x2}}, &(0x7f0000000040)={0x0, 0x20, 0x38}}}, @release, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000300)={@ptr={0x70742a85, 0x1, &(0x7f0000000140)=""/37, 0x25, 0x1, 0x15}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x1, &(0x7f0000000240)=""/137, 0x89, 0x0, 0xb}}, &(0x7f00000001c0)={0x0, 0x28, 0x40}}, 0x1000}], 0xc5, 0x0, &(0x7f0000000440)="50941d214d8b71be7bbcc610420752db4358b60a6cb899383caedbcac83f63acf686dd02b019869d066d45ff8f32954178719a00d38922aaed4a2d0d734bbcb2bd0ae7e5fbcb1f325c272df6d422c4908a96be91e045aba8e27c1d181233e9b21495f8a4c8e68ae02d7a6a07f626e9f3fc2e4ba13cdd5cddcec211f891bfc356919c83c9f22f6daf143e8f311e6ac6a990d72b60710a8df4ee4cf88093a001d6ffff645726aa09735f233a526f8cd8dfe13c65acfab15f89a5e109c9e50bbfdcb723479a29"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$KDDISABIO(r4, 0x4b37) pselect6(0x40, &(0x7f0000000180)={0x0, 0x8000}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) read$eventfd(r1, &(0x7f0000000700), 0x8) [ 3038.705123][T23555] binder: 23554:23555 ioctl c0306201 0 returned -14 [ 3038.729050][T23557] binder: 23556:23557 ioctl c0306201 0 returned -14 15:30:42 executing program 2: openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) eventfd(0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x20000000000, 0x0, 0x40, 0x200000000000}, 0x0, 0x0) 15:30:42 executing program 1: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x3d, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4b"}) 15:30:42 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f00000007c0), r1) sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000880)={&(0x7f0000000800)={0x60, r2, 0x2, 0x70bd2a, 0x25dfdbff, {}, [@L2TP_ATTR_COOKIE={0xc, 0xf, 0x9}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x3}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e20}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}]}, 0x60}, 0x1, 0x0, 0x0, 0x48000}, 0x4000011) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000540)={0xa0, 0x0, &(0x7f0000000380)=[@transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f00000000c0)={@fda={0x66646185, 0x1, 0x1, 0x24}, @fd={0x66642a85, 0x0, r0}, @flat=@weak_handle={0x77682a85, 0x1100, 0x2}}, &(0x7f0000000040)={0x0, 0x20, 0x38}}}, @release, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000300)={@ptr={0x70742a85, 0x1, &(0x7f0000000140)=""/37, 0x25, 0x1, 0x15}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x1, &(0x7f0000000240)=""/137, 0x89, 0x0, 0xb}}, &(0x7f00000001c0)={0x0, 0x28, 0x40}}, 0x1000}], 0xc5, 0x0, &(0x7f0000000440)="50941d214d8b71be7bbcc610420752db4358b60a6cb899383caedbcac83f63acf686dd02b019869d066d45ff8f32954178719a00d38922aaed4a2d0d734bbcb2bd0ae7e5fbcb1f325c272df6d422c4908a96be91e045aba8e27c1d181233e9b21495f8a4c8e68ae02d7a6a07f626e9f3fc2e4ba13cdd5cddcec211f891bfc356919c83c9f22f6daf143e8f311e6ac6a990d72b60710a8df4ee4cf88093a001d6ffff645726aa09735f233a526f8cd8dfe13c65acfab15f89a5e109c9e50bbfdcb723479a29"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x8000}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) read$eventfd(r1, &(0x7f0000000700), 0x8) 15:30:42 executing program 0: bpf$ITER_CREATE(0x21, &(0x7f00000000c0), 0x8) r0 = syz_open_dev$loop(&(0x7f0000000280), 0x5, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x4) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="f1e9e29d650c4000"/19], 0x0, 0x0, 0x0}) r3 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000300), 0x101001, 0x0) ioctl$TIOCGRS485(r3, 0x542e, &(0x7f0000000340)) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/custom1\x00', 0x802, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:42 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) (async) pselect6(0x40, &(0x7f0000000040)={0x0, 0x20, 0x4, 0x7, 0x7fff, 0x8, 0xc4, 0xfb9c}, &(0x7f00000000c0)={0x6, 0x3f, 0x91d, 0x4, 0x1000, 0x8, 0xffffffffffffffe1}, &(0x7f0000000100)={0xe4, 0x7, 0x4, 0x9, 0xffff0000, 0x4, 0x4}, &(0x7f0000000140), &(0x7f0000000240)={&(0x7f00000001c0), 0x8}) [ 3038.805676][T23561] binder: 23559:23561 ioctl c0306201 0 returned -14 [ 3038.820596][T23560] binder: 23558:23560 ioctl c0306201 0 returned -14 15:30:42 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f00000007c0), r1) sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000880)={&(0x7f0000000800)={0x60, r2, 0x2, 0x70bd2a, 0x25dfdbff, {}, [@L2TP_ATTR_COOKIE={0xc, 0xf, 0x9}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x3}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e20}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}]}, 0x60}, 0x1, 0x0, 0x0, 0x48000}, 0x4000011) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000540)={0xa0, 0x0, &(0x7f0000000380)=[@transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f00000000c0)={@fda={0x66646185, 0x1, 0x1, 0x24}, @fd={0x66642a85, 0x0, r0}, @flat=@weak_handle={0x77682a85, 0x1100, 0x2}}, &(0x7f0000000040)={0x0, 0x20, 0x38}}}, @release, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000300)={@ptr={0x70742a85, 0x1, &(0x7f0000000140)=""/37, 0x25, 0x1, 0x15}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x1, &(0x7f0000000240)=""/137, 0x89, 0x0, 0xb}}, &(0x7f00000001c0)={0x0, 0x28, 0x40}}, 0x1000}], 0xc5, 0x0, &(0x7f0000000440)="50941d214d8b71be7bbcc610420752db4358b60a6cb899383caedbcac83f63acf686dd02b019869d066d45ff8f32954178719a00d38922aaed4a2d0d734bbcb2bd0ae7e5fbcb1f325c272df6d422c4908a96be91e045aba8e27c1d181233e9b21495f8a4c8e68ae02d7a6a07f626e9f3fc2e4ba13cdd5cddcec211f891bfc356919c83c9f22f6daf143e8f311e6ac6a990d72b60710a8df4ee4cf88093a001d6ffff645726aa09735f233a526f8cd8dfe13c65acfab15f89a5e109c9e50bbfdcb723479a29"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x8000}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) read$eventfd(r1, &(0x7f0000000700), 0x8) [ 3038.847988][T23565] binder: 23564:23565 ioctl c0306201 0 returned -14 [ 3038.880545][T23571] binder: 23569:23571 ioctl c0306201 0 returned -14 [ 3038.880570][T23570] binder: 23568:23570 ioctl c0306201 0 returned -14 15:30:42 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f00000007c0), r1) sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000880)={&(0x7f0000000800)={0x60, r2, 0x2, 0x70bd2a, 0x25dfdbff, {}, [@L2TP_ATTR_COOKIE={0xc, 0xf, 0x9}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x3}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e20}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}]}, 0x60}, 0x1, 0x0, 0x0, 0x48000}, 0x4000011) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000540)={0xa0, 0x0, &(0x7f0000000380)=[@transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f00000000c0)={@fda={0x66646185, 0x1, 0x1, 0x24}, @fd={0x66642a85, 0x0, r0}, @flat=@weak_handle={0x77682a85, 0x1100, 0x2}}, &(0x7f0000000040)={0x0, 0x20, 0x38}}}, @release, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000300)={@ptr={0x70742a85, 0x1, &(0x7f0000000140)=""/37, 0x25, 0x1, 0x15}, @fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x1, &(0x7f0000000240)=""/137, 0x89, 0x0, 0xb}}, &(0x7f00000001c0)={0x0, 0x28, 0x40}}, 0x1000}], 0xc5, 0x0, &(0x7f0000000440)="50941d214d8b71be7bbcc610420752db4358b60a6cb899383caedbcac83f63acf686dd02b019869d066d45ff8f32954178719a00d38922aaed4a2d0d734bbcb2bd0ae7e5fbcb1f325c272df6d422c4908a96be91e045aba8e27c1d181233e9b21495f8a4c8e68ae02d7a6a07f626e9f3fc2e4ba13cdd5cddcec211f891bfc356919c83c9f22f6daf143e8f311e6ac6a990d72b60710a8df4ee4cf88093a001d6ffff645726aa09735f233a526f8cd8dfe13c65acfab15f89a5e109c9e50bbfdcb723479a29"}) pselect6(0x40, &(0x7f0000000180)={0x0, 0x8000}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) read$eventfd(r1, &(0x7f0000000700), 0x8) 15:30:42 executing program 4: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000007c0), r0) sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000880)={&(0x7f0000000800)={0x60, r1, 0x2, 0x70bd2a, 0x25dfdbff, {}, [@L2TP_ATTR_COOKIE={0xc, 0xf, 0x9}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x3}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e20}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}]}, 0x60}, 0x1, 0x0, 0x0, 0x48000}, 0x4000011) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x8000}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) read$eventfd(r0, &(0x7f0000000700), 0x8) [ 3038.889223][T23571] binder: 23569:23571 unknown command -1646073359 [ 3038.909651][T23571] binder: 23569:23571 ioctl c0306201 20000440 returned -22 15:30:42 executing program 4: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000007c0), r0) sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000880)={&(0x7f0000000800)={0x60, r1, 0x2, 0x70bd2a, 0x25dfdbff, {}, [@L2TP_ATTR_COOKIE={0xc, 0xf, 0x9}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x3}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e20}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}]}, 0x60}, 0x1, 0x0, 0x0, 0x48000}, 0x4000011) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x8000}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) read$eventfd(r0, &(0x7f0000000700), 0x8) 15:30:42 executing program 4: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000007c0), r0) sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000880)={&(0x7f0000000800)={0x60, r1, 0x2, 0x70bd2a, 0x25dfdbff, {}, [@L2TP_ATTR_COOKIE={0xc, 0xf, 0x9}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x3}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e20}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}]}, 0x60}, 0x1, 0x0, 0x0, 0x48000}, 0x4000011) pselect6(0x40, &(0x7f0000000180)={0x0, 0x8000}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) read$eventfd(r0, &(0x7f0000000700), 0x8) 15:30:43 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x28, 0x0, &(0x7f00000000c0)=[@register_looper, @clear_death={0x400c630f, 0x1}, @acquire, @dead_binder_done], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:43 executing program 4: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f00000007c0), r0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x8000}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) read$eventfd(r0, &(0x7f0000000700), 0x8) [ 3039.603238][T23583] binder: 23582:23583 ioctl c0306201 0 returned -14 15:30:43 executing program 4: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x8000}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) read$eventfd(r0, &(0x7f0000000700), 0x8) 15:30:43 executing program 2: openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) eventfd(0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x40, 0x200000000000}, 0x0, 0x0) 15:30:43 executing program 1: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000240)="a1"}) 15:30:43 executing program 0: bpf$ITER_CREATE(0x21, &(0x7f00000000c0), 0x8) r0 = syz_open_dev$loop(&(0x7f0000000280), 0x5, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x4) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="f1e9e29d650c4000"/19], 0x0, 0x0, 0x0}) r3 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000300), 0x101001, 0x0) ioctl$TIOCGRS485(r3, 0x542e, &(0x7f0000000340)) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/custom1\x00', 0x802, 0x0) 15:30:43 executing program 4: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x8000}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) read$eventfd(r0, &(0x7f0000000700), 0x8) 15:30:43 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) pselect6(0x40, &(0x7f0000000040)={0x0, 0x20, 0x4, 0x7, 0x7fff, 0x8, 0xc4, 0xfb9c}, &(0x7f00000000c0)={0x6, 0x3f, 0x91d, 0x4, 0x1000, 0x8, 0xffffffffffffffe1}, &(0x7f0000000100)={0xe4, 0x7, 0x4, 0x9, 0xffff0000, 0x4, 0x4}, &(0x7f0000000140), &(0x7f0000000240)={&(0x7f00000001c0), 0x8}) [ 3039.695709][T23587] binder: 23585:23587 ioctl c0306201 0 returned -14 15:30:43 executing program 4: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x8000}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) read$eventfd(0xffffffffffffffff, &(0x7f0000000700), 0x8) [ 3039.746976][T23592] binder: 23590:23592 ioctl c0306201 0 returned -14 [ 3039.778876][T23595] binder: 23594:23595 ioctl c0306201 0 returned -14 [ 3039.788002][T23595] binder: 23594:23595 unknown command -1646073359 15:30:43 executing program 4: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x8000}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) read$eventfd(0xffffffffffffffff, &(0x7f0000000700), 0x8) 15:30:43 executing program 0: bpf$ITER_CREATE(0x21, &(0x7f00000000c0), 0x8) r0 = syz_open_dev$loop(&(0x7f0000000280), 0x5, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x4) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="f1e9e29d650c4000"/19], 0x0, 0x0, 0x0}) r3 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000300), 0x101001, 0x0) ioctl$TIOCGRS485(r3, 0x542e, &(0x7f0000000340)) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) 15:30:43 executing program 4: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x8000}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) read$eventfd(0xffffffffffffffff, &(0x7f0000000700), 0x8) [ 3039.802566][T23595] binder: 23594:23595 ioctl c0306201 20000440 returned -22 [ 3039.869025][T23602] binder: 23601:23602 ioctl c0306201 0 returned -14 [ 3039.878055][T23602] binder: 23601:23602 unknown command -1646073359 [ 3039.897339][T23602] binder: 23601:23602 ioctl c0306201 20000440 returned -22 15:30:44 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@register_looper, @acquire, @dead_binder_done], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:44 executing program 4: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x8000}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) read$eventfd(r0, &(0x7f0000000700), 0x8) 15:30:44 executing program 0: bpf$ITER_CREATE(0x21, &(0x7f00000000c0), 0x8) r0 = syz_open_dev$loop(&(0x7f0000000280), 0x5, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x4) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="f1e9e29d650c4000"/19], 0x0, 0x0, 0x0}) r3 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000300), 0x101001, 0x0) ioctl$TIOCGRS485(r3, 0x542e, &(0x7f0000000340)) 15:30:44 executing program 2: openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) eventfd(0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x200000000000}, 0x0, 0x0) 15:30:44 executing program 4: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x8000}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) read$eventfd(r0, &(0x7f0000000700), 0x8) 15:30:44 executing program 0: bpf$ITER_CREATE(0x21, &(0x7f00000000c0), 0x8) r0 = syz_open_dev$loop(&(0x7f0000000280), 0x5, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x4) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="f1e9e29d650c4000"/19], 0x0, 0x0, 0x0}) openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000300), 0x101001, 0x0) 15:30:44 executing program 1: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)}) [ 3040.478957][T23608] binder: 23606:23608 ioctl c0306201 0 returned -14 [ 3040.487724][T23610] binder: 23609:23610 ioctl c0306201 0 returned -14 [ 3040.496071][T23608] binder: 23606:23608 unknown command -1646073359 [ 3040.502975][T23608] binder: 23606:23608 ioctl c0306201 20000440 returned -22 15:30:44 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/binder1\x00', 0x800, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:44 executing program 4: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x8000}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) read$eventfd(r0, &(0x7f0000000700), 0x8) [ 3040.588701][T23616] binder: 23614:23616 ioctl c0306201 0 returned -14 [ 3040.595823][T23615] binder: 23613:23615 ioctl c0306201 0 returned -14 [ 3040.606339][T23615] binder: 23613:23615 unknown command -1646073359 [ 3040.613738][T23615] binder: 23613:23615 ioctl c0306201 20000440 returned -22 15:30:44 executing program 0: bpf$ITER_CREATE(0x21, &(0x7f00000000c0), 0x8) r0 = syz_open_dev$loop(&(0x7f0000000280), 0x5, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x4) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="f1e9e29d650c4000"/19], 0x0, 0x0, 0x0}) 15:30:44 executing program 1: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)}) 15:30:44 executing program 4: openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x8000}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) read$eventfd(r0, &(0x7f0000000700), 0x8) [ 3040.649478][T23622] binder: 23620:23622 ioctl c0306201 0 returned -14 [ 3040.707847][T23625] binder: 23623:23625 ioctl c0306201 0 returned -14 [ 3040.708575][T23626] binder: 23624:23626 ioctl c0306201 0 returned -14 [ 3040.723506][T23625] binder: 23623:23625 unknown command -1646073359 [ 3040.739265][T23625] binder: 23623:23625 ioctl c0306201 20000440 returned -22 15:30:45 executing program 1: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)}) 15:30:45 executing program 4: openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x8000}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) read$eventfd(r0, &(0x7f0000000700), 0x8) 15:30:45 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x14, 0x0, &(0x7f00000000c0)=[@acquire, @dead_binder_done], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) [ 3041.339339][T23631] binder: 23629:23631 ioctl c0306201 0 returned -14 [ 3041.361766][T23634] binder: 23633:23634 ioctl c0306201 0 returned -14 15:30:45 executing program 2: openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) eventfd(0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:45 executing program 0: bpf$ITER_CREATE(0x21, &(0x7f00000000c0), 0x8) r0 = syz_open_dev$loop(&(0x7f0000000280), 0x5, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x4) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="f1e9e29d650c4000"/19], 0x0, 0x0, 0x0}) 15:30:45 executing program 1: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000240)="a1"}) 15:30:45 executing program 4: openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x8000}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) read$eventfd(r0, &(0x7f0000000700), 0x8) 15:30:45 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/binder1\x00', 0x800, 0x0) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:45 executing program 0: bpf$ITER_CREATE(0x21, &(0x7f00000000c0), 0x8) r0 = syz_open_dev$loop(&(0x7f0000000280), 0x5, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x4) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="f1e9e29d650c4000"/19], 0x0, 0x0, 0x0}) [ 3041.475445][T23638] binder: 23636:23638 ioctl c0306201 0 returned -14 [ 3041.485589][T23641] binder: 23635:23641 ioctl c0306201 0 returned -14 15:30:45 executing program 4: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r0 = openat$vcs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x8000}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) read$eventfd(r0, &(0x7f0000000700), 0x8) 15:30:45 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/binder1\x00', 0x800, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) [ 3041.539795][T23644] binder: 23643:23644 ioctl c0306201 0 returned -14 [ 3041.555070][T23646] binder: 23645:23646 ioctl c0306201 0 returned -14 15:30:45 executing program 0: bpf$ITER_CREATE(0x21, &(0x7f00000000c0), 0x8) r0 = syz_open_dev$loop(&(0x7f0000000280), 0x5, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x4) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="f1e9e29d650c4000"/19], 0x0, 0x0, 0x0}) 15:30:45 executing program 4: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r0 = openat$vcs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x8000}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) read$eventfd(r0, &(0x7f0000000700), 0x8) 15:30:45 executing program 4: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r0 = openat$vcs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x8000}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) read$eventfd(r0, &(0x7f0000000700), 0x8) [ 3041.631655][T23655] binder: 23653:23655 ioctl c0306201 0 returned -14 [ 3041.641471][T23656] binder: 23652:23656 ioctl c0306201 0 returned -14 15:30:45 executing program 0: bpf$ITER_CREATE(0x21, &(0x7f00000000c0), 0x8) r0 = syz_open_dev$loop(&(0x7f0000000280), 0x5, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x4) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="f1e9e29d650c4000"/19], 0x0, 0x0, 0x0}) [ 3042.216264][T23661] binder: 23660:23661 unknown command -1646073359 [ 3042.222920][T23661] binder: 23660:23661 ioctl c0306201 20000440 returned -22 15:30:46 executing program 1: bpf$ITER_CREATE(0x21, &(0x7f00000000c0), 0x8) r0 = syz_open_dev$loop(&(0x7f0000000280), 0x5, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x4) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="f1e9e29d650c4000"/19], 0x0, 0x0, 0x0}) 15:30:46 executing program 4: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x0, 0x0, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) read$eventfd(r0, &(0x7f0000000700), 0x8) 15:30:46 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x14, 0x0, &(0x7f00000000c0)=[@acquire, @dead_binder_done], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:46 executing program 0: bpf$ITER_CREATE(0x21, &(0x7f00000000c0), 0x8) r0 = syz_open_dev$loop(&(0x7f0000000280), 0x5, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x4) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="f1e9e29d650c4000"/19], 0x0, 0x0, 0x0}) 15:30:46 executing program 2: bpf$ITER_CREATE(0x21, &(0x7f00000000c0), 0x8) r0 = syz_open_dev$loop(&(0x7f0000000280), 0x5, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x4) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="f1e9e29d650c4000"/19], 0x0, 0x0, 0x0}) r3 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000300), 0x101001, 0x0) ioctl$TIOCGRS485(r3, 0x542e, &(0x7f0000000340)) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/custom1\x00', 0x802, 0x0) [ 3042.367672][T23667] binder: 23665:23667 ioctl c0306201 0 returned -14 [ 3042.380619][T23669] binder: 23668:23669 ioctl c0306201 0 returned -14 [ 3042.387372][T23670] binder: 23666:23670 unknown command -1646073359 [ 3042.389296][T23669] binder: 23668:23669 unknown command -1646073359 [ 3042.400828][T23669] binder: 23668:23669 ioctl c0306201 20000440 returned -22 [ 3042.402398][T23671] binder: 23663:23671 ioctl c0306201 0 returned -14 15:30:46 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x3d, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4b"}) 15:30:46 executing program 0: bpf$ITER_CREATE(0x21, &(0x7f00000000c0), 0x8) syz_open_dev$loop(&(0x7f0000000280), 0x5, 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="f1e9e29d650c4000"/19], 0x0, 0x0, 0x0}) [ 3042.420819][T23670] binder: 23666:23670 ioctl c0306201 20000440 returned -22 15:30:46 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r1 = eventfd(0x2e) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, 0x0) ioctl$VT_RELDISP(r2, 0x5605) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(0xffffffffffffffff, 0x7, &(0x7f00000000c0)=r1, 0x1) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) read$eventfd(0xffffffffffffffff, &(0x7f0000000040), 0x8) pselect6(0x40, &(0x7f0000000180)={0x1000000000000000, 0x0, 0x7ff, 0x0, 0x7, 0x0, 0xfff}, 0x0, &(0x7f0000000200)={0x40, 0x0, 0x2002000000000fff}, 0x0, 0x0) 15:30:46 executing program 1: bpf$ITER_CREATE(0x21, &(0x7f00000000c0), 0x8) r0 = syz_open_dev$loop(&(0x7f0000000280), 0x5, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x4) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="f1e9e29d650c4000"/19], 0x0, 0x0, 0x0}) [ 3042.494264][T23674] binder: 23673:23674 ioctl c0306201 0 returned -14 [ 3042.516290][T23678] binder: 23676:23678 ioctl c0306201 0 returned -14 [ 3042.537501][T23680] binder: 23675:23680 unknown command -1646073359 15:30:46 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r1 = eventfd(0x2e) (async) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, 0x0) ioctl$VT_RELDISP(r2, 0x5605) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(0xffffffffffffffff, 0x7, &(0x7f00000000c0)=r1, 0x1) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) read$eventfd(0xffffffffffffffff, &(0x7f0000000040), 0x8) (async) pselect6(0x40, &(0x7f0000000180)={0x1000000000000000, 0x0, 0x7ff, 0x0, 0x7, 0x0, 0xfff}, 0x0, &(0x7f0000000200)={0x40, 0x0, 0x2002000000000fff}, 0x0, 0x0) 15:30:46 executing program 0: bpf$ITER_CREATE(0x21, &(0x7f00000000c0), 0x8) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="f1e9e29d650c4000"/19], 0x0, 0x0, 0x0}) [ 3042.548161][T23679] binder: 23677:23679 unknown command -1646073359 [ 3042.553750][T23680] binder: 23675:23680 ioctl c0306201 20000440 returned -22 [ 3042.555362][T23679] binder: 23677:23679 ioctl c0306201 20000440 returned -22 15:30:46 executing program 1: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x24, 0x0, &(0x7f00000000c0)=[@register_looper, @clear_death={0x400c630f, 0x1}, @register_looper, @dead_binder_done], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:46 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="f1e9e29d650c4000"/19], 0x0, 0x0, 0x0}) [ 3042.596648][T23682] binder: 23681:23682 ioctl c0306201 0 returned -14 [ 3042.616446][T23686] binder: 23683:23686 unknown command -1646073359 [ 3042.633250][T23686] binder: 23683:23686 ioctl c0306201 20000440 returned -22 [ 3042.679987][T23690] binder: 23688:23690 ioctl c0306201 0 returned -14 [ 3042.680895][T23691] binder: 23689:23691 unknown command -1646073359 [ 3042.695284][T23691] binder: 23689:23691 ioctl c0306201 20000440 returned -22 15:30:46 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r1 = eventfd(0x2e) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, 0x0) ioctl$VT_RELDISP(r2, 0x5605) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(0xffffffffffffffff, 0x7, &(0x7f00000000c0)=r1, 0x1) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) read$eventfd(0xffffffffffffffff, &(0x7f0000000040), 0x8) pselect6(0x40, &(0x7f0000000180)={0x1000000000000000, 0x0, 0x7ff, 0x0, 0x7, 0x0, 0xfff}, 0x0, &(0x7f0000000200)={0x40, 0x0, 0x2002000000000fff}, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) (async) eventfd(0x2e) (async) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, 0x0) (async) ioctl$VT_RELDISP(r2, 0x5605) (async) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(0xffffffffffffffff, 0x7, &(0x7f00000000c0)=r1, 0x1) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) read$eventfd(0xffffffffffffffff, &(0x7f0000000040), 0x8) (async) pselect6(0x40, &(0x7f0000000180)={0x1000000000000000, 0x0, 0x7ff, 0x0, 0x7, 0x0, 0xfff}, 0x0, &(0x7f0000000200)={0x40, 0x0, 0x2002000000000fff}, 0x0, 0x0) (async) 15:30:47 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x14, 0x0, &(0x7f00000000c0)=[@acquire, @dead_binder_done], 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) 15:30:47 executing program 4: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x0, 0x0, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) read$eventfd(r0, &(0x7f0000000700), 0x8) 15:30:47 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="f1e9e29d650c4000"/19], 0x0, 0x0, 0x0}) [ 3043.225766][T23693] binder: 23692:23693 ioctl c0306201 0 returned -14 [ 3043.264624][T23699] binder: 23698:23699 ioctl c0306201 0 returned -14 15:30:47 executing program 2: bpf$ITER_CREATE(0x21, &(0x7f00000000c0), 0x8) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="f1e9e29d650c4000"/19], 0x0, 0x0, 0x0}) 15:30:47 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="f1e9e29d650c4000"/19], 0x0, 0x0, 0x0}) 15:30:47 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x400480, 0x0) bind$isdn_base(0xffffffffffffffff, &(0x7f0000000040)={0x22, 0xff, 0x7a, 0x4, 0x3}, 0x6) pselect6(0x40, &(0x7f0000000180)={0x0, 0x2}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) [ 3043.279454][T23700] binder: 23692:23700 ioctl c0306201 0 returned -14 15:30:47 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="f1e9e29d650c4000"/19], 0x0, 0x0, 0x0}) 15:30:47 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x400480, 0x0) (async) bind$isdn_base(0xffffffffffffffff, &(0x7f0000000040)={0x22, 0xff, 0x7a, 0x4, 0x3}, 0x6) (async) pselect6(0x40, &(0x7f0000000180)={0x0, 0x2}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) [ 3043.353039][T23708] binder: 23707:23708 ioctl c0306201 0 returned -14 [ 3043.366848][T23710] binder: 23709:23710 unknown command -1646073359 [ 3043.383264][T23710] binder: 23709:23710 ioctl c0306201 20000440 returned -22 15:30:47 executing program 0: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="f1e9e29d650c4000"/19], 0x0, 0x0, 0x0}) [ 3043.437959][T23714] binder: 23713:23714 ioctl c0306201 0 returned -14 15:30:47 executing program 1: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) pselect6(0x40, &(0x7f0000000040)={0x0, 0x20, 0x4, 0x7, 0x7fff, 0x8, 0xc4, 0xfb9c}, &(0x7f00000000c0)={0x6, 0x3f, 0x91d, 0x4, 0x1000, 0x8, 0xffffffffffffffe1}, &(0x7f0000000100)={0xe4, 0x7, 0x4, 0x9, 0xffff0000, 0x4, 0x4}, &(0x7f0000000140), &(0x7f0000000240)={&(0x7f00000001c0), 0x8}) 15:30:47 executing program 2: bpf$ITER_CREATE(0x21, &(0x7f00000000c0), 0x8) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="f1e9e29d650c4000"/19], 0x0, 0x0, 0x0}) 15:30:47 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x400480, 0x0) (async) bind$isdn_base(0xffffffffffffffff, &(0x7f0000000040)={0x22, 0xff, 0x7a, 0x4, 0x3}, 0x6) (async) pselect6(0x40, &(0x7f0000000180)={0x0, 0x2}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) [ 3043.535911][T23723] binder: 23721:23723 ioctl c0306201 0 returned -14 [ 3043.545016][T23722] binder: 23720:23722 unknown command -1646073359 [ 3043.551770][T23722] binder: 23720:23722 ioctl c0306201 20000440 returned -22 [ 3043.556297][T23728] binder: 23727:23728 ioctl c0306201 0 returned -14 15:30:47 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@register_looper, @acquire, @dead_binder_done], 0x0, 0x0, 0x0}) 15:30:47 executing program 0: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="f1e9e29d650c4000"/19], 0x0, 0x0, 0x0}) 15:30:47 executing program 2: bpf$ITER_CREATE(0x21, &(0x7f00000000c0), 0x8) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="f1e9e29d650c4000"/19], 0x0, 0x0, 0x0}) 15:30:47 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) r2 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000100)={&(0x7f00000000c0)='./file0\x00', 0x0, 0x10}, 0x10) bind$qrtr(r1, &(0x7f00000001c0)={0x2a, 0x1, 0x2}, 0xc) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000140)={r1, 0xffffffffffffffff, 0x4, r2}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x100008000}, 0x0, &(0x7f0000000200)={0x6f521b22, 0x2000000000000000, 0x2, 0x0, 0x9, 0x4, 0x8d, 0x7}, 0x0, 0x0) clock_getres(0x3, &(0x7f0000000040)) 15:30:47 executing program 4: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x0, 0x0, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) read$eventfd(r0, &(0x7f0000000700), 0x8) 15:30:47 executing program 0: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="f1e9e29d650c4000"/19], 0x0, 0x0, 0x0}) 15:30:47 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@register_looper, @acquire, @dead_binder_done], 0x0, 0x0, 0x0}) 15:30:47 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) (async, rerun: 64) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) (rerun: 64) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) (async, rerun: 32) r2 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000100)={&(0x7f00000000c0)='./file0\x00', 0x0, 0x10}, 0x10) (rerun: 32) bind$qrtr(r1, &(0x7f00000001c0)={0x2a, 0x1, 0x2}, 0xc) (async) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000140)={r1, 0xffffffffffffffff, 0x4, r2}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) (async, rerun: 32) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async, rerun: 32) pselect6(0x40, &(0x7f0000000180)={0x0, 0x100008000}, 0x0, &(0x7f0000000200)={0x6f521b22, 0x2000000000000000, 0x2, 0x0, 0x9, 0x4, 0x8d, 0x7}, 0x0, 0x0) (async) clock_getres(0x3, &(0x7f0000000040)) [ 3044.119595][T23733] binder: 23731:23733 unknown command -1646073359 [ 3044.133888][T23733] binder: 23731:23733 ioctl c0306201 20000440 returned -22 [ 3044.143454][T23735] binder: 23732:23735 ioctl c0306201 0 returned -14 [ 3044.153623][T23739] binder: 23738:23739 ioctl c0306201 0 returned -14 15:30:47 executing program 2: bpf$ITER_CREATE(0x21, &(0x7f00000000c0), 0x8) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="f1e9e29d650c4000"/19], 0x0, 0x0, 0x0}) [ 3044.235769][T23744] binder: 23741:23744 ioctl c0306201 0 returned -14 [ 3044.297467][T23746] binder: 23742:23746 ioctl c0306201 0 returned -14 [ 3044.315697][T23746] binder: 23742:23746 ioctl c0306201 0 returned -14 [ 3044.323035][T23746] binder: 23742:23746 ioctl c0306201 0 returned -14 [ 3044.329977][T23746] binder: 23742:23746 ioctl c0306201 0 returned -14 [ 3044.337041][T23746] binder: 23742:23746 ioctl c0306201 0 returned -14 [ 3044.344310][T23746] binder: 23742:23746 ioctl c0306201 0 returned -14 [ 3044.351440][T23746] binder: 23742:23746 ioctl c0306201 0 returned -14 [ 3044.359351][T23746] binder: 23742:23746 ioctl c0306201 0 returned -14 [ 3044.366905][T23746] binder: 23742:23746 ioctl c0306201 0 returned -14 [ 3044.374195][T23746] binder: 23742:23746 ioctl c0306201 0 returned -14 [ 3044.381007][T23746] binder: 23742:23746 ioctl c0306201 0 returned -14 [ 3044.388154][T23746] binder: 23742:23746 ioctl c0306201 0 returned -14 15:30:48 executing program 1: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)}) 15:30:48 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 15:30:48 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@register_looper, @acquire, @dead_binder_done], 0x0, 0x0, 0x0}) 15:30:48 executing program 2: bpf$ITER_CREATE(0x21, &(0x7f00000000c0), 0x8) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="f1e9e29d650c4000"/19], 0x0, 0x0, 0x0}) [ 3044.398832][T23746] binder: 23742:23746 ioctl c0306201 0 returned -14 [ 3044.425072][T23746] binder: 23742:23746 ioctl c0306201 0 returned -14 [ 3044.427101][T23756] binder: 23755:23756 ioctl c0306201 0 returned -14 15:30:48 executing program 2: bpf$ITER_CREATE(0x21, &(0x7f00000000c0), 0x8) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="f1e9e29d650c4000"/19], 0x0, 0x0, 0x0}) [ 3044.444317][T23758] binder: 23753:23758 ioctl c0306201 0 returned -14 [ 3044.448934][T23746] binder: 23742:23746 ioctl c0306201 0 returned -14 [ 3044.463910][T23759] binder: 23757:23759 ioctl c0306201 0 returned -14 [ 3044.464957][T23746] binder: 23742:23746 ioctl c0306201 0 returned -14 15:30:48 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 15:30:48 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@register_looper, @acquire, @dead_binder_done], 0x0, 0x0, &(0x7f0000000240)}) [ 3044.493417][T23746] binder: 23742:23746 ioctl c0306201 0 returned -14 [ 3044.509439][T23746] binder: 23742:23746 ioctl c0306201 0 returned -14 [ 3044.534581][T23746] binder: 23742:23746 ioctl c0306201 0 returned -14 [ 3044.551827][T23746] binder: 23742:23746 ioctl c0306201 0 returned -14 [ 3044.558551][T23746] binder: 23742:23746 ioctl c0306201 0 returned -14 [ 3044.574398][T23765] binder: 23764:23765 ioctl c0306201 0 returned -14 [ 3044.575249][T23766] binder: 23763:23766 ioctl c0306201 0 returned -14 [ 3044.615945][T23746] binder: 23742:23746 ioctl c0306201 0 returned -14 [ 3044.628756][T23746] binder: 23742:23746 ioctl c0306201 0 returned -14 [ 3044.635841][T23746] binder: 23742:23746 ioctl c0306201 0 returned -14 [ 3044.645681][T23746] binder: 23742:23746 ioctl c0306201 0 returned -14 [ 3044.654114][T23746] binder: 23742:23746 ioctl c0306201 0 returned -14 [ 3044.661818][T23746] binder: 23742:23746 ioctl c0306201 0 returned -14 [ 3044.668999][T23746] binder: 23742:23746 ioctl c0306201 0 returned -14 [ 3044.676091][T23746] binder: 23742:23746 ioctl c0306201 0 returned -14 [ 3044.683327][T23746] binder: 23742:23746 ioctl c0306201 0 returned -14 [ 3044.690101][T23746] binder: 23742:23746 ioctl c0306201 0 returned -14 [ 3044.697065][T23746] binder: 23742:23746 ioctl c0306201 0 returned -14 [ 3044.703999][T23746] binder: 23742:23746 ioctl c0306201 0 returned -14 15:30:48 executing program 4: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) read$eventfd(r0, &(0x7f0000000700), 0x8) 15:30:48 executing program 1: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 15:30:48 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="f1e9e29d650c4000"/19], 0x0, 0x0, 0x0}) 15:30:48 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@register_looper, @acquire, @dead_binder_done], 0x0, 0x0, &(0x7f0000000240)}) 15:30:48 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 15:30:48 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) (async) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) r2 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000100)={&(0x7f00000000c0)='./file0\x00', 0x0, 0x10}, 0x10) bind$qrtr(r1, &(0x7f00000001c0)={0x2a, 0x1, 0x2}, 0xc) (async) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000140)={r1, 0xffffffffffffffff, 0x4, r2}, 0x10) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x100008000}, 0x0, &(0x7f0000000200)={0x6f521b22, 0x2000000000000000, 0x2, 0x0, 0x9, 0x4, 0x8d, 0x7}, 0x0, 0x0) (async) clock_getres(0x3, &(0x7f0000000040)) [ 3045.000574][T23771] binder: 23770:23771 ioctl c0306201 0 returned -14 [ 3045.005809][T23772] binder: 23767:23772 ioctl c0306201 0 returned -14 [ 3045.015545][T23776] binder: 23775:23776 ioctl c0306201 0 returned -14 [ 3045.015734][T23777] binder: 23769:23777 ioctl c0306201 0 returned -14 [ 3045.029043][T23778] binder: 23768:23778 unknown command -1646073359 [ 3045.043915][T23776] binder: 23775:23776 ioctl c0306201 0 returned -14 15:30:48 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@register_looper, @acquire, @dead_binder_done], 0x0, 0x0, &(0x7f0000000240)}) 15:30:48 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, 0x0, 0x0, 0x0, 0x0}) 15:30:48 executing program 4: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, 0x0, 0x0, 0x0) read$eventfd(r0, &(0x7f0000000700), 0x8) 15:30:48 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$ASHMEM_SET_SIZE(0xffffffffffffffff, 0x40087703, 0x20) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x1, "0a0440", "016c3e954fb1b1c9c0fc79e3b23a5209e91ab1acd413d7c2e5c85187e8fd5968a2bdbf9f8cc0fec800be8b03ffff14f0dd73f1fc3773349a17fbcdcc5ea9803f5995b2c98a971369e8b1f208f0636fc376ddcf22e71e2cd5876427cbcc875bbd39343bef9d68a63e7fedd1c93de737594fb699f4fb12fb016e2b07d3c50b58d160f491768dd96fad98ced2bd5ed2e0028374b81bed4cc4df05331982bab662f44b4e8d1d4cd9304a88260d3251bfe0c03fba6d66fdec4f8e1e6d2a71911fe3f88b356746c24d91f51b968efb4df363ae626317f635297597140dc6b7d3d717e9229776b6afdf0b197e865c7e265c32811e1ded7ffc3ee39260b4ecba6dcdd910"}}, 0x118) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, &(0x7f0000000200)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xecd}, 0x0, 0x0) 15:30:48 executing program 1: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x79, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4bf2c288796964b1743a105d2fd3990c3e822bbc40134314df4d4aa8b59c55105f38b98878c1a1f6b9a7dbf769b5c8ad10fd69fcce30ea462ccd095fdd"}) [ 3045.069881][T23778] binder: 23768:23778 ioctl c0306201 20000440 returned -22 15:30:48 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, 0x0, 0x0, 0x0, 0x0}) 15:30:48 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="f1e9e29d650c4000"/19], 0x0, 0x0, 0x0}) [ 3045.129686][T23783] binder: 23781:23783 ioctl c0306201 20000440 returned -14 [ 3045.135316][T23785] binder: 23784:23785 ioctl c0306201 0 returned -14 [ 3045.146054][T23786] binder: 23782:23786 ioctl c0306201 0 returned -14 15:30:49 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@register_looper, @acquire, @dead_binder_done], 0x3d, 0x0, &(0x7f0000000240)="a19c51d7d1221a9e1b0e6a7a198107533ad7d4d1afe69e8499b989613109635137e2648f0501959c01a1df45d66853406f8024d783aa1806e61acb4b4b"}) 15:30:49 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="f1e9e29d650c4000"/19], 0x0, 0x0, 0x0}) [ 3045.214791][T23794] binder: 23790:23794 ioctl c0306201 20000440 returned -14 15:30:49 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, 0x0, 0x0, 0x0, 0x0}) 15:30:49 executing program 1: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@register_looper, @acquire, @dead_binder_done], 0x0, 0x0, &(0x7f0000000240)}) [ 3045.259253][T23798] binder: 23795:23798 ioctl c0306201 0 returned -14 15:30:49 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="f1e9e29d650c4000"/19], 0x0, 0x0, 0x0}) 15:30:49 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[], 0x0, 0x0, 0x0}) [ 3045.307401][T23801] binder: 23800:23801 ioctl c0306201 20000440 returned -14 [ 3045.344814][T23803] binder: 23802:23803 ioctl c0306201 0 returned -14 15:30:49 executing program 2: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="f1e9e29d650c4000"/19], 0x0, 0x0, 0x0}) [ 3045.366301][T23807] binder: 23806:23807 unknown command 0 [ 3045.380818][T23807] binder: 23806:23807 ioctl c0306201 20000440 returned -22 15:30:49 executing program 4: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, 0x0, 0x0, 0x0) read$eventfd(r0, &(0x7f0000000700), 0x8) 15:30:49 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x125f, 0xffffffffffffffff) ioctl$LOOP_GET_STATUS64(r0, 0x4c05, &(0x7f0000000280)) io_uring_setup(0x6a19, &(0x7f0000000080)={0x0, 0xd269, 0x8, 0x3, 0x30b}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000180), 0x8) sendmsg$NL80211_CMD_SET_BSS(r1, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="080026bd7000ffdbdf251900000005001d00ff000000a4b3231278f8d735bd73770c757e59bec7be9d6ed2955b96"], 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x90) ioctl$X86_IOC_RDMSR_REGS(0xffffffffffffffff, 0xc02063a0, &(0x7f0000000000)=[0x9039, 0xf3, 0x9, 0x8, 0xfffffffc, 0x3, 0x200]) 15:30:49 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[], 0x0, 0x0, 0x0}) 15:30:49 executing program 2: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="f1e9e29d650c4000"/19], 0x0, 0x0, 0x0}) 15:30:49 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$ASHMEM_SET_SIZE(0xffffffffffffffff, 0x40087703, 0x20) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x1, "0a0440", "016c3e954fb1b1c9c0fc79e3b23a5209e91ab1acd413d7c2e5c85187e8fd5968a2bdbf9f8cc0fec800be8b03ffff14f0dd73f1fc3773349a17fbcdcc5ea9803f5995b2c98a971369e8b1f208f0636fc376ddcf22e71e2cd5876427cbcc875bbd39343bef9d68a63e7fedd1c93de737594fb699f4fb12fb016e2b07d3c50b58d160f491768dd96fad98ced2bd5ed2e0028374b81bed4cc4df05331982bab662f44b4e8d1d4cd9304a88260d3251bfe0c03fba6d66fdec4f8e1e6d2a71911fe3f88b356746c24d91f51b968efb4df363ae626317f635297597140dc6b7d3d717e9229776b6afdf0b197e865c7e265c32811e1ded7ffc3ee39260b4ecba6dcdd910"}}, 0x118) (async) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, &(0x7f0000000200)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xecd}, 0x0, 0x0) [ 3046.035075][T23815] binder: 23810:23815 unknown command 0 [ 3046.050569][T23817] binder: 23813:23817 ioctl c0306201 0 returned -14 [ 3046.052157][T23815] binder: 23810:23815 ioctl c0306201 20000440 returned -22 15:30:49 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@register_looper, @acquire, @dead_binder_done], 0x1, 0x0, &(0x7f0000000240)="a1"}) 15:30:49 executing program 2: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="f1e9e29d650c4000"/19], 0x0, 0x0, 0x0}) 15:30:49 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[], 0x0, 0x0, 0x0}) 15:30:49 executing program 1: r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TCGETA(r0, 0x540b, &(0x7f00000000c0)) r1 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x1c, 0x0, 0x4, 0x70bd2a, 0x25dfdbff, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40400c4}, 0x20000000) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000580), r2) sendmsg$BATADV_CMD_TP_METER(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x34, r3, 0x100, 0x70bd2d, 0x25dfdbfb, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8000}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x6}]}, 0x34}, 0x1, 0x0, 0x0, 0x4040}, 0x8010) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) r4 = socket$bt_rfcomm(0x1f, 0x3, 0x3) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000500)={'wlan1\x00'}) ioctl$KDSKBENT(r2, 0x4b47, &(0x7f0000000000)={0x1, 0x5, 0xb4}) socketpair(0xa, 0x3, 0x4, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$L2TP_CMD_SESSION_MODIFY(r5, &(0x7f00000003c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x1c, 0x0, 0x1, 0x70bd2a, 0x25dfdbfb, {}, [@L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x20}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4801}, 0x1) write$RDMA_USER_CM_CMD_JOIN_MCAST(r2, &(0x7f00000001c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000180)={0xffffffffffffffff}, 0x4, 0xffffffffffffffff, 0x1c, 0x1, @ib={0x1b, 0x3ff, 0x8, {"47fc6e2c8ff2619172dd9c0a2ebb2d66"}, 0x6b4, 0xaa7, 0x8}}}, 0xa0) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r2, &(0x7f0000000280)={0x11, 0x10, 0xfa00, {&(0x7f0000000140), r6}}, 0x18) ioctl$LOOP_SET_FD(r1, 0x1263, 0xffffffffffffffff) 15:30:49 executing program 1: r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TCGETA(r0, 0x540b, &(0x7f00000000c0)) r1 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x1c, 0x0, 0x4, 0x70bd2a, 0x25dfdbff, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40400c4}, 0x20000000) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000580), r2) sendmsg$BATADV_CMD_TP_METER(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x34, r3, 0x100, 0x70bd2d, 0x25dfdbfb, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8000}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x6}]}, 0x34}, 0x1, 0x0, 0x0, 0x4040}, 0x8010) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) r4 = socket$bt_rfcomm(0x1f, 0x3, 0x3) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000500)={'wlan1\x00'}) ioctl$KDSKBENT(r2, 0x4b47, &(0x7f0000000000)={0x1, 0x5, 0xb4}) socketpair(0xa, 0x3, 0x4, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$L2TP_CMD_SESSION_MODIFY(r5, &(0x7f00000003c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x1c, 0x0, 0x1, 0x70bd2a, 0x25dfdbfb, {}, [@L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x20}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4801}, 0x1) write$RDMA_USER_CM_CMD_JOIN_MCAST(r2, &(0x7f00000001c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000180)={0xffffffffffffffff}, 0x4, 0xffffffffffffffff, 0x1c, 0x1, @ib={0x1b, 0x3ff, 0x8, {"47fc6e2c8ff2619172dd9c0a2ebb2d66"}, 0x6b4, 0xaa7, 0x8}}}, 0xa0) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r2, &(0x7f0000000280)={0x11, 0x10, 0xfa00, {&(0x7f0000000140), r6}}, 0x18) ioctl$LOOP_SET_FD(r1, 0x1263, 0xffffffffffffffff) 15:30:49 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 3046.138159][T23824] binder: 23822:23824 unknown command 0 [ 3046.158403][T23829] binder: 23826:23829 ioctl c0306201 0 returned -14 [ 3046.165545][T23824] binder: 23822:23824 ioctl c0306201 20000440 returned -22 15:30:50 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) [ 3046.234116][T23833] binder: 23831:23833 ioctl c0306201 0 returned -14 [ 3046.266804][T23835] binder: 23834:23835 unknown command 0 [ 3046.277313][T23835] binder: 23834:23835 ioctl c0306201 20000440 returned -22 15:30:50 executing program 4: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, 0x0, 0x0, 0x0) read$eventfd(r0, &(0x7f0000000700), 0x8) 15:30:50 executing program 1: r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TCGETA(r0, 0x540b, &(0x7f00000000c0)) r1 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x1c, 0x0, 0x4, 0x70bd2a, 0x25dfdbff, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40400c4}, 0x20000000) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000580), r2) sendmsg$BATADV_CMD_TP_METER(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x34, r3, 0x100, 0x70bd2d, 0x25dfdbfb, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8000}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x6}]}, 0x34}, 0x1, 0x0, 0x0, 0x4040}, 0x8010) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) r4 = socket$bt_rfcomm(0x1f, 0x3, 0x3) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000500)={'wlan1\x00'}) ioctl$KDSKBENT(r2, 0x4b47, &(0x7f0000000000)={0x1, 0x5, 0xb4}) socketpair(0xa, 0x3, 0x4, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$L2TP_CMD_SESSION_MODIFY(r5, &(0x7f00000003c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x1c, 0x0, 0x1, 0x70bd2a, 0x25dfdbfb, {}, [@L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x20}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4801}, 0x1) write$RDMA_USER_CM_CMD_JOIN_MCAST(r2, &(0x7f00000001c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000180)={0xffffffffffffffff}, 0x4, 0xffffffffffffffff, 0x1c, 0x1, @ib={0x1b, 0x3ff, 0x8, {"47fc6e2c8ff2619172dd9c0a2ebb2d66"}, 0x6b4, 0xaa7, 0x8}}}, 0xa0) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r2, &(0x7f0000000280)={0x11, 0x10, 0xfa00, {&(0x7f0000000140), r6}}, 0x18) ioctl$LOOP_SET_FD(r1, 0x1263, 0xffffffffffffffff) 15:30:50 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 15:30:50 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) 15:30:50 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$ASHMEM_SET_SIZE(0xffffffffffffffff, 0x40087703, 0x20) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x1, "0a0440", "016c3e954fb1b1c9c0fc79e3b23a5209e91ab1acd413d7c2e5c85187e8fd5968a2bdbf9f8cc0fec800be8b03ffff14f0dd73f1fc3773349a17fbcdcc5ea9803f5995b2c98a971369e8b1f208f0636fc376ddcf22e71e2cd5876427cbcc875bbd39343bef9d68a63e7fedd1c93de737594fb699f4fb12fb016e2b07d3c50b58d160f491768dd96fad98ced2bd5ed2e0028374b81bed4cc4df05331982bab662f44b4e8d1d4cd9304a88260d3251bfe0c03fba6d66fdec4f8e1e6d2a71911fe3f88b356746c24d91f51b968efb4df363ae626317f635297597140dc6b7d3d717e9229776b6afdf0b197e865c7e265c32811e1ded7ffc3ee39260b4ecba6dcdd910"}}, 0x118) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, &(0x7f0000000200)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xecd}, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) (async) ioctl$ASHMEM_SET_SIZE(0xffffffffffffffff, 0x40087703, 0x20) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, &(0x7f0000000240)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x1, "0a0440", "016c3e954fb1b1c9c0fc79e3b23a5209e91ab1acd413d7c2e5c85187e8fd5968a2bdbf9f8cc0fec800be8b03ffff14f0dd73f1fc3773349a17fbcdcc5ea9803f5995b2c98a971369e8b1f208f0636fc376ddcf22e71e2cd5876427cbcc875bbd39343bef9d68a63e7fedd1c93de737594fb699f4fb12fb016e2b07d3c50b58d160f491768dd96fad98ced2bd5ed2e0028374b81bed4cc4df05331982bab662f44b4e8d1d4cd9304a88260d3251bfe0c03fba6d66fdec4f8e1e6d2a71911fe3f88b356746c24d91f51b968efb4df363ae626317f635297597140dc6b7d3d717e9229776b6afdf0b197e865c7e265c32811e1ded7ffc3ee39260b4ecba6dcdd910"}}, 0x118) (async) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, &(0x7f0000000200)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xecd}, 0x0, 0x0) (async) [ 3046.915116][T23840] binder: 23836:23840 unknown command 0 [ 3046.924198][T23841] binder: 23837:23841 ioctl c0306201 0 returned -14 [ 3046.940106][T23840] binder: 23836:23840 ioctl c0306201 20000440 returned -22 [ 3046.948830][T23845] binder: 23842:23845 ioctl c0306201 0 returned -14 15:30:50 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@register_looper, @acquire, @dead_binder_done], 0x0, 0x0, &(0x7f0000000240)}) 15:30:50 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 15:30:50 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) 15:30:50 executing program 1: r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TCGETA(r0, 0x540b, &(0x7f00000000c0)) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x1c, 0x0, 0x4, 0x70bd2a, 0x25dfdbff, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40400c4}, 0x20000000) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000580), r1) sendmsg$BATADV_CMD_TP_METER(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x34, r2, 0x100, 0x70bd2d, 0x25dfdbfb, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8000}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x6}]}, 0x34}, 0x1, 0x0, 0x0, 0x4040}, 0x8010) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) r3 = socket$bt_rfcomm(0x1f, 0x3, 0x3) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000500)={'wlan1\x00'}) ioctl$KDSKBENT(r1, 0x4b47, &(0x7f0000000000)={0x1, 0x5, 0xb4}) socketpair(0xa, 0x3, 0x4, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$L2TP_CMD_SESSION_MODIFY(r4, &(0x7f00000003c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x1c, 0x0, 0x1, 0x70bd2a, 0x25dfdbfb, {}, [@L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x20}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4801}, 0x1) write$RDMA_USER_CM_CMD_JOIN_MCAST(r1, &(0x7f00000001c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000180)={0xffffffffffffffff}, 0x4, 0xffffffffffffffff, 0x1c, 0x1, @ib={0x1b, 0x3ff, 0x8, {"47fc6e2c8ff2619172dd9c0a2ebb2d66"}, 0x6b4, 0xaa7, 0x8}}}, 0xa0) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f0000000280)={0x11, 0x10, 0xfa00, {&(0x7f0000000140), r5}}, 0x18) [ 3047.023376][T23847] binder: 23842:23847 ioctl c0306201 0 returned -14 [ 3047.036988][T23855] binder: 23850:23855 ioctl c0306201 0 returned -14 [ 3047.045579][T23856] binder: 23849:23856 ioctl c0306201 0 returned -14 [ 3047.062951][T23858] binder: 23851:23858 unknown command 0 15:30:50 executing program 1: r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TCGETA(r0, 0x540b, &(0x7f00000000c0)) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x1c, 0x0, 0x4, 0x70bd2a, 0x25dfdbff, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40400c4}, 0x20000000) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000580), r1) sendmsg$BATADV_CMD_TP_METER(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x34, r2, 0x100, 0x70bd2d, 0x25dfdbfb, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8000}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x6}]}, 0x34}, 0x1, 0x0, 0x0, 0x4040}, 0x8010) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) r3 = socket$bt_rfcomm(0x1f, 0x3, 0x3) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000500)={'wlan1\x00'}) ioctl$KDSKBENT(r1, 0x4b47, &(0x7f0000000000)={0x1, 0x5, 0xb4}) socketpair(0xa, 0x3, 0x4, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$L2TP_CMD_SESSION_MODIFY(r4, &(0x7f00000003c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x1c, 0x0, 0x1, 0x70bd2a, 0x25dfdbfb, {}, [@L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x20}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4801}, 0x1) write$RDMA_USER_CM_CMD_JOIN_MCAST(r1, &(0x7f00000001c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000180), 0x4, 0xffffffffffffffff, 0x1c, 0x1, @ib={0x1b, 0x3ff, 0x8, {"47fc6e2c8ff2619172dd9c0a2ebb2d66"}, 0x6b4, 0xaa7, 0x8}}}, 0xa0) 15:30:50 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@register_looper, @acquire, @dead_binder_done], 0x0, 0x0, &(0x7f0000000240)}) 15:30:50 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 3047.087299][T23858] binder: 23851:23858 ioctl c0306201 20000440 returned -22 [ 3047.133540][T23863] binder: 23859:23863 ioctl c0306201 0 returned -14 [ 3047.141832][T23864] binder: 23861:23864 ioctl c0306201 20000440 returned -14 15:30:51 executing program 4: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200), 0x0, 0x0) read$eventfd(r0, &(0x7f0000000700), 0x8) 15:30:51 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="f1e9e29d650c40000000"], 0x0, 0x0, 0x0}) 15:30:51 executing program 1: r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TCGETA(r0, 0x540b, &(0x7f00000000c0)) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x1c, 0x0, 0x4, 0x70bd2a, 0x25dfdbff, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40400c4}, 0x20000000) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000580), r1) sendmsg$BATADV_CMD_TP_METER(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x34, r2, 0x100, 0x70bd2d, 0x25dfdbfb, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8000}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x6}]}, 0x34}, 0x1, 0x0, 0x0, 0x4040}, 0x8010) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) r3 = socket$bt_rfcomm(0x1f, 0x3, 0x3) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000500)={'wlan1\x00'}) ioctl$KDSKBENT(r1, 0x4b47, &(0x7f0000000000)={0x1, 0x5, 0xb4}) socketpair(0xa, 0x3, 0x4, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$L2TP_CMD_SESSION_MODIFY(r4, &(0x7f00000003c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x1c, 0x0, 0x1, 0x70bd2a, 0x25dfdbfb, {}, [@L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x20}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4801}, 0x1) 15:30:51 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, 0x0, 0x0, 0x0, 0x0}) 15:30:51 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x6e0243, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x10000}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) bpf$BPF_RAW_TRACEPOINT_OPEN_UNNAMED(0x11, &(0x7f00000000c0)={0x0, r1}, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), r2) 15:30:51 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x18, 0x0, &(0x7f00000000c0)=[@register_looper, @acquire, @dead_binder_done], 0x0, 0x0, &(0x7f0000000240)}) [ 3047.812622][T23870] binder: 23866:23870 unknown command -1646073359 [ 3047.819437][T23868] binder: 23867:23868 ioctl c0306201 20000440 returned -14 [ 3047.831509][T23871] binder: 23869:23871 ioctl c0306201 0 returned -14 [ 3047.855116][T23870] binder: 23866:23870 ioctl c0306201 20000440 returned -22 15:30:51 executing program 1: r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TCGETA(r0, 0x540b, &(0x7f00000000c0)) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x1c, 0x0, 0x4, 0x70bd2a, 0x25dfdbff, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40400c4}, 0x20000000) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000580), r1) sendmsg$BATADV_CMD_TP_METER(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x34, r2, 0x100, 0x70bd2d, 0x25dfdbfb, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8000}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x6}]}, 0x34}, 0x1, 0x0, 0x0, 0x4040}, 0x8010) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) r3 = socket$bt_rfcomm(0x1f, 0x3, 0x3) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000500)={'wlan1\x00'}) ioctl$KDSKBENT(r1, 0x4b47, &(0x7f0000000000)={0x1, 0x5, 0xb4}) socketpair(0xa, 0x3, 0x4, &(0x7f00000002c0)) 15:30:51 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[], 0x0, 0x0, 0x0}) 15:30:51 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="f1"], 0x0, 0x0, 0x0}) [ 3047.872585][T23876] binder: 23875:23876 ioctl c0306201 0 returned -14 15:30:51 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, 0x0, 0x0, 0x0, 0x0}) 15:30:51 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x6e0243, 0x0) (async) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x10000}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) (async) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) bpf$BPF_RAW_TRACEPOINT_OPEN_UNNAMED(0x11, &(0x7f00000000c0)={0x0, r1}, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), r2) 15:30:51 executing program 1: r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TCGETA(r0, 0x540b, &(0x7f00000000c0)) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x1c, 0x0, 0x4, 0x70bd2a, 0x25dfdbff, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40400c4}, 0x20000000) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000580), r1) sendmsg$BATADV_CMD_TP_METER(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x34, r2, 0x100, 0x70bd2d, 0x25dfdbfb, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8000}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x6}]}, 0x34}, 0x1, 0x0, 0x0, 0x4040}, 0x8010) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) r3 = socket$bt_rfcomm(0x1f, 0x3, 0x3) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000500)={'wlan1\x00'}) socketpair(0xa, 0x3, 0x4, &(0x7f00000002c0)) [ 3047.932720][T23881] binder: 23878:23881 unknown command 0 [ 3047.959759][T23881] binder: 23878:23881 ioctl c0306201 20000440 returned -22 [ 3047.971391][T23883] binder: 23882:23883 unknown command 241 [ 3047.989803][T23883] binder: 23882:23883 ioctl c0306201 20000440 returned -22 [ 3048.008721][T23885] binder: 23884:23885 ioctl c0306201 20000440 returned -14 [ 3048.040975][T23889] binder: 23887:23889 ioctl c0306201 0 returned -14 15:30:52 executing program 4: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200), 0x0, 0x0) read$eventfd(r0, &(0x7f0000000700), 0x8) 15:30:52 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x6e0243, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x10000}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) bpf$BPF_RAW_TRACEPOINT_OPEN_UNNAMED(0x11, &(0x7f00000000c0)={0x0, r1}, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), r2) 15:30:52 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) 15:30:52 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[], 0x0, 0x0, 0x0}) 15:30:52 executing program 1: r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TCGETA(r0, 0x540b, &(0x7f00000000c0)) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x1c, 0x0, 0x4, 0x70bd2a, 0x25dfdbff, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40400c4}, 0x20000000) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000580), r1) sendmsg$BATADV_CMD_TP_METER(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x34, r2, 0x100, 0x70bd2d, 0x25dfdbfb, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8000}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x6}]}, 0x34}, 0x1, 0x0, 0x0, 0x4040}, 0x8010) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) socket$bt_rfcomm(0x1f, 0x3, 0x3) socketpair(0xa, 0x3, 0x4, &(0x7f00000002c0)) 15:30:52 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x6e0243, 0x0) (async, rerun: 32) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x10000}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) (async, rerun: 32) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) bpf$BPF_RAW_TRACEPOINT_OPEN_UNNAMED(0x11, &(0x7f00000000c0)={0x0, r1}, 0x10) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), r2) [ 3048.693162][T23895] binder: 23894:23895 unknown command 0 [ 3048.706948][T23899] binder: 23898:23899 unknown command 0 [ 3048.710915][T23900] binder: 23893:23900 ioctl c0306201 0 returned -14 [ 3048.721967][T23895] binder: 23894:23895 ioctl c0306201 20000440 returned -22 [ 3048.734714][T23902] binder: 23897:23902 ioctl c0306201 0 returned -14 15:30:52 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) [ 3048.744956][T23899] binder: 23898:23899 ioctl c0306201 20000440 returned -22 15:30:52 executing program 1: r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TCGETA(r0, 0x540b, &(0x7f00000000c0)) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x1c, 0x0, 0x4, 0x70bd2a, 0x25dfdbff, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40400c4}, 0x20000000) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000580), r1) sendmsg$BATADV_CMD_TP_METER(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x34, r2, 0x100, 0x70bd2d, 0x25dfdbfb, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8000}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x6}]}, 0x34}, 0x1, 0x0, 0x0, 0x4040}, 0x8010) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) socketpair(0xa, 0x3, 0x4, &(0x7f00000002c0)) 15:30:52 executing program 3: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000500)={0x14, 0x0, &(0x7f0000000280)=[@enter_looper, @clear_death={0x400c630f, 0x3}], 0x5b, 0x0, &(0x7f0000000480)="fe4aa8306ad888ceaecb02a21a4d520ed48a21d9ffd24199a2addbf302737c6c3a1aa863a16c5d8d10e13548dd97442f84b1fa07224018c91372729cb35aa2403c47ceaa7f627d987bdee45fd79181d4b081a07a9f56cd52a83d0a"}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$VT_RESIZEX(0xffffffffffffffff, 0x560a, &(0x7f0000000240)={0x6fc2, 0x7fff, 0x93de, 0x1, 0x80, 0x1}) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x20, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="106308400019b200ecffffff00000863104001000000000000000000000000000000061f6a7dd2c66a9efb28c46881bf033a832471b1f23263eee1348779ce115cda51231288d7f1d2ab5b175b1663bd93bee331c9b817048e679d8dc0abfdea0866896a32640eeecaa359381afaa653a67a244103a6259bb5cfd6"], 0x45, 0x0, &(0x7f00000000c0)="e7907848adcd111a161266dd08268c0255193b9a62e88bb88ac1fd70f785010342549fe93e2748232fd1e22ecaeaabdbdc769a5294459aa737c8ee4ee1209e154ed6b8af35"}) 15:30:52 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x1800, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) setsockopt$RDS_CONG_MONITOR(0xffffffffffffffff, 0x114, 0x6, &(0x7f00000000c0), 0x4) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x400883, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:52 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[], 0x0, 0x0, 0x0}) [ 3048.826547][T23909] binder: 23908:23909 unknown command 0 [ 3048.849338][T23909] binder: 23908:23909 ioctl c0306201 20000440 returned -22 15:30:52 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) [ 3048.879833][T23916] binder: 23914:23916 unknown command 0 [ 3048.882835][T23915] binder: 23912:23915 ioctl c0306201 0 returned -14 [ 3048.896469][T23916] binder: 23914:23916 ioctl c0306201 20000440 returned -22 [ 3048.906517][T23918] binder: 23917:23918 ioctl c0306201 0 returned -14 [ 3048.939402][T23915] binder: 23912:23915 unknown command 1661468672 [ 3048.946336][T23915] binder: 23912:23915 ioctl c0306201 20000140 returned -22 [ 3048.959257][T23920] binder: 23919:23920 unknown command 0 [ 3048.972952][T23920] binder: 23919:23920 ioctl c0306201 20000440 returned -22 15:30:53 executing program 4: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200), 0x0, 0x0) read$eventfd(r0, &(0x7f0000000700), 0x8) 15:30:53 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[], 0x0, 0x0, 0x0}) 15:30:53 executing program 1: r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TCGETA(r0, 0x540b, &(0x7f00000000c0)) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x1c, 0x0, 0x4, 0x70bd2a, 0x25dfdbff, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40400c4}, 0x20000000) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000580), r1) sendmsg$BATADV_CMD_TP_METER(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x34, r2, 0x100, 0x70bd2d, 0x25dfdbfb, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8000}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x6}]}, 0x34}, 0x1, 0x0, 0x0, 0x4040}, 0x8010) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) socketpair(0xa, 0x3, 0x4, &(0x7f00000002c0)) 15:30:53 executing program 3: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000500)={0x14, 0x0, &(0x7f0000000280)=[@enter_looper, @clear_death={0x400c630f, 0x3}], 0x5b, 0x0, &(0x7f0000000480)="fe4aa8306ad888ceaecb02a21a4d520ed48a21d9ffd24199a2addbf302737c6c3a1aa863a16c5d8d10e13548dd97442f84b1fa07224018c91372729cb35aa2403c47ceaa7f627d987bdee45fd79181d4b081a07a9f56cd52a83d0a"}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$VT_RESIZEX(0xffffffffffffffff, 0x560a, &(0x7f0000000240)={0x6fc2, 0x7fff, 0x93de, 0x1, 0x80, 0x1}) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) ioctl$KDGKBMODE(0xffffffffffffffff, 0x4b44, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x20, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="106308400019b200ecffffff00000863104001000000000000000000000000000000061f6a7dd2c66a9efb28c46881bf033a832471b1f23263eee1348779ce115cda51231288d7f1d2ab5b175b1663bd93bee331c9b817048e679d8dc0abfdea0866896a32640eeecaa359381afaa653a67a244103a6259bb5cfd6"], 0x45, 0x0, &(0x7f00000000c0)="e7907848adcd111a161266dd08268c0255193b9a62e88bb88ac1fd70f785010342549fe93e2748232fd1e22ecaeaabdbdc769a5294459aa737c8ee4ee1209e154ed6b8af35"}) pselect6(0x40, &(0x7f00000001c0)={0x5, 0x0, 0x40, 0xc7, 0xd275, 0x5, 0x8001, 0xfffffffffffffbff}, &(0x7f00000002c0)={0x100000000, 0x3, 0x5, 0x3, 0xfffffffffffffffe, 0xffffffff, 0x1ff, 0x7fffffff}, &(0x7f0000000300)={0x671, 0x6, 0x6, 0x4, 0x10001, 0x7, 0x20, 0x5}, &(0x7f0000000340), &(0x7f00000003c0)={&(0x7f0000000380)={[0x1000]}, 0x8}) 15:30:53 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x28001) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000080)={0x0, {}, 0x0, {}, 0x0, 0x0, 0x16, 0x8, "fb190a466974d8b2a04acef05275a36447ed983c4632657ed726720be5270683723d857c0a7c85faf783882f71637343eecb5d435ed062cc25260286ea21f2ac", "e1945a37076bee5d7698f2511bbc7166f7aff68e4c1cca470214454fe396e27b", [0x7ff, 0x1]}) 15:30:53 executing program 0: pipe2$9p(&(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) r0 = eventfd(0x10001) r1 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x8080, 0x0) syz_open_pts(r1, 0x80) write$eventfd(r0, &(0x7f0000000040)=0x7fffffff, 0x8) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280)={r3, r4+60000000}, &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, &(0x7f00000000c0)) 15:30:53 executing program 1: r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TCGETA(r0, 0x540b, &(0x7f00000000c0)) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x1c, 0x0, 0x4, 0x70bd2a, 0x25dfdbff, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40400c4}, 0x20000000) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000580), r1) sendmsg$BATADV_CMD_TP_METER(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x34, r2, 0x100, 0x70bd2d, 0x25dfdbfb, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8000}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x6}]}, 0x34}, 0x1, 0x0, 0x0, 0x4040}, 0x8010) socketpair(0xa, 0x3, 0x4, &(0x7f00000002c0)) [ 3049.629079][T23928] binder: 23923:23928 ioctl c0306201 0 returned -14 [ 3049.640098][T23930] binder: 23921:23930 unknown command 0 [ 3049.654134][T23928] binder: 23923:23928 unknown command 1661468672 [ 3049.662383][T23930] binder: 23921:23930 ioctl c0306201 20000440 returned -22 [ 3049.664119][T23928] binder: 23923:23928 ioctl c0306201 20000140 returned -22 15:30:53 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) 15:30:53 executing program 3: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000500)={0x14, 0x0, &(0x7f0000000280)=[@enter_looper, @clear_death={0x400c630f, 0x3}], 0x5b, 0x0, &(0x7f0000000480)="fe4aa8306ad888ceaecb02a21a4d520ed48a21d9ffd24199a2addbf302737c6c3a1aa863a16c5d8d10e13548dd97442f84b1fa07224018c91372729cb35aa2403c47ceaa7f627d987bdee45fd79181d4b081a07a9f56cd52a83d0a"}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$VT_RESIZEX(0xffffffffffffffff, 0x560a, &(0x7f0000000240)={0x6fc2, 0x7fff, 0x93de, 0x1, 0x80, 0x1}) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) ioctl$KDGKBMODE(0xffffffffffffffff, 0x4b44, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x20, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="106308400019b200ecffffff00000863104001000000000000000000000000000000061f6a7dd2c66a9efb28c46881bf033a832471b1f23263eee1348779ce115cda51231288d7f1d2ab5b175b1663bd93bee331c9b817048e679d8dc0abfdea0866896a32640eeecaa359381afaa653a67a244103a6259bb5cfd6"], 0x45, 0x0, &(0x7f00000000c0)="e7907848adcd111a161266dd08268c0255193b9a62e88bb88ac1fd70f785010342549fe93e2748232fd1e22ecaeaabdbdc769a5294459aa737c8ee4ee1209e154ed6b8af35"}) pselect6(0x40, &(0x7f00000001c0)={0x5, 0x0, 0x40, 0xc7, 0xd275, 0x5, 0x8001, 0xfffffffffffffbff}, &(0x7f00000002c0)={0x100000000, 0x3, 0x5, 0x3, 0xfffffffffffffffe, 0xffffffff, 0x1ff, 0x7fffffff}, &(0x7f0000000300)={0x671, 0x6, 0x6, 0x4, 0x10001, 0x7, 0x20, 0x5}, &(0x7f0000000340), &(0x7f00000003c0)={&(0x7f0000000380)={[0x1000]}, 0x8}) 15:30:53 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x1800, 0x0) (async, rerun: 64) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) (rerun: 64) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) (async) setsockopt$RDS_CONG_MONITOR(0xffffffffffffffff, 0x114, 0x6, &(0x7f00000000c0), 0x4) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x400883, 0x0) (async) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) [ 3049.773799][T23939] binder: 23938:23939 unknown command 0 [ 3049.779778][T23939] binder: 23938:23939 ioctl c0306201 20000440 returned -22 15:30:53 executing program 1: r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TCGETA(r0, 0x540b, &(0x7f00000000c0)) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x1c, 0x0, 0x4, 0x70bd2a, 0x25dfdbff, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40400c4}, 0x20000000) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000580), r1) socketpair(0xa, 0x3, 0x4, &(0x7f00000002c0)) 15:30:53 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) [ 3049.817189][T23942] binder: 23941:23942 ioctl c0306201 0 returned -14 [ 3049.852195][T23942] binder: 23941:23942 unknown command 1661468672 [ 3049.866831][T23942] binder: 23941:23942 ioctl c0306201 20000140 returned -22 [ 3049.875050][T23948] binder: 23947:23948 unknown command 0 [ 3049.891283][T23948] binder: 23947:23948 ioctl c0306201 20000440 returned -22 15:30:54 executing program 4: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) read$eventfd(0xffffffffffffffff, &(0x7f0000000700), 0x8) 15:30:54 executing program 1: r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TCGETA(r0, 0x540b, &(0x7f00000000c0)) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x1c, 0x0, 0x4, 0x70bd2a, 0x25dfdbff, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40400c4}, 0x20000000) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) socketpair(0xa, 0x3, 0x4, &(0x7f00000002c0)) 15:30:54 executing program 3: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000500)={0x14, 0x0, &(0x7f0000000280)=[@enter_looper, @clear_death={0x400c630f, 0x3}], 0x5b, 0x0, &(0x7f0000000480)="fe4aa8306ad888ceaecb02a21a4d520ed48a21d9ffd24199a2addbf302737c6c3a1aa863a16c5d8d10e13548dd97442f84b1fa07224018c91372729cb35aa2403c47ceaa7f627d987bdee45fd79181d4b081a07a9f56cd52a83d0a"}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$VT_RESIZEX(0xffffffffffffffff, 0x560a, &(0x7f0000000240)={0x6fc2, 0x7fff, 0x93de, 0x1, 0x80, 0x1}) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) ioctl$KDGKBMODE(0xffffffffffffffff, 0x4b44, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x20, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="106308400019b200ecffffff00000863104001000000000000000000000000000000061f6a7dd2c66a9efb28c46881bf033a832471b1f23263eee1348779ce115cda51231288d7f1d2ab5b175b1663bd93bee331c9b817048e679d8dc0abfdea0866896a32640eeecaa359381afaa653a67a244103a6259bb5cfd6"], 0x45, 0x0, &(0x7f00000000c0)="e7907848adcd111a161266dd08268c0255193b9a62e88bb88ac1fd70f785010342549fe93e2748232fd1e22ecaeaabdbdc769a5294459aa737c8ee4ee1209e154ed6b8af35"}) pselect6(0x40, &(0x7f00000001c0)={0x5, 0x0, 0x40, 0xc7, 0xd275, 0x5, 0x8001, 0xfffffffffffffbff}, &(0x7f00000002c0)={0x100000000, 0x3, 0x5, 0x3, 0xfffffffffffffffe, 0xffffffff, 0x1ff, 0x7fffffff}, &(0x7f0000000300)={0x671, 0x6, 0x6, 0x4, 0x10001, 0x7, 0x20, 0x5}, &(0x7f0000000340), &(0x7f00000003c0)={&(0x7f0000000380)={[0x1000]}, 0x8}) 15:30:54 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) [ 3050.512840][T23957] binder: 23955:23957 unknown command 0 [ 3050.521389][T23958] binder: 23954:23958 ioctl c0306201 0 returned -14 [ 3050.528254][T23957] binder: 23955:23957 ioctl c0306201 20000440 returned -22 15:30:54 executing program 0: pipe2$9p(&(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) r0 = eventfd(0x10001) r1 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x8080, 0x0) syz_open_pts(r1, 0x80) write$eventfd(r0, &(0x7f0000000040)=0x7fffffff, 0x8) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280)={r3, r4+60000000}, &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, &(0x7f00000000c0)) 15:30:54 executing program 1: r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TCGETA(r0, 0x540b, &(0x7f00000000c0)) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x1c, 0x0, 0x4, 0x70bd2a, 0x25dfdbff, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40400c4}, 0x20000000) socketpair(0xa, 0x3, 0x4, &(0x7f00000002c0)) 15:30:54 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="f1e9e29d650c40000000"], 0x0, 0x0, 0x0}) 15:30:54 executing program 4: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) read$eventfd(0xffffffffffffffff, &(0x7f0000000700), 0x8) [ 3050.563749][T23958] binder: 23954:23958 unknown command 1661468672 [ 3050.586937][T23958] binder: 23954:23958 ioctl c0306201 20000140 returned -22 15:30:54 executing program 3: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000500)={0x14, 0x0, &(0x7f0000000280)=[@enter_looper, @clear_death={0x400c630f, 0x3}], 0x5b, 0x0, &(0x7f0000000480)="fe4aa8306ad888ceaecb02a21a4d520ed48a21d9ffd24199a2addbf302737c6c3a1aa863a16c5d8d10e13548dd97442f84b1fa07224018c91372729cb35aa2403c47ceaa7f627d987bdee45fd79181d4b081a07a9f56cd52a83d0a"}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$VT_RESIZEX(0xffffffffffffffff, 0x560a, &(0x7f0000000240)={0x6fc2, 0x7fff, 0x93de, 0x1, 0x80, 0x1}) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) ioctl$KDGKBMODE(0xffffffffffffffff, 0x4b44, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x20, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="106308400019b200ecffffff00000863104001000000000000000000000000000000061f6a7dd2c66a9efb28c46881bf033a832471b1f23263eee1348779ce115cda51231288d7f1d2ab5b175b1663bd93bee331c9b817048e679d8dc0abfdea0866896a32640eeecaa359381afaa653a67a244103a6259bb5cfd6"], 0x45, 0x0, &(0x7f00000000c0)="e7907848adcd111a161266dd08268c0255193b9a62e88bb88ac1fd70f785010342549fe93e2748232fd1e22ecaeaabdbdc769a5294459aa737c8ee4ee1209e154ed6b8af35"}) 15:30:54 executing program 1: r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TCGETA(r0, 0x540b, &(0x7f00000000c0)) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) socketpair(0xa, 0x3, 0x4, &(0x7f00000002c0)) 15:30:54 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x1800, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) setsockopt$RDS_CONG_MONITOR(0xffffffffffffffff, 0x114, 0x6, &(0x7f00000000c0), 0x4) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x400883, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x1800, 0x0) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) (async) setsockopt$RDS_CONG_MONITOR(0xffffffffffffffff, 0x114, 0x6, &(0x7f00000000c0), 0x4) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x400883, 0x0) (async) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) (async) 15:30:54 executing program 4: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) read$eventfd(0xffffffffffffffff, &(0x7f0000000700), 0x8) 15:30:54 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="f1"], 0x0, 0x0, 0x0}) [ 3050.670226][T23968] binder: 23967:23968 unknown command -1646073359 [ 3050.693155][T23968] binder: 23967:23968 ioctl c0306201 20000440 returned -22 15:30:54 executing program 1: r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TCGETA(r0, 0x540b, &(0x7f00000000c0)) socketpair(0xa, 0x3, 0x4, &(0x7f00000002c0)) [ 3050.754953][T23971] binder: 23970:23971 ioctl c0306201 0 returned -14 [ 3050.766108][T23977] binder: 23975:23977 ioctl c0306201 0 returned -14 [ 3050.780810][T23979] binder: 23978:23979 unknown command 241 [ 3050.787001][T23979] binder: 23978:23979 ioctl c0306201 20000440 returned -22 15:30:54 executing program 4: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) read$eventfd(r0, 0x0, 0x0) 15:30:54 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) [ 3050.815878][T23980] binder: 23970:23980 unknown command 1661468672 [ 3050.825830][T23980] binder: 23970:23980 ioctl c0306201 20000140 returned -22 [ 3050.842236][T23984] binder: 23975:23984 ioctl c0306201 0 returned -14 [ 3050.866099][T23991] binder: 23989:23991 unknown command 0 [ 3050.879179][T23991] binder: 23989:23991 ioctl c0306201 20000440 returned -22 15:30:55 executing program 0: pipe2$9p(&(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) r0 = eventfd(0x10001) r1 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x8080, 0x0) syz_open_pts(r1, 0x80) write$eventfd(r0, &(0x7f0000000040)=0x7fffffff, 0x8) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280)={r3, r4+60000000}, &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r2, 0xc01064c2, &(0x7f00000000c0)) 15:30:55 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) ioctl$ASHMEM_GET_NAME(0xffffffffffffffff, 0x81007702, &(0x7f0000000040)) 15:30:55 executing program 1: openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) socketpair(0xa, 0x3, 0x4, &(0x7f00000002c0)) 15:30:55 executing program 3: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000500)={0x14, 0x0, &(0x7f0000000280)=[@enter_looper, @clear_death={0x400c630f, 0x3}], 0x5b, 0x0, &(0x7f0000000480)="fe4aa8306ad888ceaecb02a21a4d520ed48a21d9ffd24199a2addbf302737c6c3a1aa863a16c5d8d10e13548dd97442f84b1fa07224018c91372729cb35aa2403c47ceaa7f627d987bdee45fd79181d4b081a07a9f56cd52a83d0a"}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$VT_RESIZEX(0xffffffffffffffff, 0x560a, &(0x7f0000000240)={0x6fc2, 0x7fff, 0x93de, 0x1, 0x80, 0x1}) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) ioctl$KDGKBMODE(0xffffffffffffffff, 0x4b44, &(0x7f0000000040)) 15:30:55 executing program 4: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) read$eventfd(r0, 0x0, 0x0) 15:30:55 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) [ 3051.474228][T23996] binder: 23995:23996 ioctl c0306201 0 returned -14 [ 3051.495079][T23999] binder: 23997:23999 unknown command 0 [ 3051.501039][T24001] binder: 23993:24001 ioctl c0306201 0 returned -14 [ 3051.514808][T23999] binder: 23997:23999 ioctl c0306201 20000440 returned -22 15:30:55 executing program 4: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) read$eventfd(r0, 0x0, 0x0) 15:30:55 executing program 1: socketpair(0xa, 0x3, 0x4, &(0x7f00000002c0)) 15:30:55 executing program 3: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000500)={0x14, 0x0, &(0x7f0000000280)=[@enter_looper, @clear_death={0x400c630f, 0x3}], 0x5b, 0x0, &(0x7f0000000480)="fe4aa8306ad888ceaecb02a21a4d520ed48a21d9ffd24199a2addbf302737c6c3a1aa863a16c5d8d10e13548dd97442f84b1fa07224018c91372729cb35aa2403c47ceaa7f627d987bdee45fd79181d4b081a07a9f56cd52a83d0a"}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$VT_RESIZEX(0xffffffffffffffff, 0x560a, &(0x7f0000000240)={0x6fc2, 0x7fff, 0x93de, 0x1, 0x80, 0x1}) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:55 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) [ 3051.585491][T24008] binder: 24006:24008 ioctl c0306201 0 returned -14 [ 3051.617793][T24014] binder: 24013:24014 unknown command 0 15:30:55 executing program 3: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000500)={0x14, 0x0, &(0x7f0000000280)=[@enter_looper, @clear_death={0x400c630f, 0x3}], 0x5b, 0x0, &(0x7f0000000480)="fe4aa8306ad888ceaecb02a21a4d520ed48a21d9ffd24199a2addbf302737c6c3a1aa863a16c5d8d10e13548dd97442f84b1fa07224018c91372729cb35aa2403c47ceaa7f627d987bdee45fd79181d4b081a07a9f56cd52a83d0a"}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$VT_RESIZEX(0xffffffffffffffff, 0x560a, &(0x7f0000000240)={0x6fc2, 0x7fff, 0x93de, 0x1, 0x80, 0x1}) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:55 executing program 2: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000500)={0x14, 0x0, &(0x7f0000000280)=[@enter_looper, @clear_death={0x400c630f, 0x3}], 0x5b, 0x0, &(0x7f0000000480)="fe4aa8306ad888ceaecb02a21a4d520ed48a21d9ffd24199a2addbf302737c6c3a1aa863a16c5d8d10e13548dd97442f84b1fa07224018c91372729cb35aa2403c47ceaa7f627d987bdee45fd79181d4b081a07a9f56cd52a83d0a"}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$VT_RESIZEX(0xffffffffffffffff, 0x560a, &(0x7f0000000240)={0x6fc2, 0x7fff, 0x93de, 0x1, 0x80, 0x1}) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) ioctl$KDGKBMODE(0xffffffffffffffff, 0x4b44, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x20, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="106308400019b200ecffffff00000863104001000000000000000000000000000000061f6a7dd2c66a9efb28c46881bf033a832471b1f23263eee1348779ce115cda51231288d7f1d2ab5b175b1663bd93bee331c9b817048e679d8dc0abfdea0866896a32640eeecaa359381afaa653a67a244103a6259bb5cfd6"], 0x45, 0x0, &(0x7f00000000c0)="e7907848adcd111a161266dd08268c0255193b9a62e88bb88ac1fd70f785010342549fe93e2748232fd1e22ecaeaabdbdc769a5294459aa737c8ee4ee1209e154ed6b8af35"}) [ 3051.629691][T24014] binder: 24013:24014 ioctl c0306201 20000440 returned -22 [ 3051.694510][T24017] binder: 24016:24017 ioctl c0306201 0 returned -14 [ 3051.708175][T24019] binder: 24018:24019 ioctl c0306201 0 returned -14 [ 3051.710603][T24017] binder: 24016:24017 unknown command 1661468672 [ 3051.721930][T24017] binder: 24016:24017 ioctl c0306201 20000140 returned -22 15:30:56 executing program 0: pipe2$9p(&(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) r0 = eventfd(0x10001) r1 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x8080, 0x0) syz_open_pts(r1, 0x80) write$eventfd(r0, &(0x7f0000000040)=0x7fffffff, 0x8) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280)={r3, r4+60000000}, &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:30:56 executing program 4: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000500)={0x14, 0x0, &(0x7f0000000280)=[@enter_looper, @clear_death={0x400c630f, 0x3}], 0x5b, 0x0, &(0x7f0000000480)="fe4aa8306ad888ceaecb02a21a4d520ed48a21d9ffd24199a2addbf302737c6c3a1aa863a16c5d8d10e13548dd97442f84b1fa07224018c91372729cb35aa2403c47ceaa7f627d987bdee45fd79181d4b081a07a9f56cd52a83d0a"}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$VT_RESIZEX(0xffffffffffffffff, 0x560a, &(0x7f0000000240)={0x6fc2, 0x7fff, 0x93de, 0x1, 0x80, 0x1}) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) ioctl$KDGKBMODE(0xffffffffffffffff, 0x4b44, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x20, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="106308400019b200ecffffff00000863104001000000000000000000000000000000061f6a7dd2c66a9efb28c46881bf033a832471b1f23263eee1348779ce115cda51231288d7f1d2ab5b175b1663bd93bee331c9b817048e679d8dc0abfdea0866896a32640eeecaa359381afaa653a67a244103a6259bb5cfd6"], 0x45, 0x0, &(0x7f00000000c0)="e7907848adcd111a161266dd08268c0255193b9a62e88bb88ac1fd70f785010342549fe93e2748232fd1e22ecaeaabdbdc769a5294459aa737c8ee4ee1209e154ed6b8af35"}) 15:30:56 executing program 1: socketpair(0x0, 0x3, 0x4, &(0x7f00000002c0)) 15:30:56 executing program 3: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000500)={0x14, 0x0, &(0x7f0000000280)=[@enter_looper, @clear_death={0x400c630f, 0x3}], 0x5b, 0x0, &(0x7f0000000480)="fe4aa8306ad888ceaecb02a21a4d520ed48a21d9ffd24199a2addbf302737c6c3a1aa863a16c5d8d10e13548dd97442f84b1fa07224018c91372729cb35aa2403c47ceaa7f627d987bdee45fd79181d4b081a07a9f56cd52a83d0a"}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:56 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="f1"], 0x0, 0x0, 0x0}) 15:30:56 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) ioctl$ASHMEM_GET_NAME(0xffffffffffffffff, 0x81007702, &(0x7f0000000040)) [ 3052.408436][T24026] binder: 24023:24026 ioctl c0306201 0 returned -14 [ 3052.411929][T24029] binder: 24022:24029 unknown command 241 [ 3052.422507][T24025] binder: 24024:24025 ioctl c0306201 0 returned -14 [ 3052.436521][T24033] binder: 24020:24033 ioctl c0306201 0 returned -14 [ 3052.445165][T24029] binder: 24022:24029 ioctl c0306201 20000440 returned -22 15:30:56 executing program 3: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000500)={0x14, 0x0, &(0x7f0000000280)=[@enter_looper, @clear_death={0x400c630f, 0x3}], 0x5b, 0x0, &(0x7f0000000480)="fe4aa8306ad888ceaecb02a21a4d520ed48a21d9ffd24199a2addbf302737c6c3a1aa863a16c5d8d10e13548dd97442f84b1fa07224018c91372729cb35aa2403c47ceaa7f627d987bdee45fd79181d4b081a07a9f56cd52a83d0a"}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:56 executing program 1: socketpair(0x0, 0x3, 0x4, &(0x7f00000002c0)) [ 3052.459857][T24033] binder: 24020:24033 unknown command 1661468672 [ 3052.472209][T24033] binder: 24020:24033 ioctl c0306201 20000140 returned -22 15:30:56 executing program 2: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000500)={0x14, 0x0, &(0x7f0000000280)=[@enter_looper, @clear_death={0x400c630f, 0x3}], 0x5b, 0x0, &(0x7f0000000480)="fe4aa8306ad888ceaecb02a21a4d520ed48a21d9ffd24199a2addbf302737c6c3a1aa863a16c5d8d10e13548dd97442f84b1fa07224018c91372729cb35aa2403c47ceaa7f627d987bdee45fd79181d4b081a07a9f56cd52a83d0a"}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:56 executing program 4: r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TCGETA(r0, 0x540b, &(0x7f00000000c0)) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x1c, 0x0, 0x4, 0x70bd2a, 0x25dfdbff, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40400c4}, 0x20000000) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000580), r1) sendmsg$BATADV_CMD_TP_METER(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x34, r2, 0x100, 0x70bd2d, 0x25dfdbfb, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8000}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x6}]}, 0x34}, 0x1, 0x0, 0x0, 0x4040}, 0x8010) socketpair(0xa, 0x3, 0x4, &(0x7f00000002c0)) 15:30:56 executing program 3: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000500)={0x14, 0x0, &(0x7f0000000280)=[@enter_looper, @clear_death={0x400c630f, 0x3}], 0x5b, 0x0, &(0x7f0000000480)="fe4aa8306ad888ceaecb02a21a4d520ed48a21d9ffd24199a2addbf302737c6c3a1aa863a16c5d8d10e13548dd97442f84b1fa07224018c91372729cb35aa2403c47ceaa7f627d987bdee45fd79181d4b081a07a9f56cd52a83d0a"}) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:56 executing program 3: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000500)={0x14, 0x0, &(0x7f0000000280)=[@enter_looper, @clear_death={0x400c630f, 0x3}], 0x5b, 0x0, &(0x7f0000000480)="fe4aa8306ad888ceaecb02a21a4d520ed48a21d9ffd24199a2addbf302737c6c3a1aa863a16c5d8d10e13548dd97442f84b1fa07224018c91372729cb35aa2403c47ceaa7f627d987bdee45fd79181d4b081a07a9f56cd52a83d0a"}) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) [ 3052.608977][T24042] binder: 24040:24042 ioctl c0306201 0 returned -14 15:30:57 executing program 0: pipe2$9p(&(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) r0 = eventfd(0x10001) r1 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x8080, 0x0) syz_open_pts(r1, 0x80) write$eventfd(r0, &(0x7f0000000040)=0x7fffffff, 0x8) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, 0x0) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:30:57 executing program 4: r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TCGETA(r0, 0x540b, &(0x7f00000000c0)) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x1c, 0x0, 0x4, 0x70bd2a, 0x25dfdbff, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40400c4}, 0x20000000) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000580), r1) sendmsg$BATADV_CMD_TP_METER(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x34, r2, 0x100, 0x70bd2d, 0x25dfdbfb, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8000}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x6}]}, 0x34}, 0x1, 0x0, 0x0, 0x4040}, 0x8010) socketpair(0xa, 0x3, 0x4, &(0x7f00000002c0)) 15:30:57 executing program 1: socketpair(0x0, 0x3, 0x4, &(0x7f00000002c0)) 15:30:57 executing program 2: r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TCGETA(r0, 0x540b, &(0x7f00000000c0)) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x1c, 0x0, 0x4, 0x70bd2a, 0x25dfdbff, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40400c4}, 0x20000000) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000580), r1) sendmsg$BATADV_CMD_TP_METER(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x34, r2, 0x100, 0x70bd2d, 0x25dfdbfb, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8000}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x6}]}, 0x34}, 0x1, 0x0, 0x0, 0x4040}, 0x8010) socketpair(0xa, 0x3, 0x4, &(0x7f00000002c0)) 15:30:57 executing program 3: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000500)={0x14, 0x0, &(0x7f0000000280)=[@enter_looper, @clear_death={0x400c630f, 0x3}], 0x5b, 0x0, &(0x7f0000000480)="fe4aa8306ad888ceaecb02a21a4d520ed48a21d9ffd24199a2addbf302737c6c3a1aa863a16c5d8d10e13548dd97442f84b1fa07224018c91372729cb35aa2403c47ceaa7f627d987bdee45fd79181d4b081a07a9f56cd52a83d0a"}) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:57 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) ioctl$ASHMEM_GET_NAME(0xffffffffffffffff, 0x81007702, &(0x7f0000000040)) 15:30:57 executing program 3: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:57 executing program 2: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x28001) ioctl$LOOP_SET_STATUS(r0, 0x4c02, 0x0) [ 3053.338133][T24060] binder: 24058:24060 ioctl c0306201 0 returned -14 15:30:57 executing program 4: r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TCGETA(r0, 0x540b, &(0x7f00000000c0)) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x1c, 0x0, 0x4, 0x70bd2a, 0x25dfdbff, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40400c4}, 0x20000000) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000580), r1) sendmsg$BATADV_CMD_TP_METER(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x34, r2, 0x100, 0x70bd2d, 0x25dfdbfb, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8000}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x6}]}, 0x34}, 0x1, 0x0, 0x0, 0x4040}, 0x8010) socketpair(0xa, 0x3, 0x4, &(0x7f00000002c0)) 15:30:57 executing program 1: socketpair(0xa, 0x0, 0x4, &(0x7f00000002c0)) 15:30:57 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) ioctl$TCSETSF(r1, 0x5404, &(0x7f0000000040)={0x4, 0x10001, 0x5, 0x400, 0x17, "0bc5d400be0db4484ffcaaa23f84412b04bc8a"}) 15:30:57 executing program 3: openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) [ 3053.494273][T24075] binder: 24070:24075 ioctl c0306201 0 returned -14 15:30:57 executing program 0: pipe2$9p(&(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) r0 = eventfd(0x10001) r1 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x8080, 0x0) syz_open_pts(r1, 0x80) write$eventfd(r0, &(0x7f0000000040)=0x7fffffff, 0x8) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:30:57 executing program 2: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x28001) ioctl$LOOP_SET_STATUS(r0, 0x4c02, 0x0) 15:30:57 executing program 4: r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TCGETA(r0, 0x540b, &(0x7f00000000c0)) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x1c, 0x0, 0x4, 0x70bd2a, 0x25dfdbff, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40400c4}, 0x20000000) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000580), r1) socketpair(0xa, 0x3, 0x4, &(0x7f00000002c0)) 15:30:57 executing program 3: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:57 executing program 1: socketpair(0xa, 0x0, 0x4, &(0x7f00000002c0)) 15:30:57 executing program 3: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:58 executing program 2: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x28001) ioctl$LOOP_SET_STATUS(r0, 0x4c02, 0x0) 15:30:58 executing program 4: r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TCGETA(r0, 0x540b, &(0x7f00000000c0)) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x1c, 0x0, 0x4, 0x70bd2a, 0x25dfdbff, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40400c4}, 0x20000000) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) socketpair(0xa, 0x3, 0x4, &(0x7f00000002c0)) 15:30:58 executing program 2: ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) 15:30:58 executing program 1: socketpair(0xa, 0x0, 0x4, &(0x7f00000002c0)) 15:30:58 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) (async) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) (async, rerun: 32) ioctl$TCSETSF(r1, 0x5404, &(0x7f0000000040)={0x4, 0x10001, 0x5, 0x400, 0x17, "0bc5d400be0db4484ffcaaa23f84412b04bc8a"}) (rerun: 32) 15:30:58 executing program 4: r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TCGETA(r0, 0x540b, &(0x7f00000000c0)) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x1c, 0x0, 0x4, 0x70bd2a, 0x25dfdbff, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40400c4}, 0x20000000) socketpair(0xa, 0x3, 0x4, &(0x7f00000002c0)) [ 3054.390009][T24104] binder: 24103:24104 ioctl c0306201 0 returned -14 15:30:58 executing program 0: pipe2$9p(&(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) r0 = eventfd(0x10001) r1 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x8080, 0x0) syz_open_pts(r1, 0x80) write$eventfd(r0, &(0x7f0000000040)=0x7fffffff, 0x8) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:30:58 executing program 3: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:58 executing program 2: ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) 15:30:58 executing program 4: r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TCGETA(r0, 0x540b, &(0x7f00000000c0)) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) socketpair(0xa, 0x3, 0x4, &(0x7f00000002c0)) 15:30:58 executing program 1: socketpair(0xa, 0x3, 0x0, &(0x7f00000002c0)) 15:30:58 executing program 3: openat$vcs(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:58 executing program 2: ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) 15:30:58 executing program 4: r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TCGETA(r0, 0x540b, &(0x7f00000000c0)) socketpair(0xa, 0x3, 0x4, &(0x7f00000002c0)) 15:30:59 executing program 4: openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) socketpair(0xa, 0x3, 0x4, &(0x7f00000002c0)) 15:30:59 executing program 3: openat$vcs(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:59 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) (async) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) ioctl$TCSETSF(r1, 0x5404, &(0x7f0000000040)={0x4, 0x10001, 0x5, 0x400, 0x17, "0bc5d400be0db4484ffcaaa23f84412b04bc8a"}) 15:30:59 executing program 2: r0 = syz_open_dev$loop(0x0, 0x0, 0x28001) ioctl$LOOP_SET_STATUS(r0, 0x4c02, 0x0) [ 3055.305707][T24133] binder: 24131:24133 ioctl c0306201 0 returned -14 15:30:59 executing program 0: pipe2$9p(&(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) r0 = eventfd(0x10001) r1 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x8080, 0x0) syz_open_pts(r1, 0x80) write$eventfd(r0, &(0x7f0000000040)=0x7fffffff, 0x8) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:30:59 executing program 1: socketpair(0xa, 0x3, 0x0, &(0x7f00000002c0)) 15:30:59 executing program 4: socketpair(0xa, 0x3, 0x4, &(0x7f00000002c0)) 15:30:59 executing program 3: openat$vcs(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:59 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) syz_open_dev$ptys(0xc, 0x3, 0x1) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) 15:30:59 executing program 2: r0 = syz_open_dev$loop(0x0, 0x0, 0x28001) ioctl$LOOP_SET_STATUS(r0, 0x4c02, 0x0) [ 3055.992173][T24143] binder: 24142:24143 ioctl c0306201 0 returned -14 15:30:59 executing program 3: openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:59 executing program 2: r0 = syz_open_dev$loop(0x0, 0x0, 0x28001) ioctl$LOOP_SET_STATUS(r0, 0x4c02, 0x0) 15:30:59 executing program 4: socketpair(0x0, 0x3, 0x4, &(0x7f00000002c0)) 15:30:59 executing program 2: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_STATUS(r0, 0x4c02, 0x0) 15:30:59 executing program 3: openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:30:59 executing program 1: socketpair(0xa, 0x3, 0x0, &(0x7f00000002c0)) 15:31:00 executing program 0: pipe2$9p(&(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) r0 = eventfd(0x10001) r1 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x8080, 0x0) syz_open_pts(r1, 0x80) write$eventfd(r0, &(0x7f0000000040)=0x7fffffff, 0x8) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:31:00 executing program 2: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_STATUS(r0, 0x4c02, 0x0) 15:31:00 executing program 4: socketpair(0x0, 0x3, 0x4, &(0x7f00000002c0)) 15:31:00 executing program 3: openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:31:00 executing program 1: socketpair(0xa, 0x3, 0x4, 0x0) 15:31:00 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) syz_open_dev$ptys(0xc, 0x3, 0x1) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) (async) bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) syz_open_dev$ptys(0xc, 0x3, 0x1) (async) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) (async) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) (async) 15:31:00 executing program 1: socketpair(0xa, 0x3, 0x4, 0x0) 15:31:00 executing program 2: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_STATUS(r0, 0x4c02, 0x0) [ 3056.907433][T24179] binder: 24173:24179 ioctl c0306201 0 returned -14 15:31:00 executing program 3: openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x0, 0x0, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:31:00 executing program 4: socketpair(0x0, 0x3, 0x4, &(0x7f00000002c0)) 15:31:00 executing program 1: socketpair(0xa, 0x3, 0x4, 0x0) [ 3057.007716][T24189] binder: 24173:24189 ioctl c0306201 0 returned -14 15:31:00 executing program 2: syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x28001) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) 15:31:01 executing program 0: pipe2$9p(&(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) eventfd(0x10001) r0 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x8080, 0x0) syz_open_pts(r0, 0x80) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:31:01 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r1 = bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) syz_open_dev$ptys(0xc, 0x3, 0x1) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) (async) bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) syz_open_dev$ptys(0xc, 0x3, 0x1) (async) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) (async) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) (async) 15:31:01 executing program 1: openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) socketpair(0xa, 0x3, 0x4, &(0x7f00000002c0)) 15:31:01 executing program 2: syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x28001) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) 15:31:01 executing program 4: socketpair(0xa, 0x0, 0x4, &(0x7f00000002c0)) 15:31:01 executing program 1: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) [ 3057.785248][T24208] binder: 24207:24208 ioctl c0306201 0 returned -14 15:31:01 executing program 2: syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x28001) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) 15:31:01 executing program 3: openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x0, 0x0, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:31:01 executing program 1: openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x0, 0x0, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) [ 3057.884489][T24217] binder: 24207:24217 ioctl c0306201 0 returned -14 15:31:01 executing program 4: socketpair(0xa, 0x0, 0x4, &(0x7f00000002c0)) 15:31:01 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000040), 0x800, 0x0) ioctl$TIOCCBRK(r1, 0x5428) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/binder1\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="04000000"], 0xdd, 0x0, &(0x7f0000000240)="c8272f8a48208a3c0282e61aad113fda485f486de52e2eb4a68578ec94ab81c25d2776968c5109a9da1a4ee88e636640e0e6388c64139f4fefe39fc929d71210145acf3c5396f5c148d84725bb8433e11d7c8d906488cdb862058d4c8b3541e46bad7f698741dc6fd80706ecd9304fac9df905572a8b56596fd81afe57fb580cb2de191b17091b04bd869d926b199af2d7061c4e663e43e58b7b9233da74f7ba7cc3c68f357ae7280d03a2c66d1ae1aa82efa58d54772a87a47d67f5dd3da6330918c56c0aee10b27ac1596738dd6e403d0eac5f7ade59ae82f53a254c"}) [ 3057.983012][T24229] binder: 24228:24229 ioctl c0306201 0 returned -14 15:31:01 executing program 4: socketpair(0xa, 0x0, 0x4, &(0x7f00000002c0)) [ 3058.048329][T24234] binder: 24228:24234 unknown command 4 [ 3058.055880][T24234] binder: 24228:24234 ioctl c0306201 20000140 returned -22 15:31:02 executing program 0: pipe2$9p(&(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) eventfd(0x10001) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x8080, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:31:02 executing program 4: socketpair(0xa, 0x3, 0x0, &(0x7f00000002c0)) 15:31:02 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:31:02 executing program 3: openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x0, 0x0, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) [ 3058.725361][T24242] binder: 24241:24242 ioctl c0306201 0 returned -14 15:31:02 executing program 1: openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x0, 0x0, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:31:02 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000040), 0x800, 0x0) ioctl$TIOCCBRK(r1, 0x5428) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/binder1\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="04000000"], 0xdd, 0x0, &(0x7f0000000240)="c8272f8a48208a3c0282e61aad113fda485f486de52e2eb4a68578ec94ab81c25d2776968c5109a9da1a4ee88e636640e0e6388c64139f4fefe39fc929d71210145acf3c5396f5c148d84725bb8433e11d7c8d906488cdb862058d4c8b3541e46bad7f698741dc6fd80706ecd9304fac9df905572a8b56596fd81afe57fb580cb2de191b17091b04bd869d926b199af2d7061c4e663e43e58b7b9233da74f7ba7cc3c68f357ae7280d03a2c66d1ae1aa82efa58d54772a87a47d67f5dd3da6330918c56c0aee10b27ac1596738dd6e403d0eac5f7ade59ae82f53a254c"}) 15:31:02 executing program 4: socketpair(0xa, 0x3, 0x0, &(0x7f00000002c0)) [ 3058.863187][T24253] binder: 24252:24253 ioctl c0306201 0 returned -14 15:31:02 executing program 4: socketpair(0xa, 0x3, 0x0, &(0x7f00000002c0)) [ 3058.933655][T24258] binder: 24252:24258 unknown command 4 [ 3058.939297][T24258] binder: 24252:24258 ioctl c0306201 20000140 returned -22 15:31:02 executing program 4: socketpair(0xa, 0x3, 0x4, 0x0) 15:31:02 executing program 4: socketpair(0xa, 0x3, 0x4, 0x0) 15:31:02 executing program 4: socketpair(0xa, 0x3, 0x4, 0x0) 15:31:02 executing program 4: socketpair(0xa, 0x3, 0x0, &(0x7f00000002c0)) 15:31:03 executing program 0: pipe2$9p(&(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) eventfd(0x10001) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:31:03 executing program 4: r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x10001, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pipe2$9p(&(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:31:03 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:31:03 executing program 3: openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, 0x0, 0x0, 0x0) [ 3059.605999][T24277] binder: 24276:24277 ioctl c0306201 0 returned -14 15:31:03 executing program 1: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:31:03 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000040), 0x800, 0x0) ioctl$TIOCCBRK(r1, 0x5428) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/binder1\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="04000000"], 0xdd, 0x0, &(0x7f0000000240)="c8272f8a48208a3c0282e61aad113fda485f486de52e2eb4a68578ec94ab81c25d2776968c5109a9da1a4ee88e636640e0e6388c64139f4fefe39fc929d71210145acf3c5396f5c148d84725bb8433e11d7c8d906488cdb862058d4c8b3541e46bad7f698741dc6fd80706ecd9304fac9df905572a8b56596fd81afe57fb580cb2de191b17091b04bd869d926b199af2d7061c4e663e43e58b7b9233da74f7ba7cc3c68f357ae7280d03a2c66d1ae1aa82efa58d54772a87a47d67f5dd3da6330918c56c0aee10b27ac1596738dd6e403d0eac5f7ade59ae82f53a254c"}) [ 3059.711980][T24283] binder: 24282:24283 ioctl c0306201 0 returned -14 [ 3059.730329][T24285] binder: 24284:24285 ioctl c0306201 0 returned -14 [ 3059.794637][T24286] binder: 24284:24286 unknown command 4 [ 3059.800362][T24286] binder: 24284:24286 ioctl c0306201 20000140 returned -22 15:31:04 executing program 4: r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x10001, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pipe2$9p(&(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:31:04 executing program 0: pipe2$9p(&(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) eventfd(0x10001) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:31:04 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:31:04 executing program 3: openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, 0x0, 0x0, 0x0) [ 3060.488319][T24292] binder: 24290:24292 ioctl c0306201 0 returned -14 15:31:04 executing program 1: r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x10001, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pipe2$9p(&(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:31:04 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000040), 0x800, 0x0) ioctl$TIOCCBRK(r1, 0x5428) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/binder1\x00', 0x2, 0x0) [ 3060.592079][T24300] binder: 24299:24300 ioctl c0306201 0 returned -14 15:31:05 executing program 4: r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x10001, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pipe2$9p(&(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:31:05 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r2 = syz_open_pts(r1, 0x180200) ioctl$TIOCCBRK(r2, 0x5428) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:31:05 executing program 0: pipe2$9p(&(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) eventfd(0x10001) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:31:05 executing program 3: openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, 0x0, 0x0, 0x0) 15:31:05 executing program 1: pipe2$9p(&(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) eventfd(0x10001) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:31:05 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000040), 0x800, 0x0) ioctl$TIOCCBRK(r1, 0x5428) openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/binder1\x00', 0x2, 0x0) [ 3061.388347][T24307] binder: 24304:24307 ioctl c0306201 0 returned -14 15:31:05 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000040), 0x800, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/binder1\x00', 0x2, 0x0) 15:31:05 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/binder1\x00', 0x2, 0x0) [ 3061.457797][T24314] binder: 24313:24314 ioctl c0306201 0 returned -14 [ 3061.496456][T24317] binder: 24315:24317 ioctl c0306201 0 returned -14 15:31:05 executing program 2: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/binder1\x00', 0x2, 0x0) 15:31:05 executing program 2: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/binder1\x00', 0x2, 0x0) [ 3061.534869][T24319] binder: 24318:24319 ioctl c0306201 0 returned -14 [ 3061.572199][T24321] binder: 24320:24321 ioctl c0306201 0 returned -14 15:31:05 executing program 2: openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/binder1\x00', 0x2, 0x0) 15:31:05 executing program 2: openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/binder1\x00', 0x2, 0x0) 15:31:05 executing program 4: r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x10001, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:31:06 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r2 = syz_open_pts(r1, 0x180200) ioctl$TIOCCBRK(r2, 0x5428) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) syz_open_pts(r1, 0x180200) (async) ioctl$TIOCCBRK(r2, 0x5428) (async) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) (async) 15:31:06 executing program 0: pipe2$9p(&(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x8080, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:31:06 executing program 3: openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200), 0x0, 0x0) 15:31:06 executing program 1: r0 = syz_open_dev$loop(0x0, 0x41, 0x28001) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000080)={0x0, {}, 0x0, {}, 0x3, 0x3, 0x16, 0x8, "fb190a466974d8b2a04acef05275a36447ed983c4632657ed726720be5270683723d857c0a7c85faf783882f71637343eecb5d435ed062cc25260286ea21f2ac", "e1945a37076bee5d7698f2511bbc7166f7aff68e4c1cca470214454fe396e27b", [0x7ff, 0x1]}) 15:31:06 executing program 2: openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/binder1\x00', 0x2, 0x0) [ 3062.249737][T24331] binder: 24330:24331 ioctl c0306201 0 returned -14 15:31:06 executing program 2: openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/binder1\x00', 0x2, 0x0) 15:31:06 executing program 1: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000001a80)={0x1a, 0x7, 0x9}) r1 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r2 = gettid() sched_rr_get_interval(r2, &(0x7f0000000100)) r3 = gettid() sched_rr_get_interval(r3, &(0x7f0000000100)) syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0)=0x0, {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) r5 = syz_clone3(&(0x7f0000001680)={0x2491c4000, &(0x7f0000000480), &(0x7f00000004c0), &(0x7f0000000500), {0xc}, &(0x7f0000000540)=""/4096, 0x1000, &(0x7f0000001540)=""/243, &(0x7f0000001640)=[0x0], 0x1}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780)=0x0, {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) r7 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000001a40)={r7, r7}, 0x10) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r7, 0xc01064c2, 0x0) syz_clone3(&(0x7f00000019c0)={0x24000000, &(0x7f0000000000), &(0x7f0000000080), &(0x7f00000000c0), {0x1c}, &(0x7f0000000100)=""/183, 0xb7, &(0x7f00000001c0)=""/103, &(0x7f0000001980)=[0xffffffffffffffff, 0x0, r2, r3, r4, 0xffffffffffffffff, 0xffffffffffffffff, r5, r6], 0x9, {r7}}, 0x58) ioctl$LOOP_SET_FD(r1, 0x1263, 0xffffffffffffffff) [ 3062.320726][T24341] binder: 24330:24341 ioctl c0306201 0 returned -14 15:31:06 executing program 2: openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/binder1\x00', 0x2, 0x0) 15:31:06 executing program 2: openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/binder1\x00', 0x2, 0x0) 15:31:06 executing program 2: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x2, 0x0) 15:31:06 executing program 2: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x2, 0x0) 15:31:06 executing program 4: openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:31:06 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) (async) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r2 = syz_open_pts(r1, 0x180200) ioctl$TIOCCBRK(r2, 0x5428) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:31:06 executing program 0: pipe2$9p(&(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x8080, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:31:06 executing program 3: openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200), 0x0, 0x0) 15:31:06 executing program 2: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x2, 0x0) 15:31:06 executing program 1: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000001a80)={0x1a, 0x7, 0x9}) r1 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r2 = gettid() sched_rr_get_interval(r2, &(0x7f0000000100)) r3 = gettid() sched_rr_get_interval(r3, &(0x7f0000000100)) syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0)=0x0, {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) r5 = syz_clone3(&(0x7f0000001680)={0x2491c4000, &(0x7f0000000480), &(0x7f00000004c0), &(0x7f0000000500), {0xc}, &(0x7f0000000540)=""/4096, 0x1000, &(0x7f0000001540)=""/243, &(0x7f0000001640)=[0x0], 0x1}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780)=0x0, {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) r7 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000001a40)={r7, r7}, 0x10) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r7, 0xc01064c2, 0x0) syz_clone3(&(0x7f00000019c0)={0x24000000, &(0x7f0000000000), &(0x7f0000000080), &(0x7f00000000c0), {0x1c}, &(0x7f0000000100)=""/183, 0xb7, &(0x7f00000001c0)=""/103, &(0x7f0000001980)=[0xffffffffffffffff, 0x0, r2, r3, r4, 0xffffffffffffffff, 0xffffffffffffffff, r5, r6], 0x9, {r7}}, 0x58) ioctl$LOOP_SET_FD(r1, 0x1263, 0xffffffffffffffff) 15:31:06 executing program 4: openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) [ 3063.160885][T24363] binder: 24362:24363 ioctl c0306201 0 returned -14 15:31:07 executing program 2: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs/binder1\x00', 0x0, 0x0) 15:31:07 executing program 4: openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:31:07 executing program 2: r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x10001, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:31:07 executing program 4: ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, &(0x7f0000000080)={0x10001, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:31:07 executing program 4: ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, &(0x7f0000000080)={0x10001, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:31:07 executing program 4: ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, &(0x7f0000000080)={0x10001, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:31:07 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x8, 0x20000}, 0x0, &(0x7f0000000200)={0x1, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:31:07 executing program 4: r0 = openat$sw_sync(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x10001, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:31:07 executing program 3: openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200), 0x0, 0x0) 15:31:07 executing program 1: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000001a80)={0x1a, 0x7, 0x9}) r1 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r2 = gettid() sched_rr_get_interval(r2, &(0x7f0000000100)) r3 = gettid() sched_rr_get_interval(r3, &(0x7f0000000100)) syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0)=0x0, {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) r5 = syz_clone3(&(0x7f0000001680)={0x2491c4000, &(0x7f0000000480), &(0x7f00000004c0), &(0x7f0000000500), {0xc}, &(0x7f0000000540)=""/4096, 0x1000, &(0x7f0000001540)=""/243, &(0x7f0000001640)=[0x0], 0x1}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780)=0x0, {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) r7 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000001a40)={r7, r7}, 0x10) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r7, 0xc01064c2, 0x0) syz_clone3(&(0x7f00000019c0)={0x24000000, &(0x7f0000000000), &(0x7f0000000080), &(0x7f00000000c0), {0x1c}, &(0x7f0000000100)=""/183, 0xb7, &(0x7f00000001c0)=""/103, &(0x7f0000001980)=[0xffffffffffffffff, 0x0, r2, r3, r4, 0xffffffffffffffff, 0xffffffffffffffff, r5, r6], 0x9, {r7}}, 0x58) ioctl$LOOP_SET_FD(r1, 0x1263, 0xffffffffffffffff) 15:31:07 executing program 0: pipe2$9p(&(0x7f0000000000), 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x8080, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:31:07 executing program 4: r0 = openat$sw_sync(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x10001, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) [ 3064.072580][T24392] binder: 24391:24392 ioctl c0306201 0 returned -14 15:31:07 executing program 4: r0 = openat$sw_sync(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x10001, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:31:08 executing program 2: r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x10001, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:31:08 executing program 4: openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, &(0x7f0000000080)={0x10001, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:31:08 executing program 4: openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, &(0x7f0000000080)={0x10001, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:31:08 executing program 4: openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, &(0x7f0000000080)={0x10001, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:31:08 executing program 1: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000001a80)={0x1a, 0x7, 0x9}) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = gettid() sched_rr_get_interval(r1, &(0x7f0000000100)) r2 = gettid() sched_rr_get_interval(r2, &(0x7f0000000100)) syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0)=0x0, {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) r4 = syz_clone3(&(0x7f0000001680)={0x2491c4000, &(0x7f0000000480), &(0x7f00000004c0), &(0x7f0000000500), {0xc}, &(0x7f0000000540)=""/4096, 0x1000, &(0x7f0000001540)=""/243, &(0x7f0000001640)=[0x0], 0x1}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780)=0x0, {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) r6 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000001a40)={r6, r6}, 0x10) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r6, 0xc01064c2, 0x0) syz_clone3(&(0x7f00000019c0)={0x24000000, &(0x7f0000000000), &(0x7f0000000080), &(0x7f00000000c0), {0x1c}, &(0x7f0000000100)=""/183, 0xb7, &(0x7f00000001c0)=""/103, &(0x7f0000001980)=[0xffffffffffffffff, 0x0, r1, r2, r3, 0xffffffffffffffff, 0xffffffffffffffff, r4, r5], 0x9, {r6}}, 0x58) 15:31:08 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x8, 0x20000}, 0x0, &(0x7f0000000200)={0x1, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:31:08 executing program 4: r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, 0x0) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:31:08 executing program 0: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x10001) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x8080, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:31:08 executing program 1: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000001a80)={0x1a, 0x7, 0x9}) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = gettid() sched_rr_get_interval(r1, &(0x7f0000000100)) r2 = gettid() sched_rr_get_interval(r2, &(0x7f0000000100)) syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001680)={0x2491c4000, &(0x7f0000000480), &(0x7f00000004c0), &(0x7f0000000500), {0xc}, &(0x7f0000000540)=""/4096, 0x1000, &(0x7f0000001540)=""/243, &(0x7f0000001640)=[0x0], 0x1}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000001a40)={r3, r3}, 0x10) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) 15:31:08 executing program 3: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000001a80)={0x1a, 0x7, 0x9}) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = gettid() sched_rr_get_interval(r1, &(0x7f0000000100)) r2 = gettid() sched_rr_get_interval(r2, &(0x7f0000000100)) syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0)=0x0, {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) r4 = syz_clone3(&(0x7f0000001680)={0x2491c4000, &(0x7f0000000480), &(0x7f00000004c0), &(0x7f0000000500), {0xc}, &(0x7f0000000540)=""/4096, 0x1000, &(0x7f0000001540)=""/243, &(0x7f0000001640)=[0x0], 0x1}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780)=0x0, {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) r6 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000001a40)={r6, r6}, 0x10) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r6, 0xc01064c2, 0x0) syz_clone3(&(0x7f00000019c0)={0x24000000, &(0x7f0000000000), &(0x7f0000000080), &(0x7f00000000c0), {0x1c}, &(0x7f0000000100)=""/183, 0xb7, &(0x7f00000001c0)=""/103, &(0x7f0000001980)=[0xffffffffffffffff, 0x0, r1, r2, r3, 0xffffffffffffffff, 0xffffffffffffffff, r4, r5], 0x9, {r6}}, 0x58) 15:31:08 executing program 4: r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, 0x0) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) [ 3064.952101][T24421] binder: 24420:24421 ioctl c0306201 0 returned -14 15:31:08 executing program 0: eventfd(0x10001) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x8080, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:31:08 executing program 2: r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x10001, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:31:08 executing program 4: r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, 0x0) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:31:08 executing program 0: eventfd(0x10001) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x8080, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:31:09 executing program 4: r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x0, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:31:09 executing program 0: eventfd(0x10001) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x8080, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:31:09 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x8, 0x20000}, 0x0, &(0x7f0000000200)={0x1, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x7}, 0x0, 0x0) 15:31:09 executing program 0: pipe2$9p(0x0, 0x0) eventfd(0x10001) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x8080, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:31:09 executing program 1: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000001a80)={0x1a, 0x7, 0x9}) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = gettid() sched_rr_get_interval(r1, &(0x7f0000000100)) r2 = gettid() sched_rr_get_interval(r2, &(0x7f0000000100)) syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001680)={0x2491c4000, &(0x7f0000000480), &(0x7f00000004c0), &(0x7f0000000500), {0xc}, &(0x7f0000000540)=""/4096, 0x1000, &(0x7f0000001540)=""/243, &(0x7f0000001640)=[0x0], 0x1}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000001a40)={r3, r3}, 0x10) 15:31:09 executing program 3: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000001a80)={0x1a, 0x7, 0x9}) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = gettid() sched_rr_get_interval(r1, &(0x7f0000000100)) r2 = gettid() sched_rr_get_interval(r2, &(0x7f0000000100)) syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001680)={0x2491c4000, &(0x7f0000000480), &(0x7f00000004c0), &(0x7f0000000500), {0xc}, &(0x7f0000000540)=""/4096, 0x1000, &(0x7f0000001540)=""/243, &(0x7f0000001640)=[0x0], 0x1}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000001a40)={r3, r3}, 0x10) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) 15:31:09 executing program 0: pipe2$9p(0x0, 0x0) eventfd(0x10001) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x8080, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) [ 3065.858835][T24461] binder: 24460:24461 ioctl c0306201 0 returned -14 15:31:09 executing program 0: pipe2$9p(0x0, 0x0) eventfd(0x10001) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x8080, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:31:09 executing program 0: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x8080, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:31:09 executing program 2: openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:31:09 executing program 0: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x8080, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:31:09 executing program 4: r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x0, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:31:09 executing program 2: openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:31:09 executing program 3: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000001a80)={0x1a, 0x7, 0x9}) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = gettid() sched_rr_get_interval(r1, &(0x7f0000000100)) r2 = gettid() sched_rr_get_interval(r2, &(0x7f0000000100)) syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001680)={0x2491c4000, &(0x7f0000000480), &(0x7f00000004c0), &(0x7f0000000500), {0xc}, &(0x7f0000000540)=""/4096, 0x1000, &(0x7f0000001540)=""/243, &(0x7f0000001640)=[0x0], 0x1}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000001a40)={r3, r3}, 0x10) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) 15:31:10 executing program 5: getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000040), &(0x7f00000000c0)=0x4) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) write$RDMA_USER_CM_CMD_NOTIFY(0xffffffffffffffff, &(0x7f0000000100)={0xf, 0x8, 0xfa00, {0xffffffffffffffff, 0x5}}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000000140)=[@acquire_done], 0x77, 0x0, &(0x7f0000000240)="c52479ca7053466200a9872c7c07ad8e600af36642f0d959a3b23ee33570c73b59db394cc17718e9fac67fafae67ce0595445b1bbc7a3dc1c10f7be5d227ca88eba4b5e351f223be0b4784f66956d922f51ad69f52340ec74a702cc1bf65a9e6050cfe40868dc9c148319ac57d9467a78c11de9d49a9ad"}) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x220d00, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:31:10 executing program 1: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000001a80)={0x1a, 0x7, 0x9}) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = gettid() sched_rr_get_interval(r1, &(0x7f0000000100)) r2 = gettid() sched_rr_get_interval(r2, &(0x7f0000000100)) syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001680)={0x2491c4000, &(0x7f0000000480), &(0x7f00000004c0), &(0x7f0000000500), {0xc}, &(0x7f0000000540)=""/4096, 0x1000, &(0x7f0000001540)=""/243, &(0x7f0000001640)=[0x0], 0x1}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) 15:31:10 executing program 0: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x8080, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:31:10 executing program 2: openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:31:10 executing program 3: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000001a80)={0x1a, 0x7, 0x9}) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = gettid() sched_rr_get_interval(r1, &(0x7f0000000100)) r2 = gettid() sched_rr_get_interval(r2, &(0x7f0000000100)) syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001680)={0x2491c4000, &(0x7f0000000480), &(0x7f00000004c0), &(0x7f0000000500), {0xc}, &(0x7f0000000540)=""/4096, 0x1000, &(0x7f0000001540)=""/243, &(0x7f0000001640)=[0x0], 0x1}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000001a40)={r3, r3}, 0x10) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) 15:31:10 executing program 2: ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, &(0x7f0000000080)={0x10001, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:31:10 executing program 0: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x10001) openat$ttynull(0xffffffffffffff9c, 0x0, 0x8080, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) [ 3066.775966][T24494] binder: 24493:24494 ioctl c0306201 0 returned -14 15:31:10 executing program 2: ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, &(0x7f0000000080)={0x10001, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:31:10 executing program 0: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x10001) openat$ttynull(0xffffffffffffff9c, 0x0, 0x8080, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:31:10 executing program 4: r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x0, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:31:10 executing program 2: ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, &(0x7f0000000080)={0x10001, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:31:10 executing program 0: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x10001) openat$ttynull(0xffffffffffffff9c, 0x0, 0x8080, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:31:11 executing program 5: getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000040), &(0x7f00000000c0)=0x4) (async) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) write$RDMA_USER_CM_CMD_NOTIFY(0xffffffffffffffff, &(0x7f0000000100)={0xf, 0x8, 0xfa00, {0xffffffffffffffff, 0x5}}, 0x10) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000000140)=[@acquire_done], 0x77, 0x0, &(0x7f0000000240)="c52479ca7053466200a9872c7c07ad8e600af36642f0d959a3b23ee33570c73b59db394cc17718e9fac67fafae67ce0595445b1bbc7a3dc1c10f7be5d227ca88eba4b5e351f223be0b4784f66956d922f51ad69f52340ec74a702cc1bf65a9e6050cfe40868dc9c148319ac57d9467a78c11de9d49a9ad"}) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x220d00, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:31:11 executing program 1: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000001a80)={0x1a, 0x7, 0x9}) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = gettid() sched_rr_get_interval(r1, &(0x7f0000000100)) r2 = gettid() sched_rr_get_interval(r2, &(0x7f0000000100)) syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001680)={0x2491c4000, &(0x7f0000000480), &(0x7f00000004c0), &(0x7f0000000500), {0xc}, &(0x7f0000000540)=""/4096, 0x1000, &(0x7f0000001540)=""/243, &(0x7f0000001640)=[0x0], 0x1}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:11 executing program 0: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x10001) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:31:11 executing program 2: r0 = openat$sw_sync(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x10001, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:31:11 executing program 3: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000001a80)={0x1a, 0x7, 0x9}) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = gettid() sched_rr_get_interval(r1, &(0x7f0000000100)) r2 = gettid() sched_rr_get_interval(r2, &(0x7f0000000100)) syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001680)={0x2491c4000, &(0x7f0000000480), &(0x7f00000004c0), &(0x7f0000000500), {0xc}, &(0x7f0000000540)=""/4096, 0x1000, &(0x7f0000001540)=""/243, &(0x7f0000001640)=[0x0], 0x1}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000001a40)={r3, r3}, 0x10) 15:31:11 executing program 0: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x10001) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:31:11 executing program 2: r0 = openat$sw_sync(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x10001, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) [ 3067.717141][T24523] binder: 24522:24523 ioctl c0306201 0 returned -14 15:31:11 executing program 2: r0 = openat$sw_sync(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x10001, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:31:11 executing program 0: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x10001) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:31:11 executing program 5: getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000040), &(0x7f00000000c0)=0x4) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) write$RDMA_USER_CM_CMD_NOTIFY(0xffffffffffffffff, &(0x7f0000000100)={0xf, 0x8, 0xfa00, {0xffffffffffffffff, 0x5}}, 0x10) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000000140)=[@acquire_done], 0x77, 0x0, &(0x7f0000000240)="c52479ca7053466200a9872c7c07ad8e600af36642f0d959a3b23ee33570c73b59db394cc17718e9fac67fafae67ce0595445b1bbc7a3dc1c10f7be5d227ca88eba4b5e351f223be0b4784f66956d922f51ad69f52340ec74a702cc1bf65a9e6050cfe40868dc9c148319ac57d9467a78c11de9d49a9ad"}) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x220d00, 0x0) (async) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:31:11 executing program 4: r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x10001, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x0, 0x0, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:31:11 executing program 0: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x10001) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:31:11 executing program 2: openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, &(0x7f0000000080)={0x10001, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:31:11 executing program 1: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000001a80)={0x1a, 0x7, 0x9}) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = gettid() sched_rr_get_interval(r1, &(0x7f0000000100)) r2 = gettid() sched_rr_get_interval(r2, &(0x7f0000000100)) syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:11 executing program 0: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x10001) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x0, 0x0, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) [ 3068.032207][T24541] binder: 24540:24541 ioctl c0306201 0 returned -14 15:31:11 executing program 2: openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, &(0x7f0000000080)={0x10001, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:31:11 executing program 3: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000001a80)={0x1a, 0x7, 0x9}) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = gettid() sched_rr_get_interval(r1, &(0x7f0000000100)) r2 = gettid() sched_rr_get_interval(r2, &(0x7f0000000100)) syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001680)={0x2491c4000, &(0x7f0000000480), &(0x7f00000004c0), &(0x7f0000000500), {0xc}, &(0x7f0000000540)=""/4096, 0x1000, &(0x7f0000001540)=""/243, &(0x7f0000001640)=[0x0], 0x1}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) 15:31:11 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x8c180, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000040)) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:31:11 executing program 2: openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, &(0x7f0000000080)={0x10001, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:31:11 executing program 0: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x10001) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x0, 0x0, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) [ 3068.242786][T24560] binder: 24559:24560 ioctl c0306201 0 returned -14 15:31:12 executing program 2: r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, 0x0) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:31:12 executing program 0: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x10001) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x0, 0x0, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:31:12 executing program 4: r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x10001, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x0, 0x0, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:31:12 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x8c180, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000040)) (async) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:31:12 executing program 0: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x10001) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:31:12 executing program 2: r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, 0x0) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:31:12 executing program 1: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000001a80)={0x1a, 0x7, 0x9}) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = gettid() sched_rr_get_interval(r1, &(0x7f0000000100)) r2 = gettid() sched_rr_get_interval(r2, &(0x7f0000000100)) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:12 executing program 3: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000001a80)={0x1a, 0x7, 0x9}) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = gettid() sched_rr_get_interval(r1, &(0x7f0000000100)) r2 = gettid() sched_rr_get_interval(r2, &(0x7f0000000100)) syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001680)={0x2491c4000, &(0x7f0000000480), &(0x7f00000004c0), &(0x7f0000000500), {0xc}, &(0x7f0000000540)=""/4096, 0x1000, &(0x7f0000001540)=""/243, &(0x7f0000001640)=[0x0], 0x1}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) [ 3068.939583][T24581] binder: 24574:24581 ioctl c0306201 0 returned -14 15:31:12 executing program 2: r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, 0x0) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:31:12 executing program 0: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x10001) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:31:12 executing program 1: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000001a80)={0x1a, 0x7, 0x9}) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = gettid() sched_rr_get_interval(r1, &(0x7f0000000100)) r2 = gettid() sched_rr_get_interval(r2, &(0x7f0000000100)) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:12 executing program 2: r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x0, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:31:12 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x8c180, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000040)) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x8c180, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f0000000040)) (async) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) (async) 15:31:12 executing program 0: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x10001) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) [ 3069.164863][T24599] binder: 24598:24599 ioctl c0306201 0 returned -14 [ 3069.221888][T24602] binder: 24598:24602 ioctl c0306201 0 returned -14 15:31:13 executing program 1: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000001a80)={0x1a, 0x7, 0x9}) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = gettid() sched_rr_get_interval(r1, &(0x7f0000000100)) r2 = gettid() sched_rr_get_interval(r2, &(0x7f0000000100)) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:13 executing program 4: r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x10001, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x0, 0x0, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:31:13 executing program 0: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x10001) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:31:13 executing program 3: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000001a80)={0x1a, 0x7, 0x9}) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = gettid() sched_rr_get_interval(r1, &(0x7f0000000100)) r2 = gettid() sched_rr_get_interval(r2, &(0x7f0000000100)) syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:13 executing program 0: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x10001) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:31:13 executing program 0: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x10001) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:31:13 executing program 2: r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x0, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:31:13 executing program 1: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000001a80)={0x1a, 0x7, 0x9}) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = gettid() sched_rr_get_interval(r1, &(0x7f0000000100)) gettid() syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:13 executing program 5: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000001a80)={0x1a, 0x7, 0x9}) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = gettid() sched_rr_get_interval(r1, &(0x7f0000000100)) r2 = gettid() sched_rr_get_interval(r2, &(0x7f0000000100)) syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001680)={0x2491c4000, &(0x7f0000000480), &(0x7f00000004c0), &(0x7f0000000500), {0xc}, &(0x7f0000000540)=""/4096, 0x1000, &(0x7f0000001540)=""/243, &(0x7f0000001640)=[0x0], 0x1}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:13 executing program 0: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x10001) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:31:14 executing program 0: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x10001) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:31:14 executing program 0: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x10001) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, 0x0, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:31:14 executing program 3: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000001a80)={0x1a, 0x7, 0x9}) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = gettid() sched_rr_get_interval(r1, &(0x7f0000000100)) r2 = gettid() sched_rr_get_interval(r2, &(0x7f0000000100)) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:14 executing program 1: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000001a80)={0x1a, 0x7, 0x9}) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = gettid() sched_rr_get_interval(r1, &(0x7f0000000100)) syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:14 executing program 4: r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x10001, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:31:14 executing program 0: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x10001) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, 0x0, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:31:14 executing program 3: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000001a80)={0x1a, 0x7, 0x9}) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = gettid() sched_rr_get_interval(r1, &(0x7f0000000100)) r2 = gettid() sched_rr_get_interval(r2, &(0x7f0000000100)) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:14 executing program 5: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000001a80)={0x1a, 0x7, 0x9}) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = gettid() sched_rr_get_interval(r1, &(0x7f0000000100)) gettid() syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:14 executing program 2: r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x0, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:31:14 executing program 0: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x10001) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, 0x0, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:31:14 executing program 3: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000001a80)={0x1a, 0x7, 0x9}) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = gettid() sched_rr_get_interval(r1, &(0x7f0000000100)) r2 = gettid() sched_rr_get_interval(r2, &(0x7f0000000100)) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:14 executing program 0: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x10001) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000340)={0x0, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:31:14 executing program 0: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x10001) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000340)={0x0, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:31:14 executing program 3: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000001a80)={0x1a, 0x7, 0x9}) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = gettid() sched_rr_get_interval(r1, &(0x7f0000000100)) gettid() syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:14 executing program 1: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000001a80)={0x1a, 0x7, 0x9}) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) gettid() syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:15 executing program 0: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x10001) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000340)={0x0, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:31:15 executing program 0: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x10001) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000340)={0xa322, 0x0, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:31:15 executing program 4: r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x10001, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180), 0x0, 0x0, 0x0, 0x0) 15:31:15 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x10001) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, 0x0, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:31:15 executing program 1: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000001a80)={0x1a, 0x7, 0x9}) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:15 executing program 3: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000001a80)={0x1a, 0x7, 0x9}) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = gettid() sched_rr_get_interval(r1, &(0x7f0000000100)) syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:15 executing program 2: r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x10001, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x0, 0x0, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:31:15 executing program 0: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x10001) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000340)={0xa322, 0x0, 0x0, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:31:15 executing program 5: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000001a80)={0x1a, 0x7, 0x9}) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = gettid() sched_rr_get_interval(r1, &(0x7f0000000100)) gettid() syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:15 executing program 0: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x10001) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000340)={0xa322, 0x0, 0x0, 0x0, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:31:15 executing program 1: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000001a80)={0x1a, 0x7, 0x9}) syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:15 executing program 0: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x10001) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000340)={0xa322, 0x0, 0x0, 0x0, 0x0, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:31:15 executing program 0: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x10001) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000340)={0xa322, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:31:16 executing program 0: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x10001) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000340)={0xa322, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:31:16 executing program 5: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000001a80)={0x1a, 0x7, 0x9}) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = gettid() sched_rr_get_interval(r1, &(0x7f0000000100)) syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:16 executing program 4: r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x10001, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180), 0x0, 0x0, 0x0, 0x0) 15:31:16 executing program 1: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:16 executing program 3: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000001a80)={0x1a, 0x7, 0x9}) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) gettid() syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:16 executing program 2: r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x10001, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x0, 0x0, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:31:16 executing program 0: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x10001) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000340)={0xa322}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:31:16 executing program 0: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x10001) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000340)={0xa322}, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:31:16 executing program 3: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000001a80)={0x1a, 0x7, 0x9}) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:16 executing program 0: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x10001) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000340)={0xa322}, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:31:16 executing program 0: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x10001) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000340)={0xa322}, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:31:16 executing program 5: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000001a80)={0x1a, 0x7, 0x9}) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = gettid() sched_rr_get_interval(r1, &(0x7f0000000100)) syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:16 executing program 0: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x10001) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000340)={0xa322}, &(0x7f0000000280), 0x0) 15:31:16 executing program 1: openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:17 executing program 4: r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x10001, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180), 0x0, 0x0, 0x0, 0x0) 15:31:17 executing program 3: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000001a80)={0x1a, 0x7, 0x9}) syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:17 executing program 5: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000001a80)={0x1a, 0x7, 0x9}) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = gettid() sched_rr_get_interval(r1, &(0x7f0000000100)) syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:17 executing program 2: r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x10001, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x0, 0x0, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:31:17 executing program 1: syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:17 executing program 3: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:17 executing program 5: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000001a80)={0x1a, 0x7, 0x9}) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = gettid() sched_rr_get_interval(r1, &(0x7f0000000100)) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:17 executing program 5: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000001a80)={0x1a, 0x7, 0x9}) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = gettid() sched_rr_get_interval(r1, &(0x7f0000000100)) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:17 executing program 1: syz_clone3(0x0, 0x0) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:17 executing program 5: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000001a80)={0x1a, 0x7, 0x9}) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = gettid() sched_rr_get_interval(r1, &(0x7f0000000100)) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:17 executing program 1: syz_clone3(0x0, 0x0) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:18 executing program 3: openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:18 executing program 4: r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x10001, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200), 0x0, 0x0) 15:31:18 executing program 5: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000001a80)={0x1a, 0x7, 0x9}) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) gettid() syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:18 executing program 1: syz_clone3(0x0, 0x0) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:18 executing program 2: r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x10001, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:31:18 executing program 1: syz_clone3(&(0x7f0000000400)={0x0, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:18 executing program 3: syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:18 executing program 1: syz_clone3(&(0x7f0000000400)={0x0, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:18 executing program 5: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000001a80)={0x1a, 0x7, 0x9}) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:18 executing program 1: syz_clone3(&(0x7f0000000400)={0x0, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:18 executing program 3: syz_clone3(0x0, 0x0) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:18 executing program 3: syz_clone3(0x0, 0x0) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:18 executing program 1: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:19 executing program 4: r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x10001, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200), 0x0, 0x0) 15:31:19 executing program 3: syz_clone3(0x0, 0x0) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:19 executing program 5: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000001a80)={0x1a, 0x7, 0x9}) syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:19 executing program 2: r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x10001, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180), 0x0, 0x0, 0x0, 0x0) 15:31:19 executing program 3: syz_clone3(&(0x7f0000000400)={0x0, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:19 executing program 1: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:19 executing program 5: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:19 executing program 3: syz_clone3(&(0x7f0000000400)={0x0, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:19 executing program 3: syz_clone3(&(0x7f0000000400)={0x0, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:19 executing program 1: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:19 executing program 5: openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:19 executing program 3: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:20 executing program 4: r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x10001, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200), 0x0, 0x0) 15:31:20 executing program 1: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:20 executing program 2: r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x10001, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180), 0x0, 0x0, 0x0, 0x0) 15:31:20 executing program 0: r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x10001, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200), 0x0, 0x0) 15:31:20 executing program 5: syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:20 executing program 3: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:20 executing program 1: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:20 executing program 5: syz_clone3(0x0, 0x0) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:20 executing program 3: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:20 executing program 1: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:20 executing program 4: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:21 executing program 2: r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x10001, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180), 0x0, 0x0, 0x0, 0x0) 15:31:21 executing program 5: syz_clone3(0x0, 0x0) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:21 executing program 0: syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:21 executing program 5: syz_clone3(0x0, 0x0) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:21 executing program 3: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:21 executing program 1: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:21 executing program 5: syz_clone3(&(0x7f0000000400)={0x0, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:21 executing program 5: syz_clone3(&(0x7f0000000400)={0x0, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:21 executing program 4: syz_clone3(&(0x7f0000000400)={0x0, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:21 executing program 3: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:21 executing program 0: syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:21 executing program 5: syz_clone3(&(0x7f0000000400)={0x0, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:22 executing program 2: r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x10001, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200), 0x0, 0x0) 15:31:22 executing program 1: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(0x0, 0x0) 15:31:22 executing program 4: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:22 executing program 5: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:22 executing program 3: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:22 executing program 1: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(0x0, 0x0) 15:31:22 executing program 0: syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:22 executing program 4: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(0x0, 0x0) 15:31:22 executing program 5: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:22 executing program 2: r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x10001, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200), 0x0, 0x0) 15:31:23 executing program 1: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(0x0, 0x0) 15:31:23 executing program 3: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:23 executing program 5: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:23 executing program 0: syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:23 executing program 4: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:23 executing program 1: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:23 executing program 3: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(0x0, 0x0) 15:31:23 executing program 0: syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:23 executing program 0: syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:23 executing program 2: r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x10001, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200), 0x0, 0x0) 15:31:23 executing program 0: syz_clone3(0x0, 0x0) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:24 executing program 0: syz_clone3(0x0, 0x0) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:24 executing program 5: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:24 executing program 0: syz_clone3(0x0, 0x0) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:24 executing program 1: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:24 executing program 3: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(0x0, 0x0) 15:31:24 executing program 4: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(0x0, 0x0) 15:31:24 executing program 0: syz_clone3(&(0x7f0000000400)={0x0, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:24 executing program 0: syz_clone3(&(0x7f0000000400)={0x0, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:24 executing program 0: syz_clone3(&(0x7f0000000400)={0x0, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:24 executing program 2: r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x10001, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200), 0x0, 0x0) 15:31:24 executing program 1: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:24 executing program 4: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:24 executing program 3: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(0x0, 0x0) 15:31:24 executing program 5: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:24 executing program 0: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:25 executing program 3: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) [ 3081.662592][ T1224] ieee802154 phy0 wpan0: encryption failed: -22 [ 3081.668930][ T1224] ieee802154 phy1 wpan1: encryption failed: -22 15:31:25 executing program 1: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:25 executing program 0: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:25 executing program 5: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:25 executing program 4: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:25 executing program 2: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:26 executing program 3: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:26 executing program 1: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:26 executing program 0: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:26 executing program 5: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:26 executing program 4: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:26 executing program 2: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:26 executing program 3: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:26 executing program 5: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(0x0, 0x0) 15:31:26 executing program 1: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:26 executing program 0: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:27 executing program 1: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:27 executing program 3: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:27 executing program 5: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(0x0, 0x0) 15:31:27 executing program 4: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(0x0, 0x0) 15:31:27 executing program 2: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:27 executing program 4: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:27 executing program 1: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 15:31:27 executing program 3: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:28 executing program 5: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(0x0, 0x0) 15:31:28 executing program 2: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(0x0, 0x0) 15:31:28 executing program 1: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 15:31:30 executing program 0: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:30 executing program 2: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:30 executing program 4: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:30 executing program 5: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:30 executing program 3: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:30 executing program 1: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 15:31:31 executing program 5: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:31 executing program 1: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0], 0x7}, 0x58) 15:31:31 executing program 3: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:31 executing program 4: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:31 executing program 0: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:31 executing program 2: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:32 executing program 5: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:32 executing program 0: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:32 executing program 1: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x6}, 0x58) 15:31:32 executing program 2: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0], 0x7}, 0x58) 15:31:32 executing program 3: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 15:31:32 executing program 4: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:32 executing program 0: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(0x0, 0x0) 15:31:32 executing program 1: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0], 0x5}, 0x58) 15:31:33 executing program 5: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:33 executing program 3: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 15:31:33 executing program 0: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(0x0, 0x0) 15:31:33 executing program 2: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(0x0, 0x0) 15:31:33 executing program 4: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 15:31:33 executing program 1: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x4}, 0x58) 15:31:33 executing program 5: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:33 executing program 0: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(0x0, 0x0) 15:31:33 executing program 3: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 15:31:33 executing program 2: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(0x0, 0x0) 15:31:34 executing program 4: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 15:31:34 executing program 1: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0], 0x3}, 0x58) 15:31:34 executing program 5: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:34 executing program 0: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:34 executing program 2: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(0x0, 0x0) 15:31:34 executing program 3: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0], 0x7}, 0x58) 15:31:34 executing program 1: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff], 0x2}, 0x58) 15:31:34 executing program 4: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0], 0x3}, 0x58) 15:31:34 executing program 5: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:34 executing program 0: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:35 executing program 2: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 15:31:35 executing program 3: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x6}, 0x58) 15:31:35 executing program 4: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0], 0x7}, 0x58) 15:31:35 executing program 5: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 15:31:35 executing program 0: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:35 executing program 1: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0], 0x1}, 0x58) 15:31:35 executing program 2: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:36 executing program 3: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0], 0x5}, 0x58) 15:31:36 executing program 0: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:36 executing program 2: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:36 executing program 5: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 15:31:36 executing program 1: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)}, 0x58) 15:31:36 executing program 4: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0], 0x1}, 0x58) 15:31:37 executing program 1: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)}, 0x58) 15:31:37 executing program 5: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 15:31:37 executing program 3: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x4}, 0x58) 15:31:37 executing program 0: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:37 executing program 2: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:37 executing program 4: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0], 0x5}, 0x58) 15:31:38 executing program 5: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0], 0x7}, 0x58) 15:31:38 executing program 3: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0], 0x3}, 0x58) 15:31:38 executing program 1: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)}, 0x58) 15:31:38 executing program 0: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:38 executing program 5: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x6}, 0x58) 15:31:38 executing program 3: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff], 0x2}, 0x58) 15:31:38 executing program 0: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:38 executing program 1: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:39 executing program 5: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0], 0x5}, 0x58) 15:31:39 executing program 0: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 15:31:42 executing program 2: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:42 executing program 4: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0], 0x5}, 0x58) 15:31:42 executing program 3: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0], 0x1}, 0x58) 15:31:42 executing program 1: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff], 0x2}, 0x58) 15:31:42 executing program 0: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 15:31:42 executing program 5: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x4}, 0x58) 15:31:42 executing program 2: syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:42 executing program 0: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 15:31:42 executing program 5: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0], 0x3}, 0x58) 15:31:42 executing program 3: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)}, 0x58) 15:31:43 executing program 1: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0], 0x1}, 0x58) 15:31:43 executing program 4: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0], 0x5}, 0x58) 15:31:43 executing program 2: syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:43 executing program 2: syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:43 executing program 2: syz_clone3(0x0, 0x0) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:43 executing program 0: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0], 0x7}, 0x58) 15:31:43 executing program 3: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)}, 0x58) 15:31:43 executing program 5: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff], 0x2}, 0x58) 15:31:43 executing program 2: syz_clone3(0x0, 0x0) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:43 executing program 1: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0], 0x3}, 0x58) 15:31:43 executing program 4: syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0], 0x5}, 0x58) 15:31:43 executing program 2: syz_clone3(0x0, 0x0) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:44 executing program 4: syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0], 0x5}, 0x58) 15:31:44 executing program 0: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x6}, 0x58) 15:31:44 executing program 3: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)}, 0x58) 15:31:44 executing program 2: syz_clone3(&(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:44 executing program 5: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0], 0x1}, 0x58) 15:31:44 executing program 4: syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0], 0x5}, 0x58) 15:31:44 executing program 1: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0], 0x7}, 0x58) 15:31:44 executing program 2: syz_clone3(&(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(0x0, 0x0) 15:31:44 executing program 4: syz_clone3(0x0, 0x0) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0], 0x5}, 0x58) 15:31:44 executing program 0: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0], 0x5}, 0x58) 15:31:44 executing program 3: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)}, 0x58) 15:31:44 executing program 2: syz_clone3(&(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(0x0, 0x0) 15:31:44 executing program 4: syz_clone3(0x0, 0x0) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0], 0x5}, 0x58) 15:31:44 executing program 2: syz_clone3(&(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(0x0, 0x0) 15:31:44 executing program 5: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)}, 0x58) 15:31:45 executing program 4: syz_clone3(0x0, 0x0) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0], 0x5}, 0x58) 15:31:45 executing program 2: syz_clone3(&(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:45 executing program 4: syz_clone3(&(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0], 0x5}, 0x58) 15:31:45 executing program 1: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)}, 0x58) 15:31:45 executing program 0: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x4}, 0x58) 15:31:45 executing program 3: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0], 0x1}, 0x58) 15:31:45 executing program 5: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)}, 0x58) 15:31:45 executing program 4: syz_clone3(&(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(0x0, 0x0) 15:31:45 executing program 2: syz_clone3(&(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:45 executing program 4: syz_clone3(&(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(0x0, 0x0) 15:31:45 executing program 2: syz_clone3(&(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:45 executing program 4: syz_clone3(&(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(0x0, 0x0) 15:31:45 executing program 5: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)}, 0x58) 15:31:45 executing program 4: syz_clone3(&(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 15:31:45 executing program 0: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0], 0x3}, 0x58) 15:31:46 executing program 1: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x4}, 0x58) 15:31:46 executing program 2: syz_clone3(&(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:46 executing program 3: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x6}, 0x58) 15:31:46 executing program 4: syz_clone3(&(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 15:31:46 executing program 2: syz_clone3(&(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 15:31:46 executing program 4: syz_clone3(&(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 15:31:46 executing program 2: syz_clone3(&(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 15:31:46 executing program 5: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)}, 0x58) 15:31:46 executing program 0: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff], 0x2}, 0x58) 15:31:46 executing program 4: syz_clone3(&(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x4}, 0x58) 15:31:46 executing program 1: syz_clone3(&(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 15:31:46 executing program 2: syz_clone3(&(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 15:31:46 executing program 3: syz_clone3(&(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 15:31:47 executing program 1: syz_clone3(&(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 15:31:47 executing program 4: syz_clone3(&(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0], 0x3}, 0x58) 15:31:47 executing program 2: syz_clone3(&(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0], 0x7}, 0x58) 15:31:47 executing program 3: syz_clone3(&(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x4}, 0x58) 15:31:47 executing program 4: syz_clone3(&(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff], 0x2}, 0x58) 15:31:47 executing program 5: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 15:31:47 executing program 0: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0], 0x1}, 0x58) 15:31:47 executing program 2: syz_clone3(&(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x6}, 0x58) 15:31:47 executing program 1: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff], 0x2}, 0x58) 15:31:47 executing program 3: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x4}, 0x58) 15:31:47 executing program 4: syz_clone3(&(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0], 0x1}, 0x58) 15:31:47 executing program 2: syz_clone3(&(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0], 0x5}, 0x58) 15:31:48 executing program 4: syz_clone3(&(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)}, 0x58) 15:31:48 executing program 2: syz_clone3(&(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x4}, 0x58) 15:31:48 executing program 0: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)}, 0x58) 15:31:48 executing program 4: syz_clone3(&(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)}, 0x58) 15:31:48 executing program 5: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0], 0x1}, 0x58) 15:31:48 executing program 2: syz_clone3(&(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0], 0x3}, 0x58) 15:31:48 executing program 4: syz_clone3(&(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)}, 0x58) 15:31:48 executing program 1: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 15:31:48 executing program 3: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 15:31:48 executing program 4: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0], 0x5}, 0x58) 15:31:48 executing program 2: syz_clone3(&(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff], 0x2}, 0x58) 15:31:48 executing program 0: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)}, 0x58) 15:31:49 executing program 2: syz_clone3(&(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0], 0x1}, 0x58) 15:31:49 executing program 5: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)}, 0x58) 15:31:49 executing program 1: syz_clone3(&(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0], 0x3}, 0x58) 15:31:49 executing program 2: syz_clone3(&(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)}, 0x58) 15:31:49 executing program 3: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff], 0x2}, 0x58) 15:31:49 executing program 1: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:49 executing program 4: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)}, 0x58) 15:31:49 executing program 0: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)}, 0x58) 15:31:49 executing program 2: syz_clone3(&(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)}, 0x58) 15:31:49 executing program 5: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0], 0x3}, 0x58) 15:31:50 executing program 2: syz_clone3(&(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)}, 0x58) 15:31:50 executing program 2: syz_clone3(&(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)}, 0x58) 15:31:50 executing program 0: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)}, 0x58) 15:31:50 executing program 4: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)}, 0x58) 15:31:50 executing program 1: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0], 0x7}, 0x58) 15:31:50 executing program 3: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:50 executing program 2: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x4}, 0x58) 15:31:50 executing program 5: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 15:31:50 executing program 4: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0], 0x5}, 0x58) 15:31:51 executing program 0: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 15:31:51 executing program 3: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 15:31:51 executing program 2: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 15:31:51 executing program 1: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:51 executing program 5: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x6}, 0x58) 15:31:51 executing program 4: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:51 executing program 0: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x4}, 0x58) 15:31:51 executing program 3: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(0x0, 0x0) 15:31:52 executing program 2: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:52 executing program 1: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x6}, 0x58) 15:31:52 executing program 5: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:52 executing program 4: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:52 executing program 0: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x4}, 0x58) 15:31:52 executing program 3: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(0x0, 0x0) 15:31:53 executing program 0: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:53 executing program 4: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:53 executing program 3: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:53 executing program 0: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) 15:31:54 executing program 3: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:54 executing program 4: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:57 executing program 2: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:57 executing program 1: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x6}, 0x58) 15:31:57 executing program 5: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:57 executing program 3: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:57 executing program 0: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:57 executing program 4: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:58 executing program 0: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:58 executing program 3: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:58 executing program 1: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(0x0, 0x0) 15:31:58 executing program 4: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, {}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:58 executing program 2: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(0x0, 0x0) 15:31:58 executing program 5: syz_clone3(0x0, 0x0) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:59 executing program 5: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:59 executing program 4: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:59 executing program 3: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:59 executing program 1: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:59 executing program 0: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x0, 0x0, &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:31:59 executing program 2: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(0x0, 0x0) 15:31:59 executing program 5: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:32:00 executing program 4: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(0x0, 0x0) 15:32:00 executing program 3: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:32:00 executing program 1: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:32:00 executing program 2: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:32:00 executing program 0: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:32:00 executing program 5: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:32:00 executing program 4: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, 0x0, 0x0, {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:32:01 executing program 5: openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:32:01 executing program 0: syz_clone3(&(0x7f0000000400)={0x0, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:32:01 executing program 1: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:32:01 executing program 2: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000001a80)={0x1a, 0x7, 0x9}) syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:32:01 executing program 3: syz_clone3(&(0x7f0000000400)={0x40080000, 0x0, &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:32:01 executing program 4: syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:32:02 executing program 0: syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:32:02 executing program 5: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000001a80)={0x1a, 0x7, 0x9}) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) gettid() syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:32:02 executing program 1: openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:32:02 executing program 3: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000001a80)={0x1a, 0x7, 0x9}) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = gettid() sched_rr_get_interval(r1, &(0x7f0000000100)) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:32:02 executing program 2: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000001a80)={0x1a, 0x7, 0x9}) syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:32:02 executing program 4: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:32:02 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x10001) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000340)={0xa322}, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:02 executing program 0: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x10001) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000340)={0xa322}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:02 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x10001) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000340)={0xa322}, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:02 executing program 0: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000001a80)={0x1a, 0x7, 0x9}) syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:32:02 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x10001) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000340)={0xa322}, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:02 executing program 5: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000001a80)={0x1a, 0x7, 0x9}) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:32:03 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x10001) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000340)={0xa322}, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:03 executing program 2: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000001a80)={0x1a, 0x7, 0x9}) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:32:03 executing program 1: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000001a80)={0x1a, 0x7, 0x9}) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:32:03 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x10001) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000340)={0xa322}, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:03 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x10001) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000340)={0xa322}, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:03 executing program 4: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000001a80)={0x1a, 0x7, 0x9}) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) gettid() syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:32:03 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x10001) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000340)={0xa322}, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:03 executing program 0: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x10001) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, 0x0, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:03 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x10001) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000340)={0xa322}, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:03 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x10001) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000340)={0xa322}, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:03 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x10001) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:03 executing program 0: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000001a80)={0x1a, 0x7, 0x9}) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = gettid() sched_rr_get_interval(r1, &(0x7f0000000100)) r2 = gettid() sched_rr_get_interval(r2, &(0x7f0000000100)) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:32:03 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000340)={0xa322}, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:03 executing program 2: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x10001) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:04 executing program 1: r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x0, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:32:04 executing program 5: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000001a80)={0x1a, 0x7, 0x9}) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = gettid() sched_rr_get_interval(r1, &(0x7f0000000100)) r2 = gettid() sched_rr_get_interval(r2, &(0x7f0000000100)) syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001680)={0x2491c4000, &(0x7f0000000480), &(0x7f00000004c0), &(0x7f0000000500), {0xc}, &(0x7f0000000540)=""/4096, 0x1000, &(0x7f0000001540)=""/243, &(0x7f0000001640)=[0x0], 0x1}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) 15:32:04 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000340)={0xa322}, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:04 executing program 0: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000001a80)={0x1a, 0x7, 0x9}) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = gettid() sched_rr_get_interval(r1, &(0x7f0000000100)) r2 = gettid() sched_rr_get_interval(r2, &(0x7f0000000100)) syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001680)={0x2491c4000, &(0x7f0000000480), &(0x7f00000004c0), &(0x7f0000000500), {0xc}, &(0x7f0000000540)=""/4096, 0x1000, &(0x7f0000001540)=""/243, &(0x7f0000001640)=[0x0], 0x1}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) 15:32:04 executing program 2: r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x0, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:32:04 executing program 4: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x8080, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:04 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000340)={0xa322}, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:04 executing program 3: eventfd(0x10001) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000340)={0xa322}, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:04 executing program 4: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x8080, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:04 executing program 3: eventfd(0x10001) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000340)={0xa322}, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:04 executing program 4: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x8080, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:04 executing program 3: eventfd(0x10001) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000340)={0xa322}, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:05 executing program 1: r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x0, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:32:05 executing program 4: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x8080, 0x0) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:05 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x8080, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:05 executing program 0: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000001a80)={0x1a, 0x7, 0x9}) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = gettid() sched_rr_get_interval(r1, &(0x7f0000000100)) r2 = gettid() sched_rr_get_interval(r2, &(0x7f0000000100)) syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001680)={0x2491c4000, &(0x7f0000000480), &(0x7f00000004c0), &(0x7f0000000500), {0xc}, &(0x7f0000000540)=""/4096, 0x1000, &(0x7f0000001540)=""/243, &(0x7f0000001640)=[0x0], 0x1}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000001a40)={r3, r3}, 0x10) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) 15:32:05 executing program 3: pipe2$9p(0x0, 0x0) eventfd(0x10001) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000340)={0xa322}, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:05 executing program 3: pipe2$9p(0x0, 0x0) eventfd(0x10001) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000340)={0xa322}, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:05 executing program 2: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000001a80)={0x1a, 0x7, 0x9}) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = gettid() sched_rr_get_interval(r1, &(0x7f0000000100)) r2 = gettid() sched_rr_get_interval(r2, &(0x7f0000000100)) syz_clone3(&(0x7f0000000400)={0x40080000, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0), {0x33}, &(0x7f0000000300)=""/61, 0x3d, &(0x7f0000000340)=""/72, &(0x7f00000003c0)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0], 0x8}, 0x58) syz_clone3(&(0x7f0000001680)={0x2491c4000, &(0x7f0000000480), &(0x7f00000004c0), &(0x7f0000000500), {0xc}, &(0x7f0000000540)=""/4096, 0x1000, &(0x7f0000001540)=""/243, &(0x7f0000001640)=[0x0], 0x1}, 0x58) syz_clone3(&(0x7f0000001900)={0x200, &(0x7f0000001700), &(0x7f0000001740), &(0x7f0000001780), {0x23}, &(0x7f00000017c0)=""/6, 0x6, &(0x7f0000001800)=""/162, &(0x7f00000018c0)=[0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff], 0x8}, 0x58) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000001a40)={r3, r3}, 0x10) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) 15:32:05 executing program 4: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x8080, 0x0) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:05 executing program 5: eventfd(0x10001) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x8080, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:05 executing program 4: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x8080, 0x0) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:05 executing program 3: pipe2$9p(0x0, 0x0) eventfd(0x10001) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000340)={0xa322}, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:05 executing program 5: openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, &(0x7f0000000080)={0x10001, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:32:05 executing program 1: r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x0, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:32:05 executing program 4: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:05 executing program 5: r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x10001, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:32:05 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000340)={0xa322}, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:05 executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) sendmsg$qrtr(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000040)={0x2a, 0x0, 0x1}, 0xc, &(0x7f0000000480)=[{&(0x7f00000000c0)="195b696101feb2f3c392ccff9342e32eafd3b5c8273b9acd35bd3491ca70f7eda33035ea6759aa6d517e8e7d9cdbc1cbc7c9790e23e7cfa76aaa9b060665ad74d5d572a0648b3f90a9a40d52692c84c3d41c7edff71368e974786dc04be6ce878d7da92d56dc35c9e8ffa30ee72181d6b515a5ee58c6ad51fe79e8d5cc641c0978a1b89d97", 0x85}, {&(0x7f0000000240)="e2335a9639f1bd1eb2d3b0912e989e46debd2b76ae6861e6638a2cf7a274405f3fd664f1fd179b92bb3136b3ee06c7c326302df9053c70e0351031f6ff8e4034a04a964a7160c33bdc625fe102fe33e13760566db092632bc84a26adb4f673ebcbbe536e1d14bb50f98a6882350fc6df52016aebad94e94f723a7a9d4b2510da0f54450ee5c3818e486f3fd5d9bc7000067a81205d07ec70cceaea9e2a0abf3f452ea074eefd94cf146bcc6438", 0xad}, {&(0x7f00000001c0)="b1034ee82dfca7dc3ab1cc594afacd", 0xf}, {&(0x7f0000000300)="976c8151706e19a63a8ab352677ca28abe533b1a240e5e788cdd05fea061356a2c66cf430d0516c33e6932d158", 0x2d}, {&(0x7f0000000340)="40f4eb2825a21a32c02e0c5bcd69d7947caf53c3704256ce0aa59eb212eecac7e65313bdb33f9075df181822de80e6e4581c530e37a55a343be535ab2ee7983579faf5e7d579f7503156ca6429aca586f890cdc53c5ff78e73945e9ae96998ae18e815c10b130f5f5eff1822af3eeabcbb3209dd0728e345b869581ab5d40307eec93c499fe46800a6b0f03938b8355dcde4b8d0659f526a24", 0x99}, {&(0x7f0000000400)="3c2767d7eb86a7858e8b72ce868e9917b482c8a13f7346e955e5afe6138d583e5de34c19addd383b741f6c6407085f02af538c4370d2b194e40af105ca3ea296d63e70910d5ad18bd78ac982073c896645", 0x51}], 0x6, 0x0, 0x0, 0x4000000}, 0x38) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) ioctl$TIOCSISO7816(r1, 0xc0285443, &(0x7f0000000540)={0x8d4d, 0x9, 0x5, 0x253a, 0x6}) 15:32:05 executing program 2: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x400000000000, 0x80000) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, &(0x7f00000001c0)) sendmsg$NL80211_CMD_SET_BSS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000140)={&(0x7f0000000600)=ANY=[@ANYBLOB="000000dd8417fdfae493ba9aa345e63af890cdabd3904bd443969edd70a9bf2e1f411a5d8ce963cc1097c9b5ee763c1e6e59272d57de0734b926084bbb1f07b178745145ad7411b826fb7b1dbed99a5a", @ANYRES16=0x0, @ANYBLOB="48002abd7000ffdbdf25190000000c00990004000000590000000500a3000100000005001e000000000005001d00090000000500a2000000000005001c0000000000"], 0x48}}, 0x2) r2 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_tracing={0x1a, 0x5, &(0x7f00000002c0)=@raw=[@btf_id={0x18, 0x5, 0x3, 0x0, 0x5}, @exit, @initr0={0x18, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x1}], &(0x7f0000000300)='syzkaller\x00', 0x30000, 0x0, 0x0, 0x0, 0x18, '\x00', 0x0, 0xb, r1, 0x8, &(0x7f0000000340)={0x6, 0x3}, 0x8, 0x10, &(0x7f0000000380)={0x0, 0x10, 0x40, 0x6}, 0x10, 0x288c, r1, 0x0, &(0x7f00000003c0)}, 0x80) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000480)=@base={0x15, 0x1000, 0x401, 0x1, 0x0, r1, 0x6, '\x00', 0x0, r1, 0x3, 0x1}, 0x48) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r4, 0xc01064c2, 0x0) r5 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r5, 0xc01064c2, 0x0) ioctl$PPPIOCSACTIVE(0xffffffffffffffff, 0x40107446, &(0x7f0000000100)={0x2, &(0x7f00000000c0)=[{0x200, 0xeb, 0x0, 0x1}, {0xab, 0x81, 0x80}]}) r6 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000500), 0x101400, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000580)=@bpf_tracing={0x1a, 0x6, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x1e1d}, [@exit, @kfunc={0x85, 0x0, 0x2, 0x0, 0x1}, @generic={0x7f, 0x6, 0x8, 0x1, 0x1}]}, &(0x7f0000000200)='GPL\x00', 0xffff, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, 0x1c, 0xffffffffffffffff, 0x8, &(0x7f0000000240)={0x7, 0x4}, 0x8, 0x10, &(0x7f0000000280)={0x0, 0x2, 0x81, 0x6}, 0x10, 0x150fa, r2, 0x0, &(0x7f0000000540)=[0xffffffffffffffff, r1, r3, r1, r4, r5, 0xffffffffffffffff, r6]}, 0x80) ioctl$LOOP_SET_FD(r0, 0x125f, 0xffffffffffffffff) 15:32:06 executing program 2: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x400000000000, 0x80000) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, &(0x7f00000001c0)) sendmsg$NL80211_CMD_SET_BSS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000140)={&(0x7f0000000600)=ANY=[@ANYBLOB="000000dd8417fdfae493ba9aa345e63af890cdabd3904bd443969edd70a9bf2e1f411a5d8ce963cc1097c9b5ee763c1e6e59272d57de0734b926084bbb1f07b178745145ad7411b826fb7b1dbed99a5a", @ANYRES16=0x0, @ANYBLOB="48002abd7000ffdbdf25190000000c00990004000000590000000500a3000100000005001e000000000005001d00090000000500a2000000000005001c0000000000"], 0x48}}, 0x2) r2 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_tracing={0x1a, 0x5, &(0x7f00000002c0)=@raw=[@btf_id={0x18, 0x5, 0x3, 0x0, 0x5}, @exit, @initr0={0x18, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x1}], &(0x7f0000000300)='syzkaller\x00', 0x30000, 0x0, 0x0, 0x0, 0x18, '\x00', 0x0, 0xb, r1, 0x8, &(0x7f0000000340)={0x6, 0x3}, 0x8, 0x10, &(0x7f0000000380)={0x0, 0x10, 0x40, 0x6}, 0x10, 0x288c, r1, 0x0, &(0x7f00000003c0)}, 0x80) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000480)=@base={0x15, 0x1000, 0x401, 0x1, 0x0, r1, 0x6, '\x00', 0x0, r1, 0x3, 0x1}, 0x48) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r4, 0xc01064c2, 0x0) r5 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r5, 0xc01064c2, 0x0) ioctl$PPPIOCSACTIVE(0xffffffffffffffff, 0x40107446, &(0x7f0000000100)={0x2, &(0x7f00000000c0)=[{0x200, 0xeb, 0x0, 0x1}, {0xab, 0x81, 0x80}]}) r6 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000500), 0x101400, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000580)=@bpf_tracing={0x1a, 0x6, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x1e1d}, [@exit, @kfunc={0x85, 0x0, 0x2, 0x0, 0x1}, @generic={0x7f, 0x6, 0x8, 0x1, 0x1}]}, &(0x7f0000000200)='GPL\x00', 0xffff, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, 0x1c, 0xffffffffffffffff, 0x8, &(0x7f0000000240)={0x7, 0x4}, 0x8, 0x10, &(0x7f0000000280)={0x0, 0x2, 0x81, 0x6}, 0x10, 0x150fa, r2, 0x0, &(0x7f0000000540)=[0xffffffffffffffff, r1, r3, r1, r4, r5, 0xffffffffffffffff, r6]}, 0x80) ioctl$LOOP_SET_FD(r0, 0x125f, 0xffffffffffffffff) 15:32:06 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000340)={0xa322}, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) [ 3122.214338][T26136] binder: 26132:26136 ioctl c0306201 0 returned -14 15:32:06 executing program 4: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:06 executing program 2: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x400000000000, 0x80000) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, &(0x7f00000001c0)) sendmsg$NL80211_CMD_SET_BSS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000140)={&(0x7f0000000600)=ANY=[@ANYBLOB="000000dd8417fdfae493ba9aa345e63af890cdabd3904bd443969edd70a9bf2e1f411a5d8ce963cc1097c9b5ee763c1e6e59272d57de0734b926084bbb1f07b178745145ad7411b826fb7b1dbed99a5a", @ANYRES16=0x0, @ANYBLOB="48002abd7000ffdbdf25190000000c00990004000000590000000500a3000100000005001e000000000005001d00090000000500a2000000000005001c0000000000"], 0x48}}, 0x2) r2 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_tracing={0x1a, 0x5, &(0x7f00000002c0)=@raw=[@btf_id={0x18, 0x5, 0x3, 0x0, 0x5}, @exit, @initr0={0x18, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x1}], &(0x7f0000000300)='syzkaller\x00', 0x30000, 0x0, 0x0, 0x0, 0x18, '\x00', 0x0, 0xb, r1, 0x8, &(0x7f0000000340)={0x6, 0x3}, 0x8, 0x10, &(0x7f0000000380)={0x0, 0x10, 0x40, 0x6}, 0x10, 0x288c, r1, 0x0, &(0x7f00000003c0)}, 0x80) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000480)=@base={0x15, 0x1000, 0x401, 0x1, 0x0, r1, 0x6, '\x00', 0x0, r1, 0x3, 0x1}, 0x48) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r4, 0xc01064c2, 0x0) r5 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r5, 0xc01064c2, 0x0) ioctl$PPPIOCSACTIVE(0xffffffffffffffff, 0x40107446, &(0x7f0000000100)={0x2, &(0x7f00000000c0)=[{0x200, 0xeb, 0x0, 0x1}, {0xab, 0x81, 0x80}]}) r6 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000500), 0x101400, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000580)=@bpf_tracing={0x1a, 0x6, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x1e1d}, [@exit, @kfunc={0x85, 0x0, 0x2, 0x0, 0x1}, @generic={0x7f, 0x6, 0x8, 0x1, 0x1}]}, &(0x7f0000000200)='GPL\x00', 0xffff, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, 0x1c, 0xffffffffffffffff, 0x8, &(0x7f0000000240)={0x7, 0x4}, 0x8, 0x10, &(0x7f0000000280)={0x0, 0x2, 0x81, 0x6}, 0x10, 0x150fa, r2, 0x0, &(0x7f0000000540)=[0xffffffffffffffff, r1, r3, r1, r4, r5, 0xffffffffffffffff, r6]}, 0x80) ioctl$LOOP_SET_FD(r0, 0x125f, 0xffffffffffffffff) 15:32:06 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000340)={0xa322}, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:06 executing program 4: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:06 executing program 1: openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:32:06 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000340)={0xa322}, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:06 executing program 2: syz_open_dev$loop(&(0x7f0000000040), 0x400000000000, 0x80000) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f00000001c0)) sendmsg$NL80211_CMD_SET_BSS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000140)={&(0x7f0000000600)=ANY=[@ANYBLOB="000000dd8417fdfae493ba9aa345e63af890cdabd3904bd443969edd70a9bf2e1f411a5d8ce963cc1097c9b5ee763c1e6e59272d57de0734b926084bbb1f07b178745145ad7411b826fb7b1dbed99a5a", @ANYRES16=0x0, @ANYBLOB="48002abd7000ffdbdf25190000000c00990004000000590000000500a3000100000005001e000000000005001d00090000000500a2000000000005001c0000000000"], 0x48}}, 0x2) r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_tracing={0x1a, 0x5, &(0x7f00000002c0)=@raw=[@btf_id={0x18, 0x5, 0x3, 0x0, 0x5}, @exit, @initr0={0x18, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x1}], &(0x7f0000000300)='syzkaller\x00', 0x30000, 0x0, 0x0, 0x0, 0x18, '\x00', 0x0, 0xb, r0, 0x8, &(0x7f0000000340)={0x6, 0x3}, 0x8, 0x10, &(0x7f0000000380)={0x0, 0x10, 0x40, 0x6}, 0x10, 0x288c, r0, 0x0, &(0x7f00000003c0)}, 0x80) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000480)=@base={0x15, 0x1000, 0x401, 0x1, 0x0, r0, 0x6, '\x00', 0x0, r0, 0x3, 0x1}, 0x48) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r4, 0xc01064c2, 0x0) ioctl$PPPIOCSACTIVE(0xffffffffffffffff, 0x40107446, &(0x7f0000000100)={0x2, &(0x7f00000000c0)=[{0x200, 0xeb, 0x0, 0x1}, {0xab, 0x81, 0x80}]}) r5 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000500), 0x101400, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000580)=@bpf_tracing={0x1a, 0x6, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x1e1d}, [@exit, @kfunc={0x85, 0x0, 0x2, 0x0, 0x1}, @generic={0x7f, 0x6, 0x8, 0x1, 0x1}]}, &(0x7f0000000200)='GPL\x00', 0xffff, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, 0x1c, 0xffffffffffffffff, 0x8, &(0x7f0000000240)={0x7, 0x4}, 0x8, 0x10, &(0x7f0000000280)={0x0, 0x2, 0x81, 0x6}, 0x10, 0x150fa, r1, 0x0, &(0x7f0000000540)=[0xffffffffffffffff, r0, r2, r0, r3, r4, 0xffffffffffffffff, r5]}, 0x80) 15:32:06 executing program 4: pipe2$9p(&(0x7f0000000000), 0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x8080, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:06 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r1, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, r1) socket(0x26, 0x5, 0x0) ioctl$LOOP_SET_FD(r0, 0x1263, 0xffffffffffffffff) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETSW(r2, 0x5403, &(0x7f0000000000)={0x2, 0x8, 0x9, 0x6e, 0x18, "86dacc8e28bb19f2cb097c72c47ffb4c328cb0"}) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r2, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {&(0x7f00000000c0), 0x1, {0xa, 0x4e23, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x38) 15:32:06 executing program 5: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r1, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, r1) socket(0x26, 0x5, 0x0) ioctl$LOOP_SET_FD(r0, 0x1263, 0xffffffffffffffff) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETSW(r2, 0x5403, &(0x7f0000000000)={0x2, 0x8, 0x9, 0x6e, 0x18, "86dacc8e28bb19f2cb097c72c47ffb4c328cb0"}) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r2, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {&(0x7f00000000c0)={0xffffffffffffffff}, 0x1, {0xa, 0x4e23, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x38) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r3, &(0x7f0000000140)={0x11, 0x10, 0xfa00, {&(0x7f0000000080), r4}}, 0x18) 15:32:06 executing program 2: syz_open_dev$loop(&(0x7f0000000040), 0x400000000000, 0x80000) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f00000001c0)) sendmsg$NL80211_CMD_SET_BSS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000140)={&(0x7f0000000600)=ANY=[@ANYBLOB="000000dd8417fdfae493ba9aa345e63af890cdabd3904bd443969edd70a9bf2e1f411a5d8ce963cc1097c9b5ee763c1e6e59272d57de0734b926084bbb1f07b178745145ad7411b826fb7b1dbed99a5a", @ANYRES16=0x0, @ANYBLOB="48002abd7000ffdbdf25190000000c00990004000000590000000500a3000100000005001e000000000005001d00090000000500a2000000000005001c0000000000"], 0x48}}, 0x2) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_tracing={0x1a, 0x5, &(0x7f00000002c0)=@raw=[@btf_id={0x18, 0x5, 0x3, 0x0, 0x5}, @exit, @initr0={0x18, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x1}], &(0x7f0000000300)='syzkaller\x00', 0x30000, 0x0, 0x0, 0x0, 0x18, '\x00', 0x0, 0xb, r0, 0x8, &(0x7f0000000340)={0x6, 0x3}, 0x8, 0x10, &(0x7f0000000380)={0x0, 0x10, 0x40, 0x6}, 0x10, 0x288c, r0, 0x0, &(0x7f00000003c0)}, 0x80) bpf$MAP_CREATE(0x0, &(0x7f0000000480)=@base={0x15, 0x1000, 0x401, 0x1, 0x0, r0, 0x6, '\x00', 0x0, r0, 0x3, 0x1}, 0x48) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, 0x0) ioctl$PPPIOCSACTIVE(0xffffffffffffffff, 0x40107446, &(0x7f0000000100)={0x2, &(0x7f00000000c0)=[{0x200, 0xeb, 0x0, 0x1}, {0xab, 0x81, 0x80}]}) openat$vcs(0xffffffffffffff9c, &(0x7f0000000500), 0x101400, 0x0) 15:32:07 executing program 4: pipe2$9p(&(0x7f0000000000), 0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x8080, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:07 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000340)={0xa322}, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:07 executing program 1: openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:32:07 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r1, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, r1) socket(0x26, 0x5, 0x0) ioctl$LOOP_SET_FD(r0, 0x1263, 0xffffffffffffffff) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETSW(r2, 0x5403, &(0x7f0000000000)={0x2, 0x8, 0x9, 0x6e, 0x18, "86dacc8e28bb19f2cb097c72c47ffb4c328cb0"}) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r2, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {&(0x7f00000000c0)={0xffffffffffffffff}, 0x1, {0xa, 0x4e23, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x38) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r3, &(0x7f0000000140)={0x11, 0x10, 0xfa00, {&(0x7f0000000080), r4}}, 0x18) r5 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r5, 0xc01064c2, 0x0) 15:32:07 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x3}, 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x1}, 0x0, 0x0) 15:32:07 executing program 1: openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:32:07 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000340)={0xa322}, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:07 executing program 4: pipe2$9p(&(0x7f0000000000), 0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x8080, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:07 executing program 2: syz_open_dev$loop(&(0x7f0000000040), 0x400000000000, 0x80000) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f00000001c0)) sendmsg$NL80211_CMD_SET_BSS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000140)={&(0x7f0000000600)=ANY=[@ANYBLOB="000000dd8417fdfae493ba9aa345e63af890cdabd3904bd443969edd70a9bf2e1f411a5d8ce963cc1097c9b5ee763c1e6e59272d57de0734b926084bbb1f07b178745145ad7411b826fb7b1dbed99a5a", @ANYRES16=0x0, @ANYBLOB="48002abd7000ffdbdf25190000000c00990004000000590000000500a3000100000005001e000000000005001d00090000000500a2000000000005001c0000000000"], 0x48}}, 0x2) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_tracing={0x1a, 0x5, &(0x7f00000002c0)=@raw=[@btf_id={0x18, 0x5, 0x3, 0x0, 0x5}, @exit, @initr0={0x18, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x1}], &(0x7f0000000300)='syzkaller\x00', 0x30000, 0x0, 0x0, 0x0, 0x18, '\x00', 0x0, 0xb, r0, 0x8, &(0x7f0000000340)={0x6, 0x3}, 0x8, 0x10, &(0x7f0000000380)={0x0, 0x10, 0x40, 0x6}, 0x10, 0x288c, r0, 0x0, &(0x7f00000003c0)}, 0x80) bpf$MAP_CREATE(0x0, &(0x7f0000000480)=@base={0x15, 0x1000, 0x401, 0x1, 0x0, r0, 0x6, '\x00', 0x0, r0, 0x3, 0x1}, 0x48) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, 0x0) ioctl$PPPIOCSACTIVE(0xffffffffffffffff, 0x40107446, &(0x7f0000000100)={0x2, &(0x7f00000000c0)=[{0x200, 0xeb, 0x0, 0x1}, {0xab, 0x81, 0x80}]}) 15:32:07 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r1, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, r1) socket(0x26, 0x5, 0x0) ioctl$LOOP_SET_FD(r0, 0x1263, 0xffffffffffffffff) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETSW(r2, 0x5403, &(0x7f0000000000)={0x2, 0x8, 0x9, 0x6e, 0x18, "86dacc8e28bb19f2cb097c72c47ffb4c328cb0"}) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r2, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {&(0x7f00000000c0)={0xffffffffffffffff}, 0x1, {0xa, 0x4e23, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x38) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r3, &(0x7f0000000140)={0x11, 0x10, 0xfa00, {&(0x7f0000000080), r4}}, 0x18) r5 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r5, 0xc01064c2, 0x0) [ 3123.379555][T26175] binder: 26174:26175 ioctl c0306201 0 returned -14 15:32:07 executing program 2: syz_open_dev$loop(&(0x7f0000000040), 0x400000000000, 0x80000) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f00000001c0)) sendmsg$NL80211_CMD_SET_BSS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000140)={&(0x7f0000000600)=ANY=[@ANYBLOB="000000dd8417fdfae493ba9aa345e63af890cdabd3904bd443969edd70a9bf2e1f411a5d8ce963cc1097c9b5ee763c1e6e59272d57de0734b926084bbb1f07b178745145ad7411b826fb7b1dbed99a5a", @ANYRES16=0x0, @ANYBLOB="48002abd7000ffdbdf25190000000c00990004000000590000000500a3000100000005001e000000000005001d00090000000500a2000000000005001c0000000000"], 0x48}}, 0x2) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_tracing={0x1a, 0x5, &(0x7f00000002c0)=@raw=[@btf_id={0x18, 0x5, 0x3, 0x0, 0x5}, @exit, @initr0={0x18, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x1}], &(0x7f0000000300)='syzkaller\x00', 0x30000, 0x0, 0x0, 0x0, 0x18, '\x00', 0x0, 0xb, r0, 0x8, &(0x7f0000000340)={0x6, 0x3}, 0x8, 0x10, &(0x7f0000000380)={0x0, 0x10, 0x40, 0x6}, 0x10, 0x288c, r0, 0x0, &(0x7f00000003c0)}, 0x80) bpf$MAP_CREATE(0x0, &(0x7f0000000480)=@base={0x15, 0x1000, 0x401, 0x1, 0x0, r0, 0x6, '\x00', 0x0, r0, 0x3, 0x1}, 0x48) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, 0x0) 15:32:07 executing program 1: ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, &(0x7f0000000080)={0x0, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:32:07 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r1, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, r1) socket(0x26, 0x5, 0x0) ioctl$LOOP_SET_FD(r0, 0x1263, 0xffffffffffffffff) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETSW(r2, 0x5403, &(0x7f0000000000)={0x2, 0x8, 0x9, 0x6e, 0x18, "86dacc8e28bb19f2cb097c72c47ffb4c328cb0"}) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r2, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {&(0x7f00000000c0)={0xffffffffffffffff}, 0x1, {0xa, 0x4e23, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x38) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r3, &(0x7f0000000140)={0x11, 0x10, 0xfa00, {&(0x7f0000000080), r4}}, 0x18) r5 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r5, 0xc01064c2, 0x0) 15:32:07 executing program 4: eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x8080, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:07 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000340)={0xa322}, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:07 executing program 2: syz_open_dev$loop(&(0x7f0000000040), 0x400000000000, 0x80000) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f00000001c0)) sendmsg$NL80211_CMD_SET_BSS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000140)={&(0x7f0000000600)=ANY=[@ANYBLOB="000000dd8417fdfae493ba9aa345e63af890cdabd3904bd443969edd70a9bf2e1f411a5d8ce963cc1097c9b5ee763c1e6e59272d57de0734b926084bbb1f07b178745145ad7411b826fb7b1dbed99a5a", @ANYRES16=0x0, @ANYBLOB="48002abd7000ffdbdf25190000000c00990004000000590000000500a3000100000005001e000000000005001d00090000000500a2000000000005001c0000000000"], 0x48}}, 0x2) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_tracing={0x1a, 0x5, &(0x7f00000002c0)=@raw=[@btf_id={0x18, 0x5, 0x3, 0x0, 0x5}, @exit, @initr0={0x18, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x1}], &(0x7f0000000300)='syzkaller\x00', 0x30000, 0x0, 0x0, 0x0, 0x18, '\x00', 0x0, 0xb, r0, 0x8, &(0x7f0000000340)={0x6, 0x3}, 0x8, 0x10, &(0x7f0000000380)={0x0, 0x10, 0x40, 0x6}, 0x10, 0x288c, r0, 0x0, &(0x7f00000003c0)}, 0x80) bpf$MAP_CREATE(0x0, &(0x7f0000000480)=@base={0x15, 0x1000, 0x401, 0x1, 0x0, r0, 0x6, '\x00', 0x0, r0, 0x3, 0x1}, 0x48) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) 15:32:08 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:32:08 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r1, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, r1) socket(0x26, 0x5, 0x0) ioctl$LOOP_SET_FD(r0, 0x1263, 0xffffffffffffffff) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETSW(r2, 0x5403, &(0x7f0000000000)={0x2, 0x8, 0x9, 0x6e, 0x18, "86dacc8e28bb19f2cb097c72c47ffb4c328cb0"}) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r2, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {&(0x7f00000000c0)={0xffffffffffffffff}, 0x1, {0xa, 0x4e23, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x38) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r3, &(0x7f0000000140)={0x11, 0x10, 0xfa00, {&(0x7f0000000080), r4}}, 0x18) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) 15:32:08 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x0, 0x0, 0x0, &(0x7f0000000340)={0xa322}, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:08 executing program 1: ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, &(0x7f0000000080)={0x0, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:32:08 executing program 4: eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x8080, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:08 executing program 2: syz_open_dev$loop(&(0x7f0000000040), 0x400000000000, 0x80000) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f00000001c0)) sendmsg$NL80211_CMD_SET_BSS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000140)={&(0x7f0000000600)=ANY=[@ANYBLOB="000000dd8417fdfae493ba9aa345e63af890cdabd3904bd443969edd70a9bf2e1f411a5d8ce963cc1097c9b5ee763c1e6e59272d57de0734b926084bbb1f07b178745145ad7411b826fb7b1dbed99a5a", @ANYRES16=0x0, @ANYBLOB="48002abd7000ffdbdf25190000000c00990004000000590000000500a3000100000005001e000000000005001d00090000000500a2000000000005001c0000000000"], 0x48}}, 0x2) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_tracing={0x1a, 0x5, &(0x7f00000002c0)=@raw=[@btf_id={0x18, 0x5, 0x3, 0x0, 0x5}, @exit, @initr0={0x18, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x1}], &(0x7f0000000300)='syzkaller\x00', 0x30000, 0x0, 0x0, 0x0, 0x18, '\x00', 0x0, 0xb, r0, 0x8, &(0x7f0000000340)={0x6, 0x3}, 0x8, 0x10, &(0x7f0000000380)={0x0, 0x10, 0x40, 0x6}, 0x10, 0x288c, r0, 0x0, &(0x7f00000003c0)}, 0x80) bpf$MAP_CREATE(0x0, &(0x7f0000000480)=@base={0x15, 0x1000, 0x401, 0x1, 0x0, r0, 0x6, '\x00', 0x0, r0, 0x3, 0x1}, 0x48) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) [ 3124.274165][T26241] binder: 26240:26241 ioctl c0306201 0 returned -14 15:32:08 executing program 1: ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, &(0x7f0000000080)={0x0, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:32:08 executing program 4: eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x8080, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:08 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r1, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, r1) socket(0x26, 0x5, 0x0) ioctl$LOOP_SET_FD(r0, 0x1263, 0xffffffffffffffff) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETSW(r2, 0x5403, &(0x7f0000000000)={0x2, 0x8, 0x9, 0x6e, 0x18, "86dacc8e28bb19f2cb097c72c47ffb4c328cb0"}) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r2, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {&(0x7f00000000c0)={0xffffffffffffffff}, 0x1, {0xa, 0x4e23, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x38) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r3, &(0x7f0000000140)={0x11, 0x10, 0xfa00, {&(0x7f0000000080), r4}}, 0x18) 15:32:08 executing program 2: syz_open_dev$loop(&(0x7f0000000040), 0x400000000000, 0x80000) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f00000001c0)) sendmsg$NL80211_CMD_SET_BSS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000140)={&(0x7f0000000600)=ANY=[@ANYBLOB="000000dd8417fdfae493ba9aa345e63af890cdabd3904bd443969edd70a9bf2e1f411a5d8ce963cc1097c9b5ee763c1e6e59272d57de0734b926084bbb1f07b178745145ad7411b826fb7b1dbed99a5a", @ANYRES16=0x0, @ANYBLOB="48002abd7000ffdbdf25190000000c00990004000000590000000500a3000100000005001e000000000005001d00090000000500a2000000000005001c0000000000"], 0x48}}, 0x2) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_tracing={0x1a, 0x5, &(0x7f00000002c0)=@raw=[@btf_id={0x18, 0x5, 0x3, 0x0, 0x5}, @exit, @initr0={0x18, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x1}], &(0x7f0000000300)='syzkaller\x00', 0x30000, 0x0, 0x0, 0x0, 0x18, '\x00', 0x0, 0xb, r0, 0x8, &(0x7f0000000340)={0x6, 0x3}, 0x8, 0x10, &(0x7f0000000380)={0x0, 0x10, 0x40, 0x6}, 0x10, 0x288c, r0, 0x0, &(0x7f00000003c0)}, 0x80) bpf$MAP_CREATE(0x0, &(0x7f0000000480)=@base={0x15, 0x1000, 0x401, 0x1, 0x0, r0, 0x6, '\x00', 0x0, r0, 0x3, 0x1}, 0x48) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) 15:32:08 executing program 4: pipe2$9p(0x0, 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x8080, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:08 executing program 1: r0 = openat$sw_sync(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x0, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:32:08 executing program 5: eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x8080, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:08 executing program 4: pipe2$9p(0x0, 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x8080, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:08 executing program 2: syz_open_dev$loop(&(0x7f0000000040), 0x400000000000, 0x80000) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f00000001c0)) sendmsg$NL80211_CMD_SET_BSS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000140)={&(0x7f0000000600)=ANY=[@ANYBLOB="000000dd8417fdfae493ba9aa345e63af890cdabd3904bd443969edd70a9bf2e1f411a5d8ce963cc1097c9b5ee763c1e6e59272d57de0734b926084bbb1f07b178745145ad7411b826fb7b1dbed99a5a", @ANYRES16=0x0, @ANYBLOB="48002abd7000ffdbdf25190000000c00990004000000590000000500a3000100000005001e000000000005001d00090000000500a2000000000005001c0000000000"], 0x48}}, 0x2) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_tracing={0x1a, 0x5, &(0x7f00000002c0)=@raw=[@btf_id={0x18, 0x5, 0x3, 0x0, 0x5}, @exit, @initr0={0x18, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x1}], &(0x7f0000000300)='syzkaller\x00', 0x30000, 0x0, 0x0, 0x0, 0x18, '\x00', 0x0, 0xb, r0, 0x8, &(0x7f0000000340)={0x6, 0x3}, 0x8, 0x10, &(0x7f0000000380)={0x0, 0x10, 0x40, 0x6}, 0x10, 0x288c, r0, 0x0, &(0x7f00000003c0)}, 0x80) bpf$MAP_CREATE(0x0, &(0x7f0000000480)=@base={0x15, 0x1000, 0x401, 0x1, 0x0, r0, 0x6, '\x00', 0x0, r0, 0x3, 0x1}, 0x48) 15:32:08 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r1, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, r1) socket(0x26, 0x5, 0x0) ioctl$LOOP_SET_FD(r0, 0x1263, 0xffffffffffffffff) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETSW(r2, 0x5403, &(0x7f0000000000)={0x2, 0x8, 0x9, 0x6e, 0x18, "86dacc8e28bb19f2cb097c72c47ffb4c328cb0"}) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r2, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {&(0x7f00000000c0), 0x1, {0xa, 0x4e23, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x38) 15:32:08 executing program 1: r0 = openat$sw_sync(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x0, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:32:08 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x0, 0x0, 0x0, &(0x7f0000000340)={0xa322}, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:09 executing program 2: syz_open_dev$loop(&(0x7f0000000040), 0x400000000000, 0x80000) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f00000001c0)) sendmsg$NL80211_CMD_SET_BSS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000140)={&(0x7f0000000600)=ANY=[@ANYBLOB="000000dd8417fdfae493ba9aa345e63af890cdabd3904bd443969edd70a9bf2e1f411a5d8ce963cc1097c9b5ee763c1e6e59272d57de0734b926084bbb1f07b178745145ad7411b826fb7b1dbed99a5a", @ANYRES16=0x0, @ANYBLOB="48002abd7000ffdbdf25190000000c00990004000000590000000500a3000100000005001e000000000005001d00090000000500a2000000000005001c0000000000"], 0x48}}, 0x2) bpf$MAP_CREATE(0x0, &(0x7f0000000480)=@base={0x15, 0x1000, 0x401, 0x1, 0x0, r0, 0x6, '\x00', 0x0, r0, 0x3, 0x1}, 0x48) 15:32:09 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r1, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, r1) socket(0x26, 0x5, 0x0) ioctl$LOOP_SET_FD(r0, 0x1263, 0xffffffffffffffff) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETSW(r2, 0x5403, &(0x7f0000000000)={0x2, 0x8, 0x9, 0x6e, 0x18, "86dacc8e28bb19f2cb097c72c47ffb4c328cb0"}) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r2, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {&(0x7f00000000c0), 0x1, {0xa, 0x4e23, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x38) 15:32:09 executing program 1: r0 = openat$sw_sync(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x0, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:32:09 executing program 4: pipe2$9p(0x0, 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x8080, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:09 executing program 5: syz_open_dev$loop(&(0x7f0000000040), 0x400000000000, 0x80000) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f00000001c0)) sendmsg$NL80211_CMD_SET_BSS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000140)={&(0x7f0000000600)=ANY=[@ANYBLOB="000000dd8417fdfae493ba9aa345e63af890cdabd3904bd443969edd70a9bf2e1f411a5d8ce963cc1097c9b5ee763c1e6e59272d57de0734b926084bbb1f07b178745145ad7411b826fb7b1dbed99a5a", @ANYRES16=0x0, @ANYBLOB="48002abd7000ffdbdf25190000000c00990004000000590000000500a3000100000005001e000000000005001d00090000000500a2000000000005001c0000000000"], 0x48}}, 0x2) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_tracing={0x1a, 0x5, &(0x7f00000002c0)=@raw=[@btf_id={0x18, 0x5, 0x3, 0x0, 0x5}, @exit, @initr0={0x18, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x1}], &(0x7f0000000300)='syzkaller\x00', 0x30000, 0x0, 0x0, 0x0, 0x18, '\x00', 0x0, 0xb, r0, 0x8, &(0x7f0000000340)={0x6, 0x3}, 0x8, 0x10, &(0x7f0000000380)={0x0, 0x10, 0x40, 0x6}, 0x10, 0x288c, r0, 0x0, &(0x7f00000003c0)}, 0x80) bpf$MAP_CREATE(0x0, &(0x7f0000000480)=@base={0x15, 0x1000, 0x401, 0x1, 0x0, r0, 0x6, '\x00', 0x0, r0, 0x3, 0x1}, 0x48) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) 15:32:09 executing program 2: syz_open_dev$loop(&(0x7f0000000040), 0x400000000000, 0x80000) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, &(0x7f00000001c0)) bpf$MAP_CREATE(0x0, &(0x7f0000000480)=@base={0x15, 0x1000, 0x401, 0x1, 0x0, r0, 0x6, '\x00', 0x0, r0, 0x3, 0x1}, 0x48) 15:32:09 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r1, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, r1) socket(0x26, 0x5, 0x0) ioctl$LOOP_SET_FD(r0, 0x1263, 0xffffffffffffffff) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETSW(r2, 0x5403, &(0x7f0000000000)={0x2, 0x8, 0x9, 0x6e, 0x18, "86dacc8e28bb19f2cb097c72c47ffb4c328cb0"}) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r2, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {&(0x7f00000000c0), 0x1, {0xa, 0x4e23, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x38) 15:32:09 executing program 4: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, 0x0, 0x8080, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:09 executing program 1: openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, &(0x7f0000000080)={0x0, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:32:09 executing program 5: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r1, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, r1) socket(0x26, 0x5, 0x0) ioctl$LOOP_SET_FD(r0, 0x1263, 0xffffffffffffffff) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETSW(r2, 0x5403, &(0x7f0000000000)={0x2, 0x8, 0x9, 0x6e, 0x18, "86dacc8e28bb19f2cb097c72c47ffb4c328cb0"}) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r2, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {&(0x7f00000000c0), 0x1, {0xa, 0x4e23, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x38) 15:32:09 executing program 2: syz_open_dev$loop(&(0x7f0000000040), 0x400000000000, 0x80000) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000480)=@base={0x15, 0x1000, 0x401, 0x1, 0x0, r0, 0x6, '\x00', 0x0, r0, 0x3, 0x1}, 0x48) 15:32:09 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x0, 0x0, 0x0, &(0x7f0000000340)={0xa322}, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:09 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r1, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, r1) socket(0x26, 0x5, 0x0) ioctl$LOOP_SET_FD(r0, 0x1263, 0xffffffffffffffff) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r2, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {&(0x7f00000000c0), 0x1, {0xa, 0x4e23, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x38) 15:32:09 executing program 1: openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, &(0x7f0000000080)={0x0, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:32:09 executing program 4: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, 0x0, 0x8080, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:09 executing program 2: syz_open_dev$loop(&(0x7f0000000040), 0x400000000000, 0x80000) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000480)=@base={0x15, 0x1000, 0x401, 0x1, 0x0, r0, 0x6, '\x00', 0x0, r0, 0x3, 0x1}, 0x48) 15:32:09 executing program 5: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r1, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, r1) socket(0x26, 0x5, 0x0) ioctl$LOOP_SET_FD(r0, 0x1263, 0xffffffffffffffff) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TCSETSW(r2, 0x5403, &(0x7f0000000000)={0x2, 0x8, 0x9, 0x6e, 0x18, "86dacc8e28bb19f2cb097c72c47ffb4c328cb0"}) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r2, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {&(0x7f00000000c0), 0x1, {0xa, 0x4e23, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x38) 15:32:09 executing program 4: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, 0x0, 0x8080, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:09 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r1, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, r1) socket(0x26, 0x5, 0x0) ioctl$LOOP_SET_FD(r0, 0x1263, 0xffffffffffffffff) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(0xffffffffffffffff, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {&(0x7f00000000c0), 0x1, {0xa, 0x4e23, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x38) 15:32:09 executing program 2: syz_open_dev$loop(&(0x7f0000000040), 0x400000000000, 0x80000) bpf$MAP_CREATE(0x0, &(0x7f0000000480)=@base={0x15, 0x1000, 0x401, 0x1, 0x0, 0xffffffffffffffff, 0x6, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x1}, 0x48) 15:32:09 executing program 1: openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, &(0x7f0000000080)={0x0, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:32:09 executing program 5: r0 = syz_open_dev$loop(&(0x7f0000000040), 0xffffffffffffffff, 0x2e0041) ioctl$LOOP_SET_FD(r0, 0x1263, 0xffffffffffffffff) ioctl$LOOP_GET_STATUS64(r0, 0x4c05, &(0x7f0000000080)) 15:32:10 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r1, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, r1) socket(0x26, 0x5, 0x0) ioctl$LOOP_SET_FD(r0, 0x1263, 0xffffffffffffffff) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(0xffffffffffffffff, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {&(0x7f00000000c0), 0x1, {0xa, 0x4e23, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x38) 15:32:10 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, 0x0, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:10 executing program 4: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:10 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000480)=@base={0x15, 0x1000, 0x401, 0x1, 0x0, 0xffffffffffffffff, 0x6, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x1}, 0x48) 15:32:10 executing program 1: r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, 0x0) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:32:10 executing program 5: r0 = syz_open_dev$loop(&(0x7f0000000040), 0xffffffffffffffff, 0x2e0041) ioctl$LOOP_SET_FD(r0, 0x1263, 0xffffffffffffffff) ioctl$LOOP_GET_STATUS64(r0, 0x4c05, &(0x7f0000000080)) 15:32:10 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r1, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, r1) socket(0x26, 0x5, 0x0) ioctl$LOOP_SET_FD(r0, 0x1263, 0xffffffffffffffff) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(0xffffffffffffffff, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {&(0x7f00000000c0), 0x1, {0xa, 0x4e23, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x38) 15:32:10 executing program 1: r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, 0x0) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:32:10 executing program 2: bpf$MAP_CREATE(0x0, 0x0, 0x0) 15:32:10 executing program 0: syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r0 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r0, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, r0) socket(0x26, 0x5, 0x0) r1 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r1, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {&(0x7f00000000c0), 0x1, {0xa, 0x4e23, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x38) 15:32:10 executing program 4: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:10 executing program 5: r0 = syz_open_dev$loop(&(0x7f0000000040), 0xffffffffffffffff, 0x2e0041) ioctl$LOOP_SET_FD(r0, 0x1263, 0xffffffffffffffff) ioctl$LOOP_GET_STATUS64(r0, 0x4c05, &(0x7f0000000080)) 15:32:10 executing program 2: bpf$MAP_CREATE(0x0, 0x0, 0x0) 15:32:11 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, 0x0, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:11 executing program 1: r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, 0x0) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:32:11 executing program 0: syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r0 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r0, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, r0) r1 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r1, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {&(0x7f00000000c0), 0x1, {0xa, 0x4e23, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x38) 15:32:11 executing program 5: r0 = syz_open_dev$loop(&(0x7f0000000040), 0xffffffffffffffff, 0x2e0041) ioctl$LOOP_SET_FD(r0, 0x1263, 0xffffffffffffffff) 15:32:11 executing program 4: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:11 executing program 2: bpf$MAP_CREATE(0x0, 0x0, 0x0) 15:32:11 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000480)=@base={0x0, 0x1000, 0x401, 0x1, 0x0, 0xffffffffffffffff, 0x6, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x1}, 0x48) 15:32:11 executing program 4: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x2, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:11 executing program 0: syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r0 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r0, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) r1 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r1, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {&(0x7f00000000c0), 0x1, {0xa, 0x4e23, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x38) 15:32:11 executing program 1: r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x0, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x0, 0x0, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:32:11 executing program 5: syz_open_dev$loop(&(0x7f0000000040), 0xffffffffffffffff, 0x2e0041) 15:32:11 executing program 5: syz_open_dev$loop(0x0, 0xffffffffffffffff, 0x2e0041) 15:32:12 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, 0x0, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:12 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000480)=@base={0x0, 0x1000, 0x401, 0x1, 0x0, 0xffffffffffffffff, 0x6, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x1}, 0x48) 15:32:12 executing program 4: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x0, 0x0, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:12 executing program 0: syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) socket$qrtr(0x2a, 0x2, 0x0) r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {&(0x7f00000000c0), 0x1, {0xa, 0x4e23, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x38) 15:32:12 executing program 5: syz_open_dev$loop(0x0, 0xffffffffffffffff, 0x2e0041) 15:32:12 executing program 5: syz_open_dev$loop(0x0, 0xffffffffffffffff, 0x2e0041) 15:32:12 executing program 4: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x0, 0x0, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:12 executing program 0: syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {&(0x7f00000000c0), 0x1, {0xa, 0x4e23, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x38) 15:32:12 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000480)=@base={0x0, 0x1000, 0x401, 0x1, 0x0, 0xffffffffffffffff, 0x6, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x1}, 0x48) 15:32:12 executing program 1: r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x0, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x0, 0x0, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:32:12 executing program 5: syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x2e0041) 15:32:12 executing program 4: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x0, 0x0, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:13 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000340), 0x0, &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:13 executing program 0: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {&(0x7f00000000c0), 0x1, {0xa, 0x4e23, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x38) 15:32:13 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000480)=@base={0x15, 0x0, 0x401, 0x1, 0x0, 0xffffffffffffffff, 0x6, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x1}, 0x48) 15:32:13 executing program 4: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0xffffffffffffffff, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:13 executing program 5: syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x2e0041) 15:32:13 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000480)=@base={0x15, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, 0x6, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x1}, 0x48) 15:32:13 executing program 1: r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x0, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x0, 0x0, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:32:13 executing program 5: syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x2e0041) 15:32:13 executing program 0: syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(0xffffffffffffffff, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {&(0x7f00000000c0), 0x1, {0xa, 0x4e23, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x38) 15:32:13 executing program 4: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:13 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000480)=@base={0x15, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x6, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x1}, 0x48) 15:32:13 executing program 0: syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(0xffffffffffffffff, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {&(0x7f00000000c0), 0x1, {0xa, 0x4e23, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x38) 15:32:14 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000340), 0x0, &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:14 executing program 5: syz_open_dev$loop(&(0x7f0000000040), 0xffffffffffffffff, 0x0) 15:32:14 executing program 4: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:14 executing program 0: syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(0xffffffffffffffff, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {&(0x7f00000000c0), 0x1, {0xa, 0x4e23, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x38) 15:32:14 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000480)=@base={0x15, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x1}, 0x48) 15:32:14 executing program 5: syz_open_dev$loop(&(0x7f0000000040), 0xffffffffffffffff, 0x0) 15:32:14 executing program 1: r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x0, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:32:14 executing program 0: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, 0x0, 0x0) 15:32:14 executing program 4: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:14 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000480)=@base={0x15, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x1}, 0x48) 15:32:14 executing program 5: syz_open_dev$loop(&(0x7f0000000040), 0xffffffffffffffff, 0x0) 15:32:14 executing program 0: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, 0x0, 0x0) 15:32:15 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000340), 0x0, &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:15 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000480)=@base={0x15}, 0x48) 15:32:15 executing program 4: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:15 executing program 0: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, 0x0, 0x0) 15:32:15 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x81, 0x7aab, 0x0, 0x8, 0x8001, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:15 executing program 1: r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x0, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180), 0x0, 0x0, 0x0, 0x0) 15:32:15 executing program 2: syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r0 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r0, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, r0) socket(0x26, 0x5, 0x0) r1 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r1, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {&(0x7f00000000c0), 0x1, {0xa, 0x4e23, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x38) 15:32:15 executing program 0: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x1, {0xa, 0x4e23, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x38) 15:32:15 executing program 5: r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, 0x0) pselect6(0x40, &(0x7f0000000180)={0x3}, 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:32:15 executing program 4: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd1}, &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:15 executing program 2: syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r0 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r0, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, r0) socket(0x26, 0x5, 0x0) r1 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r1, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {&(0x7f00000000c0), 0x1, {0xa, 0x4e23, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x38) 15:32:15 executing program 4: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), &(0x7f0000000140)={0x2, 0x800, 0x40, 0x3, 0x747, 0x7, 0x8, 0x1}, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:16 executing program 3: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) 15:32:16 executing program 5: openat$vcs(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) pipe2$9p(0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:32:16 executing program 0: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x0, {0xa, 0x4e23, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x38) 15:32:16 executing program 4: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000340)={0xa322, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:16 executing program 2: syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r0 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r0, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, r0) socket(0x26, 0x5, 0x0) r1 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r1, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {&(0x7f00000000c0), 0x1, {0xa, 0x4e23, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x38) 15:32:16 executing program 1: r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x0, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180), 0x0, 0x0, 0x0, 0x0) 15:32:16 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x4, &(0x7f00000000c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x9}, [@jmp={0x5, 0x1, 0x1, 0x3, 0xb, 0x8, 0xfffffffffffffff0}]}, &(0x7f0000000100)='GPL\x00', 0x4, 0x71, &(0x7f0000000240)=""/113, 0x40f00, 0x2, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000140)={0xa, 0x2}, 0x8, 0x10, &(0x7f00000001c0)={0x1, 0x4, 0x5, 0xe0d2}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x1, 0x1, 0x1, 0xffffffffffffffff, 0x1]}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000040)='xdp_bulk_tx\x00', r1}, 0x10) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000003c0), 0x4400, 0x0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r4, 0xc01064c2, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=@base={0x0, 0x4, 0x4, 0x1, 0x10, 0x1, 0x8, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x2, 0x5}, 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000640)={0x18, 0xb, &(0x7f0000000400)=@raw=[@map_val={0x18, 0x5, 0x2, 0x0, r2, 0x0, 0x0, 0x0, 0x8}, @btf_id={0x18, 0x3, 0x3, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0x31}, @exit, @kfunc={0x85, 0x0, 0x2, 0x0, 0x5}, @map_fd={0x18, 0x0, 0x1, 0x0, 0x1}, @initr0={0x18, 0x0, 0x0, 0x0, 0xf2, 0x0, 0x0, 0x0, 0x8}], &(0x7f0000000480)='GPL\x00', 0x81, 0x3f, &(0x7f00000004c0)=""/63, 0x40f00, 0x4, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000500)={0x6, 0x2}, 0x8, 0x10, &(0x7f0000000540)={0x0, 0x7, 0x80, 0x26f}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000600)=[r3, r4, r5, 0x1]}, 0x80) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c}, 0x0, 0x0) 15:32:16 executing program 4: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, 0x0, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:16 executing program 0: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x0, {0xa, 0x0, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x38) 15:32:16 executing program 2: syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r0 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r0, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, r0) socket(0x26, 0x5, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(0xffffffffffffffff, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {&(0x7f00000000c0), 0x1, {0xa, 0x4e23, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x38) 15:32:16 executing program 3: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x0, {0xa, 0x4e23, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x38) 15:32:16 executing program 0: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x0, {0xa, 0x0, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x38) 15:32:16 executing program 4: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, 0x0, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) [ 3132.705987][T26503] binder: 26498:26503 ioctl c0306201 0 returned -14 15:32:16 executing program 4: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, 0x0, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:16 executing program 2: syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r0 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r0, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, r0) socket(0x26, 0x5, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(0xffffffffffffffff, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {&(0x7f00000000c0), 0x1, {0xa, 0x4e23, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x38) 15:32:16 executing program 0: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x0, {0xa, 0x0, 0x0, @private2}}}, 0x38) 15:32:16 executing program 3: syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r0 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r0, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, r0) socket(0x26, 0x5, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(0xffffffffffffffff, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {&(0x7f00000000c0), 0x1, {0xa, 0x4e23, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x38) 15:32:17 executing program 2: syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r0 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r0, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, r0) socket(0x26, 0x5, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(0xffffffffffffffff, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {&(0x7f00000000c0), 0x1, {0xa, 0x4e23, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x38) 15:32:17 executing program 1: r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x0, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180), 0x0, 0x0, 0x0, 0x0) 15:32:17 executing program 4: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000340)={0x0, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:17 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1263, 0xffffffffffffffff) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f00000000c0)) r1 = syz_open_dev$loop(&(0x7f0000000000), 0x66c, 0xe21c0) r2 = syz_open_dev$cec(&(0x7f0000000080), 0x0, 0x2) ioctl$LOOP_CHANGE_FD(r1, 0x4c06, r2) 15:32:17 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000000), 0xffffffffffffffff, 0x0) ioctl$LOOP_SET_FD(r0, 0x301, 0xffffffffffffffff) socketpair(0x2b, 0x800, 0x5d11, &(0x7f0000000040)={0xffffffffffffffff}) r2 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r2, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) bind$qrtr(r2, &(0x7f0000000180)={0x2a, 0xffffffff}, 0xc) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="000127bd7000fcdbdf250a000000050038000100000005003000000000000500370001000000"], 0x2c}, 0x1, 0x0, 0x0, 0x8050}, 0x8080) 15:32:17 executing program 5: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000000)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000080)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f00000000c0)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(r0, 0xc02864ca, &(0x7f0000000180)={&(0x7f0000000100)=[0x0, r1, 0x0, r2, 0x0, r3], &(0x7f0000000140)=[0x80, 0x58f5, 0x0, 0x0, 0x7, 0x6], 0x1, 0x6, 0x3}) openat$sysctl(0xffffffffffffff9c, &(0x7f0000000200)='/sys/kernel/mm/ksm/run\x00', 0x1, 0x0) r4 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x20000) ioctl$TIOCL_SETVESABLANK(r0, 0x541c, &(0x7f0000000240)) ioctl$LOOP_SET_FD(r4, 0x1263, 0xffffffffffffffff) syz_open_dev$dri(&(0x7f00000001c0), 0x1, 0x2) 15:32:17 executing program 2: syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r0 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r0, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, r0) r1 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r1, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {&(0x7f00000000c0), 0x1, {0xa, 0x4e23, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x38) 15:32:17 executing program 4: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000340)={0x0, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:17 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000), 0x2, 0x0) r2 = bpf$OBJ_GET_PROG(0x7, &(0x7f00000000c0)={&(0x7f0000000080)='./file0\x00', 0x0, 0x10}, 0x10) ioctl$LOOP_SET_FD(r1, 0x4c00, r2) write$RDMA_USER_CM_CMD_REJECT(0xffffffffffffffff, &(0x7f0000000100)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x7f, "a37767", "46df22581e8497976b778e3aa119a9e55c433eeca866f7bd9bd5a4976c0834153ff77aea974d0b8342af487a84c90347fee9de1cb86f385e09bc606572288ab735c32145fa6c748c580385a163f1324a3a5999fbd74e6d4f253a7832df018ea4583ac5f5db661345642db2a5b963aa67d667f15259702828d6945f429c0f273b577c0b418b5ad5f879bdae088db71f72f246f18035293f55b75ad1759b0198df34df1f5f346a25e7b1d080e469647075ad1e3d096c908d7704cf53f7f69281e671fb46d082516af3af2dd8232ba1d7e75a4229b1e9a577e364e6989fb0d914fc719004703d3345bf0de973be6a0b829d9fd116a92b0740fdd629150102805ae0"}}, 0x110) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000280)={&(0x7f0000000240)='jbd2_handle_stats\x00', r3}, 0x10) ioctl$LOOP_SET_FD(r0, 0x125f, 0xffffffffffffffff) 15:32:17 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x40081271, 0xffffffffffffffff) 15:32:17 executing program 5: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1277, 0xffffffffffffffff) 15:32:17 executing program 2: syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r0 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r0, 0x8915, &(0x7f0000000200)={'virt_wifi0\x00'}) r1 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r1, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {&(0x7f00000000c0), 0x1, {0xa, 0x4e23, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x38) 15:32:17 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x40081271, 0xffffffffffffffff) 15:32:18 executing program 1: r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x0, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200), 0x0, 0x0) 15:32:18 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x400448c9, 0xffffffffffffffff) 15:32:18 executing program 4: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000340)={0x0, 0x7, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:18 executing program 5: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1277, 0xffffffffffffffff) 15:32:18 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x40081271, 0xffffffffffffffff) 15:32:18 executing program 2: syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) socket$qrtr(0x2a, 0x2, 0x0) r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {&(0x7f00000000c0), 0x1, {0xa, 0x4e23, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x38) 15:32:18 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x8933, 0xffffffffffffffff) 15:32:18 executing program 2: syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {&(0x7f00000000c0), 0x1, {0xa, 0x4e23, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x38) 15:32:18 executing program 5: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1277, 0xffffffffffffffff) 15:32:18 executing program 0: ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x40081271, 0xffffffffffffffff) 15:32:18 executing program 4: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000340)={0xa322, 0x0, 0x1, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:18 executing program 0: ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x40081271, 0xffffffffffffffff) 15:32:19 executing program 1: r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x0, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200), 0x0, 0x0) 15:32:19 executing program 5: ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x1277, 0xffffffffffffffff) 15:32:19 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {&(0x7f00000000c0), 0x1, {0xa, 0x4e23, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x38) 15:32:19 executing program 3: syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {&(0x7f00000000c0), 0x1, {0xa, 0x4e23, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x38) 15:32:19 executing program 4: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000340)={0xa322, 0x0, 0x0, 0xa, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:19 executing program 0: ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x40081271, 0xffffffffffffffff) 15:32:19 executing program 0: r0 = syz_open_dev$loop(0x0, 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x40081271, 0xffffffffffffffff) 15:32:19 executing program 5: ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x1277, 0xffffffffffffffff) 15:32:19 executing program 3: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x500000000000000}, 0x0, 0x0) 15:32:19 executing program 4: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000340)={0xa322, 0x0, 0x0, 0x0, 0x9, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:19 executing program 2: syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(0xffffffffffffffff, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {&(0x7f00000000c0), 0x1, {0xa, 0x4e23, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x38) 15:32:19 executing program 5: ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x1277, 0xffffffffffffffff) [ 3135.509311][T26586] binder: 26585:26586 ioctl c0306201 0 returned -14 15:32:20 executing program 1: r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000080)={0x0, "fa736a17ba0f301af430914942bc0b2c75412d00af8aa5adad44f9a9a275119f"}) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200), 0x0, 0x0) 15:32:20 executing program 4: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000340)={0xa322, 0x0, 0x0, 0x0, 0x0, 0xffffffffffff7fff, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:20 executing program 0: r0 = syz_open_dev$loop(0x0, 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x40081271, 0xffffffffffffffff) 15:32:20 executing program 5: r0 = syz_open_dev$loop(0x0, 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1277, 0xffffffffffffffff) 15:32:20 executing program 2: syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(0xffffffffffffffff, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {&(0x7f00000000c0), 0x1, {0xa, 0x4e23, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x38) 15:32:20 executing program 0: r0 = syz_open_dev$loop(0x0, 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x40081271, 0xffffffffffffffff) 15:32:20 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1267, 0xffffffffffffffff) 15:32:20 executing program 5: r0 = syz_open_dev$loop(0x0, 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1277, 0xffffffffffffffff) 15:32:20 executing program 4: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000340)={0xa322, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:20 executing program 2: syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(0xffffffffffffffff, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {&(0x7f00000000c0), 0x1, {0xa, 0x4e23, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x38) 15:32:20 executing program 0: syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x40081271, 0xffffffffffffffff) 15:32:20 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1267, 0xffffffffffffffff) 15:32:20 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, 0x0, 0x0) 15:32:20 executing program 5: r0 = syz_open_dev$loop(0x0, 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1277, 0xffffffffffffffff) 15:32:20 executing program 4: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000340)={0xa322, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:20 executing program 0: syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x40081271, 0xffffffffffffffff) 15:32:20 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1267, 0xffffffffffffffff) 15:32:20 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x5452, 0xffffffffffffffff) 15:32:21 executing program 5: syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x1277, 0xffffffffffffffff) 15:32:21 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, 0x0, 0x0) 15:32:21 executing program 3: ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x1267, 0xffffffffffffffff) 15:32:21 executing program 0: syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x40081271, 0xffffffffffffffff) 15:32:21 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, 0x0, 0x0) 15:32:21 executing program 4: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000340)={0xa322}, &(0x7f0000000280), &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:21 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x5452, 0xffffffffffffffff) 15:32:21 executing program 3: ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x1267, 0xffffffffffffffff) 15:32:21 executing program 5: syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x1277, 0xffffffffffffffff) 15:32:21 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1264, 0xffffffffffffffff) 15:32:21 executing program 4: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000340)={0xa322}, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)={[0xffffffffffff8001]}, 0x8}) 15:32:21 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x1, {0xa, 0x4e23, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x38) 15:32:21 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x5452, 0xffffffffffffffff) 15:32:21 executing program 3: ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x1267, 0xffffffffffffffff) 15:32:21 executing program 5: syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x1277, 0xffffffffffffffff) 15:32:21 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1269, 0xffffffffffffffff) 15:32:21 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x0, {0xa, 0x4e23, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x38) 15:32:21 executing program 1: ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x5452, 0xffffffffffffffff) 15:32:21 executing program 4: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) 15:32:21 executing program 3: r0 = syz_open_dev$loop(0x0, 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1267, 0xffffffffffffffff) 15:32:21 executing program 5: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x1, {0xa, 0x4e23, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x38) 15:32:21 executing program 1: ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x5452, 0xffffffffffffffff) 15:32:21 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1269, 0xffffffffffffffff) 15:32:21 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000}, 0x0, 0x0) 15:32:21 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x0, {0xa, 0x0, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x38) 15:32:21 executing program 3: r0 = syz_open_dev$loop(0x0, 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1267, 0xffffffffffffffff) 15:32:21 executing program 1: ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x5452, 0xffffffffffffffff) 15:32:21 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1269, 0xffffffffffffffff) [ 3137.711738][T26676] binder: 26673:26676 ioctl c0306201 0 returned -14 15:32:21 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) (fail_nth: 1) 15:32:21 executing program 3: r0 = syz_open_dev$loop(0x0, 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1267, 0xffffffffffffffff) 15:32:21 executing program 1: r0 = syz_open_dev$loop(0x0, 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x5452, 0xffffffffffffffff) 15:32:21 executing program 0: ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x1269, 0xffffffffffffffff) 15:32:21 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x0, {0xa, 0x0, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}}}}, 0x38) [ 3137.855424][T26687] FAULT_INJECTION: forcing a failure. [ 3137.855424][T26687] name fail_usercopy, interval 1, probability 0, space 0, times 0 15:32:21 executing program 0: ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x1269, 0xffffffffffffffff) 15:32:21 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x0, {0xa, 0x0, 0x0, @private2}}}, 0x38) [ 3137.896119][T26687] CPU: 0 PID: 26687 Comm: syz-executor.5 Not tainted 5.17.0-rc2-syzkaller-00353-g90c9e950c0de #0 [ 3137.906677][T26687] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3137.916751][T26687] Call Trace: [ 3137.920044][T26687] [ 3137.923099][T26687] dump_stack_lvl+0xcd/0x134 [ 3137.927723][T26687] should_fail.cold+0x5/0xa [ 3137.932253][T26687] _copy_from_user+0x2c/0x180 [ 3137.936954][T26687] core_sys_select+0x2bd/0x9c0 [ 3137.941746][T26687] ? do_compat_pselect+0x210/0x210 [ 3137.946891][T26687] ? __sanitizer_cov_trace_const_cmp1+0x22/0x80 [ 3137.953169][T26687] ? __lock_acquire+0x1655/0x5470 [ 3137.958231][T26687] ? set_user_sigmask+0x213/0x2a0 [ 3137.963285][T26687] ? __set_current_blocked+0x110/0x110 [ 3137.968764][T26687] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 3137.974785][T26687] do_pselect.constprop.0+0x17b/0x1c0 [ 3137.980190][T26687] ? kern_select+0x1c0/0x1c0 [ 3137.984809][T26687] ? __context_tracking_exit+0xb8/0xe0 [ 3137.990300][T26687] ? lock_downgrade+0x6e0/0x6e0 [ 3137.995186][T26687] ? lock_downgrade+0x6e0/0x6e0 [ 3138.000068][T26687] __x64_sys_pselect6+0x17f/0x230 [ 3138.005118][T26687] ? __ia32_sys_select+0x150/0x150 [ 3138.010249][T26687] ? syscall_enter_from_user_mode+0x21/0x70 [ 3138.016144][T26687] do_syscall_64+0x35/0xb0 [ 3138.020556][T26687] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 3138.026446][T26687] RIP: 0033:0x7fd9f38a2059 [ 3138.030853][T26687] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 3138.050464][T26687] RSP: 002b:00007fd9f2217168 EFLAGS: 00000246 ORIG_RAX: 000000000000010e [ 3138.058877][T26687] RAX: ffffffffffffffda RBX: 00007fd9f39b4f60 RCX: 00007fd9f38a2059 [ 3138.066847][T26687] RDX: 0000000000000000 RSI: 0000000020000100 RDI: 0000000000000040 [ 3138.074808][T26687] RBP: 00007fd9f22171d0 R08: 0000000000000000 R09: 0000000000000000 [ 3138.082766][T26687] R10: 0000000020000340 R11: 0000000000000246 R12: 0000000000000001 [ 3138.090724][T26687] R13: 00007fd9f3ee8b1f R14: 00007fd9f2217300 R15: 0000000000022000 [ 3138.098709][T26687] [ 3138.101797][ C0] vkms_vblank_simulate: vblank timer overrun 15:32:22 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000}, 0x0, 0x0) 15:32:22 executing program 0: ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x1269, 0xffffffffffffffff) 15:32:22 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x0, {0xa, 0x0, 0x0, @private2}}}, 0x38) (fail_nth: 1) 15:32:22 executing program 1: r0 = syz_open_dev$loop(0x0, 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x5452, 0xffffffffffffffff) 15:32:22 executing program 3: syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x1267, 0xffffffffffffffff) 15:32:22 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) (fail_nth: 2) 15:32:22 executing program 0: r0 = syz_open_dev$loop(0x0, 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1269, 0xffffffffffffffff) 15:32:22 executing program 1: r0 = syz_open_dev$loop(0x0, 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x5452, 0xffffffffffffffff) [ 3138.592900][T26708] FAULT_INJECTION: forcing a failure. [ 3138.592900][T26708] name failslab, interval 1, probability 0, space 0, times 0 [ 3138.599993][T26707] FAULT_INJECTION: forcing a failure. [ 3138.599993][T26707] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 3138.617219][T26708] CPU: 0 PID: 26708 Comm: syz-executor.2 Not tainted 5.17.0-rc2-syzkaller-00353-g90c9e950c0de #0 [ 3138.629575][T26708] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3138.639648][T26708] Call Trace: [ 3138.642943][T26708] [ 3138.645887][T26708] dump_stack_lvl+0xcd/0x134 [ 3138.650520][T26708] should_fail.cold+0x5/0xa [ 3138.655050][T26708] ? kvmalloc_node+0x3e/0x100 [ 3138.659744][T26708] should_failslab+0x5/0x10 [ 3138.664269][T26708] __kmalloc_node+0x75/0x390 [ 3138.668881][T26708] kvmalloc_node+0x3e/0x100 [ 3138.673428][T26708] file_tty_write.constprop.0+0x681/0x910 [ 3138.679171][T26708] ? n_tty_receive_char+0x5b0/0x5b0 [ 3138.684407][T26708] new_sync_write+0x431/0x660 [ 3138.689107][T26708] ? new_sync_read+0x6e0/0x6e0 [ 3138.693903][T26708] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 3138.700607][T26708] ? security_file_permission+0xab/0xd0 [ 3138.706190][T26708] vfs_write+0x7cd/0xae0 [ 3138.710452][T26708] ksys_write+0x12d/0x250 [ 3138.714793][T26708] ? __ia32_sys_read+0xb0/0xb0 [ 3138.719577][T26708] ? syscall_enter_from_user_mode+0x21/0x70 [ 3138.725657][T26708] do_syscall_64+0x35/0xb0 [ 3138.730095][T26708] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 3138.736012][T26708] RIP: 0033:0x7f29fb428059 [ 3138.740433][T26708] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 3138.760054][T26708] RSP: 002b:00007f29f9d9d168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 3138.768476][T26708] RAX: ffffffffffffffda RBX: 00007f29fb53af60 RCX: 00007f29fb428059 [ 3138.776467][T26708] RDX: 0000000000000038 RSI: 0000000020000100 RDI: 0000000000000003 [ 3138.784452][T26708] RBP: 00007f29f9d9d1d0 R08: 0000000000000000 R09: 0000000000000000 [ 3138.792439][T26708] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 3138.800428][T26708] R13: 00007f29fba6eb1f R14: 00007f29f9d9d300 R15: 0000000000022000 [ 3138.808427][T26708] [ 3138.811453][T26707] CPU: 1 PID: 26707 Comm: syz-executor.5 Not tainted 5.17.0-rc2-syzkaller-00353-g90c9e950c0de #0 [ 3138.811535][ C0] vkms_vblank_simulate: vblank timer overrun [ 3138.821973][T26707] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3138.837983][T26707] Call Trace: [ 3138.841263][T26707] [ 3138.844192][T26707] dump_stack_lvl+0xcd/0x134 [ 3138.848786][T26707] should_fail.cold+0x5/0xa [ 3138.853290][T26707] _copy_from_user+0x2c/0x180 [ 3138.857972][T26707] core_sys_select+0x366/0x9c0 [ 3138.862740][T26707] ? do_compat_pselect+0x210/0x210 [ 3138.867856][T26707] ? __sanitizer_cov_trace_const_cmp1+0x22/0x80 [ 3138.874110][T26707] ? __lock_acquire+0x1655/0x5470 [ 3138.879143][T26707] ? set_user_sigmask+0x213/0x2a0 [ 3138.884170][T26707] ? __set_current_blocked+0x110/0x110 [ 3138.889673][T26707] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 3138.895667][T26707] do_pselect.constprop.0+0x17b/0x1c0 [ 3138.901045][T26707] ? kern_select+0x1c0/0x1c0 [ 3138.905640][T26707] ? __context_tracking_exit+0xb8/0xe0 [ 3138.911099][T26707] ? lock_downgrade+0x6e0/0x6e0 [ 3138.915953][T26707] ? lock_downgrade+0x6e0/0x6e0 [ 3138.920965][T26707] __x64_sys_pselect6+0x17f/0x230 [ 3138.926013][T26707] ? __ia32_sys_select+0x150/0x150 [ 3138.931136][T26707] ? syscall_enter_from_user_mode+0x21/0x70 [ 3138.937044][T26707] do_syscall_64+0x35/0xb0 [ 3138.941459][T26707] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 3138.947356][T26707] RIP: 0033:0x7fd9f38a2059 [ 3138.951774][T26707] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 3138.971381][T26707] RSP: 002b:00007fd9f2217168 EFLAGS: 00000246 ORIG_RAX: 000000000000010e [ 3138.979791][T26707] RAX: ffffffffffffffda RBX: 00007fd9f39b4f60 RCX: 00007fd9f38a2059 15:32:22 executing program 3: syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x1267, 0xffffffffffffffff) [ 3138.987772][T26707] RDX: 0000000000000000 RSI: 0000000020000100 RDI: 0000000000000040 [ 3138.995748][T26707] RBP: 00007fd9f22171d0 R08: 0000000000000000 R09: 0000000000000000 [ 3139.003720][T26707] R10: 0000000020000340 R11: 0000000000000246 R12: 0000000000000001 [ 3139.011686][T26707] R13: 00007fd9f3ee8b1f R14: 00007fd9f2217300 R15: 0000000000022000 [ 3139.019671][T26707] 15:32:22 executing program 0: r0 = syz_open_dev$loop(0x0, 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1269, 0xffffffffffffffff) 15:32:22 executing program 1: syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x5452, 0xffffffffffffffff) [ 3139.049399][T26713] binder: 26710:26713 ioctl c0306201 0 returned -14 15:32:22 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) (fail_nth: 3) [ 3139.164279][T26723] FAULT_INJECTION: forcing a failure. [ 3139.164279][T26723] name failslab, interval 1, probability 0, space 0, times 0 [ 3139.178026][T26723] CPU: 1 PID: 26723 Comm: syz-executor.5 Not tainted 5.17.0-rc2-syzkaller-00353-g90c9e950c0de #0 [ 3139.188561][T26723] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3139.198634][T26723] Call Trace: [ 3139.201923][T26723] [ 3139.204862][T26723] dump_stack_lvl+0xcd/0x134 [ 3139.209469][T26723] should_fail.cold+0x5/0xa [ 3139.214056][T26723] ? vcs_poll_data_get.part.0+0x43/0x270 [ 3139.219692][T26723] should_failslab+0x5/0x10 [ 3139.224204][T26723] kmem_cache_alloc_trace+0x55/0x2c0 [ 3139.229495][T26723] vcs_poll_data_get.part.0+0x43/0x270 [ 3139.234955][T26723] vcs_poll+0x13f/0x180 [ 3139.239111][T26723] ? vcs_fasync+0xb0/0xb0 [ 3139.243440][T26723] do_select+0x996/0x16a0 [ 3139.247793][T26723] ? select_estimate_accuracy+0x320/0x320 [ 3139.253517][T26723] ? __stack_depot_save+0x35/0x500 [ 3139.258632][T26723] ? poll_initwait+0x170/0x170 [ 3139.263422][T26723] ? poll_schedule_timeout.constprop.0+0x190/0x190 [ 3139.269927][T26723] ? poll_schedule_timeout.constprop.0+0x190/0x190 [ 3139.276431][T26723] ? __lock_acquire+0x1655/0x5470 [ 3139.281464][T26723] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 3139.287558][T26723] ? find_held_lock+0x2d/0x110 [ 3139.292328][T26723] ? __might_fault+0xd1/0x170 [ 3139.297014][T26723] ? lock_downgrade+0x6e0/0x6e0 [ 3139.301887][T26723] core_sys_select+0x3c2/0x9c0 [ 3139.306659][T26723] ? do_compat_pselect+0x210/0x210 [ 3139.311776][T26723] ? __sanitizer_cov_trace_const_cmp1+0x22/0x80 [ 3139.318029][T26723] ? __lock_acquire+0x1655/0x5470 [ 3139.323064][T26723] ? set_user_sigmask+0x213/0x2a0 [ 3139.328089][T26723] ? __set_current_blocked+0x110/0x110 [ 3139.333554][T26723] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 3139.339541][T26723] do_pselect.constprop.0+0x17b/0x1c0 [ 3139.344916][T26723] ? kern_select+0x1c0/0x1c0 [ 3139.349518][T26723] ? __context_tracking_exit+0xb8/0xe0 [ 3139.355067][T26723] ? lock_downgrade+0x6e0/0x6e0 [ 3139.360005][T26723] ? lock_downgrade+0x6e0/0x6e0 [ 3139.364864][T26723] __x64_sys_pselect6+0x17f/0x230 [ 3139.369893][T26723] ? __ia32_sys_select+0x150/0x150 [ 3139.375013][T26723] ? syscall_enter_from_user_mode+0x21/0x70 [ 3139.380911][T26723] do_syscall_64+0x35/0xb0 [ 3139.385326][T26723] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 3139.391236][T26723] RIP: 0033:0x7fd9f38a2059 [ 3139.395648][T26723] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 3139.415250][T26723] RSP: 002b:00007fd9f2217168 EFLAGS: 00000246 ORIG_RAX: 000000000000010e [ 3139.423659][T26723] RAX: ffffffffffffffda RBX: 00007fd9f39b4f60 RCX: 00007fd9f38a2059 [ 3139.431628][T26723] RDX: 0000000000000000 RSI: 0000000020000100 RDI: 0000000000000040 [ 3139.439594][T26723] RBP: 00007fd9f22171d0 R08: 0000000000000000 R09: 0000000000000000 [ 3139.447563][T26723] R10: 0000000020000340 R11: 0000000000000246 R12: 0000000000000001 [ 3139.455528][T26723] R13: 00007fd9f3ee8b1f R14: 00007fd9f2217300 R15: 0000000000022000 [ 3139.463509][T26723] 15:32:23 executing program 4: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) pselect6(0x40, &(0x7f0000000180), 0x0, &(0x7f0000000200)={0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000}, 0x0, 0x0) 15:32:23 executing program 3: syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x1267, 0xffffffffffffffff) 15:32:23 executing program 1: syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x5452, 0xffffffffffffffff) 15:32:23 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x0, {0xa, 0x0, 0x0, @private2}}}, 0x38) (fail_nth: 2) 15:32:23 executing program 0: r0 = syz_open_dev$loop(0x0, 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1269, 0xffffffffffffffff) 15:32:23 executing program 0: syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x1269, 0xffffffffffffffff) [ 3139.918137][T26729] FAULT_INJECTION: forcing a failure. [ 3139.918137][T26729] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 3139.939160][T26733] binder: 26732:26733 ioctl c0306201 0 returned -14 [ 3139.949517][T26729] CPU: 0 PID: 26729 Comm: syz-executor.2 Not tainted 5.17.0-rc2-syzkaller-00353-g90c9e950c0de #0 15:32:23 executing program 0: syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x1269, 0xffffffffffffffff) [ 3139.960066][T26729] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3139.970166][T26729] Call Trace: [ 3139.973460][T26729] [ 3139.976409][T26729] dump_stack_lvl+0xcd/0x134 [ 3139.981023][T26729] should_fail.cold+0x5/0xa [ 3139.985548][T26729] _copy_from_iter+0x389/0x1410 [ 3139.990429][T26729] ? hash_and_copy_to_iter+0x200/0x200 [ 3139.995915][T26729] ? __sanitizer_cov_trace_const_cmp1+0x22/0x80 [ 3140.002186][T26729] ? __sanitizer_cov_trace_const_cmp1+0x22/0x80 [ 3140.008462][T26729] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 15:32:23 executing program 0: syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x1269, 0xffffffffffffffff) 15:32:23 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1269, 0xffffffffffffffff) (fail_nth: 1) [ 3140.014734][T26729] ? __phys_addr+0xc4/0x140 [ 3140.019271][T26729] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 3140.025543][T26729] ? __phys_addr_symbol+0x2c/0x70 [ 3140.030599][T26729] ? __sanitizer_cov_trace_cmp8+0x1d/0x70 [ 3140.036349][T26729] ? __check_object_size+0x16e/0x310 [ 3140.041665][T26729] file_tty_write.constprop.0+0x4d5/0x910 [ 3140.047414][T26729] ? n_tty_receive_char+0x5b0/0x5b0 [ 3140.052727][T26729] new_sync_write+0x431/0x660 [ 3140.057430][T26729] ? new_sync_read+0x6e0/0x6e0 [ 3140.062239][T26729] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 3140.068511][T26729] ? security_file_permission+0xab/0xd0 [ 3140.074092][T26729] vfs_write+0x7cd/0xae0 [ 3140.074762][T26741] FAULT_INJECTION: forcing a failure. [ 3140.074762][T26741] name failslab, interval 1, probability 0, space 0, times 0 [ 3140.078363][T26729] ksys_write+0x12d/0x250 [ 3140.078400][T26729] ? __ia32_sys_read+0xb0/0xb0 [ 3140.078435][T26729] ? syscall_enter_from_user_mode+0x21/0x70 [ 3140.105968][T26729] do_syscall_64+0x35/0xb0 [ 3140.110396][T26729] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 3140.116302][T26729] RIP: 0033:0x7f29fb428059 [ 3140.120724][T26729] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 3140.140345][T26729] RSP: 002b:00007f29f9d9d168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 3140.148872][T26729] RAX: ffffffffffffffda RBX: 00007f29fb53af60 RCX: 00007f29fb428059 [ 3140.156851][T26729] RDX: 0000000000000038 RSI: 0000000020000100 RDI: 0000000000000003 [ 3140.164830][T26729] RBP: 00007f29f9d9d1d0 R08: 0000000000000000 R09: 0000000000000000 [ 3140.172812][T26729] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 3140.180788][T26729] R13: 00007f29fba6eb1f R14: 00007f29f9d9d300 R15: 0000000000022000 [ 3140.188794][T26729] [ 3140.191818][T26741] CPU: 1 PID: 26741 Comm: syz-executor.0 Not tainted 5.17.0-rc2-syzkaller-00353-g90c9e950c0de #0 [ 3140.202342][T26741] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3140.212397][T26741] Call Trace: [ 3140.215673][T26741] [ 3140.218601][T26741] dump_stack_lvl+0xcd/0x134 [ 3140.223195][T26741] should_fail.cold+0x5/0xa [ 3140.227697][T26741] ? tomoyo_realpath_from_path+0xc3/0x620 [ 3140.233432][T26741] should_failslab+0x5/0x10 [ 3140.237951][T26741] __kmalloc+0x72/0x340 [ 3140.242115][T26741] ? lock_chain_count+0x20/0x20 [ 3140.246978][T26741] tomoyo_realpath_from_path+0xc3/0x620 [ 3140.252537][T26741] ? tomoyo_profile+0x42/0x50 [ 3140.257216][T26741] tomoyo_path_number_perm+0x1d5/0x590 [ 3140.262681][T26741] ? tomoyo_path_number_perm+0x18d/0x590 [ 3140.268340][T26741] ? tomoyo_execute_permission+0x4a0/0x4a0 [ 3140.274156][T26741] ? __lock_acquire+0x1655/0x5470 [ 3140.279209][T26741] ? find_held_lock+0x2d/0x110 [ 3140.283987][T26741] ? __fget_files+0x28c/0x470 [ 3140.288673][T26741] security_file_ioctl+0x50/0xb0 [ 3140.293615][T26741] __x64_sys_ioctl+0xb3/0x200 [ 3140.298292][T26741] do_syscall_64+0x35/0xb0 [ 3140.302715][T26741] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 3140.308620][T26741] RIP: 0033:0x7f0aa432d059 [ 3140.313042][T26741] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 3140.332651][T26741] RSP: 002b:00007f0aa2ca2168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3140.341064][T26741] RAX: ffffffffffffffda RBX: 00007f0aa443ff60 RCX: 00007f0aa432d059 [ 3140.349029][T26741] RDX: ffffffffffffffff RSI: 0000000000001269 RDI: 0000000000000003 [ 3140.356994][T26741] RBP: 00007f0aa2ca21d0 R08: 0000000000000000 R09: 0000000000000000 15:32:24 executing program 1: syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x5452, 0xffffffffffffffff) 15:32:24 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1267, 0xffffffffffffffff) (fail_nth: 1) 15:32:24 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100), 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) [ 3140.364961][T26741] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 3140.372924][T26741] R13: 00007f0aa4973b1f R14: 00007f0aa2ca2300 R15: 0000000000022000 [ 3140.380907][T26741] [ 3140.396999][T26741] ERROR: Out of memory at tomoyo_realpath_from_path. [ 3140.459591][T26745] FAULT_INJECTION: forcing a failure. [ 3140.459591][T26745] name failslab, interval 1, probability 0, space 0, times 0 [ 3140.500170][T26745] CPU: 1 PID: 26745 Comm: syz-executor.3 Not tainted 5.17.0-rc2-syzkaller-00353-g90c9e950c0de #0 [ 3140.510754][T26745] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3140.520833][T26745] Call Trace: [ 3140.524128][T26745] [ 3140.527097][T26745] dump_stack_lvl+0xcd/0x134 [ 3140.531720][T26745] should_fail.cold+0x5/0xa [ 3140.536251][T26745] ? tomoyo_realpath_from_path+0xc3/0x620 [ 3140.542002][T26745] should_failslab+0x5/0x10 [ 3140.546530][T26745] __kmalloc+0x72/0x340 [ 3140.550728][T26745] ? lock_chain_count+0x20/0x20 [ 3140.555627][T26745] tomoyo_realpath_from_path+0xc3/0x620 [ 3140.561168][T26745] ? tomoyo_profile+0x42/0x50 [ 3140.565859][T26745] tomoyo_path_number_perm+0x1d5/0x590 [ 3140.571320][T26745] ? tomoyo_path_number_perm+0x18d/0x590 [ 3140.576996][T26745] ? tomoyo_execute_permission+0x4a0/0x4a0 [ 3140.582798][T26745] ? __lock_acquire+0x1655/0x5470 [ 3140.587832][T26745] ? find_held_lock+0x2d/0x110 [ 3140.592608][T26745] ? __fget_files+0x28c/0x470 [ 3140.597324][T26745] security_file_ioctl+0x50/0xb0 [ 3140.602265][T26745] __x64_sys_ioctl+0xb3/0x200 [ 3140.606950][T26745] do_syscall_64+0x35/0xb0 [ 3140.611369][T26745] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 3140.617268][T26745] RIP: 0033:0x7fdabb663059 [ 3140.621690][T26745] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 3140.641306][T26745] RSP: 002b:00007fdab9fd8168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3140.649725][T26745] RAX: ffffffffffffffda RBX: 00007fdabb775f60 RCX: 00007fdabb663059 [ 3140.657695][T26745] RDX: ffffffffffffffff RSI: 0000000000001267 RDI: 0000000000000003 [ 3140.665662][T26745] RBP: 00007fdab9fd81d0 R08: 0000000000000000 R09: 0000000000000000 [ 3140.673627][T26745] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 3140.681590][T26745] R13: 00007fdabbca9b1f R14: 00007fdab9fd8300 R15: 0000000000022000 [ 3140.689572][T26745] [ 3140.696422][T26745] ERROR: Out of memory at tomoyo_realpath_from_path. 15:32:24 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1277, 0xffffffffffffffff) (fail_nth: 1) 15:32:24 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1269, 0xffffffffffffffff) (fail_nth: 2) 15:32:24 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x5452, 0xffffffffffffffff) (fail_nth: 1) 15:32:24 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x2}, 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) 15:32:24 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x0, {0xa, 0x0, 0x0, @private2}}}, 0x38) (fail_nth: 3) 15:32:24 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1267, 0xffffffffffffffff) (fail_nth: 2) [ 3140.796520][T26749] FAULT_INJECTION: forcing a failure. [ 3140.796520][T26749] name failslab, interval 1, probability 0, space 0, times 0 [ 3140.826916][T26758] FAULT_INJECTION: forcing a failure. [ 3140.826916][T26758] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 3140.828320][T26756] FAULT_INJECTION: forcing a failure. [ 3140.828320][T26756] name failslab, interval 1, probability 0, space 0, times 0 [ 3140.828620][T26756] [ 3140.828625][T26756] ====================================================== [ 3140.828631][T26756] WARNING: possible circular locking dependency detected [ 3140.828639][T26756] 5.17.0-rc2-syzkaller-00353-g90c9e950c0de #0 Not tainted [ 3140.828650][T26756] ------------------------------------------------------ [ 3140.828656][T26756] syz-executor.2/26756 is trying to acquire lock: [ 3140.828667][T26756] ffffffff8ba922e0 (console_owner){-...}-{0:0}, at: vprintk_emit+0x29b/0x4f0 [ 3140.828776][T26756] [ 3140.828776][T26756] but task is already holding lock: [ 3140.828782][T26756] ffff88801d21f958 (&port->lock){-.-.}-{2:2}, at: pty_write+0xea/0x1e0 [ 3140.828832][T26756] [ 3140.828832][T26756] which lock already depends on the new lock. [ 3140.828832][T26756] [ 3140.828837][T26756] [ 3140.828837][T26756] the existing dependency chain (in reverse order) is: [ 3140.828843][T26756] [ 3140.828843][T26756] -> #2 (&port->lock){-.-.}-{2:2}: [ 3140.828867][T26756] _raw_spin_lock_irqsave+0x39/0x50 [ 3140.828894][T26756] tty_port_tty_get+0x1f/0x100 [ 3140.828915][T26756] tty_port_default_wakeup+0x11/0x40 [ 3140.828941][T26756] serial8250_tx_chars+0x4f3/0xad0 [ 3140.828966][T26756] serial8250_handle_irq.part.0+0x328/0x3d0 [ 3140.828992][T26756] serial8250_default_handle_irq+0xb2/0x220 [ 3140.829017][T26756] serial8250_interrupt+0xfd/0x200 [ 3140.829039][T26756] __handle_irq_event_percpu+0x22b/0x880 [ 3140.829059][T26756] handle_irq_event+0xa7/0x1e0 [ 3140.829077][T26756] handle_edge_irq+0x25f/0xd00 [ 3140.829098][T26756] __common_interrupt+0x9d/0x210 [ 3140.829163][T26756] common_interrupt+0xa4/0xc0 [ 3140.829186][T26756] asm_common_interrupt+0x1e/0x40 [ 3140.829206][T26756] acpi_idle_do_entry+0x1c6/0x250 [ 3140.829230][T26756] acpi_idle_enter+0x361/0x500 [ 3140.829276][T26756] cpuidle_enter_state+0x1b1/0xc80 [ 3140.829359][T26756] cpuidle_enter+0x4a/0xa0 [ 3140.829383][T26756] do_idle+0x3e8/0x590 [ 3140.829425][T26756] cpu_startup_entry+0x14/0x20 [ 3140.829448][T26756] start_kernel+0x47a/0x49b [ 3140.829510][T26756] secondary_startup_64_no_verify+0xc3/0xcb [ 3140.829541][T26756] [ 3140.829541][T26756] -> #1 (&port_lock_key){-.-.}-{2:2}: [ 3140.829568][T26756] _raw_spin_lock_irqsave+0x39/0x50 [ 3140.829592][T26756] serial8250_console_write+0x91a/0xb70 [ 3140.829617][T26756] console_unlock+0x7a9/0xb70 [ 3140.829639][T26756] vprintk_emit+0x198/0x4f0 [ 3140.829661][T26756] vprintk+0x80/0x90 [ 3140.829683][T26756] _printk+0xba/0xed [ 3140.829714][T26756] register_console+0x410/0x7c0 [ 3140.829735][T26756] univ8250_console_init+0x3a/0x46 [ 3140.829771][T26756] console_init+0x3c1/0x58d [ 3140.829791][T26756] start_kernel+0x30b/0x49b [ 3140.829812][T26756] secondary_startup_64_no_verify+0xc3/0xcb [ 3140.829836][T26756] [ 3140.829836][T26756] -> #0 (console_owner){-...}-{0:0}: [ 3140.829860][T26756] __lock_acquire+0x2a2c/0x5470 [ 3140.829883][T26756] lock_acquire+0x1ab/0x510 [ 3140.829905][T26756] vprintk_emit+0x2d8/0x4f0 [ 3140.829928][T26756] vprintk+0x80/0x90 [ 3140.829949][T26756] _printk+0xba/0xed [ 3140.829969][T26756] should_fail+0x472/0x5a0 [ 3140.829989][T26756] should_failslab+0x5/0x10 [ 3140.830014][T26756] __kmalloc+0x72/0x340 [ 3140.830037][T26756] tty_buffer_alloc+0x23f/0x2a0 [ 3140.830058][T26756] __tty_buffer_request_room+0x156/0x2a0 [ 3140.830080][T26756] tty_insert_flip_string_fixed_flag+0x93/0x250 [ 3140.830105][T26756] pty_write+0x11c/0x1e0 [ 3140.830126][T26756] n_tty_write+0xa7a/0xfd0 [ 3140.830145][T26756] file_tty_write.constprop.0+0x526/0x910 [ 3140.830171][T26756] new_sync_write+0x431/0x660 [ 3140.830194][T26756] vfs_write+0x7cd/0xae0 [ 3140.830216][T26756] ksys_write+0x12d/0x250 [ 3140.830238][T26756] do_syscall_64+0x35/0xb0 [ 3140.830257][T26756] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 3140.830284][T26756] [ 3140.830284][T26756] other info that might help us debug this: [ 3140.830284][T26756] [ 3140.830290][T26756] Chain exists of: [ 3140.830290][T26756] console_owner --> &port_lock_key --> &port->lock [ 3140.830290][T26756] [ 3140.830318][T26756] Possible unsafe locking scenario: [ 3140.830318][T26756] [ 3140.830322][T26756] CPU0 CPU1 [ 3140.830328][T26756] ---- ---- [ 3140.830333][T26756] lock(&port->lock); [ 3140.830350][T26756] lock(&port_lock_key); [ 3140.830363][T26756] lock(&port->lock); [ 3140.830376][T26756] lock(console_owner); [ 3140.830387][T26756] [ 3140.830387][T26756] *** DEADLOCK *** [ 3140.830387][T26756] [ 3140.830391][T26756] 5 locks held by syz-executor.2/26756: [ 3140.830405][T26756] #0: ffff888080d72098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x22/0x80 [ 3140.830456][T26756] #1: ffff888080d72130 (&tty->atomic_write_lock){+.+.}-{3:3}, at: file_tty_write.constprop.0+0x29f/0x910 [ 3140.830510][T26756] #2: ffff888080d722e8 (&tty->termios_rwsem){++++}-{3:3}, at: n_tty_write+0x1bf/0xfd0 [ 3140.830556][T26756] #3: ffffc9000fbfb378 (&ldata->output_lock){+.+.}-{3:3}, at: n_tty_write+0xa47/0xfd0 [ 3140.830602][T26756] #4: ffff88801d21f958 (&port->lock){-.-.}-{2:2}, at: pty_write+0xea/0x1e0 [ 3140.830651][T26756] [ 3140.830651][T26756] stack backtrace: [ 3140.830657][T26756] CPU: 1 PID: 26756 Comm: syz-executor.2 Not tainted 5.17.0-rc2-syzkaller-00353-g90c9e950c0de #0 [ 3140.830680][T26756] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3140.830692][T26756] Call Trace: [ 3140.830699][T26756] [ 3140.830707][T26756] dump_stack_lvl+0xcd/0x134 [ 3140.830733][T26756] check_noncircular+0x25f/0x2e0 [ 3140.830759][T26756] ? filter_irq_stacks+0x90/0x90 [ 3140.830786][T26756] ? print_circular_bug+0x1e0/0x1e0 [ 3140.830813][T26756] ? lockdep_lock+0xc6/0x200 [ 3140.830836][T26756] ? call_rcu_zapped+0xb0/0xb0 [ 3140.830860][T26756] __lock_acquire+0x2a2c/0x5470 [ 3140.830890][T26756] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 3140.830920][T26756] lock_acquire+0x1ab/0x510 [ 3140.830943][T26756] ? vprintk_emit+0x29b/0x4f0 [ 3140.830968][T26756] ? lock_release+0x720/0x720 [ 3140.830992][T26756] ? lock_downgrade+0x6e0/0x6e0 [ 3140.831015][T26756] ? do_raw_spin_lock+0x120/0x2b0 [ 3140.831041][T26756] ? rwlock_bug.part.0+0x90/0x90 [ 3140.831066][T26756] ? _raw_spin_unlock_irqrestore+0x3d/0x70 [ 3140.831095][T26756] vprintk_emit+0x2d8/0x4f0 [ 3140.831118][T26756] ? vprintk_emit+0x29b/0x4f0 [ 3140.831144][T26756] vprintk+0x80/0x90 [ 3140.831168][T26756] _printk+0xba/0xed [ 3140.831190][T26756] ? record_print_text.cold+0x16/0x16 [ 3140.831217][T26756] ? __lock_acquire+0x1655/0x5470 [ 3140.831241][T26756] ? ___ratelimit+0x222/0x4b0 [ 3140.831264][T26756] should_fail+0x472/0x5a0 [ 3140.831287][T26756] ? tty_buffer_alloc+0x23f/0x2a0 [ 3140.831308][T26756] should_failslab+0x5/0x10 [ 3140.831334][T26756] __kmalloc+0x72/0x340 [ 3140.831368][T26756] tty_buffer_alloc+0x23f/0x2a0 [ 3140.831393][T26756] __tty_buffer_request_room+0x156/0x2a0 [ 3140.831419][T26756] tty_insert_flip_string_fixed_flag+0x93/0x250 [ 3140.831448][T26756] pty_write+0x11c/0x1e0 [ 3140.831474][T26756] n_tty_write+0xa7a/0xfd0 [ 3140.831494][T26756] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 3140.831522][T26756] ? _copy_from_iter+0x12b/0x1410 [ 3140.831549][T26756] ? n_tty_receive_char+0x5b0/0x5b0 [ 3140.831571][T26756] ? __init_waitqueue_head+0xd0/0xd0 [ 3140.831594][T26756] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 3140.831622][T26756] ? __phys_addr+0xc4/0x140 [ 3140.831645][T26756] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 3140.831672][T26756] ? __phys_addr_symbol+0x2c/0x70 [ 3140.831695][T26756] ? __sanitizer_cov_trace_cmp8+0x1d/0x70 [ 3140.831720][T26756] ? __check_object_size+0x16e/0x310 [ 3140.831743][T26756] file_tty_write.constprop.0+0x526/0x910 [ 3140.831771][T26756] ? n_tty_receive_char+0x5b0/0x5b0 [ 3140.831795][T26756] new_sync_write+0x431/0x660 [ 3140.831819][T26756] ? new_sync_read+0x6e0/0x6e0 [ 3140.831847][T26756] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 3140.831875][T26756] ? security_file_permission+0xab/0xd0 [ 3140.831916][T26756] vfs_write+0x7cd/0xae0 [ 3140.831943][T26756] ksys_write+0x12d/0x250 [ 3140.831968][T26756] ? __ia32_sys_read+0xb0/0xb0 [ 3140.831995][T26756] ? syscall_enter_from_user_mode+0x21/0x70 [ 3140.832024][T26756] do_syscall_64+0x35/0xb0 [ 3140.832045][T26756] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 3140.832074][T26756] RIP: 0033:0x7f29fb428059 [ 3140.832091][T26756] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 3140.832114][T26756] RSP: 002b:00007f29f9d9d168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 3140.832135][T26756] RAX: ffffffffffffffda RBX: 00007f29fb53af60 RCX: 00007f29fb428059 [ 3140.832150][T26756] RDX: 0000000000000038 RSI: 0000000020000100 RDI: 0000000000000003 [ 3140.832164][T26756] RBP: 00007f29f9d9d1d0 R08: 0000000000000000 R09: 0000000000000000 [ 3140.832180][T26756] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 3140.832194][T26756] R13: 00007f29fba6eb1f R14: 00007f29f9d9d300 R15: 0000000000022000 [ 3140.832217][T26756] [ 3140.842695][T26757] FAULT_INJECTION: forcing a failure. [ 3140.842695][T26757] name failslab, interval 1, probability 0, space 0, times 0 [ 3140.852717][T26756] CPU: 1 PID: 26756 Comm: syz-executor.2 Not tainted 5.17.0-rc2-syzkaller-00353-g90c9e950c0de #0 [ 3140.852743][T26756] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3140.852755][T26756] Call Trace: [ 3140.852763][T26756] [ 3140.852770][T26756] dump_stack_lvl+0xcd/0x134 [ 3140.852798][T26756] should_fail.cold+0x5/0xa [ 3140.852819][T26756] ? tty_buffer_alloc+0x23f/0x2a0 [ 3140.852843][T26756] should_failslab+0x5/0x10 [ 3141.783585][T26756] __kmalloc+0x72/0x340 15:32:25 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1277, 0xffffffffffffffff) (fail_nth: 2) 15:32:25 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x5452, 0xffffffffffffffff) (fail_nth: 2) 15:32:25 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1267, 0xffffffffffffffff) (fail_nth: 3) 15:32:25 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1269, 0xffffffffffffffff) [ 3141.783619][T26756] tty_buffer_alloc+0x23f/0x2a0 [ 3141.783641][T26756] __tty_buffer_request_room+0x156/0x2a0 15:32:25 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x5452, 0xffffffffffffffff) (fail_nth: 3) 15:32:25 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1277, 0xffffffffffffffff) (fail_nth: 3) 15:32:25 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1267, 0xffffffffffffffff) [ 3141.783664][T26756] tty_insert_flip_string_fixed_flag+0x93/0x250 [ 3141.783693][T26756] pty_write+0x11c/0x1e0 [ 3141.783716][T26756] n_tty_write+0xa7a/0xfd0 15:32:25 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x0, {0xa, 0x0, 0x0, @private2}}}, 0x38) 15:32:25 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x2, 0xffffffffffffffff) [ 3141.783735][T26756] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 3141.783760][T26756] ? _copy_from_iter+0x12b/0x1410 [ 3141.783786][T26756] ? n_tty_receive_char+0x5b0/0x5b0 [ 3141.783806][T26756] ? __init_waitqueue_head+0xd0/0xd0 [ 3141.783828][T26756] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 3141.783853][T26756] ? __phys_addr+0xc4/0x140 [ 3141.783874][T26756] ? __sanitizer_cov_trace_const_cmp8+0x1d/0x70 [ 3141.783899][T26756] ? __phys_addr_symbol+0x2c/0x70 [ 3141.783920][T26756] ? __sanitizer_cov_trace_cmp8+0x1d/0x70 [ 3141.783943][T26756] ? __check_object_size+0x16e/0x310 [ 3141.783964][T26756] file_tty_write.constprop.0+0x526/0x910 [ 3141.783989][T26756] ? n_tty_receive_char+0x5b0/0x5b0 [ 3141.784011][T26756] new_sync_write+0x431/0x660 [ 3141.784033][T26756] ? new_sync_read+0x6e0/0x6e0 [ 3141.784058][T26756] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 3141.784083][T26756] ? security_file_permission+0xab/0xd0 [ 3141.784110][T26756] vfs_write+0x7cd/0xae0 [ 3141.784132][T26756] ksys_write+0x12d/0x250 [ 3141.784153][T26756] ? __ia32_sys_read+0xb0/0xb0 [ 3141.784175][T26756] ? syscall_enter_from_user_mode+0x21/0x70 [ 3141.784202][T26756] do_syscall_64+0x35/0xb0 [ 3141.784221][T26756] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 3141.784248][T26756] RIP: 0033:0x7f29fb428059 [ 3141.784264][T26756] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 3141.784288][T26756] RSP: 002b:00007f29f9d9d168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 3141.784308][T26756] RAX: ffffffffffffffda RBX: 00007f29fb53af60 RCX: 00007f29fb428059 [ 3141.784322][T26756] RDX: 0000000000000038 RSI: 0000000020000100 RDI: 0000000000000003 [ 3141.784335][T26756] RBP: 00007f29f9d9d1d0 R08: 0000000000000000 R09: 0000000000000000 [ 3141.784347][T26756] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 3141.784360][T26756] R13: 00007f29fba6eb1f R14: 00007f29f9d9d300 R15: 0000000000022000 [ 3141.784382][T26756] [ 3141.795022][T26749] CPU: 0 PID: 26749 Comm: syz-executor.1 Not tainted 5.17.0-rc2-syzkaller-00353-g90c9e950c0de #0 [ 3141.795056][T26749] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3141.795071][T26749] Call Trace: [ 3141.795078][T26749] [ 3141.795087][T26749] dump_stack_lvl+0xcd/0x134 [ 3141.795119][T26749] should_fail.cold+0x5/0xa [ 3141.795144][T26749] ? tomoyo_realpath_from_path+0xc3/0x620 [ 3141.795174][T26749] should_failslab+0x5/0x10 [ 3141.795202][T26749] __kmalloc+0x72/0x340 [ 3141.795228][T26749] ? lock_chain_count+0x20/0x20 [ 3141.795256][T26749] tomoyo_realpath_from_path+0xc3/0x620 [ 3141.795284][T26749] ? tomoyo_profile+0x42/0x50 [ 3141.795312][T26749] tomoyo_path_number_perm+0x1d5/0x590 [ 3141.795340][T26749] ? tomoyo_path_number_perm+0x18d/0x590 [ 3141.795370][T26749] ? tomoyo_execute_permission+0x4a0/0x4a0 [ 3141.795400][T26749] ? __lock_acquire+0x1655/0x5470 [ 3141.795440][T26749] ? find_held_lock+0x2d/0x110 [ 3141.795470][T26749] ? __fget_files+0x28c/0x470 [ 3141.795498][T26749] security_file_ioctl+0x50/0xb0 [ 3141.795525][T26749] __x64_sys_ioctl+0xb3/0x200 [ 3141.795552][T26749] do_syscall_64+0x35/0xb0 [ 3141.795577][T26749] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 3141.795608][T26749] RIP: 0033:0x7f56c008f059 [ 3141.795627][T26749] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 3141.795651][T26749] RSP: 002b:00007f56bea04168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3141.795676][T26749] RAX: ffffffffffffffda RBX: 00007f56c01a1f60 RCX: 00007f56c008f059 [ 3141.795693][T26749] RDX: ffffffffffffffff RSI: 0000000000005452 RDI: 0000000000000003 [ 3141.795709][T26749] RBP: 00007f56bea041d0 R08: 0000000000000000 R09: 0000000000000000 [ 3141.795725][T26749] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 3141.795739][T26749] R13: 00007f56c06d5b1f R14: 00007f56bea04300 R15: 0000000000022000 [ 3141.795763][T26749] [ 3141.795773][T26749] ERROR: Out of memory at tomoyo_realpath_from_path. [ 3141.796079][T26757] CPU: 1 PID: 26757 Comm: syz-executor.3 Not tainted 5.17.0-rc2-syzkaller-00353-g90c9e950c0de #0 [ 3141.796106][T26757] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3141.796118][T26757] Call Trace: [ 3141.796124][T26757] [ 3141.796132][T26757] dump_stack_lvl+0xcd/0x134 [ 3141.796161][T26757] should_fail.cold+0x5/0xa [ 3141.796184][T26757] ? tomoyo_encode2.part.0+0xe9/0x3a0 [ 3141.796212][T26757] should_failslab+0x5/0x10 [ 3141.796241][T26757] __kmalloc+0x72/0x340 [ 3141.796270][T26757] tomoyo_encode2.part.0+0xe9/0x3a0 [ 3141.796307][T26757] tomoyo_encode+0x28/0x50 [ 3141.796330][T26757] tomoyo_realpath_from_path+0x186/0x620 [ 3141.796362][T26757] tomoyo_path_number_perm+0x1d5/0x590 [ 3141.796389][T26757] ? tomoyo_path_number_perm+0x18d/0x590 [ 3141.796417][T26757] ? tomoyo_execute_permission+0x4a0/0x4a0 [ 3141.796446][T26757] ? rcu_read_lock_sched_held+0xd/0x70 [ 3141.796474][T26757] ? lock_acquire+0x442/0x510 [ 3141.796503][T26757] ? lock_downgrade+0x6e0/0x6e0 [ 3141.796537][T26757] ? rcu_read_lock_sched_held+0xd/0x70 [ 3141.796564][T26757] ? lock_acquire+0x442/0x510 [ 3141.796590][T26757] ? rcu_read_lock_sched_held+0xd/0x70 [ 3141.796617][T26757] ? lock_release+0x522/0x720 [ 3141.796645][T26757] ? __fget_files+0x28c/0x470 [ 3141.796674][T26757] security_file_ioctl+0x50/0xb0 [ 3141.796700][T26757] __x64_sys_ioctl+0xb3/0x200 [ 3141.796727][T26757] do_syscall_64+0x35/0xb0 [ 3141.796752][T26757] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 3141.796782][T26757] RIP: 0033:0x7fdabb663059 [ 3141.796800][T26757] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 3141.796822][T26757] RSP: 002b:00007fdab9fd8168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3141.796848][T26757] RAX: ffffffffffffffda RBX: 00007fdabb775f60 RCX: 00007fdabb663059 [ 3141.796868][T26757] RDX: ffffffffffffffff RSI: 0000000000001267 RDI: 0000000000000003 [ 3141.796886][T26757] RBP: 00007fdab9fd81d0 R08: 0000000000000000 R09: 0000000000000000 [ 3141.796904][T26757] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 3141.796921][T26757] R13: 00007fdabbca9b1f R14: 00007fdab9fd8300 R15: 0000000000022000 [ 3141.796946][T26757] [ 3141.796961][T26757] ERROR: Out of memory at tomoyo_realpath_from_path. [ 3141.803712][T26759] FAULT_INJECTION: forcing a failure. [ 3141.803712][T26759] name failslab, interval 1, probability 0, space 0, times 0 [ 3141.803742][T26759] CPU: 1 PID: 26759 Comm: syz-executor.4 Not tainted 5.17.0-rc2-syzkaller-00353-g90c9e950c0de #0 [ 3141.803769][T26759] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3141.803784][T26759] Call Trace: [ 3141.803792][T26759] [ 3141.803800][T26759] dump_stack_lvl+0xcd/0x134 [ 3141.803830][T26759] should_fail.cold+0x5/0xa [ 3141.803855][T26759] ? tomoyo_realpath_from_path+0xc3/0x620 [ 3141.803886][T26759] should_failslab+0x5/0x10 [ 3141.803914][T26759] __kmalloc+0x72/0x340 [ 3141.803938][T26759] ? __sanitizer_cov_trace_const_cmp1+0x22/0x80 [ 3141.803971][T26759] tomoyo_realpath_from_path+0xc3/0x620 [ 3141.803999][T26759] ? tomoyo_profile+0x42/0x50 [ 3141.804024][T26759] tomoyo_path_number_perm+0x1d5/0x590 [ 3141.804050][T26759] ? tomoyo_path_number_perm+0x18d/0x590 [ 3141.804077][T26759] ? tomoyo_execute_permission+0x4a0/0x4a0 [ 3141.804104][T26759] ? rcu_read_lock_sched_held+0xd/0x70 [ 3141.804130][T26759] ? lock_acquire+0x442/0x510 [ 3141.804158][T26759] ? lock_downgrade+0x6e0/0x6e0 [ 3141.804192][T26759] ? rcu_read_lock_sched_held+0xd/0x70 [ 3141.804217][T26759] ? lock_acquire+0x442/0x510 [ 3141.804242][T26759] ? rcu_read_lock_sched_held+0xd/0x70 [ 3141.804267][T26759] ? lock_release+0x522/0x720 [ 3141.804303][T26759] ? __fget_files+0x28c/0x470 [ 3141.804333][T26759] security_file_ioctl+0x50/0xb0 [ 3141.804360][T26759] __x64_sys_ioctl+0xb3/0x200 [ 3141.804386][T26759] do_syscall_64+0x35/0xb0 [ 3141.804409][T26759] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 3141.804438][T26759] RIP: 0033:0x7fcf5e4d6059 [ 3141.804455][T26759] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 3141.804479][T26759] RSP: 002b:00007fcf5ce4b168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3141.804506][T26759] RAX: ffffffffffffffda RBX: 00007fcf5e5e8f60 RCX: 00007fcf5e4d6059 [ 3141.804523][T26759] RDX: ffffffffffffffff RSI: 0000000000001277 RDI: 0000000000000003 [ 3141.804539][T26759] RBP: 00007fcf5ce4b1d0 R08: 0000000000000000 R09: 0000000000000000 [ 3141.804555][T26759] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 3141.804570][T26759] R13: 00007fcf5eb1cb1f R14: 00007fcf5ce4b300 R15: 0000000000022000 [ 3141.804594][T26759] [ 3141.806115][T26759] ERROR: Out of memory at tomoyo_realpath_from_path. [ 3141.807595][T26758] CPU: 1 PID: 26758 Comm: syz-executor.0 Not tainted 5.17.0-rc2-syzkaller-00353-g90c9e950c0de #0 [ 3141.807621][T26758] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3141.807633][T26758] Call Trace: [ 3141.807638][T26758] [ 3141.807646][T26758] dump_stack_lvl+0xcd/0x134 [ 3141.807672][T26758] should_fail.cold+0x5/0xa [ 3141.807694][T26758] prepare_alloc_pages+0x17b/0x570 [ 3141.807720][T26758] __alloc_pages+0x12f/0x500 [ 3141.807743][T26758] ? __alloc_pages_slowpath.constprop.0+0x20d0/0x20d0 [ 3141.807772][T26758] ? __slab_alloc.constprop.0+0x4d/0xa0 [ 3141.807799][T26758] alloc_pages+0x1aa/0x310 [ 3141.807823][T26758] new_slab+0x28a/0x3b0 [ 3141.807849][T26758] ___slab_alloc+0x87c/0xe90 [ 3141.807878][T26758] ? tomoyo_realpath_from_path+0xc3/0x620 [ 3141.807914][T26758] ? tomoyo_realpath_from_path+0xc3/0x620 [ 3141.807944][T26758] __slab_alloc.constprop.0+0x4d/0xa0 [ 3141.807976][T26758] ? tomoyo_realpath_from_path+0xc3/0x620 [ 3141.808005][T26758] __kmalloc+0x2fb/0x340 [ 3141.808035][T26758] tomoyo_realpath_from_path+0xc3/0x620 [ 3141.808066][T26758] ? tomoyo_profile+0x42/0x50 [ 3141.808093][T26758] tomoyo_path_number_perm+0x1d5/0x590 [ 3141.808120][T26758] ? tomoyo_path_number_perm+0x18d/0x590 [ 3141.808150][T26758] ? tomoyo_execute_permission+0x4a0/0x4a0 [ 3141.808179][T26758] ? __lock_acquire+0x1655/0x5470 [ 3141.808221][T26758] ? find_held_lock+0x2d/0x110 [ 3141.808249][T26758] ? __fget_files+0x28c/0x470 [ 3141.808286][T26758] security_file_ioctl+0x50/0xb0 [ 3141.808315][T26758] __x64_sys_ioctl+0xb3/0x200 [ 3141.808343][T26758] do_syscall_64+0x35/0xb0 [ 3141.808368][T26758] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 3141.808400][T26758] RIP: 0033:0x7f0aa432d059 [ 3141.808419][T26758] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 3141.808444][T26758] RSP: 002b:00007f0aa2ca2168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3141.808468][T26758] RAX: ffffffffffffffda RBX: 00007f0aa443ff60 RCX: 00007f0aa432d059 [ 3141.808486][T26758] RDX: ffffffffffffffff RSI: 0000000000001269 RDI: 0000000000000003 [ 3141.808503][T26758] RBP: 00007f0aa2ca21d0 R08: 0000000000000000 R09: 0000000000000000 [ 3141.808519][T26758] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 3141.808534][T26758] R13: 00007f0aa4973b1f R14: 00007f0aa2ca2300 R15: 0000000000022000 [ 3141.808559][T26758] [ 3141.852282][T26762] FAULT_INJECTION: forcing a failure. [ 3141.852282][T26762] name failslab, interval 1, probability 0, space 0, times 0 [ 3141.852312][T26762] CPU: 0 PID: 26762 Comm: syz-executor.4 Not tainted 5.17.0-rc2-syzkaller-00353-g90c9e950c0de #0 [ 3141.852337][T26762] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3141.852350][T26762] Call Trace: [ 3141.852356][T26762] [ 3141.852364][T26762] dump_stack_lvl+0xcd/0x134 [ 3141.852394][T26762] should_fail.cold+0x5/0xa [ 3141.852423][T26762] ? tomoyo_encode2.part.0+0xe9/0x3a0 [ 3141.852452][T26762] should_failslab+0x5/0x10 [ 3141.852480][T26762] __kmalloc+0x72/0x340 [ 3141.852508][T26762] tomoyo_encode2.part.0+0xe9/0x3a0 [ 3141.852536][T26762] tomoyo_encode+0x28/0x50 15:32:26 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x8}, 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) 15:32:26 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1277, 0xffffffffffffffff) 15:32:26 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x5452, 0xffffffffffffffff) 15:32:26 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x2, 0xffffffffffffffff) 15:32:26 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x10, 0xffffffffffffffff) 15:32:26 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa02, {0x0, 0x0, {0xa, 0x0, 0x0, @private2}}}, 0x38) [ 3141.852560][T26762] tomoyo_realpath_from_path+0x186/0x620 [ 3141.852592][T26762] tomoyo_path_number_perm+0x1d5/0x590 [ 3141.852618][T26762] ? tomoyo_path_number_perm+0x18d/0x590 [ 3141.852646][T26762] ? tomoyo_execute_permission+0x4a0/0x4a0 [ 3141.852674][T26762] ? rcu_read_lock_sched_held+0xd/0x70 [ 3141.852701][T26762] ? lock_acquire+0x442/0x510 [ 3141.852730][T26762] ? lock_downgrade+0x6e0/0x6e0 [ 3141.852764][T26762] ? rcu_read_lock_sched_held+0xd/0x70 [ 3141.852799][T26762] ? lock_acquire+0x442/0x510 15:32:26 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x10, 0xffffffffffffffff) 15:32:26 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x301, 0xffffffffffffffff) 15:32:26 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x2, 0xffffffffffffffff) 15:32:27 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x2, 0xffffffffffffffff) [ 3141.852826][T26762] ? rcu_read_lock_sched_held+0xd/0x70 [ 3141.852853][T26762] ? lock_release+0x522/0x720 [ 3141.852882][T26762] ? __fget_files+0x28c/0x470 [ 3141.852911][T26762] security_file_ioctl+0x50/0xb0 [ 3141.852938][T26762] __x64_sys_ioctl+0xb3/0x200 [ 3141.852965][T26762] do_syscall_64+0x35/0xb0 [ 3141.852990][T26762] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 3141.853020][T26762] RIP: 0033:0x7fcf5e4d6059 [ 3141.853040][T26762] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 3141.853066][T26762] RSP: 002b:00007fcf5ce4b168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3141.853090][T26762] RAX: ffffffffffffffda RBX: 00007fcf5e5e8f60 RCX: 00007fcf5e4d6059 [ 3141.853108][T26762] RDX: ffffffffffffffff RSI: 0000000000001277 RDI: 0000000000000003 [ 3141.853124][T26762] RBP: 00007fcf5ce4b1d0 R08: 0000000000000000 R09: 0000000000000000 [ 3141.853140][T26762] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 15:32:27 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1225, 0xffffffffffffffff) 15:32:27 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x10, 0xffffffffffffffff) [ 3141.853156][T26762] R13: 00007fcf5eb1cb1f R14: 00007fcf5ce4b300 R15: 0000000000022000 [ 3141.853182][T26762] [ 3141.856843][T26762] ERROR: Out of memory at tomoyo_realpath_from_path. [ 3141.859565][T26764] FAULT_INJECTION: forcing a failure. [ 3141.859565][T26764] name failslab, interval 1, probability 0, space 0, times 0 [ 3141.859595][T26764] CPU: 1 PID: 26764 Comm: syz-executor.1 Not tainted 5.17.0-rc2-syzkaller-00353-g90c9e950c0de #0 [ 3141.859626][T26764] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3141.859640][T26764] Call Trace: [ 3141.859647][T26764] [ 3141.859655][T26764] dump_stack_lvl+0xcd/0x134 [ 3141.859685][T26764] should_fail.cold+0x5/0xa [ 3141.859709][T26764] ? tomoyo_encode2.part.0+0xe9/0x3a0 [ 3141.859737][T26764] should_failslab+0x5/0x10 [ 3141.859766][T26764] __kmalloc+0x72/0x340 [ 3141.859799][T26764] tomoyo_encode2.part.0+0xe9/0x3a0 [ 3141.859830][T26764] tomoyo_encode+0x28/0x50 [ 3141.859855][T26764] tomoyo_realpath_from_path+0x186/0x620 [ 3141.859888][T26764] tomoyo_path_number_perm+0x1d5/0x590 [ 3141.859914][T26764] ? tomoyo_path_number_perm+0x18d/0x590 [ 3141.859944][T26764] ? tomoyo_execute_permission+0x4a0/0x4a0 [ 3141.859972][T26764] ? rcu_read_lock_sched_held+0xd/0x70 [ 3141.859998][T26764] ? lock_acquire+0x442/0x510 [ 3141.860024][T26764] ? lock_downgrade+0x6e0/0x6e0 [ 3141.860056][T26764] ? rcu_read_lock_sched_held+0xd/0x70 [ 3141.860080][T26764] ? lock_acquire+0x442/0x510 [ 3141.860103][T26764] ? rcu_read_lock_sched_held+0xd/0x70 [ 3141.860127][T26764] ? lock_release+0x522/0x720 [ 3141.860152][T26764] ? __fget_files+0x28c/0x470 [ 3141.860182][T26764] security_file_ioctl+0x50/0xb0 [ 3141.860206][T26764] __x64_sys_ioctl+0xb3/0x200 [ 3141.860233][T26764] do_syscall_64+0x35/0xb0 [ 3141.860256][T26764] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 3141.860296][T26764] RIP: 0033:0x7f56c008f059 [ 3141.860314][T26764] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 3141.860338][T26764] RSP: 002b:00007f56bea04168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3141.860362][T26764] RAX: ffffffffffffffda RBX: 00007f56c01a1f60 RCX: 00007f56c008f059 [ 3141.860377][T26764] RDX: ffffffffffffffff RSI: 0000000000005452 RDI: 0000000000000003 [ 3141.860393][T26764] RBP: 00007f56bea041d0 R08: 0000000000000000 R09: 0000000000000000 [ 3141.860409][T26764] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 3141.860425][T26764] R13: 00007f56c06d5b1f R14: 00007f56bea04300 R15: 0000000000022000 [ 3141.860445][T26764] [ 3141.860555][T26764] ERROR: Out of memory at tomoyo_realpath_from_path. [ 3141.878238][T26766] FAULT_INJECTION: forcing a failure. [ 3141.878238][T26766] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 3141.878270][T26766] CPU: 1 PID: 26766 Comm: syz-executor.3 Not tainted 5.17.0-rc2-syzkaller-00353-g90c9e950c0de #0 [ 3141.878305][T26766] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3141.878319][T26766] Call Trace: [ 3141.878326][T26766] [ 3141.878334][T26766] dump_stack_lvl+0xcd/0x134 [ 3141.878365][T26766] should_fail.cold+0x5/0xa [ 3141.878390][T26766] _copy_to_user+0x2c/0x150 [ 3141.878418][T26766] simple_read_from_buffer+0xcc/0x160 [ 3141.878453][T26766] proc_fail_nth_read+0x187/0x220 [ 3141.878482][T26766] ? proc_tid_comm_permission+0x1b0/0x1b0 [ 3141.878512][T26766] ? security_file_permission+0xab/0xd0 [ 3141.878543][T26766] ? proc_tid_comm_permission+0x1b0/0x1b0 [ 3141.878572][T26766] vfs_read+0x1b5/0x600 [ 3141.878599][T26766] ksys_read+0x12d/0x250 [ 3141.878628][T26766] ? vfs_write+0xae0/0xae0 [ 3141.878656][T26766] ? syscall_enter_from_user_mode+0x21/0x70 [ 3141.878689][T26766] do_syscall_64+0x35/0xb0 [ 3141.878711][T26766] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 3141.878740][T26766] RIP: 0033:0x7fdabb615c0c [ 3141.878758][T26766] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 fc ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 2f fd ff ff 48 [ 3141.878783][T26766] RSP: 002b:00007fdab9fd8160 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 3141.878808][T26766] RAX: ffffffffffffffda RBX: 00007fdabb775f60 RCX: 00007fdabb615c0c [ 3141.878824][T26766] RDX: 000000000000000f RSI: 00007fdab9fd81e0 RDI: 0000000000000004 [ 3141.878836][T26766] RBP: 00007fdab9fd81d0 R08: 0000000000000000 R09: 0000000000000000 [ 3141.878849][T26766] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 3141.878862][T26766] R13: 00007fdabbca9b1f R14: 00007fdab9fd8300 R15: 0000000000022000 [ 3141.878884][T26766] [ 3141.910338][T26772] FAULT_INJECTION: forcing a failure. [ 3141.910338][T26772] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 3141.910370][T26772] CPU: 1 PID: 26772 Comm: syz-executor.4 Not tainted 5.17.0-rc2-syzkaller-00353-g90c9e950c0de #0 [ 3141.910427][T26772] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3141.910443][T26772] Call Trace: [ 3141.910455][T26772] [ 3141.910464][T26772] dump_stack_lvl+0xcd/0x134 [ 3141.910496][T26772] should_fail.cold+0x5/0xa [ 3141.910542][T26772] _copy_to_user+0x2c/0x150 [ 3141.910575][T26772] simple_read_from_buffer+0xcc/0x160 [ 3141.910624][T26772] proc_fail_nth_read+0x187/0x220 [ 3141.910653][T26772] ? proc_tid_comm_permission+0x1b0/0x1b0 [ 3141.910684][T26772] ? security_file_permission+0xab/0xd0 [ 3141.910734][T26772] ? proc_tid_comm_permission+0x1b0/0x1b0 [ 3141.910761][T26772] vfs_read+0x1b5/0x600 [ 3141.910795][T26772] ksys_read+0x12d/0x250 [ 3141.910838][T26772] ? vfs_write+0xae0/0xae0 [ 3141.910872][T26772] ? syscall_enter_from_user_mode+0x21/0x70 [ 3141.910905][T26772] do_syscall_64+0x35/0xb0 [ 3141.910943][T26772] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 3141.910976][T26772] RIP: 0033:0x7fcf5e488c0c [ 3141.910995][T26772] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 fc ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 2f fd ff ff 48 [ 3141.911044][T26772] RSP: 002b:00007fcf5ce4b160 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 3141.911069][T26772] RAX: ffffffffffffffda RBX: 00007fcf5e5e8f60 RCX: 00007fcf5e488c0c [ 3141.911088][T26772] RDX: 000000000000000f RSI: 00007fcf5ce4b1e0 RDI: 0000000000000004 [ 3141.911109][T26772] RBP: 00007fcf5ce4b1d0 R08: 0000000000000000 R09: 0000000000000000 [ 3141.911139][T26772] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 3141.911165][T26772] R13: 00007fcf5eb1cb1f R14: 00007fcf5ce4b300 R15: 0000000000022000 [ 3141.911190][T26772] [ 3141.921300][T26771] FAULT_INJECTION: forcing a failure. [ 3141.921300][T26771] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 3141.921330][T26771] CPU: 0 PID: 26771 Comm: syz-executor.1 Not tainted 5.17.0-rc2-syzkaller-00353-g90c9e950c0de #0 [ 3141.921358][T26771] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3141.921372][T26771] Call Trace: [ 3141.921380][T26771] [ 3141.921388][T26771] dump_stack_lvl+0xcd/0x134 [ 3141.921418][T26771] should_fail.cold+0x5/0xa [ 3141.921442][T26771] _copy_to_user+0x2c/0x150 [ 3141.921471][T26771] simple_read_from_buffer+0xcc/0x160 [ 3141.921504][T26771] proc_fail_nth_read+0x187/0x220 [ 3141.921531][T26771] ? proc_tid_comm_permission+0x1b0/0x1b0 [ 3141.921558][T26771] ? security_file_permission+0xab/0xd0 [ 3141.921587][T26771] ? proc_tid_comm_permission+0x1b0/0x1b0 [ 3141.921617][T26771] vfs_read+0x1b5/0x600 [ 3141.921645][T26771] ksys_read+0x12d/0x250 [ 3141.921671][T26771] ? vfs_write+0xae0/0xae0 [ 3141.921699][T26771] ? syscall_enter_from_user_mode+0x21/0x70 [ 3141.921732][T26771] do_syscall_64+0x35/0xb0 [ 3141.921756][T26771] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 3141.921799][T26771] RIP: 0033:0x7f56c0041c0c [ 3141.921819][T26771] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 fc ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 2f fd ff ff 48 [ 3141.921845][T26771] RSP: 002b:00007f56bea04160 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 3141.921870][T26771] RAX: ffffffffffffffda RBX: 00007f56c01a1f60 RCX: 00007f56c0041c0c [ 3141.921886][T26771] RDX: 000000000000000f RSI: 00007f56bea041e0 RDI: 0000000000000004 [ 3141.921900][T26771] RBP: 00007f56bea041d0 R08: 0000000000000000 R09: 0000000000000000 [ 3141.921915][T26771] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 3141.921930][T26771] R13: 00007f56c06d5b1f R14: 00007f56bea04300 R15: 0000000000022000 15:32:27 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x10}, 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) 15:32:27 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x301, 0xffffffffffffffff) 15:32:27 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x10, 0xffffffffffffffff) 15:32:27 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1260, 0xffffffffffffffff) 15:32:27 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x301, 0xffffffffffffffff) 15:32:27 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa03, {0x0, 0x0, {0xa, 0x0, 0x0, @private2}}}, 0x38) 15:32:27 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1263, 0xffffffffffffffff) [ 3141.921952][T26771] [ 3143.101694][ T1224] ieee802154 phy0 wpan0: encryption failed: -22 [ 3144.086534][ T1224] ieee802154 phy1 wpan1: encryption failed: -22 15:32:27 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x2000000}, 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) 15:32:27 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x125c, 0xffffffffffffffff) 15:32:27 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x125d, 0xffffffffffffffff) 15:32:27 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x125d, 0xffffffffffffffff) 15:32:27 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x541b, 0xffffffffffffffff) 15:32:27 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa07, {0x0, 0x0, {0xa, 0x0, 0x0, @private2}}}, 0x38) 15:32:27 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x8000000}, 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) 15:32:27 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x125e, 0xffffffffffffffff) 15:32:28 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa38, {0x0, 0x0, {0xa, 0x0, 0x0, @private2}}}, 0x38) 15:32:28 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1265, 0xffffffffffffffff) 15:32:28 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x125f, 0xffffffffffffffff) 15:32:28 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x5421, 0xffffffffffffffff) 15:32:28 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x125e, 0xffffffffffffffff) 15:32:28 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x541b, 0xffffffffffffffff) 15:32:28 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x2, {0xa, 0x0, 0x0, @private2}}}, 0x38) 15:32:28 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x10000000}, 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) 15:32:28 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1260, 0xffffffffffffffff) 15:32:28 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x125f, 0xffffffffffffffff) 15:32:28 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x5450, 0xffffffffffffffff) 15:32:28 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x3, {0xa, 0x0, 0x0, @private2}}}, 0x38) 15:32:28 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x5421, 0xffffffffffffffff) 15:32:28 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1261, 0xffffffffffffffff) 15:32:28 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x200000000000000}, 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) 15:32:28 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1260, 0xffffffffffffffff) 15:32:28 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x5451, 0xffffffffffffffff) 15:32:28 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x7, {0xa, 0x0, 0x0, @private2}}}, 0x38) 15:32:28 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1262, 0xffffffffffffffff) 15:32:28 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x800000000000000}, 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) 15:32:28 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1261, 0xffffffffffffffff) 15:32:28 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x5460, 0xffffffffffffffff) 15:32:28 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x5450, 0xffffffffffffffff) 15:32:28 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x38, {0xa, 0x0, 0x0, @private2}}}, 0x38) 15:32:28 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1262, 0xffffffffffffffff) 15:32:28 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1263, 0xffffffffffffffff) 15:32:28 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x1000000000000000}, 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) 15:32:28 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x300, {0xa, 0x0, 0x0, @private2}}}, 0x38) 15:32:28 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1263, 0xffffffffffffffff) 15:32:28 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x8933, 0xffffffffffffffff) 15:32:28 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x5451, 0xffffffffffffffff) 15:32:28 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1264, 0xffffffffffffffff) 15:32:28 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x700, {0xa, 0x0, 0x0, @private2}}}, 0x38) 15:32:28 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x2}, 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) 15:32:28 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x5452, 0xffffffffffffffff) 15:32:28 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x400448c9, 0xffffffffffffffff) 15:32:28 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1264, 0xffffffffffffffff) 15:32:28 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1265, 0xffffffffffffffff) 15:32:28 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x400448dd, 0xffffffffffffffff) 15:32:28 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x8}, 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) 15:32:28 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x5460, 0xffffffffffffffff) 15:32:28 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x2000, {0xa, 0x0, 0x0, @private2}}}, 0x38) 15:32:28 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1265, 0xffffffffffffffff) 15:32:28 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1267, 0xffffffffffffffff) 15:32:28 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x400454ca, 0xffffffffffffffff) 15:32:28 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x8933, 0xffffffffffffffff) 15:32:28 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x10}, 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) 15:32:28 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x3800, {0xa, 0x0, 0x0, @private2}}}, 0x38) 15:32:28 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1268, 0xffffffffffffffff) 15:32:28 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x40049409, 0xffffffffffffffff) 15:32:28 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1268, 0xffffffffffffffff) 15:32:28 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x2000000}, 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) 15:32:28 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x400448c9, 0xffffffffffffffff) 15:32:28 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1269, 0xffffffffffffffff) 15:32:28 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x40086602, 0xffffffffffffffff) 15:32:28 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x400448dd, 0xffffffffffffffff) 15:32:28 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x20000, {0xa, 0x0, 0x0, @private2}}}, 0x38) 15:32:28 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1269, 0xffffffffffffffff) 15:32:28 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x8000000}, 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) 15:32:28 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1274, 0xffffffffffffffff) 15:32:28 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x200000, {0xa, 0x0, 0x0, @private2}}}, 0x38) 15:32:28 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x400454ca, 0xffffffffffffffff) 15:32:28 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x40186366, 0xffffffffffffffff) 15:32:28 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1274, 0xffffffffffffffff) 15:32:28 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x10000000}, 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) 15:32:28 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1276, 0xffffffffffffffff) 15:32:28 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x1000000, {0xa, 0x0, 0x0, @private2}}}, 0x38) 15:32:28 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x40049409, 0xffffffffffffffff) 15:32:28 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x401c5820, 0xffffffffffffffff) 15:32:28 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1276, 0xffffffffffffffff) 15:32:28 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1277, 0xffffffffffffffff) 15:32:28 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x200000000000000}, 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) 15:32:28 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x2000000, {0xa, 0x0, 0x0, @private2}}}, 0x38) 15:32:28 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x4020940d, 0xffffffffffffffff) 15:32:28 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x40081271, 0xffffffffffffffff) 15:32:28 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1278, 0xffffffffffffffff) 15:32:28 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x800000000000000}, 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) 15:32:28 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1278, 0xffffffffffffffff) 15:32:28 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x40086602, 0xffffffffffffffff) 15:32:28 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x80086301, 0xffffffffffffffff) 15:32:28 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x3000000, {0xa, 0x0, 0x0, @private2}}}, 0x38) 15:32:28 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1279, 0xffffffffffffffff) 15:32:28 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x1000000000000000}, 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) 15:32:28 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x80086601, 0xffffffffffffffff) 15:32:28 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1279, 0xffffffffffffffff) 15:32:28 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x40186366, 0xffffffffffffffff) 15:32:28 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x2}, 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) 15:32:28 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x801c581f, 0xffffffffffffffff) 15:32:28 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x7000000, {0xa, 0x0, 0x0, @private2}}}, 0x38) 15:32:28 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x127a, 0xffffffffffffffff) 15:32:28 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x127a, 0xffffffffffffffff) 15:32:28 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x127b, 0xffffffffffffffff) 15:32:28 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x127b, 0xffffffffffffffff) 15:32:28 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x401c5820, 0xffffffffffffffff) 15:32:28 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0xc0045878, 0xffffffffffffffff) 15:32:28 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x8}, 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) 15:32:28 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x38000000, {0xa, 0x0, 0x0, @private2}}}, 0x38) 15:32:28 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x127c, 0xffffffffffffffff) 15:32:29 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0xc0045878, 0xffffffffffffffff) 15:32:29 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x127c, 0xffffffffffffffff) 15:32:29 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x10}, 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) 15:32:29 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x4020940d, 0xffffffffffffffff) 15:32:29 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x2000000000000, {0xa, 0x0, 0x0, @private2}}}, 0x38) 15:32:29 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x127d, 0xffffffffffffffff) 15:32:29 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0xc0189436, 0xffffffffffffffff) 15:32:29 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x127d, 0xffffffffffffffff) 15:32:29 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x80081270, 0xffffffffffffffff) 15:32:29 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x2000000}, 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) 15:32:29 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x20000000000000, {0xa, 0x0, 0x0, @private2}}}, 0x38) 15:32:29 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x127e, 0xffffffffffffffff) 15:32:29 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x127e, 0xffffffffffffffff) 15:32:29 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0xc020660b, 0xffffffffffffffff) 15:32:29 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x80081272, 0xffffffffffffffff) 15:32:29 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x100000000000000, {0xa, 0x0, 0x0, @private2}}}, 0x38) 15:32:29 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x8000000}, 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) 15:32:29 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x127f, 0xffffffffffffffff) 15:32:29 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x5452, 0xffffffffffffffff) openat$ashmem(0xffffffffffffff9c, &(0x7f0000000040), 0x200, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) ioctl$TIOCCBRK(r1, 0x5428) 15:32:29 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x127f, 0xffffffffffffffff) 15:32:29 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x80086301, 0xffffffffffffffff) 15:32:29 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x541b, 0xffffffffffffffff) 15:32:29 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x200000000000000, {0xa, 0x0, 0x0, @private2}}}, 0x38) 15:32:29 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x5452, 0xffffffffffffffff) openat$ashmem(0xffffffffffffff9c, &(0x7f0000000040), 0x200, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) ioctl$TIOCCBRK(r1, 0x5428) syz_open_dev$loop(&(0x7f0000000000), 0x0, 0x0) (async) ioctl$LOOP_SET_FD(r0, 0x5452, 0xffffffffffffffff) (async) openat$ashmem(0xffffffffffffff9c, &(0x7f0000000040), 0x200, 0x0) (async) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) (async) ioctl$TIOCCBRK(r1, 0x5428) (async) 15:32:29 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x80086601, 0xffffffffffffffff) 15:32:29 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x10000000}, 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) 15:32:29 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x300000000000000, {0xa, 0x0, 0x0, @private2}}}, 0x38) 15:32:29 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x5421, 0xffffffffffffffff) 15:32:29 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x801c581f, 0xffffffffffffffff) 15:32:29 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x541b, 0xffffffffffffffff) 15:32:29 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x5452, 0xffffffffffffffff) (async) openat$ashmem(0xffffffffffffff9c, &(0x7f0000000040), 0x200, 0x0) (async) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) (async) ioctl$TIOCCBRK(r1, 0x5428) 15:32:29 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x5450, 0xffffffffffffffff) 15:32:29 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0xc0045878, 0xffffffffffffffff) 15:32:29 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x200000000000000}, 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) 15:32:29 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x5421, 0xffffffffffffffff) 15:32:29 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000), 0x1, 0x6a80eadf618889b2) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, 0x0) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r1) ioctl$LOOP_SET_FD(r0, 0x5452, r0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) timer_getoverrun(0x0) ioctl$SYNC_IOC_FILE_INFO(r3, 0xc0383e04, &(0x7f0000000280)={""/32, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000080)=[{}, {}, {}, {}, {}, {}]}) ioctl$LOOP_SET_FD(r3, 0x4c00, r0) 15:32:29 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x700000000000000, {0xa, 0x0, 0x0, @private2}}}, 0x38) 15:32:29 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x800000000000000}, 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) 15:32:29 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0xc0045878, 0xffffffffffffffff) 15:32:29 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x5450, 0xffffffffffffffff) 15:32:29 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x5451, 0xffffffffffffffff) 15:32:29 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000), 0x1, 0x6a80eadf618889b2) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, 0x0) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r1) ioctl$LOOP_SET_FD(r0, 0x5452, r0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) timer_getoverrun(0x0) ioctl$SYNC_IOC_FILE_INFO(r3, 0xc0383e04, &(0x7f0000000280)={""/32, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000080)=[{}, {}, {}, {}, {}, {}]}) ioctl$LOOP_SET_FD(r3, 0x4c00, r0) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) (async) syz_open_dev$loop(&(0x7f0000000000), 0x1, 0x6a80eadf618889b2) (async) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, 0x0) (async) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r1) (async) ioctl$LOOP_SET_FD(r0, 0x5452, r0) (async) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) (async) timer_getoverrun(0x0) (async) ioctl$SYNC_IOC_FILE_INFO(r3, 0xc0383e04, &(0x7f0000000280)={""/32, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000080)=[{}, {}, {}, {}, {}, {}]}) (async) ioctl$LOOP_SET_FD(r3, 0x4c00, r0) (async) 15:32:29 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x3800000000000000, {0xa, 0x0, 0x0, @private2}}}, 0x38) 15:32:29 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x1000000000000000}, 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) 15:32:29 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0xc0189436, 0xffffffffffffffff) 15:32:29 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x5451, 0xffffffffffffffff) 15:32:29 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0xffffffff00000000, {0xa, 0x0, 0x0, @private2}}}, 0x38) 15:32:29 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x5452, 0xffffffffffffffff) 15:32:29 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) (async) r1 = syz_open_dev$loop(&(0x7f0000000000), 0x1, 0x6a80eadf618889b2) (async) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, 0x0) (async) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r1) (async, rerun: 64) ioctl$LOOP_SET_FD(r0, 0x5452, r0) (async, rerun: 64) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) timer_getoverrun(0x0) ioctl$SYNC_IOC_FILE_INFO(r3, 0xc0383e04, &(0x7f0000000280)={""/32, 0x0, 0x0, 0x6, 0x0, &(0x7f0000000080)=[{}, {}, {}, {}, {}, {}]}) (async) ioctl$LOOP_SET_FD(r3, 0x4c00, r0) 15:32:29 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0xc020660b, 0xffffffffffffffff) 15:32:29 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x5452, 0xffffffffffffffff) 15:32:29 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2}, 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) 15:32:29 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x5460, 0xffffffffffffffff) 15:32:29 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x0, {0xa, 0x0, 0x0, @private2}}}, 0x38) 15:32:29 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) eventfd2(0x81, 0x1) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000), 0x240100, 0x0) ioctl$IMGETVERSION(r1, 0x80044942, &(0x7f0000000080)) ioctl$LOOP_SET_FD(r0, 0x5452, 0xffffffffffffffff) 15:32:29 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x5460, 0xffffffffffffffff) 15:32:29 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x8}, 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) 15:32:29 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0xc0481273, 0xffffffffffffffff) 15:32:29 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x8933, 0xffffffffffffffff) 15:32:29 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x0, {0xa, 0x2, 0x0, @private2}}}, 0x38) 15:32:29 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) eventfd2(0x81, 0x1) (async) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000), 0x240100, 0x0) ioctl$IMGETVERSION(r1, 0x80044942, &(0x7f0000000080)) (async) ioctl$LOOP_SET_FD(r0, 0x5452, 0xffffffffffffffff) 15:32:29 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x8933, 0xffffffffffffffff) 15:32:29 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1269, 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x2c, 0x0, 0x10, 0x70bd2a, 0x25dfdbfb, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x153}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40010}, 0x60000) openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000140), 0x44682, 0x0) 15:32:29 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x10}, 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) 15:32:29 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) (async) eventfd2(0x81, 0x1) (async) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000), 0x240100, 0x0) ioctl$IMGETVERSION(r1, 0x80044942, &(0x7f0000000080)) (async) ioctl$LOOP_SET_FD(r0, 0x5452, 0xffffffffffffffff) 15:32:29 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x400448c9, 0xffffffffffffffff) 15:32:29 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x0, {0xa, 0x3, 0x0, @private2}}}, 0x38) 15:32:29 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1269, 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x2c, 0x0, 0x10, 0x70bd2a, 0x25dfdbfb, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x153}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40010}, 0x60000) openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000140), 0x44682, 0x0) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$LOOP_SET_FD(r0, 0x1269, 0xffffffffffffffff) (async) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x2c, 0x0, 0x10, 0x70bd2a, 0x25dfdbfb, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x153}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40010}, 0x60000) (async) openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000140), 0x44682, 0x0) (async) 15:32:29 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000000}, 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) 15:32:29 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x5452, 0xffffffffffffffff) r1 = syz_open_dev$loop(&(0x7f0000000140), 0x0, 0x40800) ioctl$LOOP_GET_STATUS(r1, 0x4c03, &(0x7f0000000180)) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000080)={0x0, {}, 0x0, {}, 0x1, 0x12, 0x73ee, 0x15, "92933387b165087afe44f56cf5e725e05ed48c413c39e1587b8264818865569697b15b0812e5fafcc244530165747748aad17e91586e1a0ccc8457ceffaa73c4", "069c0394adcc86206a98035db65ff9025496897be18a101cde46db5fb6c8caee", [0x3ff, 0x7]}) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, 0x0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r3, 0xc01064c5, &(0x7f0000000280)={&(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0], 0x4}) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000000)={r2, 0xffffffffffffffff, 0x0, r3}, 0x10) 15:32:29 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x400448c9, 0xffffffffffffffff) 15:32:29 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x400448dd, 0xffffffffffffffff) 15:32:29 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1269, 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x2c, 0x0, 0x10, 0x70bd2a, 0x25dfdbfb, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x153}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40010}, 0x60000) openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000140), 0x44682, 0x0) 15:32:29 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x400448dd, 0xffffffffffffffff) 15:32:29 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x400454ca, 0xffffffffffffffff) 15:32:29 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x0, {0xa, 0x7, 0x0, @private2}}}, 0x38) 15:32:29 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x8000000}, 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) 15:32:29 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x5452, 0xffffffffffffffff) r1 = syz_open_dev$loop(&(0x7f0000000140), 0x0, 0x40800) ioctl$LOOP_GET_STATUS(r1, 0x4c03, &(0x7f0000000180)) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000080)={0x0, {}, 0x0, {}, 0x1, 0x12, 0x73ee, 0x15, "92933387b165087afe44f56cf5e725e05ed48c413c39e1587b8264818865569697b15b0812e5fafcc244530165747748aad17e91586e1a0ccc8457ceffaa73c4", "069c0394adcc86206a98035db65ff9025496897be18a101cde46db5fb6c8caee", [0x3ff, 0x7]}) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, 0x0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r3, 0xc01064c5, &(0x7f0000000280)={&(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0], 0x4}) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000000)={r2, 0xffffffffffffffff, 0x0, r3}, 0x10) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$LOOP_SET_FD(r0, 0x5452, 0xffffffffffffffff) (async) syz_open_dev$loop(&(0x7f0000000140), 0x0, 0x40800) (async) ioctl$LOOP_GET_STATUS(r1, 0x4c03, &(0x7f0000000180)) (async) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000080)={0x0, {}, 0x0, {}, 0x1, 0x12, 0x73ee, 0x15, "92933387b165087afe44f56cf5e725e05ed48c413c39e1587b8264818865569697b15b0812e5fafcc244530165747748aad17e91586e1a0ccc8457ceffaa73c4", "069c0394adcc86206a98035db65ff9025496897be18a101cde46db5fb6c8caee", [0x3ff, 0x7]}) (async) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, 0x0) (async) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r3, 0xc01064c5, &(0x7f0000000280)={&(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0], 0x4}) (async) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000000)={r2, 0xffffffffffffffff, 0x0, r3}, 0x10) (async) 15:32:29 executing program 0: syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) 15:32:29 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x0, {0xa, 0x38, 0x0, @private2}}}, 0x38) 15:32:29 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x40049409, 0xffffffffffffffff) 15:32:29 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x400454ca, 0xffffffffffffffff) 15:32:29 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x10000000}, 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) 15:32:29 executing program 0: syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) 15:32:29 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x5452, 0xffffffffffffffff) r1 = syz_open_dev$loop(&(0x7f0000000140), 0x0, 0x40800) ioctl$LOOP_GET_STATUS(r1, 0x4c03, &(0x7f0000000180)) (async) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000080)={0x0, {}, 0x0, {}, 0x1, 0x12, 0x73ee, 0x15, "92933387b165087afe44f56cf5e725e05ed48c413c39e1587b8264818865569697b15b0812e5fafcc244530165747748aad17e91586e1a0ccc8457ceffaa73c4", "069c0394adcc86206a98035db65ff9025496897be18a101cde46db5fb6c8caee", [0x3ff, 0x7]}) (async) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, 0x0) (async) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r3, 0xc01064c5, &(0x7f0000000280)={&(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0], 0x4}) (async) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000000)={r2, 0xffffffffffffffff, 0x0, r3}, 0x10) 15:32:29 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x40049409, 0xffffffffffffffff) 15:32:29 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x40081271, 0xffffffffffffffff) 15:32:29 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x0, {0xa, 0x300, 0x0, @private2}}}, 0x38) 15:32:29 executing program 0: syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) 15:32:29 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x200000000000000}, 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) 15:32:29 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x40081271, 0xffffffffffffffff) 15:32:29 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000000), 0xfffffffffffffffe, 0x40) ioctl$LOOP_SET_FD(r0, 0x5452, 0xffffffffffffffff) 15:32:29 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x40086602, 0xffffffffffffffff) 15:32:30 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x0, {0xa, 0x700, 0x0, @private2}}}, 0x38) 15:32:30 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1269, 0xffffffffffffffff) syz_open_dev$loop(&(0x7f0000000000), 0x401, 0x0) 15:32:30 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x800000000000000}, 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) 15:32:30 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x40086602, 0xffffffffffffffff) 15:32:30 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000000), 0xfffffffffffffffe, 0x40) ioctl$LOOP_SET_FD(r0, 0x5452, 0xffffffffffffffff) 15:32:30 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1269, 0xffffffffffffffff) syz_open_dev$loop(&(0x7f0000000000), 0x401, 0x0) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$LOOP_SET_FD(r0, 0x1269, 0xffffffffffffffff) (async) syz_open_dev$loop(&(0x7f0000000000), 0x401, 0x0) (async) 15:32:30 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x40101283, 0xffffffffffffffff) 15:32:30 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x0, {0xa, 0x2000, 0x0, @private2}}}, 0x38) 15:32:30 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000000), 0xfffffffffffffffe, 0x40) ioctl$LOOP_SET_FD(r0, 0x5452, 0xffffffffffffffff) 15:32:30 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x40101283, 0xffffffffffffffff) 15:32:30 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1000000000000000}, 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) 15:32:30 executing program 1: syz_open_pts(0xffffffffffffffff, 0x4000) r0 = syz_open_dev$loop(&(0x7f0000000080), 0x0, 0x0) ioctl$VT_RESIZEX(0xffffffffffffffff, 0x560a, &(0x7f0000000000)={0x0, 0xeca1, 0x5, 0x3f, 0x8, 0x57c6}) ioctl$LOOP_SET_DIRECT_IO(r0, 0x4c08, 0x7ff) ioctl$LOOP_SET_FD(r0, 0x5452, 0xffffffffffffffff) 15:32:30 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1269, 0xffffffffffffffff) (async) syz_open_dev$loop(&(0x7f0000000000), 0x401, 0x0) 15:32:30 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x0, {0xa, 0x3800, 0x0, @private2}}}, 0x38) 15:32:30 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x40101286, 0xffffffffffffffff) 15:32:30 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x40101286, 0xffffffffffffffff) 15:32:30 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) 15:32:30 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000000), 0x480000, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, 0x0) ioctl$LOOP_SET_FD(r0, 0x1269, 0xffffffffffffffff) ioctl$DRM_IOCTL_SYNCOBJ_RESET(r1, 0xc01064c4, &(0x7f00000000c0)={&(0x7f0000000080)=[0x0, 0x0], 0x2}) r3 = socket(0x18, 0x80000, 0x5) syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), r3) 15:32:30 executing program 1: syz_open_pts(0xffffffffffffffff, 0x4000) r0 = syz_open_dev$loop(&(0x7f0000000080), 0x0, 0x0) ioctl$VT_RESIZEX(0xffffffffffffffff, 0x560a, &(0x7f0000000000)={0x0, 0xeca1, 0x5, 0x3f, 0x8, 0x57c6}) (async) ioctl$LOOP_SET_DIRECT_IO(r0, 0x4c08, 0x7ff) (async) ioctl$LOOP_SET_FD(r0, 0x5452, 0xffffffffffffffff) 15:32:30 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x40101288, 0xffffffffffffffff) 15:32:30 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x40101288, 0xffffffffffffffff) 15:32:30 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x0, {0xa, 0x0, 0x0, @private2}}}, 0x38) 15:32:30 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x8}, 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) 15:32:30 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) (async) openat$vcs(0xffffffffffffff9c, &(0x7f0000000000), 0x480000, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) (async) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, 0x0) (async) ioctl$LOOP_SET_FD(r0, 0x1269, 0xffffffffffffffff) (async) ioctl$DRM_IOCTL_SYNCOBJ_RESET(r1, 0xc01064c4, &(0x7f00000000c0)={&(0x7f0000000080)=[0x0, 0x0], 0x2}) (async) r3 = socket(0x18, 0x80000, 0x5) syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), r3) 15:32:30 executing program 1: syz_open_pts(0xffffffffffffffff, 0x4000) r0 = syz_open_dev$loop(&(0x7f0000000080), 0x0, 0x0) ioctl$VT_RESIZEX(0xffffffffffffffff, 0x560a, &(0x7f0000000000)={0x0, 0xeca1, 0x5, 0x3f, 0x8, 0x57c6}) ioctl$LOOP_SET_DIRECT_IO(r0, 0x4c08, 0x7ff) ioctl$LOOP_SET_FD(r0, 0x5452, 0xffffffffffffffff) syz_open_pts(0xffffffffffffffff, 0x4000) (async) syz_open_dev$loop(&(0x7f0000000080), 0x0, 0x0) (async) ioctl$VT_RESIZEX(0xffffffffffffffff, 0x560a, &(0x7f0000000000)={0x0, 0xeca1, 0x5, 0x3f, 0x8, 0x57c6}) (async) ioctl$LOOP_SET_DIRECT_IO(r0, 0x4c08, 0x7ff) (async) ioctl$LOOP_SET_FD(r0, 0x5452, 0xffffffffffffffff) (async) 15:32:30 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x401070c9, 0xffffffffffffffff) 15:32:30 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x0, {0xa, 0x0, 0x2, @private2}}}, 0x38) 15:32:30 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x401070c9, 0xffffffffffffffff) 15:32:30 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x10}, 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) 15:32:30 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000000), 0x480000, 0x0) (async) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) (async) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, 0x0) (async) ioctl$LOOP_SET_FD(r0, 0x1269, 0xffffffffffffffff) ioctl$DRM_IOCTL_SYNCOBJ_RESET(r1, 0xc01064c4, &(0x7f00000000c0)={&(0x7f0000000080)=[0x0, 0x0], 0x2}) (async) r3 = socket(0x18, 0x80000, 0x5) syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), r3) 15:32:30 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x401070ca, 0xffffffffffffffff) 15:32:30 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x0, {0xa, 0x0, 0x3, @private2}}}, 0x38) 15:32:30 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x5452, 0xffffffffffffffff) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) process_mrelease(r1, 0x0) r2 = syz_open_dev$loop(&(0x7f0000000000), 0x0, 0x141040) ioctl$LOOP_CLR_FD(r2, 0x4c01) 15:32:30 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x401070ca, 0xffffffffffffffff) 15:32:30 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) ioctl$PPPIOCSACTIVE(r1, 0x40107446, &(0x7f00000000c0)={0x4, &(0x7f0000000080)=[{0xfff7, 0xdf, 0x1, 0x7}, {0xab, 0x3e, 0x3, 0x2}, {0x7, 0x80, 0xfb, 0x6}, {0x2, 0x7, 0x40, 0x8}]}) ioctl$LOOP_SET_FD(r0, 0x1269, 0xffffffffffffffff) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, 0x0) setsockopt$RDS_CANCEL_SENT_TO(r2, 0x114, 0x1, &(0x7f0000000000)={0x2, 0x4e20, @empty}, 0xfffffef1) 15:32:30 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x2000000}, 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) 15:32:30 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x0, {0xa, 0x0, 0x7, @private2}}}, 0x38) 15:32:30 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x401070cd, 0xffffffffffffffff) 15:32:30 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x5452, 0xffffffffffffffff) (async) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) (async) process_mrelease(r1, 0x0) (async) r2 = syz_open_dev$loop(&(0x7f0000000000), 0x0, 0x141040) ioctl$LOOP_CLR_FD(r2, 0x4c01) 15:32:30 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x401070cd, 0xffffffffffffffff) 15:32:30 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) ioctl$PPPIOCSACTIVE(r1, 0x40107446, &(0x7f00000000c0)={0x4, &(0x7f0000000080)=[{0xfff7, 0xdf, 0x1, 0x7}, {0xab, 0x3e, 0x3, 0x2}, {0x7, 0x80, 0xfb, 0x6}, {0x2, 0x7, 0x40, 0x8}]}) ioctl$LOOP_SET_FD(r0, 0x1269, 0xffffffffffffffff) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, 0x0) setsockopt$RDS_CANCEL_SENT_TO(r2, 0x114, 0x1, &(0x7f0000000000)={0x2, 0x4e20, @empty}, 0xfffffef1) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r0) (async) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) (async) ioctl$PPPIOCSACTIVE(r1, 0x40107446, &(0x7f00000000c0)={0x4, &(0x7f0000000080)=[{0xfff7, 0xdf, 0x1, 0x7}, {0xab, 0x3e, 0x3, 0x2}, {0x7, 0x80, 0xfb, 0x6}, {0x2, 0x7, 0x40, 0x8}]}) (async) ioctl$LOOP_SET_FD(r0, 0x1269, 0xffffffffffffffff) (async) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, 0x0) (async) setsockopt$RDS_CANCEL_SENT_TO(r2, 0x114, 0x1, &(0x7f0000000000)={0x2, 0x4e20, @empty}, 0xfffffef1) (async) 15:32:30 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x0, {0xa, 0x0, 0x38, @private2}}}, 0x38) 15:32:30 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x8000000}, 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) 15:32:30 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x40186366, 0xffffffffffffffff) 15:32:30 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x40186366, 0xffffffffffffffff) 15:32:30 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x5452, 0xffffffffffffffff) (async) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) process_mrelease(r1, 0x0) r2 = syz_open_dev$loop(&(0x7f0000000000), 0x0, 0x141040) ioctl$LOOP_CLR_FD(r2, 0x4c01) 15:32:30 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) (async) ioctl$PPPIOCSACTIVE(r1, 0x40107446, &(0x7f00000000c0)={0x4, &(0x7f0000000080)=[{0xfff7, 0xdf, 0x1, 0x7}, {0xab, 0x3e, 0x3, 0x2}, {0x7, 0x80, 0xfb, 0x6}, {0x2, 0x7, 0x40, 0x8}]}) (async) ioctl$LOOP_SET_FD(r0, 0x1269, 0xffffffffffffffff) (async) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, 0x0) (async) setsockopt$RDS_CANCEL_SENT_TO(r2, 0x114, 0x1, &(0x7f0000000000)={0x2, 0x4e20, @empty}, 0xfffffef1) 15:32:30 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x401870c8, 0xffffffffffffffff) 15:32:30 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x10000000}, 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) 15:32:30 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x0, {0xa, 0x0, 0x300, @private2}}}, 0x38) 15:32:30 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x5, 0x880) ioctl$LOOP_SET_FD(r0, 0x5452, 0xffffffffffffffff) getsockname$qrtr(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000080)=0xc) 15:32:30 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x401870cb, 0xffffffffffffffff) 15:32:30 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x401870c8, 0xffffffffffffffff) 15:32:30 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x200000000000000}, 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) 15:32:30 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x5, 0x880) ioctl$LOOP_SET_FD(r0, 0x5452, 0xffffffffffffffff) getsockname$qrtr(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000080)=0xc) syz_open_dev$loop(&(0x7f0000000040), 0x5, 0x880) (async) ioctl$LOOP_SET_FD(r0, 0x5452, 0xffffffffffffffff) (async) getsockname$qrtr(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000080)=0xc) (async) 15:32:30 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x7fffffff, 0x6b4240) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) ioctl$LOOP_SET_FD(r1, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_SET_FD(r0, 0x1269, 0xffffffffffffffff) 15:32:30 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x401870cc, 0xffffffffffffffff) 15:32:30 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x401870cb, 0xffffffffffffffff) 15:32:30 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x0, {0xa, 0x0, 0x700, @private2}}}, 0x38) 15:32:30 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x7fffffff, 0x6b4240) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) (async, rerun: 32) ioctl$LOOP_SET_FD(r1, 0x4c00, 0xffffffffffffffff) (async, rerun: 32) ioctl$LOOP_SET_FD(r0, 0x1269, 0xffffffffffffffff) 15:32:30 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x800000000000000}, 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) 15:32:30 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x5, 0x880) ioctl$LOOP_SET_FD(r0, 0x5452, 0xffffffffffffffff) (async) getsockname$qrtr(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000080)=0xc) 15:32:30 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x401870cc, 0xffffffffffffffff) 15:32:30 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x401c5820, 0xffffffffffffffff) 15:32:30 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x0, {0xa, 0x0, 0x2000, @private2}}}, 0x38) 15:32:30 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x7fffffff, 0x6b4240) (async, rerun: 64) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) (rerun: 64) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) ioctl$LOOP_SET_FD(r1, 0x4c00, 0xffffffffffffffff) (async) ioctl$LOOP_SET_FD(r0, 0x1269, 0xffffffffffffffff) 15:32:30 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x1000000000000000}, 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) 15:32:30 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x5452, 0xffffffffffffffff) r1 = syz_open_dev$loop(&(0x7f0000000080), 0x9, 0x80180) ioctl$LOOP_SET_STATUS(r1, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x4, 0x2, 0x19, 0x8, "51d91818c70c8f5a6740bb20243c4837fdc77d403538cff81ad40f562af92f0841c6cf3d1e1dda0590bd2b532aa57655510faf2c463789bd7b2d1e22fd619dc0", "6c38599b7d47143383628daaa20d7d91fcd24025274914b946ad48b7f8bb5c1e", [0x9, 0x7]}) syz_open_dev$loop(&(0x7f0000000000), 0x7fffffff, 0x8080) 15:32:30 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x401c5820, 0xffffffffffffffff) 15:32:30 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x4020940d, 0xffffffffffffffff) 15:32:30 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x0, {0xa, 0x0, 0x3800, @private2}}}, 0x38) 15:32:30 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) 15:32:30 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x5452, 0xffffffffffffffff) r1 = syz_open_dev$loop(&(0x7f0000000080), 0x9, 0x80180) ioctl$LOOP_SET_STATUS(r1, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x4, 0x2, 0x19, 0x8, "51d91818c70c8f5a6740bb20243c4837fdc77d403538cff81ad40f562af92f0841c6cf3d1e1dda0590bd2b532aa57655510faf2c463789bd7b2d1e22fd619dc0", "6c38599b7d47143383628daaa20d7d91fcd24025274914b946ad48b7f8bb5c1e", [0x9, 0x7]}) syz_open_dev$loop(&(0x7f0000000000), 0x7fffffff, 0x8080) 15:32:30 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x4020940d, 0xffffffffffffffff) 15:32:30 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x80041284, 0xffffffffffffffff) 15:32:30 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1269, 0xffffffffffffffff) ioctl$SYNC_IOC_FILE_INFO(0xffffffffffffffff, 0xc0383e04, &(0x7f00000002c0)={""/32, 0x0, 0x0, 0x4, 0x0, &(0x7f0000000180)=[{}, {}, {}, {}]}) ioctl$LOOP_CLR_FD(r0, 0x4c01) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) ioctl$LOOP_GET_STATUS64(r0, 0x4c05, &(0x7f0000000080)) 15:32:30 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) 15:32:30 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x0, {0xa, 0x0, 0x20000, @private2}}}, 0x38) 15:32:30 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x80041285, 0xffffffffffffffff) 15:32:30 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x5452, 0xffffffffffffffff) r1 = syz_open_dev$loop(&(0x7f0000000080), 0x9, 0x80180) ioctl$LOOP_SET_STATUS(r1, 0x4c02, &(0x7f00000000c0)={0x0, {}, 0x0, {}, 0x4, 0x2, 0x19, 0x8, "51d91818c70c8f5a6740bb20243c4837fdc77d403538cff81ad40f562af92f0841c6cf3d1e1dda0590bd2b532aa57655510faf2c463789bd7b2d1e22fd619dc0", "6c38599b7d47143383628daaa20d7d91fcd24025274914b946ad48b7f8bb5c1e", [0x9, 0x7]}) (async) syz_open_dev$loop(&(0x7f0000000000), 0x7fffffff, 0x8080) 15:32:30 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x80041284, 0xffffffffffffffff) 15:32:30 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1269, 0xffffffffffffffff) ioctl$SYNC_IOC_FILE_INFO(0xffffffffffffffff, 0xc0383e04, &(0x7f00000002c0)={""/32, 0x0, 0x0, 0x4, 0x0, &(0x7f0000000180)=[{}, {}, {}, {}]}) ioctl$LOOP_CLR_FD(r0, 0x4c01) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) ioctl$LOOP_GET_STATUS64(r0, 0x4c05, &(0x7f0000000080)) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$LOOP_SET_FD(r0, 0x1269, 0xffffffffffffffff) (async) ioctl$SYNC_IOC_FILE_INFO(0xffffffffffffffff, 0xc0383e04, &(0x7f00000002c0)={""/32, 0x0, 0x0, 0x4, 0x0, &(0x7f0000000180)=[{}, {}, {}, {}]}) (async) ioctl$LOOP_CLR_FD(r0, 0x4c01) (async) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) (async) ioctl$LOOP_GET_STATUS64(r0, 0x4c05, &(0x7f0000000080)) (async) 15:32:30 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x0, {0xa, 0x0, 0x200000, @private2}}}, 0x38) 15:32:30 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x80081270, 0xffffffffffffffff) 15:32:30 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x10}, 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) 15:32:30 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x80041285, 0xffffffffffffffff) 15:32:30 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$TIOCSISO7816(0xffffffffffffffff, 0xc0285443, &(0x7f0000000080)={0xffffffff, 0x9, 0x80000000, 0x7, 0x20000000}) ioctl$LOOP_SET_FD(r0, 0x5452, 0xffffffffffffffff) openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) 15:32:30 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x0, {0xa, 0x0, 0x1000000, @private2}}}, 0x38) 15:32:30 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x1269, 0xffffffffffffffff) (async) ioctl$SYNC_IOC_FILE_INFO(0xffffffffffffffff, 0xc0383e04, &(0x7f00000002c0)={""/32, 0x0, 0x0, 0x4, 0x0, &(0x7f0000000180)=[{}, {}, {}, {}]}) (async) ioctl$LOOP_CLR_FD(r0, 0x4c01) (async) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) ioctl$LOOP_GET_STATUS64(r0, 0x4c05, &(0x7f0000000080)) 15:32:30 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x80081272, 0xffffffffffffffff) 15:32:30 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$TIOCSISO7816(0xffffffffffffffff, 0xc0285443, &(0x7f0000000080)={0xffffffff, 0x9, 0x80000000, 0x7, 0x20000000}) ioctl$LOOP_SET_FD(r0, 0x5452, 0xffffffffffffffff) openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$TIOCSISO7816(0xffffffffffffffff, 0xc0285443, &(0x7f0000000080)={0xffffffff, 0x9, 0x80000000, 0x7, 0x20000000}) (async) ioctl$LOOP_SET_FD(r0, 0x5452, 0xffffffffffffffff) (async) openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) 15:32:30 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000}, 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) 15:32:30 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x80081270, 0xffffffffffffffff) 15:32:30 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$PPPIOCSNPMODE(0xffffffffffffffff, 0x4008744b, &(0x7f0000000000)={0x0, 0x3}) ioctl$LOOP_SET_FD(r0, 0x1269, 0xffffffffffffffff) 15:32:30 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x80081280, 0xffffffffffffffff) 15:32:30 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x0, {0xa, 0x0, 0x2000000, @private2}}}, 0x38) 15:32:30 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$TIOCSISO7816(0xffffffffffffffff, 0xc0285443, &(0x7f0000000080)={0xffffffff, 0x9, 0x80000000, 0x7, 0x20000000}) ioctl$LOOP_SET_FD(r0, 0x5452, 0xffffffffffffffff) openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) 15:32:31 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$PPPIOCSNPMODE(0xffffffffffffffff, 0x4008744b, &(0x7f0000000000)={0x0, 0x3}) ioctl$LOOP_SET_FD(r0, 0x1269, 0xffffffffffffffff) 15:32:31 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x0, {0xa, 0x0, 0x3000000, @private2}}}, 0x38) 15:32:31 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000}, 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) 15:32:31 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x80081272, 0xffffffffffffffff) 15:32:31 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x80086301, 0xffffffffffffffff) 15:32:31 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) syz_open_dev$loop(&(0x7f0000000000), 0x0, 0x444a42) ioctl$LOOP_SET_FD(r0, 0x5452, 0xffffffffffffffff) 15:32:31 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$PPPIOCSNPMODE(0xffffffffffffffff, 0x4008744b, &(0x7f0000000000)={0x0, 0x3}) (async) ioctl$LOOP_SET_FD(r0, 0x1269, 0xffffffffffffffff) 15:32:31 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000}, 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) 15:32:31 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x80086601, 0xffffffffffffffff) 15:32:31 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x0, {0xa, 0x0, 0x7000000, @private2}}}, 0x38) 15:32:31 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x80081280, 0xffffffffffffffff) 15:32:31 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) syz_open_dev$loop(&(0x7f0000000000), 0x0, 0x444a42) (async) ioctl$LOOP_SET_FD(r0, 0x5452, 0xffffffffffffffff) 15:32:31 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x7, &(0x7f0000000140)=@raw=[@ldst={0x3, 0x2, 0x1, 0x3, 0x6, 0xffffffffffffffff, 0x10}, @btf_id={0x18, 0x8, 0x3, 0x0, 0x2}, @btf_id={0x18, 0x6, 0x3, 0x0, 0x80004}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8000}], &(0x7f0000000080)='GPL\x00', 0xfc, 0x0, 0x0, 0x41100, 0x4, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f00000000c0)={0x4, 0x3}, 0x8, 0x10, &(0x7f0000000100)={0x5, 0xd, 0x1, 0x1}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x80) ioctl$LOOP_SET_FD(r0, 0x1269, 0xffffffffffffffff) 15:32:31 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x80086301, 0xffffffffffffffff) 15:32:31 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x801c581f, 0xffffffffffffffff) 15:32:31 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) (async) syz_open_dev$loop(&(0x7f0000000000), 0x0, 0x444a42) ioctl$LOOP_SET_FD(r0, 0x5452, 0xffffffffffffffff) 15:32:31 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x0, {0xa, 0x0, 0x38000000, @private2}}}, 0x38) 15:32:31 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000}, 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) 15:32:31 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0xc0045878, 0xffffffffffffffff) 15:32:31 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x7, &(0x7f0000000140)=@raw=[@ldst={0x3, 0x2, 0x1, 0x3, 0x6, 0xffffffffffffffff, 0x10}, @btf_id={0x18, 0x8, 0x3, 0x0, 0x2}, @btf_id={0x18, 0x6, 0x3, 0x0, 0x80004}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8000}], &(0x7f0000000080)='GPL\x00', 0xfc, 0x0, 0x0, 0x41100, 0x4, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f00000000c0)={0x4, 0x3}, 0x8, 0x10, &(0x7f0000000100)={0x5, 0xd, 0x1, 0x1}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x80) ioctl$LOOP_SET_FD(r0, 0x1269, 0xffffffffffffffff) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) (async) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x7, &(0x7f0000000140)=@raw=[@ldst={0x3, 0x2, 0x1, 0x3, 0x6, 0xffffffffffffffff, 0x10}, @btf_id={0x18, 0x8, 0x3, 0x0, 0x2}, @btf_id={0x18, 0x6, 0x3, 0x0, 0x80004}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8000}], &(0x7f0000000080)='GPL\x00', 0xfc, 0x0, 0x0, 0x41100, 0x4, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f00000000c0)={0x4, 0x3}, 0x8, 0x10, &(0x7f0000000100)={0x5, 0xd, 0x1, 0x1}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x80) (async) ioctl$LOOP_SET_FD(r0, 0x1269, 0xffffffffffffffff) (async) 15:32:31 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x80086601, 0xffffffffffffffff) 15:32:31 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x5452, 0xffffffffffffffff) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000), 0x20dfc12433f9301b, 0x0) ioctl$LOOP_SET_STATUS64(r1, 0x4c04, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x7, 0x7e, 0x0, 0x12, 0x15, 0x10, "c9416e8186e0a8ad48cd3d14d8ee32e63df1b6c67433cfa4d37444611493eb96d8b4de70a26c48ae7341e2ba6c2a92652a10075157c8a1bc13ab4fd5cde8ebb8", "ac06360b9560920eae744640c4284e3f26df60cb56a5dddea6e529274019ac8abd0bf28e05fdf178fc1648c72807d4702c119e7d2e3ec0d8dd72d2582b79c0a3", "7b0c71f73e6c632f0df08e0bdb559a396435bd00698d37219607adf7c4b09e93", [0x12000000000000, 0x8001]}) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, 0x0) ioctl$LOOP_CLR_FD(r2, 0x4c01) 15:32:31 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000000000}, 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) 15:32:31 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x0, {0xa, 0x0, 0x0, @private2={0xfc, 0x7}}}}, 0x38) 15:32:31 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x801c581f, 0xffffffffffffffff) 15:32:31 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0xc0045878, 0xffffffffffffffff) 15:32:31 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x5452, 0xffffffffffffffff) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000), 0x20dfc12433f9301b, 0x0) ioctl$LOOP_SET_STATUS64(r1, 0x4c04, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x7, 0x7e, 0x0, 0x12, 0x15, 0x10, "c9416e8186e0a8ad48cd3d14d8ee32e63df1b6c67433cfa4d37444611493eb96d8b4de70a26c48ae7341e2ba6c2a92652a10075157c8a1bc13ab4fd5cde8ebb8", "ac06360b9560920eae744640c4284e3f26df60cb56a5dddea6e529274019ac8abd0bf28e05fdf178fc1648c72807d4702c119e7d2e3ec0d8dd72d2582b79c0a3", "7b0c71f73e6c632f0df08e0bdb559a396435bd00698d37219607adf7c4b09e93", [0x12000000000000, 0x8001]}) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, 0x0) ioctl$LOOP_CLR_FD(r2, 0x4c01) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) (async) ioctl$LOOP_SET_FD(r0, 0x5452, 0xffffffffffffffff) (async) openat$vcs(0xffffffffffffff9c, &(0x7f0000000000), 0x20dfc12433f9301b, 0x0) (async) ioctl$LOOP_SET_STATUS64(r1, 0x4c04, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x7, 0x7e, 0x0, 0x12, 0x15, 0x10, "c9416e8186e0a8ad48cd3d14d8ee32e63df1b6c67433cfa4d37444611493eb96d8b4de70a26c48ae7341e2ba6c2a92652a10075157c8a1bc13ab4fd5cde8ebb8", "ac06360b9560920eae744640c4284e3f26df60cb56a5dddea6e529274019ac8abd0bf28e05fdf178fc1648c72807d4702c119e7d2e3ec0d8dd72d2582b79c0a3", "7b0c71f73e6c632f0df08e0bdb559a396435bd00698d37219607adf7c4b09e93", [0x12000000000000, 0x8001]}) (async) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, 0x0) (async) ioctl$LOOP_CLR_FD(r2, 0x4c01) (async) 15:32:31 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x7, &(0x7f0000000140)=@raw=[@ldst={0x3, 0x2, 0x1, 0x3, 0x6, 0xffffffffffffffff, 0x10}, @btf_id={0x18, 0x8, 0x3, 0x0, 0x2}, @btf_id={0x18, 0x6, 0x3, 0x0, 0x80004}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8000}], &(0x7f0000000080)='GPL\x00', 0xfc, 0x0, 0x0, 0x41100, 0x4, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f00000000c0)={0x4, 0x3}, 0x8, 0x10, &(0x7f0000000100)={0x5, 0xd, 0x1, 0x1}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x80) (async, rerun: 64) ioctl$LOOP_SET_FD(r0, 0x1269, 0xffffffffffffffff) (rerun: 64) 15:32:31 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0xc0045878, 0xffffffffffffffff) 15:32:31 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000000}, 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) 15:32:31 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0xc0101282, 0xffffffffffffffff) 15:32:31 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x0, {0xa, 0x0, 0x0, @private2}}}, 0x38) 15:32:31 executing program 0: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$KDSIGACCEPT(r0, 0x4b4e, 0x32) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000000)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(0xffffffffffffffff, 0xc01864cb, &(0x7f0000000100)={&(0x7f0000000080)=[0x0, r1, 0x0], &(0x7f00000000c0)=[0x2d, 0x2, 0xe39, 0x7, 0x80000000, 0x7, 0x8000], 0x3, 0x1}) r2 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) ioctl$LOOP_SET_FD(r3, 0x1269, r2) 15:32:31 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x5452, 0xffffffffffffffff) (async) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000), 0x20dfc12433f9301b, 0x0) ioctl$LOOP_SET_STATUS64(r1, 0x4c04, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x7, 0x7e, 0x0, 0x12, 0x15, 0x10, "c9416e8186e0a8ad48cd3d14d8ee32e63df1b6c67433cfa4d37444611493eb96d8b4de70a26c48ae7341e2ba6c2a92652a10075157c8a1bc13ab4fd5cde8ebb8", "ac06360b9560920eae744640c4284e3f26df60cb56a5dddea6e529274019ac8abd0bf28e05fdf178fc1648c72807d4702c119e7d2e3ec0d8dd72d2582b79c0a3", "7b0c71f73e6c632f0df08e0bdb559a396435bd00698d37219607adf7c4b09e93", [0x12000000000000, 0x8001]}) (async, rerun: 32) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) (rerun: 32) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r2, 0xc01064c2, 0x0) ioctl$LOOP_CLR_FD(r2, 0x4c01) 15:32:31 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) 15:32:31 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x0, {0xa, 0x0, 0x0, @private2={0xfc, 0x2, '\x00', 0x2}}}}, 0x38) 15:32:31 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0xc0189436, 0xffffffffffffffff) 15:32:31 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0xc0045878, 0xffffffffffffffff) 15:32:31 executing program 1: syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$LOOP_SET_FD(r0, 0x5452, 0xffffffffffffffff) 15:32:31 executing program 0: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$KDSIGACCEPT(r0, 0x4b4e, 0x32) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000000)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(0xffffffffffffffff, 0xc01864cb, &(0x7f0000000100)={&(0x7f0000000080)=[0x0, r1, 0x0], &(0x7f00000000c0)=[0x2d, 0x2, 0xe39, 0x7, 0x80000000, 0x7, 0x8000], 0x3, 0x1}) r2 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) ioctl$LOOP_SET_FD(r3, 0x1269, r2) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) (async) ioctl$KDSIGACCEPT(r0, 0x4b4e, 0x32) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000000)) (async) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(0xffffffffffffffff, 0xc01864cb, &(0x7f0000000100)={&(0x7f0000000080)=[0x0, r1, 0x0], &(0x7f00000000c0)=[0x2d, 0x2, 0xe39, 0x7, 0x80000000, 0x7, 0x8000], 0x3, 0x1}) (async) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) (async) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) (async) ioctl$LOOP_SET_FD(r3, 0x1269, r2) (async) 15:32:31 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) 15:32:31 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0xc0101282, 0xffffffffffffffff) 15:32:31 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0xc020660b, 0xffffffffffffffff) 15:32:31 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x0, {0xa, 0x0, 0x0, @private2={0xfc, 0x2, '\x00', 0x3}}}}, 0x38) 15:32:31 executing program 0: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$KDSIGACCEPT(r0, 0x4b4e, 0x32) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000000)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(0xffffffffffffffff, 0xc01864cb, &(0x7f0000000100)={&(0x7f0000000080)=[0x0, r1, 0x0], &(0x7f00000000c0)=[0x2d, 0x2, 0xe39, 0x7, 0x80000000, 0x7, 0x8000], 0x3, 0x1}) r2 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) ioctl$LOOP_SET_FD(r3, 0x1269, r2) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) (async) ioctl$KDSIGACCEPT(r0, 0x4b4e, 0x32) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000000)) (async) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(0xffffffffffffffff, 0xc01864cb, &(0x7f0000000100)={&(0x7f0000000080)=[0x0, r1, 0x0], &(0x7f00000000c0)=[0x2d, 0x2, 0xe39, 0x7, 0x80000000, 0x7, 0x8000], 0x3, 0x1}) (async) syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) (async) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r3, 0xc01064c2, 0x0) (async) ioctl$LOOP_SET_FD(r3, 0x1269, r2) (async) 15:32:31 executing program 1: syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) (async, rerun: 32) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) (rerun: 32) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) ioctl$LOOP_SET_FD(r0, 0x5452, 0xffffffffffffffff) 15:32:31 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}, 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) 15:32:31 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0xc0189436, 0xffffffffffffffff) 15:32:31 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x0, {0xa, 0x0, 0x0, @private2={0xfc, 0x2, '\x00', 0x7}}}}, 0x38) 15:32:31 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0xc0481273, 0xffffffffffffffff) 15:32:31 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0xfffffffffffffffd, 0x480001) ioctl$LOOP_SET_FD(r0, 0x1269, 0xffffffffffffffff) 15:32:31 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000}, 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) 15:32:31 executing program 1: syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) (async, rerun: 32) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) (rerun: 32) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r0, 0xc01064c2, 0x0) (async) ioctl$LOOP_SET_FD(r0, 0x5452, 0xffffffffffffffff) 15:32:31 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x0, {0xa, 0x0, 0x0, @private2={0xfc, 0x2, '\x00', 0x38}}}}, 0x38) 15:32:31 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0xc020660b, 0xffffffffffffffff) 15:32:31 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0xfffffffffffffffd, 0x480001) ioctl$LOOP_SET_FD(r0, 0x1269, 0xffffffffffffffff) 15:32:31 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_IP(r1, &(0x7f0000000080)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x9, @local, 0x81}, {0xa, 0x4e22, 0x6, @empty, 0xd2}, 0xffffffffffffffff, 0x7}}, 0x48) ioctl$LOOP_SET_FD(r0, 0x1277, 0xffffffffffffffff) 15:32:31 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0xc0481273, 0xffffffffffffffff) 15:32:31 executing program 5: pipe2$9p(&(0x7f0000000000), 0x0) eventfd(0x0) openat$ttynull(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000}, 0x0, &(0x7f0000000340)={0xa322}, 0x0, 0x0) 15:32:31 executing program 2: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000100)={0x10, 0x30, 0xfa00, {0x0, 0x0, {0xa, 0x0, 0x0, @private2}}}, 0x38) 15:32:31 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000000), 0x0, 0x303040) ioctl$LOOP_SET_FD(r0, 0x5452, 0xffffffffffffffff) 15:32:31 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000040), 0xfffffffffffffffd, 0x480001) ioctl$LOOP_SET_FD(r0, 0x1269, 0xffffffffffffffff) syz_open_dev$loop(&(0x7f0000000040), 0xfffffffffffffffd, 0x480001) (async) ioctl$LOOP_SET_FD(r0, 0x1269, 0xffffffffffffffff) (async) 15:32:31 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_IP(r1, &(0x7f0000000080)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x9, @local, 0x81}, {0xa, 0x4e22, 0x6, @empty, 0xd2}, 0xffffffffffffffff, 0x7}}, 0x48) ioctl$LOOP_SET_FD(r0, 0x1277, 0xffffffffffffffff) sy