[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [ 26.850778] kauditd_printk_skb: 7 callbacks suppressed [ 26.850791] audit: type=1800 audit(1539727851.240:29): pid=5248 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rc.local" dev="sda1" ino=2432 res=0 [ 26.884414] audit: type=1800 audit(1539727851.250:30): pid=5248 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="startpar" name="rmnologin" dev="sda1" ino=2423 res=0 Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.24' (ECDSA) to the list of known hosts. 2018/10/16 22:11:01 fuzzer started 2018/10/16 22:11:03 dialing manager at 10.128.0.26:40325 2018/10/16 22:11:03 syscalls: 1 2018/10/16 22:11:03 code coverage: enabled 2018/10/16 22:11:03 comparison tracing: enabled 2018/10/16 22:11:03 setuid sandbox: enabled 2018/10/16 22:11:03 namespace sandbox: enabled 2018/10/16 22:11:03 Android sandbox: /sys/fs/selinux/policy does not exist 2018/10/16 22:11:03 fault injection: enabled 2018/10/16 22:11:03 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 2018/10/16 22:11:03 net packed injection: enabled 2018/10/16 22:11:03 net device setup: enabled 22:13:02 executing program 0: r0 = syz_open_dev$admmidi(&(0x7f0000000100)='/dev/admmidi#\x00', 0x0, 0x0) setsockopt$RDS_GET_MR_FOR_DEST(r0, 0x114, 0x7, &(0x7f0000000280)={@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e24, @multicast2}, 0x0, 0x1, 0x1, 0x2}}, {&(0x7f00000001c0)=""/143, 0x8f}, &(0x7f00000000c0)}, 0xa0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = creat(&(0x7f0000001140)='./file0\x00', 0x3) write$binfmt_script(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="0100202e2f07006c653020237a7d3975e93a69284781c694eb902e7c671d2cf67d21f5dd6393b48ddd93a343cd0d55906785815bc329caee315d1ea03bdb5071a8966df5920a2e1dee4eb3be4af9a410f6301abd910c7610e711b133c5db8eeb9a3d7be57f2b1862f08e969dd2a78567604669b742cd9d047402331d092e28c9da9cedc90ce38ef098bdc36f582b3d658bdf3c3cd467a5a48234127b8630b7290cac6e1cd53b726c600551cd3fa8c0de8c78e40b056c95a8d80164a5c5de7c3805a71f5cda9935bcab32ce3b4fc956a1c5bcd79ed02f09bba11766578cfdbdc8a7d954ef716735d8afdff002defc7768ce51e0eb9df947a5cd7a8c0768bc5e2d2a10e18a"], 0x104) close(r1) execve(&(0x7f0000000180)='./file0\x00', &(0x7f0000000140), &(0x7f0000000140)) clock_gettime(0x0, &(0x7f0000000040)) syzkaller login: [ 157.998965] IPVS: ftp: loaded support on port[0] = 21 22:13:02 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x8b000)=nil, 0x8b000, 0x1000004, 0x10000032, 0xffffffffffffffff, 0x0) futex(&(0x7f0000001000), 0x8c, 0x1, &(0x7f0000191000), &(0x7f0000000000), 0x0) [ 158.283792] IPVS: ftp: loaded support on port[0] = 21 22:13:02 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/igmp\x00') preadv(r0, &(0x7f0000000380)=[{&(0x7f0000000200)=""/150, 0x96}], 0x1, 0x0) [ 158.578646] IPVS: ftp: loaded support on port[0] = 21 22:13:03 executing program 3: clone(0x200, &(0x7f0000000080), &(0x7f0000000000), &(0x7f0000000100), &(0x7f0000000280)) mknod(&(0x7f0000f80000)='./file0\x00', 0x1040, 0x0) execve(&(0x7f0000000400)='./file0\x00', &(0x7f00000003c0), &(0x7f0000000600)) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000280)=""/11, 0x10158) creat(&(0x7f00000002c0)='./file1\x00', 0x101) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000200)) clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, &(0x7f0000000140), 0xffffffffffffffff) r1 = creat(&(0x7f0000000080)="e91f7189591e9233614b00", 0x10a) r2 = dup2(r0, r1) execve(&(0x7f00000000c0)="e91f7189591e9233614b00", &(0x7f0000000140), &(0x7f0000001580)) ioctl$TUNSETTXFILTER(r2, 0x400454d1, &(0x7f00000001c0)=ANY=[]) open$dir(&(0x7f0000000240)='./file0\x00', 0x841, 0x0) clone(0x3102001ff6, 0x0, 0xfffffffffffffffe, &(0x7f0000000300), 0xffffffffffffffff) execve(&(0x7f0000000040)='./file1\x00', &(0x7f0000000400), &(0x7f0000000b40)) ioctl$BLKROTATIONAL(r0, 0x127e, &(0x7f0000000380)) [ 159.132775] IPVS: ftp: loaded support on port[0] = 21 [ 159.400266] bridge0: port 1(bridge_slave_0) entered blocking state [ 159.423097] bridge0: port 1(bridge_slave_0) entered disabled state [ 159.430629] device bridge_slave_0 entered promiscuous mode 22:13:03 executing program 4: socket(0x1e, 0x805, 0x0) r0 = socket$inet6(0xa, 0x3, 0x800000000000004) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d5c6070") socket$vsock_stream(0x28, 0x1, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000140)={0x2a}, &(0x7f0000000200)={0x0, r1+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8}) vmsplice(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0) [ 159.536066] bridge0: port 2(bridge_slave_1) entered blocking state [ 159.561434] bridge0: port 2(bridge_slave_1) entered disabled state [ 159.568905] device bridge_slave_1 entered promiscuous mode [ 159.715208] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 159.759202] IPVS: ftp: loaded support on port[0] = 21 [ 159.894441] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready 22:13:04 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000880)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x541b, &(0x7f0000000000)) [ 160.248727] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 160.329622] bridge0: port 1(bridge_slave_0) entered blocking state [ 160.351146] bridge0: port 1(bridge_slave_0) entered disabled state [ 160.363841] device bridge_slave_0 entered promiscuous mode [ 160.379660] bridge0: port 1(bridge_slave_0) entered blocking state [ 160.393726] bridge0: port 1(bridge_slave_0) entered disabled state [ 160.407877] device bridge_slave_0 entered promiscuous mode [ 160.424353] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 160.478267] bridge0: port 2(bridge_slave_1) entered blocking state [ 160.499287] IPVS: ftp: loaded support on port[0] = 21 [ 160.510708] bridge0: port 2(bridge_slave_1) entered disabled state [ 160.529675] device bridge_slave_1 entered promiscuous mode [ 160.538467] bridge0: port 2(bridge_slave_1) entered blocking state [ 160.545052] bridge0: port 2(bridge_slave_1) entered disabled state [ 160.557572] device bridge_slave_1 entered promiscuous mode [ 160.653585] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 160.680972] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 160.797278] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 160.840253] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 161.087089] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 161.102522] team0: Port device team_slave_0 added [ 161.207604] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 161.237737] team0: Port device team_slave_1 added [ 161.264483] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 161.304768] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 161.383389] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 161.392648] bridge0: port 1(bridge_slave_0) entered blocking state [ 161.399140] bridge0: port 1(bridge_slave_0) entered disabled state [ 161.409837] device bridge_slave_0 entered promiscuous mode [ 161.423419] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 161.440319] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 161.457521] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 161.498828] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 161.553017] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 161.562579] bridge0: port 2(bridge_slave_1) entered blocking state [ 161.568955] bridge0: port 2(bridge_slave_1) entered disabled state [ 161.592268] device bridge_slave_1 entered promiscuous mode [ 161.623769] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 161.652000] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 161.659990] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 161.704075] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 161.727983] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 161.750458] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 161.771912] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 161.819028] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 161.959766] bridge0: port 1(bridge_slave_0) entered blocking state [ 161.973899] bridge0: port 1(bridge_slave_0) entered disabled state [ 161.982548] device bridge_slave_0 entered promiscuous mode [ 162.115759] bridge0: port 2(bridge_slave_1) entered blocking state [ 162.125624] bridge0: port 2(bridge_slave_1) entered disabled state [ 162.133423] device bridge_slave_1 entered promiscuous mode [ 162.214030] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 162.228690] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 162.251910] team0: Port device team_slave_0 added [ 162.259111] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 162.288034] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 162.310338] team0: Port device team_slave_0 added [ 162.380634] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 162.394175] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 162.408692] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 162.432217] team0: Port device team_slave_1 added [ 162.437704] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 162.463299] team0: Port device team_slave_1 added [ 162.550452] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 162.562765] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 162.570708] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 162.611512] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 162.656149] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 162.706256] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 162.788442] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 162.806983] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 162.823540] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 162.852634] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 162.862615] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 162.871652] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 162.879706] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 162.921458] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 162.929130] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 162.949518] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 162.992234] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 163.002353] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 163.010345] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 163.022275] bridge0: port 1(bridge_slave_0) entered blocking state [ 163.036026] bridge0: port 1(bridge_slave_0) entered disabled state [ 163.072444] device bridge_slave_0 entered promiscuous mode [ 163.082147] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 163.107607] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 163.121806] team0: Port device team_slave_0 added [ 163.184065] bridge0: port 2(bridge_slave_1) entered blocking state [ 163.190573] bridge0: port 2(bridge_slave_1) entered disabled state [ 163.219232] device bridge_slave_1 entered promiscuous mode [ 163.230895] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 163.250181] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 163.273730] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 163.321643] team0: Port device team_slave_1 added [ 163.360835] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 163.409778] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 163.431218] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 163.471489] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 163.478416] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 163.500368] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 163.513632] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 163.524960] bridge0: port 2(bridge_slave_1) entered blocking state [ 163.531565] bridge0: port 2(bridge_slave_1) entered forwarding state [ 163.538565] bridge0: port 1(bridge_slave_0) entered blocking state [ 163.545012] bridge0: port 1(bridge_slave_0) entered forwarding state [ 163.562482] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 163.593028] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 163.601503] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 163.627149] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 163.708186] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 163.730281] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 163.746968] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 163.870833] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 163.885250] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 163.907240] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 163.927574] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 163.942838] team0: Port device team_slave_0 added [ 163.954926] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 164.011794] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 164.094029] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 164.112428] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 164.122200] team0: Port device team_slave_1 added [ 164.219977] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 164.227119] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 164.237251] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 164.270513] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 164.284312] bridge0: port 2(bridge_slave_1) entered blocking state [ 164.290689] bridge0: port 2(bridge_slave_1) entered forwarding state [ 164.297418] bridge0: port 1(bridge_slave_0) entered blocking state [ 164.303839] bridge0: port 1(bridge_slave_0) entered forwarding state [ 164.320204] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 164.335368] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 164.358729] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 164.392623] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 164.408562] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 164.431351] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 164.441513] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 164.470679] bridge0: port 2(bridge_slave_1) entered blocking state [ 164.477146] bridge0: port 2(bridge_slave_1) entered forwarding state [ 164.483875] bridge0: port 1(bridge_slave_0) entered blocking state [ 164.490262] bridge0: port 1(bridge_slave_0) entered forwarding state [ 164.523979] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 164.545200] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 164.562740] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 164.587513] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 164.691369] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 164.701392] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 164.709388] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 164.803776] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 164.814507] team0: Port device team_slave_0 added [ 164.916189] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 164.948684] team0: Port device team_slave_1 added [ 165.021827] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 165.031850] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 165.091517] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 165.101877] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 165.112214] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 165.250518] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 165.267971] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 165.278172] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 165.383784] bridge0: port 2(bridge_slave_1) entered blocking state [ 165.390195] bridge0: port 2(bridge_slave_1) entered forwarding state [ 165.396917] bridge0: port 1(bridge_slave_0) entered blocking state [ 165.403331] bridge0: port 1(bridge_slave_0) entered forwarding state [ 165.424124] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 165.432243] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 165.447621] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 165.481873] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 165.568662] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 165.581748] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 165.599498] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 166.032593] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 166.270612] bridge0: port 2(bridge_slave_1) entered blocking state [ 166.277074] bridge0: port 2(bridge_slave_1) entered forwarding state [ 166.283781] bridge0: port 1(bridge_slave_0) entered blocking state [ 166.290152] bridge0: port 1(bridge_slave_0) entered forwarding state [ 166.314272] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 166.998782] bridge0: port 2(bridge_slave_1) entered blocking state [ 167.005222] bridge0: port 2(bridge_slave_1) entered forwarding state [ 167.011948] bridge0: port 1(bridge_slave_0) entered blocking state [ 167.018322] bridge0: port 1(bridge_slave_0) entered forwarding state [ 167.038161] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 167.101563] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 167.110324] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 168.799119] 8021q: adding VLAN 0 to HW filter on device bond0 [ 169.295476] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 169.606917] 8021q: adding VLAN 0 to HW filter on device bond0 [ 169.778455] 8021q: adding VLAN 0 to HW filter on device bond0 [ 169.810627] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 169.833603] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 169.851944] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 170.203078] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 170.233587] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 170.324475] 8021q: adding VLAN 0 to HW filter on device team0 [ 170.441605] 8021q: adding VLAN 0 to HW filter on device bond0 [ 170.723669] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 170.751744] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 170.764420] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 170.772897] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 170.792065] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 170.809979] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 170.931848] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 171.146511] 8021q: adding VLAN 0 to HW filter on device bond0 [ 171.211774] 8021q: adding VLAN 0 to HW filter on device team0 [ 171.273955] 8021q: adding VLAN 0 to HW filter on device team0 [ 171.402350] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 171.408644] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 171.427771] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 171.643456] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 171.940478] 8021q: adding VLAN 0 to HW filter on device team0 [ 172.117216] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 172.123757] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 172.139266] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 172.155451] 8021q: adding VLAN 0 to HW filter on device bond0 [ 172.602352] 8021q: adding VLAN 0 to HW filter on device team0 [ 172.622373] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 173.101816] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 173.108134] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 173.116353] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 173.322795] hrtimer: interrupt took 34062 ns 22:13:17 executing program 0: r0 = syz_open_dev$admmidi(&(0x7f0000000100)='/dev/admmidi#\x00', 0x0, 0x0) setsockopt$RDS_GET_MR_FOR_DEST(r0, 0x114, 0x7, &(0x7f0000000280)={@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e24, @multicast2}, 0x0, 0x1, 0x1, 0x2}}, {&(0x7f00000001c0)=""/143, 0x8f}, &(0x7f00000000c0)}, 0xa0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = creat(&(0x7f0000001140)='./file0\x00', 0x3) write$binfmt_script(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="0100202e2f07006c653020237a7d3975e93a69284781c694eb902e7c671d2cf67d21f5dd6393b48ddd93a343cd0d55906785815bc329caee315d1ea03bdb5071a8966df5920a2e1dee4eb3be4af9a410f6301abd910c7610e711b133c5db8eeb9a3d7be57f2b1862f08e969dd2a78567604669b742cd9d047402331d092e28c9da9cedc90ce38ef098bdc36f582b3d658bdf3c3cd467a5a48234127b8630b7290cac6e1cd53b726c600551cd3fa8c0de8c78e40b056c95a8d80164a5c5de7c3805a71f5cda9935bcab32ce3b4fc956a1c5bcd79ed02f09bba11766578cfdbdc8a7d954ef716735d8afdff002defc7768ce51e0eb9df947a5cd7a8c0768bc5e2d2a10e18a"], 0x104) close(r1) execve(&(0x7f0000000180)='./file0\x00', &(0x7f0000000140), &(0x7f0000000140)) clock_gettime(0x0, &(0x7f0000000040)) 22:13:18 executing program 0: fdatasync(0xffffffffffffff9c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$IPVS_CMD_DEL_DEST(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000040)={&(0x7f0000000940)=ANY=[]}, 0x1, 0x0, 0x0, 0x90}, 0x0) syz_open_procfs(0x0, &(0x7f0000000200)="2f6578650000c10000000000e9ff0700000000000054fa07424adee916d2da75afe70b35a0fd6a1f0200f5ab26d7a071fb35331ce39c5a6568641006d7c0206a74e33326530000000000000000000000") ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000280)=0x400) r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) listen(r0, 0x6) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) connect$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f0000000340)='tls\x00', 0x4) setsockopt$sock_timeval(0xffffffffffffffff, 0x1, 0x0, &(0x7f0000000040)={0x0, 0x2710}, 0x10) syz_open_dev$adsp(&(0x7f0000000240)='/dev/adsp#\x00', 0x101, 0x40000) inotify_add_watch(r1, &(0x7f0000000180)='./file0\x00', 0x0) sendmmsg(r1, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp={0x18, 0x2, {0x0, @rand_addr}}, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) ioctl$TIOCMSET(0xffffffffffffffff, 0x5418, &(0x7f0000000300)) [ 173.750235] 8021q: adding VLAN 0 to HW filter on device team0 22:13:18 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000000)={0xfffb, 0x1b, 0x0, 0xffffffffffffffff}) ioctl$DMA_BUF_IOCTL_SYNC(r2, 0x40086200, &(0x7f0000000040)=0x2) ioctl$DMA_BUF_IOCTL_SYNC(r2, 0x40086200, &(0x7f0000000080)=0x5) 22:13:18 executing program 0: syz_emit_ethernet(0xff27, &(0x7f000000a000)={@broadcast=[0xff, 0xe0], @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x36, 0x0, 0xfec3, 0x0, 0x0, 0x0, 0x2f, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}, @multicast1}, @udp={0x0, 0x883e, 0x8}}}}}, 0x0) [ 173.947648] ion_buffer_destroy: buffer still mapped in the kernel [ 174.045743] ip_tunnel: non-ECT from 172.20.255.187 with TOS=0x2 [ 174.080596] ip_tunnel: non-ECT from 172.20.255.187 with TOS=0x2 22:13:18 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0x0) write$binfmt_script(r1, &(0x7f0000000040)=ANY=[@ANYBLOB="2302202e2f66077579c81016881d69"], 0xf) clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) mknod$loop(&(0x7f0000000180)='./file0\x00', 0x1, 0xffffffffffffffff) execveat(r1, &(0x7f0000000000)='\x00', &(0x7f0000000400), &(0x7f00000003c0), 0x1000) 22:13:18 executing program 0: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) 22:13:18 executing program 2: setsockopt$RDS_GET_MR_FOR_DEST(0xffffffffffffffff, 0x114, 0x7, &(0x7f0000000280)={@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e24, @multicast2}, 0x0, 0x1, 0x1, 0x2}}, {&(0x7f00000001c0)=""/143, 0x8f}, &(0x7f00000000c0), 0x38}, 0xa0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x8000, 0x3) ioctl$KIOCSOUND(r0, 0x4b2f, 0xfffffffffffffffd) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000005340)={@remote}, &(0x7f0000005380)=0x14) r1 = creat(&(0x7f0000001140)='./file0\x00', 0x3) write$binfmt_script(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="0100202e2f07006c653020237a7d3975e93a69284781c694eb902e7c671d2cf67d21f5dd6393b48ddd93a343cd0d55906785815bc329caee315d1ea03bdb5071a8966df5920a2e1dee4eb3be4af9a410f6301abd910c7610e711b133c5db8eeb9a3d7be57f2b1862f08e969dd2a78567604669b742cd9d047402331d092e28c9da9cedc90ce38ef098bdc36f582b3d658bdf3c3cd467a5a48234127b8630b7290cac6e1cd53b726c600551cd3fa8c0de8c78e40b056c95a8d80164a5c5de7c3805a71f5cda9935bcab32ce3b4fc956a1c5bcd79ed02f09bba11766578cfdbdc8a7d954ef716735d8afdff002defc7768ce51e0eb9df947a5cd7a8c0768bc5e2d2a10e18a"], 0x104) close(r1) execve(&(0x7f0000000180)='./file0\x00', &(0x7f0000000140), &(0x7f0000000140)) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) utimes(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)={{0x77359400}, {r2, r3/1000+10000}}) 22:13:18 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000480)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000280)=[@text32={0x20, &(0x7f00000003c0)="0f20c035100000000f22c0c4c1f87766baf80cb8aedf018fef66bafc0c66ed0f01ef8149000f00000036f30f2000c4c37962530782670fc75b39643e2e0f01cf66baf80cb86c5fbb8aef66bafc0c66b8e07166ef", 0x54}], 0x1, 0x0, &(0x7f0000000040), 0xfffffffffffff29) ioctl$KVM_RUN(r2, 0xae80, 0x0) syz_open_dev$usbmon(&(0x7f0000000080)='/dev/usbmon#\x00', 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f000004f000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000100)="26410f300f01c90f06643e400f01c9420f758e000000002ef3400fb8e566baf80cb8ac8abd80ef66bafc0cedd2fe0f01ca66ba4000ec", 0x36}], 0x1, 0x0, &(0x7f00000004c0), 0x1000031b) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000280)=[@text16={0x10, &(0x7f0000000040)="660f382b1a0f01dfdde80f32d9e90f086665676426f7c5000000000f2245deef0f23f5", 0x23}], 0x1, 0x0, &(0x7f0000000140), 0x0) select(0x40, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x81}, &(0x7f0000000340), &(0x7f0000000380), &(0x7f00000003c0)={0x0, 0x7530}) setsockopt$IP_VS_SO_SET_ZERO(0xffffffffffffffff, 0x0, 0x48f, &(0x7f00000000c0)={0x0, @local, 0x4e22, 0x0, 'fo\x00', 0x0, 0x0, 0x74}, 0x2c) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 174.472816] binder: 6927:6932 Acquire 1 refcount change on invalid ref 0 ret -22 [ 174.524956] binder: 6927:6938 Acquire 1 refcount change on invalid ref 0 ret -22 [ 174.548878] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/l1tf.html for details. 22:13:19 executing program 0: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f00000001c0)}) [ 174.871242] binder: 6956:6959 Acquire 1 refcount change on invalid ref 0 ret -22 22:13:20 executing program 3: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r0, 0xd3c9) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000480)=0x80, 0x0) setsockopt$inet6_opts(r2, 0x29, 0x37, &(0x7f0000000000)=@dstopts, 0x8) 22:13:20 executing program 4: r0 = syz_open_dev$admmidi(&(0x7f0000000100)='/dev/admmidi#\x00', 0x0, 0x0) setsockopt$RDS_GET_MR_FOR_DEST(r0, 0x114, 0x7, &(0x7f0000000280)={@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e24, @multicast2}, 0x0, 0x0, 0x1, 0x2}}, {&(0x7f00000001c0)=""/143, 0x8f}, &(0x7f00000000c0), 0x2}, 0xa0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = creat(&(0x7f0000001140)='./file0\x00', 0x3) write$binfmt_script(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="0100202e2f07006c653020237a7d3975e93a69284781c694eb902e7c671d2cf67d21f5dd6393b48ddd93a343cd0d55906785815bc329caee315d1ea03bdb5071a8966df5920a2e1dee4eb3be4af9a410f6301abd910c7610e711b133c5db8eeb9a3d7be57f2b1862f08e969dd2a78567604669b742cd9d047402331d092e28c9da9cedc90ce38ef098bdc36f582b3d658bdf3c3cd467a5a48234127b8630b7290cac6e1cd53b726c600551cd3fa8c0de8c78e40b056c95a8d80164a5c5de7c3805a71f5cda9935bcab32ce3b4fc956a1c5bcd79ed02f09bba11766578cfdbdc8a7d954ef716735d8afdff002defc7768ce51e0eb9df947a5cd7a8c0768bc5e2d2a10e18a"], 0x104) close(0xffffffffffffffff) execve(&(0x7f0000000180)='./file0\x00', &(0x7f0000000140), &(0x7f0000000140)) clock_gettime(0x0, &(0x7f0000000040)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000340)={{{@in6=@dev, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in=@multicast2}}, &(0x7f0000000000)=0xe8) ioprio_get$uid(0x3, r2) 22:13:20 executing program 2: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-vsock\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) dup3(r1, r0, 0x0) 22:13:20 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$IPVS_CMD_DEL_DEST(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000140), 0xc, &(0x7f0000000040)={&(0x7f0000000940)=ANY=[]}}, 0x0) syz_open_procfs(0x0, &(0x7f0000000200)="2f6578650000c10000000000e9ff0700000000000054fa07424adee916d2da75afe70b35a0fd6a1f0200f5ab26d7a071fb35331ce39c5a6568641006d7c0206a74e33326530000000000000000000000") r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) mq_open(&(0x7f0000000000)='..\x00', 0x0, 0x0, &(0x7f0000000040)) r1 = socket$inet_dccp(0x2, 0x6, 0x0) listen(r0, 0x6) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) ioctl$TIOCMSET(0xffffffffffffffff, 0x5418, &(0x7f0000000300)=0x8) 22:13:20 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000001fc0)={'ip_vti0\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r0, 0x8916, &(0x7f00000001c0)={@ipv4={[], [], @multicast2}, 0x0, r2}) 22:13:20 executing program 5: socketpair$unix(0x1, 0x8000020000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x100, 0x0) lsetxattr$security_smack_transmute(&(0x7f0000000080)='./bus\x00', &(0x7f00000000c0)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000140)='TRUE', 0x4, 0x2) ioctl$RTC_AIE_ON(r1, 0x7001) r2 = socket$inet6(0xa, 0x400000000001, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000001c0)={0x0}, &(0x7f0000000200)=0xc) r4 = gettid() kcmp(r3, r4, 0x4, r0, r1) r5 = dup(r2) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r2, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x1, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r6 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r6, 0x2007fff) sendfile(r5, r6, &(0x7f0000000600), 0x800100000000) connect$netlink(r5, &(0x7f0000000100)=@unspec, 0xc) 22:13:20 executing program 3: r0 = socket(0x10, 0x2, 0x0) recvmmsg(r0, &(0x7f0000009240)=[{{&(0x7f0000001d00)=@nfc, 0x80, &(0x7f0000001d80), 0x0, &(0x7f0000001ec0)=""/50, 0x32}}, {{0x0, 0x0, &(0x7f0000008ec0)=[{&(0x7f0000007ec0)=""/4096, 0x1000}, {&(0x7f0000003840)=""/122, 0x7a}, {&(0x7f00000038c0)=""/242, 0xf2}, {&(0x7f00000039c0)=""/204, 0xcc}, {&(0x7f0000003ac0)=""/214, 0xd6}, {&(0x7f0000003bc0)=""/151, 0x97}, {&(0x7f0000003c80)=""/197, 0xc5}, {&(0x7f0000004180)=""/169, 0xa9}, {&(0x7f0000004240)=""/147, 0x93}, {&(0x7f0000003d80)=""/72, 0x48}], 0xa}}], 0x2, 0x0, &(0x7f0000009440)={0x77359400}) sendmsg$nl_crypto(r0, &(0x7f0000000300)={&(0x7f0000000040), 0xc, &(0x7f0000000280)={&(0x7f0000000180)=@upd={0xe0, 0x12, 0x301, 0x0, 0x0, {{'\nrc32\x00'}}}, 0xe0}}, 0x0) [ 176.134193] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. 22:13:20 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0xfffb, 0x1}) 22:13:20 executing program 2: r0 = openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000000)={0xfffb, 0x1b, 0x0, 0xffffffffffffffff}) ioctl$DMA_BUF_IOCTL_SYNC(r1, 0x40086200, &(0x7f0000000040)=0x2) ioctl$DMA_BUF_IOCTL_SYNC(r1, 0x40086200, &(0x7f0000000080)=0x5) 22:13:20 executing program 5: socketpair$unix(0x1, 0x8000020000005, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x100, 0x0) lsetxattr$security_smack_transmute(&(0x7f0000000080)='./bus\x00', &(0x7f00000000c0)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000140)='TRUE', 0x4, 0x2) ioctl$RTC_AIE_ON(r1, 0x7001) r2 = socket$inet6(0xa, 0x400000000001, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000001c0)={0x0}, &(0x7f0000000200)=0xc) r4 = gettid() kcmp(r3, r4, 0x4, r0, r1) r5 = dup(r2) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r2, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x1, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r6 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r6, 0x2007fff) sendfile(r5, r6, &(0x7f0000000600), 0x800100000000) connect$netlink(r5, &(0x7f0000000100)=@unspec, 0xc) [ 176.189254] netlink: 192 bytes leftover after parsing attributes in process `syz-executor3'. 22:13:20 executing program 4: r0 = openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0x40, 0x31, 0x0, 0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r1}], 0x1, &(0x7f0000000080)={0x0, 0x989680}, &(0x7f0000000100), 0x8) [ 176.252252] netlink: 192 bytes leftover after parsing attributes in process `syz-executor3'. 22:13:20 executing program 3: r0 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x4}, 0xc, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYBLOB="1c0000001a000500000000000000000002d2783c5682df4f586f0000"], 0x1}, 0x1, 0x0, 0x0, 0x3}, 0x0) r1 = socket$inet6(0xa, 0x803, 0x3) ioctl(r1, 0x1000021000008912, &(0x7f0000000100)="0a5c2d0c3c126205718070") sendmmsg$alg(r0, &(0x7f0000000140)=[{0x0, 0x0, &(0x7f0000000100), 0x0, &(0x7f0000000100)}], 0x492492492492805, 0x0) 22:13:20 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$IPVS_CMD_DEL_DEST(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000140), 0xc, &(0x7f0000000040)={&(0x7f0000000940)=ANY=[]}}, 0x0) syz_open_procfs(0x0, &(0x7f0000000200)="2f6578650000c10000000000e9ff0700000000000054fa07424adee916d2da75afe70b35a0fd6a1f0200f5ab26d7a071fb35331ce39c5a6568641006d7c0206a74e33326530000000000000000000000") r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) mq_open(&(0x7f0000000000)='..\x00', 0x0, 0x0, &(0x7f0000000040)) r1 = socket$inet_dccp(0x2, 0x6, 0x0) listen(r0, 0x6) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) ioctl$TIOCMSET(0xffffffffffffffff, 0x5418, &(0x7f0000000300)=0x8) 22:13:20 executing program 2: r0 = openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0x40, 0x31, 0x0, 0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r1, 0x1}], 0x1, &(0x7f0000000080)={0x0, 0x989680}, &(0x7f0000000100), 0x8) 22:13:20 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) poll(&(0x7f0000000380)=[{}], 0xf, 0x4) 22:13:20 executing program 5: openat$sequencer(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/sequencer\x00', 0x4000, 0x0) 22:13:20 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket(0x1000000010, 0x802, 0x0) sendmmsg(r1, &(0x7f0000006440), 0x0, 0x0) write(r1, &(0x7f00000001c0)="240000001a0025e0046bbc04fef7001c020b49ff00000000800008000800030001000000", 0x24) 22:13:20 executing program 2: r0 = openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0x40, 0x31, 0x0, 0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r1, 0x1}], 0x1, &(0x7f0000000080)={0x0, 0x989680}, &(0x7f0000000100), 0x8) 22:13:20 executing program 3: socket$inet6(0xa, 0x7ffffffffffff, 0x0) ioctl$KVM_SET_DEBUGREGS(0xffffffffffffffff, 0x4080aea2, &(0x7f0000000200)={[], 0x0, 0x40, 0xb0}) socket$inet6(0xa, 0x2, 0x0) ioctl$IOC_PR_RELEASE(0xffffffffffffffff, 0x401070ca, &(0x7f0000000100)) connect$inet6(0xffffffffffffffff, &(0x7f0000002740)={0xa, 0x0, 0x0, @dev}, 0x79) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000480)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000280)=[@text32={0x20, &(0x7f00000003c0)="0f20c035100000000f22c0c4c1f87766baf80cb8aedf018fef66bafc0c66ed0f01ef8149000f00000036f30f2000c4c37962530782670fc75b39643e2e0f01cf66baf80cb86c5fbb8aef66bafc0c66b8e07166ef", 0x54}], 0x1, 0x0, &(0x7f0000000040), 0xfffffffffffff29) openat$ashmem(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ashmem\x00', 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) dup(0xffffffffffffffff) socket$inet6_udp(0xa, 0x2, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000002c0)={{{@in=@dev, @in=@broadcast}}, {{@in6=@mcast1}, 0x0, @in=@loopback}}, &(0x7f0000000000)=0xe8) ioctl$KVM_RUN(r2, 0xae80, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x3}, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) 22:13:21 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") unshare(0x400) r1 = openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000000)={0xfffb, 0x1b, 0x0, 0xffffffffffffffff}) fcntl$getflags(r2, 0x1) 22:13:21 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ioctl$EXT4_IOC_SETFLAGS(r0, 0x40086602, &(0x7f00000000c0)) r1 = syz_open_procfs(0x0, &(0x7f0000000480)="2f6578650000c10000000000e9ff0700000000000054fa07424adee916d2e975afe70b35a0fd6a1f0200f5ab26d7a071fb35331ce39c5a6568641006d7c0206a74e33326530000000000000000000000") r2 = creat(&(0x7f0000000f00)='./bus\x00', 0x0) pread64(r1, &(0x7f0000000180)=""/184, 0x1c, 0x0) write$FUSE_INTERRUPT(r1, &(0x7f0000000100)={0x10}, 0x1) getuid() lstat(&(0x7f0000000240)='./bus\x00', &(0x7f0000000280)) getresuid(&(0x7f0000000300), &(0x7f0000000340), &(0x7f0000000380)) getresgid(&(0x7f00000003c0), &(0x7f0000000400), &(0x7f0000000440)) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000500)={{{@in=@local, @in6=@dev}}, {{@in=@broadcast}, 0x0, @in6=@mcast2}}, &(0x7f0000000600)=0xe8) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000740)={{{@in=@local, @in6=@remote}}, {{@in6=@mcast2}, 0x0, @in6=@ipv4={[], [], @broadcast}}}, &(0x7f00000006c0)=0xe8) stat(&(0x7f0000000840)='./bus\x00', &(0x7f0000000880)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000900)={{{@in6=@ipv4={[], [], @dev}, @in=@multicast2}}, {{@in=@remote}, 0x0, @in=@multicast2}}, &(0x7f0000000a00)=0xe8) fstat(r1, &(0x7f0000000a40)) write$FUSE_DIRENTPLUS(r0, &(0x7f0000000ac0)=ANY=[@ANYBLOB="5f000000ff7f0000000000000600000000000000030000000000000046000000040000002f6578650000c10000000000e9ff0700000000000054fa07424adee916d2e975afe70b35a0fd6a1f0200f5ab26d7a071fb35331ce39c5a6568641006d7c0206a74e3"], 0x66) uname(&(0x7f0000000140)=""/48) fcntl$setstatus(r2, 0x4, 0x6100) sendfile(r2, r1, &(0x7f0000000040), 0x1000003fb) 22:13:21 executing program 2: r0 = openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0x40, 0x31, 0x0, 0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r1, 0x1}], 0x1, &(0x7f0000000080)={0x0, 0x989680}, &(0x7f0000000100), 0x8) 22:13:21 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x2, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="faff1a267a4dc5a20e43c2853ff14f7c0100000000000000d789a9e2c6beb8b0484e51e39b13c89cbc407cc816c3aa3c4fe1fe87abd1799e5100acdc61ff369a584d596c5a868098d2bffd33411d41fab9b0723b51625138d9af215f01b7808dc627c2989cb8981f4bf194b32c8b9635b41aa8956908aca6df8706f8016695eeea0a0a60ce48cd83bd3e04694994b0c445cefe2c423e44938ebfb5903f16785134c4da0b4bfd701dd47e2820babb"], 0xae) ioctl$TCSETA(r0, 0x5406, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x9b4b62b}) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000040)={0x17, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x401}) 22:13:21 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$IPVS_CMD_DEL_DEST(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000140), 0xc, &(0x7f0000000040)={&(0x7f0000000940)=ANY=[]}}, 0x0) syz_open_procfs(0x0, &(0x7f0000000200)="2f6578650000c10000000000e9ff0700000000000054fa07424adee916d2da75afe70b35a0fd6a1f0200f5ab26d7a071fb35331ce39c5a6568641006d7c0206a74e33326530000000000000000000000") r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) mq_open(&(0x7f0000000000)='..\x00', 0x0, 0x0, &(0x7f0000000040)) r1 = socket$inet_dccp(0x2, 0x6, 0x0) listen(r0, 0x6) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) ioctl$TIOCMSET(0xffffffffffffffff, 0x5418, &(0x7f0000000300)=0x8) 22:13:21 executing program 4: clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000200), 0xffffffffffffffff) set_tid_address(&(0x7f0000000080)) 22:13:21 executing program 2: r0 = openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0x40, 0x31, 0x0, 0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r1, 0x1}], 0x1, &(0x7f0000000080)={0x0, 0x989680}, &(0x7f0000000100), 0x8) 22:13:21 executing program 0: ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") socket$inet(0x2, 0x3, 0x2) r0 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_int(r0, 0x0, 0xcd, &(0x7f0000000000), 0x3c) 22:13:21 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x2, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="faff1a267a4dc5a20e43c2853ff14f7c0100000000000000d789a9e2c6beb8b0484e51e39b13c89cbc407cc816c3aa3c4fe1fe87abd1799e5100acdc61ff369a584d596c5a868098d2bffd33411d41fab9b0723b51625138d9af215f01b7808dc627c2989cb8981f4bf194b32c8b9635b41aa8956908aca6df8706f8016695eeea0a0a60ce48cd83bd3e04694994b0c445cefe2c423e44938ebfb5903f16785134c4da0b4bfd701dd47e2820babb"], 0xae) ioctl$TCSETA(r0, 0x5406, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x9b4b62b}) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000040)={0x17, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x401}) 22:13:21 executing program 3: clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000200), 0xffffffffffffffff) r0 = inotify_init1(0x0) fcntl$setown(r0, 0x8, 0xffffffffffffffff) fcntl$getownex(r0, 0x10, &(0x7f0000000080)={0x0, 0x0}) process_vm_readv(r1, &(0x7f0000000000)=[{&(0x7f0000001300)=""/4096, 0x1000}], 0x1, &(0x7f0000003600)=[{&(0x7f0000003580)=""/121, 0x79}], 0x1, 0x0) 22:13:21 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{0xffffffffffffffff, 0x1}], 0x1, &(0x7f0000000080)={0x0, 0x989680}, &(0x7f0000000100), 0x8) 22:13:21 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'syz_tun\x00'}) sendmsg$nl_route(r0, &(0x7f0000000500)={&(0x7f0000000440), 0xc, &(0x7f00000004c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="00005a8a0a000200000000f7ffffff0004f69a0dc814d6f8ca577c269b8ca2ed7429da43c7de1ae544872b31801424a4507d4a795f1cd98849a328e28ee6ebe9a419492fae557d3947fe0d71ca97d40dfe4014a61012b9a999985b1698671471b765aaa0a3853efc7408491922ef528ffc5f14e93b9ddfe5a97b339d80e00fcd666f8e98b8cd9a3bc4000001004ab96e915253296dff1d9a87b8837706"], 0x1}}, 0x0) 22:13:21 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7400000000000000, 0x0, &(0x7f00000000c0), &(0x7f0000000100)}}}], 0x97, 0x0, &(0x7f0000fedffe)}) 22:13:21 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000ffe000/0x2000)=nil}) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f00000003c0)={{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, 0x8005001f, 0x0, 0x0, 0x28}) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = socket$inet6(0xa, 0x3, 0x800000000000004) ioctl(r3, 0x8912, &(0x7f00000000c0)="153f6234488dd25d766070") 22:13:21 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0x40, 0x31, 0x0, 0xffffffffffffffff}) ioctl$EXT4_IOC_GROUP_EXTEND(r1, 0x40086607, &(0x7f0000000080)) 22:13:21 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{0xffffffffffffffff, 0x1}], 0x1, &(0x7f0000000080)={0x0, 0x989680}, &(0x7f0000000100), 0x8) 22:13:21 executing program 4: r0 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000040)=@req={0x80, 0x0, 0x0, 0x73d}, 0x29b) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) sendto$inet6(r0, &(0x7f0000000000), 0x101d0, 0x0, 0x0, 0x0) 22:13:21 executing program 5: r0 = socket$inet6(0xa, 0x81000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = socket(0x0, 0x3, 0x0) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000200)='pids.current\x00', 0x0, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x4e20, @broadcast}, 0x10) sendto$inet(r3, &(0x7f0000000200), 0xfffffffffffffeb4, 0x2000800e, &(0x7f0000db4ff0)={0x2, 0x4e20, @loopback, [0x2, 0x7000028]}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000400)='vegas\x00', 0x6) recvfrom(r3, &(0x7f0000f9cf9b)=""/101, 0x389756b1353686c0, 0x120, 0x0, 0xffffffffffffffeb) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x66, &(0x7f0000000040)={0x0}, &(0x7f00000000c0)=0x8) ioctl$UI_DEV_SETUP(r2, 0x405c5503, &(0x7f00000002c0)={{0xffffffff, 0xff00000000000000, 0x4, 0x1}, 'syz1\x00', 0x13}) sendto$inet(r3, &(0x7f0000000080)="89", 0x1, 0x41, &(0x7f0000000180)={0x2, 0x0, @broadcast}, 0x10) getsockopt$sock_timeval(0xffffffffffffffff, 0x1, 0x0, &(0x7f0000000000), &(0x7f0000000040)=0x10) connect$inet(r1, &(0x7f0000000100)={0x2, 0x4e20, @local}, 0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r2, 0x84, 0x66, &(0x7f0000000140)={r4, 0x4}, &(0x7f00000001c0)=0x8) write(r1, &(0x7f00000004c0), 0x0) [ 177.125974] binder: 7155:7158 transaction failed 29189/-22, size 8358680908399640576-0 line 2855 [ 177.135333] ptrace attach of "/root/syz-executor3"[5481] was attempted by "/root/syz-executor3"[7153] [ 177.148446] binder: 7155:7165 transaction failed 29189/-22, size 8358680908399640576-0 line 2855 22:13:21 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ppoll(&(0x7f0000000000)=[{0xffffffffffffffff, 0x1}], 0x1, &(0x7f0000000080)={0x0, 0x989680}, &(0x7f0000000100), 0x8) 22:13:21 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_emit_ethernet(0x66, &(0x7f0000015e15)={@local, @remote, [], {@ipv6={0x86dd, {0x0, 0x6, 'v`Q', 0x30, 0x11, 0x0, @remote={0xfe, 0x80, [0xf5ffffff], 0xffffffffffffffff}, @mcast2={0xff, 0x2, [0x0, 0xfffffffffffff000]}, {[], @icmpv6=@dest_unreach={0xffffff86, 0x0, 0x0, 0x0, [0x14, 0xfffffff5], {0x0, 0x6, "c5961e", 0x0, 0x0, 0x0, @mcast1={0xff, 0x1, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x3, 0x58]}, @mcast2}}}}}}}, 0x0) [ 177.226368] *** Guest State *** [ 177.234316] ptrace attach of "/root/syz-executor3"[5481] was attempted by "/root/syz-executor3"[7174] [ 177.243833] CR0: actual=0x000000008005003f, shadow=0x000000008005001f, gh_mask=fffffffffffffff7 22:13:21 executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000080)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) read$FUSE(r0, &(0x7f00000040c0), 0x1000) read$FUSE(r0, &(0x7f00000020c0), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1, {0x7, 0x1b, 0x0, 0x10800}}, 0x50) readlink(&(0x7f0000001580)='./file0/file0\x00', &(0x7f0000000480)=""/4096, 0x1000) write$FUSE_DIRENT(r0, &(0x7f0000000340)=ANY=[@ANYBLOB="90000000000000000200000000000000010000000045000000000000000000000b08956d069e000000002066ce654d316e6f646576656d3100f9ff00000000000000000000000000000000000001000000000000002c00000000000008000000000000000000000000000000001c00000000000051a717000418b9b3cc002b737973740400000065746367726f757024"], 0x90) [ 177.293825] CR4: actual=0x0000000000002068, shadow=0x0000000000000028, gh_mask=ffffffffffffe871 22:13:21 executing program 3: 22:13:21 executing program 2: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0x40, 0x31, 0x0, 0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x1}], 0x1, &(0x7f0000000080)={0x0, 0x989680}, &(0x7f0000000100), 0x8) [ 177.353173] CR3 = 0x0000000000000000 [ 177.368426] PDPTR0 = 0x0000000000000000 PDPTR1 = 0x0000000000000000 22:13:21 executing program 0: [ 177.400151] PDPTR2 = 0x0000000000000000 PDPTR3 = 0x0000000000000000 [ 177.440333] RSP = 0x0000000000000000 RIP = 0x000000000000fff0 22:13:21 executing program 3: [ 177.469091] RFLAGS=0x00000002 DR7 = 0x0000000000000400 [ 177.491614] Sysenter RSP=0000000000000000 CS:RIP=0000:0000000000000000 [ 177.516138] CS: sel=0x0000, attr=0x10000, limit=0x00000000, base=0x0000000000000000 [ 177.538917] DS: sel=0x0000, attr=0x10000, limit=0x00000000, base=0x0000000000000000 [ 177.551558] SS: sel=0x0000, attr=0x10000, limit=0x00000000, base=0x0000000000000000 [ 177.560678] ES: sel=0x0000, attr=0x10000, limit=0x00000000, base=0x0000000000000000 [ 177.605279] FS: sel=0x0000, attr=0x10000, limit=0x00000000, base=0x0000000000000000 [ 177.619526] GS: sel=0x0000, attr=0x10000, limit=0x00000000, base=0x0000000000000000 [ 177.627948] GDTR: limit=0x00000000, base=0x0000000000000000 [ 177.636229] LDTR: sel=0x0000, attr=0x10000, limit=0x00000000, base=0x0000000000000000 [ 177.644804] IDTR: limit=0x00000000, base=0x0000000000000000 [ 177.652879] TR: sel=0x0000, attr=0x10000, limit=0x00000000, base=0x0000000000000000 [ 177.660851] EFER = 0x0000000000000000 PAT = 0x0007040600070406 [ 177.667932] DebugCtl = 0x0000000000000000 DebugExceptions = 0x0000000000000000 [ 177.675565] Interruptibility = 00000000 ActivityState = 00000000 [ 177.681874] *** Host State *** [ 177.685251] RIP = 0xffffffff81212b2e RSP = 0xffff88018ec3f3d0 [ 177.691331] CS=0010 SS=0018 DS=0000 ES=0000 FS=0000 GS=0000 TR=0040 [ 177.697744] FSBase=0000000000000000 GSBase=ffff8801dae00000 TRBase=fffffe0000034000 [ 177.705610] GDTBase=fffffe0000032000 IDTBase=fffffe0000000000 [ 177.711564] CR0=0000000080050033 CR3=00000001c1846000 CR4=00000000001426f0 [ 177.718583] Sysenter RSP=fffffe0000033200 CS:RIP=0010:ffffffff87c013a0 [ 177.725291] EFER = 0x0000000000000d01 PAT = 0x0407050600070106 [ 177.731407] *** Control State *** [ 177.734852] PinBased=0000003f CPUBased=b5986dfa SecondaryExec=000000c2 [ 177.741734] EntryControls=0000d1ff ExitControls=002fefff [ 177.747195] ExceptionBitmap=00060042 PFECmask=00000000 PFECmatch=00000000 [ 177.754175] VMEntry: intr_info=00000000 errcode=00000000 ilen=00000000 [ 177.760991] VMExit: intr_info=00000000 errcode=00000000 ilen=00000000 [ 177.767639] reason=80000021 qualification=0000000000000000 [ 177.774014] IDTVectoring: info=00000000 errcode=00000000 [ 177.779488] TSC Offset = 0xffffff9eb7b4d215 [ 177.783878] EPT pointer = 0x00000001c092c01e 22:13:22 executing program 1: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sync() ioctl$int_in(0xffffffffffffffff, 0x5452, &(0x7f0000000240)=0x52) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000140)={@multicast1, @multicast2, 0x0}, &(0x7f00000001c0)=0xc) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000200)={@multicast2, @remote, r1}, 0xc) setsockopt$inet6_MRT6_ADD_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd2, &(0x7f00000002c0)={{0xa, 0x0, 0x0, @local, 0x800000000}, {0xa, 0x4e22, 0x40, @mcast1}, 0x7ff}, 0x5c) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/loop-control\x00', 0x1, 0x0) recvfrom$inet(0xffffffffffffffff, &(0x7f00000003c0)=""/225, 0xe1, 0x40012003, 0x0, 0x0) fstat(r0, &(0x7f0000000600)) ioctl$PIO_UNIMAP(0xffffffffffffffff, 0x4b67, &(0x7f0000000380)={0x0, &(0x7f0000000340)}) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, 0x0) ioctl$EVIOCSKEYCODE_V2(0xffffffffffffffff, 0x40284504, &(0x7f0000000280)={0x0, 0x0, 0x2, 0xdd51, "8cff2574fc6d9664c3ea8583b04a793f07222df046f256ce005658b5c4496b0a"}) r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000340)='/dev/loop-control\x00', 0x0, 0x0) ioctl$FS_IOC_FSGETXATTR(0xffffffffffffffff, 0x801c581f, &(0x7f0000000580)={0x200, 0x28, 0x101, 0x80, 0x8}) fstat(0xffffffffffffffff, &(0x7f0000000000)) setxattr$trusted_overlay_nlink(&(0x7f0000000500)='./file0\x00', &(0x7f0000000680)='trusted.overlay.nlink\x00', &(0x7f00000006c0)={'U-', 0x100000001}, 0xfffffffffffffe51, 0x1) ioctl$int_in(r3, 0x5452, &(0x7f00000000c0)=0x36034632) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) 22:13:22 executing program 2: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0x40, 0x31, 0x0, 0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x1}], 0x1, &(0x7f0000000080)={0x0, 0x989680}, &(0x7f0000000100), 0x8) 22:13:22 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x2, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000140)='/dev/zero\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000001000)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], 0x17) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x9b4b62b}) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000040)={0x17}) 22:13:22 executing program 0: r0 = socket(0x1e, 0x4, 0x0) sendto$inet6(r0, &(0x7f0000000080)="918bd4a5c146f47d02cfea660bef740ec27e42e048534234d37f43cf98a1534815aa8eeb02dad6e80e60400c87fa5310a0076413817e5bd3196c30c564928e97343c859b7f40d86b769b3e84b44fe5e6793b9e54a8de5ad19deea40d4e4971194bd440462e434e8642f0d6d2ccceca3eabc3", 0x72, 0x0, 0x0, 0x0) 22:13:22 executing program 5: 22:13:22 executing program 2: ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0x40, 0x31, 0x0, 0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x1}], 0x1, &(0x7f0000000080)={0x0, 0x989680}, &(0x7f0000000100), 0x8) 22:13:22 executing program 0: 22:13:22 executing program 4: 22:13:22 executing program 3: 22:13:22 executing program 0: 22:13:22 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0x40, 0x31, 0x0, 0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x1}], 0x1, &(0x7f0000000080)={0x0, 0x989680}, &(0x7f0000000100), 0x8) 22:13:22 executing program 5: 22:13:23 executing program 1: 22:13:23 executing program 0: 22:13:23 executing program 3: 22:13:23 executing program 5: 22:13:23 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0x40, 0x31, 0x0, 0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x1}], 0x1, &(0x7f0000000080)={0x0, 0x989680}, &(0x7f0000000100), 0x8) 22:13:23 executing program 4: 22:13:23 executing program 4: 22:13:23 executing program 3: 22:13:23 executing program 5: 22:13:23 executing program 0: 22:13:23 executing program 1: 22:13:23 executing program 2: openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000040)={0x40, 0x31, 0x0, 0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r0, 0x1}], 0x1, &(0x7f0000000080)={0x0, 0x989680}, &(0x7f0000000100), 0x8) 22:13:23 executing program 4: 22:13:23 executing program 1: 22:13:23 executing program 5: 22:13:23 executing program 3: 22:13:23 executing program 0: 22:13:23 executing program 2: r0 = openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0x0, 0x31, 0x0, 0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r1, 0x1}], 0x1, &(0x7f0000000080)={0x0, 0x989680}, &(0x7f0000000100), 0x8) 22:13:23 executing program 4: 22:13:23 executing program 5: 22:13:23 executing program 0: 22:13:23 executing program 1: 22:13:23 executing program 3: 22:13:23 executing program 2: r0 = openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0x0, 0x31, 0x0, 0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r1, 0x1}], 0x1, &(0x7f0000000080)={0x0, 0x989680}, &(0x7f0000000100), 0x8) 22:13:23 executing program 4: 22:13:23 executing program 0: 22:13:23 executing program 5: 22:13:23 executing program 3: 22:13:23 executing program 1: 22:13:23 executing program 4: 22:13:23 executing program 2: r0 = openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0x0, 0x31, 0x0, 0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r1, 0x1}], 0x1, &(0x7f0000000080)={0x0, 0x989680}, &(0x7f0000000100), 0x8) 22:13:23 executing program 0: 22:13:23 executing program 3: 22:13:23 executing program 5: 22:13:23 executing program 4: 22:13:23 executing program 1: 22:13:23 executing program 0: 22:13:23 executing program 2: r0 = openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0x40, 0x0, 0x0, 0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r1, 0x1}], 0x1, &(0x7f0000000080)={0x0, 0x989680}, &(0x7f0000000100), 0x8) 22:13:23 executing program 4: 22:13:23 executing program 5: 22:13:23 executing program 3: 22:13:24 executing program 1: 22:13:24 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000001a00), 0x8, 0x0) close(r0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000380)='/dev/ptmx\x00', 0x0, 0x0) read(r1, &(0x7f0000000000)=""/11, 0xb) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000200)) clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) ioctl$EXT4_IOC_SETFLAGS(r0, 0x40086602, &(0x7f00000000c0)) 22:13:24 executing program 4: mknod(&(0x7f0000f80000)='./file0\x00', 0x1040, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f00000002c0)=""/11, 0xb) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000200)) clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, &(0x7f0000000140), 0xffffffffffffffff) r1 = creat(&(0x7f0000000180)="e91f7189591e9233614b00", 0x0) dup2(r0, r1) execve(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140), &(0x7f0000001580)) ioctl$sock_inet6_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000300)) open$dir(&(0x7f0000000240)='./file0\x00', 0x841, 0x0) 22:13:24 executing program 5: r0 = socket$inet6(0xa, 0x3, 0x900000000000004) ioctl(r0, 0x8912, &(0x7f0000000000)="153f6234488dd25d5c6070") r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCBRADDBR(r1, 0x89a0, &(0x7f0000000080)='team0\x00') r2 = socket$packet(0x11, 0x3, 0x300) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000001440)={'team0\x00', 0x0}) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000001480)={r3, 0x1, 0x6}, 0x10) sendmsg$nl_route(r1, &(0x7f0000000200)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000240)=@dellink={0x34, 0x11, 0x201, 0x0, 0x0, {}, [@IFLA_IFNAME={0x14, 0x3, 'team0\x00'}]}, 0x34}}, 0x0) 22:13:24 executing program 2: r0 = openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0x40, 0x0, 0x0, 0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r1, 0x1}], 0x1, &(0x7f0000000080)={0x0, 0x989680}, &(0x7f0000000100), 0x8) 22:13:24 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000300)={0x4, 0x0, &(0x7f0000000240)=[@exit_looper], 0x0, 0x0, &(0x7f0000000280)}) 22:13:24 executing program 1: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sync() ioctl$int_in(0xffffffffffffffff, 0x5452, &(0x7f0000000240)=0x52) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000140)={@multicast1, @multicast2, 0x0}, &(0x7f00000001c0)=0xc) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000200)={@multicast2, @remote, r1}, 0xc) setsockopt$inet6_MRT6_ADD_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd2, &(0x7f00000002c0)={{0xa, 0x0, 0x0, @local, 0x800000000}, {0xa, 0x4e22, 0x40, @mcast1}, 0x7ff}, 0x5c) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/loop-control\x00', 0x1, 0x0) recvfrom$inet(0xffffffffffffffff, &(0x7f00000003c0)=""/225, 0xe1, 0x40012003, 0x0, 0x0) fstat(r0, &(0x7f0000000600)) ioctl$PIO_UNIMAP(0xffffffffffffffff, 0x4b67, &(0x7f0000000380)={0x0, &(0x7f0000000340)}) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, 0x0) ioctl$EVIOCSKEYCODE_V2(0xffffffffffffffff, 0x40284504, &(0x7f0000000280)={0x0, 0x0, 0x2, 0xdd51, "8cff2574fc6d9664c3ea8583b04a793f07222df046f256ce005658b5c4496b0a"}) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000340)='/dev/loop-control\x00', 0x0, 0x0) ioctl$FS_IOC_FSGETXATTR(0xffffffffffffffff, 0x801c581f, &(0x7f0000000580)={0x200, 0x28, 0x101, 0x80, 0x8}) seccomp(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x58fe4}]}) [ 179.754142] device team0 entered promiscuous mode [ 179.775652] device team_slave_0 entered promiscuous mode 22:13:24 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='\x00\x00\x00\x00\x00') rt_sigpending(&(0x7f00000001c0), 0x8) r1 = openat$cgroup_ro(r0, &(0x7f0000000000)="6d656d00017937737761532e63757289c942abe3fa72656e7400", 0x0, 0x0) ioctl$DRM_IOCTL_ADD_MAP(r0, 0xc0286415, &(0x7f0000000040)={0x0, 0x7, 0x0, 0x80, &(0x7f0000ffa000/0x6000)=nil, 0x2}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) finit_module(r0, &(0x7f0000000200)='filter\x00', 0x3) syz_emit_ethernet(0x642, &(0x7f0000000100)={@local, @remote, [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x223, 0x0, 0x0, @local={0xfe, 0x8a00, [0x0, 0x0, 0x3, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x634]}, @local, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) getsockopt$ARPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x61, &(0x7f0000000080)={'filter\x00'}, &(0x7f0000000140)=0x24) ioctl$EVIOCGABS3F(r1, 0x8018457f, &(0x7f0000000240)=""/112) preadv(r1, &(0x7f0000000180)=[{&(0x7f00000000c0)=""/81, 0x20000111}], 0x1, 0x2000107c) [ 179.800604] device team_slave_1 entered promiscuous mode 22:13:24 executing program 2: r0 = openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0x40, 0x0, 0x0, 0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r1, 0x1}], 0x1, &(0x7f0000000080)={0x0, 0x989680}, &(0x7f0000000100), 0x8) 22:13:24 executing program 2: r0 = openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0x40, 0x31}) ppoll(&(0x7f0000000000), 0x0, &(0x7f0000000080)={0x0, 0x989680}, &(0x7f0000000100), 0x8) 22:13:24 executing program 2: r0 = openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0x40, 0x31}) ppoll(&(0x7f0000000000), 0x0, &(0x7f0000000080)={0x0, 0x989680}, &(0x7f0000000100), 0x8) 22:13:24 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000280)=0xe) ioctl$TCFLSH(r1, 0x540b, 0x0) 22:13:24 executing program 2: r0 = openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0x40, 0x31}) ppoll(&(0x7f0000000000), 0x0, &(0x7f0000000080)={0x0, 0x989680}, &(0x7f0000000100), 0x8) [ 180.435172] device team0 left promiscuous mode [ 180.439858] device team_slave_0 left promiscuous mode [ 180.445968] device team_slave_1 left promiscuous mode [ 180.757735] team0 (unregistering): Port device team_slave_0 removed [ 180.913856] team0 (unregistering): Port device team_slave_1 removed 22:13:27 executing program 0: r0 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) ioctl$void(r0, 0xc0045878) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_MCAST_MSFILTER(r1, 0x29, 0x30, &(0x7f0000000140)=ANY=[@ANYBLOB="ffffffff000000000a004e2481000000ff020000000000000000000000000001010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000a004e23030000000000000000000000000000000000000001040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a004e2304000000fe8000000000000000000000000000bb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000a004e2200000000ff02000000000000000000000000000103000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a004e2309000000000000000000000000000000000000002a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a004e2006000000fe8000000000000000000000000000bbff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a004e2205000000fe80000000000000000000000000001700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a004e2108000000ff0100000000000000000000000000015dffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a004e2203000000000000000000000000000000000000010104000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x1) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) sendmmsg(r1, &(0x7f0000007d80), 0x6, 0x0) 22:13:27 executing program 3: r0 = syz_open_dev$admmidi(&(0x7f0000000100)='/dev/admmidi#\x00', 0x0, 0x0) setsockopt$RDS_GET_MR_FOR_DEST(0xffffffffffffffff, 0x114, 0x7, &(0x7f0000000280)={@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x0, 0x1}}, {&(0x7f00000001c0)=""/143, 0x8f}, &(0x7f00000000c0)}, 0xa0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = creat(&(0x7f0000001140)='./file0\x00', 0x3) write$binfmt_script(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="0100202e2f07006c653020237a7d3975e93a69284781c694eb902e7c671d2cf67d21f5dd6393b48ddd93a343cd0d55906785815bc329caee315d1ea03bdb5071a8966df5920a2e1dee4eb3be4af9a410f6301abd910c7610e711b133c5db8eeb9a3d7be57f2b1862f08e969dd2a78567604669b742cd9d047402331d092e28c9da9cedc90ce38ef098bdc36f582b3d658bdf3c3cd467a5a48234127b8630b7290cac6e1cd53b726c600551cd3fa8c0de8c78e40b056c95a8d80164a5c5de7c3805a71f"], 0xc3) close(r1) execve(&(0x7f0000000180)='./file0\x00', &(0x7f0000000140), &(0x7f0000000140)) 22:13:27 executing program 2: r0 = openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0x40, 0x31}) ppoll(&(0x7f0000000000)=[{0xffffffffffffffff, 0x1}], 0x1, &(0x7f0000000080)={0x0, 0x989680}, &(0x7f0000000100), 0x8) 22:13:27 executing program 4: r0 = syz_open_dev$dspn(&(0x7f0000000100)='/dev/dsp#\x00', 0x1, 0x0) ppoll(&(0x7f0000013000)=[{r0}], 0x1, &(0x7f0000001000)={0x77359400}, &(0x7f000000d000), 0x8) ioctl$int_in(r0, 0x800000c0045006, &(0x7f0000000000)=0x7f) read(r0, &(0x7f0000000040)=""/187, 0xbb) 22:13:27 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000000)) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x0, 0x0) 22:13:27 executing program 5: r0 = epoll_create(0xfffd) close(r0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) read(r1, &(0x7f0000000140)=""/11, 0x238) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000200)) clone(0x1102001bfc, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) ioctl$sock_inet_SIOCSIFNETMASK(r0, 0x891c, &(0x7f0000000000)={'dummy0\x00', {0x2, 0x0, @remote}}) syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x0) 22:13:27 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000000)) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x0, 0x0) 22:13:27 executing program 2: r0 = openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0x40, 0x31}) ppoll(&(0x7f0000000000)=[{0xffffffffffffffff, 0x1}], 0x1, &(0x7f0000000080)={0x0, 0x989680}, &(0x7f0000000100), 0x8) 22:13:27 executing program 0: syz_open_dev$usb(&(0x7f0000000480)='/dev/bus/usb/00#/00#\x00', 0x0, 0x0) sendmsg$IPVS_CMD_DEL_DAEMON(0xffffffffffffffff, &(0x7f0000002e00)={&(0x7f0000002c80)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000002dc0)={&(0x7f0000000840)=ANY=[@ANYBLOB], 0x1}}, 0x0) r0 = socket$inet_dccp(0x2, 0x6, 0x0) syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x100) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f0000000300)={'ipvs\x00'}, &(0x7f00000007c0)=0x1e) 22:13:27 executing program 3: r0 = syz_open_dev$admmidi(&(0x7f0000000100)='/dev/admmidi#\x00', 0x0, 0x0) setsockopt$RDS_GET_MR_FOR_DEST(0xffffffffffffffff, 0x114, 0x7, &(0x7f0000000280)={@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x0, 0x1}}, {&(0x7f00000001c0)=""/143, 0x8f}, &(0x7f00000000c0)}, 0xa0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = creat(&(0x7f0000001140)='./file0\x00', 0x3) write$binfmt_script(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="0100202e2f07006c653020237a7d3975e93a69284781c694eb902e7c671d2cf67d21f5dd6393b48ddd93a343cd0d55906785815bc329caee315d1ea03bdb5071a8966df5920a2e1dee4eb3be4af9a410f6301abd910c7610e711b133c5db8eeb9a3d7be57f2b1862f08e969dd2a78567604669b742cd9d047402331d092e28c9da9cedc90ce38ef098bdc36f582b3d658bdf3c3cd467a5a48234127b8630b7290cac6e1cd53b726c600551cd3fa8c0de8c78e40b056c95a8d80164a5c5de7c3805a71f"], 0xc3) close(r1) execve(&(0x7f0000000180)='./file0\x00', &(0x7f0000000140), &(0x7f0000000140)) 22:13:27 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000080)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) read$FUSE(r0, &(0x7f00000040c0), 0x1000) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1, {0x7, 0x1b, 0x0, 0x0, 0x0, 0x9}}, 0x50) 22:13:27 executing program 2: r0 = openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0x40, 0x31}) ppoll(&(0x7f0000000000)=[{0xffffffffffffffff, 0x1}], 0x1, &(0x7f0000000080)={0x0, 0x989680}, &(0x7f0000000100), 0x8) 22:13:27 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r0, 0xd3c9) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) accept4(0xffffffffffffffff, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000480)=0x80, 0x0) setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000000)=@dstopts, 0x8) sendto$inet6(r1, &(0x7f0000000040), 0xffb0, 0x0, &(0x7f0000000140)={0xa, 0x0, 0x0, @mcast2}, 0x1c) 22:13:27 executing program 2: r0 = openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0x40, 0x31, 0x0, 0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r1}], 0x1, &(0x7f0000000080)={0x0, 0x989680}, &(0x7f0000000100), 0x8) 22:13:27 executing program 1: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r0, 0xd3c9) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r1, &(0x7f0000000040), 0xffb0, 0x0, &(0x7f0000000140)={0xa, 0x0, 0x0, @mcast2}, 0x1c) [ 183.020083] dccp_xmit_packet: Payload too large (65456) for featneg. [ 183.117145] dccp_xmit_packet: Payload too large (65456) for featneg. 22:13:27 executing program 4: r0 = perf_event_open(&(0x7f0000000100)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_config_ext={0x0, 0x1}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r0, 0x4008240b, &(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext}) perf_event_open(&(0x7f0000aaa000)={0x2, 0x70, 0x85a, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, &(0x7f00000000c0), &(0x7f00000002c0), &(0x7f0000000080), &(0x7f0000000100)) 22:13:27 executing program 2: r0 = openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0x40, 0x31, 0x0, 0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r1}], 0x1, &(0x7f0000000080)={0x0, 0x989680}, &(0x7f0000000100), 0x8) 22:13:27 executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000080)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) read$FUSE(r0, &(0x7f00000040c0), 0x1000) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$FUSE_INTERRUPT(r0, &(0x7f0000000040)={0x10, 0x0, 0x1}, 0x10) 22:13:27 executing program 0: pipe(&(0x7f00000002c0)={0xffffffffffffffff}) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000c86f88)={0x2, 0x70, 0x12}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) fcntl$setpipe(r0, 0x407, 0xffffffffffffffff) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f0000000140)={@mcast2}) 22:13:27 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x80000000000045, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000140)="2f65786500000000000409004bddd9de91be10eebf000ee9a90f79805854fa07424adee901d2da75af1f0200f5ab26d7a071fb35331ce39c5a") perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r0, r1, &(0x7f0000000180), 0x8402) 22:13:27 executing program 5: recvfrom(0xffffffffffffffff, &(0x7f00000022c0)=""/4096, 0xffffffffffffffd9, 0x0, &(0x7f0000002240)=@ipx={0x4, 0x0, 0x0, "5d6f634e9e66"}, 0x80) r0 = open(&(0x7f0000103ff8)='./file0\x00', 0x141042, 0x0) ftruncate(r0, 0x5) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x802, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r0, &(0x7f0000000240), 0x40800fff) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000080)=""/4, 0x4}], 0x2dc) fchdir(0xffffffffffffffff) 22:13:27 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000240)="2f007e574d000330809022cfde26555dc9ecfe1974406edad38364782d63b6612854b9e49dbdcaef718197007f870a308b1e3a798fa78870f2fc45ef933e51828ab675064e2adbe9126423b4a73d68fbe99c6db2f160d49cb6cce76c27289a4f9d097354aaa5860d2383df87526baa184d90bb7529366c17bc33d765e9bc2f882a13f3a9c1f60660bd4fd2fa31d2c0a775242289bce062d10d24ded5406918a66b2c75c43fe1ff458ae5cd9fec63039ba5a7b66a60ede5ccdabc7ee77660ef2358ccdff02226021384b0c235f114ed9ade92767aecc256acdeb610df42e7169f240357f735ae5fe29017e51e27252f48b95bfbbb3a865535298bdc36d71db635f41c57771db77aeaff883feb3dc3cc24bd3c036e396ad3af37945058839e812270bc40901fa654e7cc3292a82fc89bacfe129e0d284be9d3e2528e4fdac32bcaefe910ebd3b948a3bfebef5fa8d82473c7fbf3ec", 0x0, 0x0) lseek(r1, 0x5d, 0x1) 22:13:27 executing program 2: r0 = openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0x40, 0x31, 0x0, 0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r1}], 0x1, &(0x7f0000000080)={0x0, 0x989680}, &(0x7f0000000100), 0x8) 22:13:28 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x6, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) mq_open(&(0x7f0000000000)='..\x00', 0x0, 0x0, &(0x7f0000000040)) r1 = socket$inet_dccp(0x2, 0x6, 0x0) listen(r0, 0x6) connect$inet(r1, &(0x7f0000e5c000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffffffffffe69) 22:13:28 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000029000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r0, 0x5452, &(0x7f0000fc3000)=0x1) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001c4, 0x0) dup2(r0, r1) fcntl$setown(0xffffffffffffffff, 0x8, 0x0) tkill(0x0, 0x0) 22:13:28 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x0) 22:13:28 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") unshare(0x400) getsockname$inet(r0, &(0x7f0000000100)={0x2, 0x0, @broadcast}, &(0x7f0000000140)=0x10) 22:13:28 executing program 4: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x9, 0x83, 0x8, 0x3}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000001140)={r0, &(0x7f0000000080), &(0x7f0000000080)}, 0x20) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={r0, &(0x7f0000000480), &(0x7f00000000c0)}, 0x20) 22:13:28 executing program 2: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f00006dc000)=[{0x6, 0x0, 0x0, 0xa1}]}, 0x10) sendto$inet(r0, &(0x7f00000001c0), 0x0, 0x200007ff, &(0x7f0000deaff0)={0x2, 0x3, @loopback}, 0x10) sendto$inet(r0, &(0x7f00000002c0)="20d6dac772b6f65cc7c3fc9bf8d917fbd5bd28cd6ad9243ec3c3fc41fe4295b32b630b3e888a8d0eb1abd9d081c0c6655507c293ed17dcc8e25f2cb85d0e732ff34d9f574cdd31597a5e3a688fff4a8f31474711e4b8f7ab05068770f885c03286fadc1d0fd02098bd981aaf152f2da86443cc605a5cb9a63475b63d354cb1f158bd", 0x82, 0x1, &(0x7f0000000cc0)={0x2, 0x0, @dev}, 0x10) sendto$inet(r0, &(0x7f0000000000)='\n', 0x1, 0x0, &(0x7f0000000140)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000580)="89", 0x1, 0x0, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) close(r0) [ 183.763496] binder: 7478:7481 ioctl 40046205 0 returned -22 22:13:28 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000001000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000180)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}) ioctl$KVM_NMI(r2, 0xae9a) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001380)=ANY=[@ANYBLOB="f10f7f"], 0x3) ioctl$KVM_RUN(r2, 0xae80, 0x0) 22:13:28 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") unlinkat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x201) 22:13:28 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000000)={@remote, r1}, 0x14) 22:13:28 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = socket$inet6(0xa, 0x2, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000008380)=[{{&(0x7f0000000000)=@in={0x2, 0x0, @dev}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="10000000000000000000000007000000"], 0x10}}], 0x1, 0x0) connect$inet6(r1, &(0x7f0000002740)={0xa, 0x0, 0x0, @mcast1, 0x4}, 0x1c) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)=@in={0x2, 0x4e21, @local}, 0x80, &(0x7f0000000200), 0x0, &(0x7f0000002480)=ANY=[]}, 0x0) syz_open_dev$mouse(&(0x7f0000000100)='/dev/input/mouse#\x00', 0x28c, 0x0) sendmmsg(r1, &(0x7f0000007e00), 0x136a88c8311572c, 0x0) 22:13:28 executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) accept4$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @dev}, &(0x7f00000001c0)=0x10, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f00000016c0)=ANY=[@ANYBLOB]) read$FUSE(r0, &(0x7f00000040c0), 0x1000) prctl$setmm(0x23, 0x7, &(0x7f0000ffe000/0x2000)=nil) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffffff, 0xc00c642e, &(0x7f0000000380)={0x0, 0x80000}) socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) open(&(0x7f0000000040)='./file0\x00', 0x80000, 0x20) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) readlink(&(0x7f0000001580)='./file0/file0\x00', &(0x7f0000000480)=""/4096, 0x1000) dup3(r1, r0, 0x80000) 22:13:28 executing program 5: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x80000000000045, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000140)="2f65786500000000000409004bddd9de91be10eebf000ee9a90f79805854fa07424adee901d2da75af1f0200f5ab26d7a071fb35331ce39c5a") perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x1ffffffffffffe, 0x0, 0x0, 0x2, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r1, &(0x7f0000000180), 0x8402) 22:13:28 executing program 4: r0 = eventfd(0x0) open(&(0x7f0000000200)='./file0\x00', 0x2000, 0x0) writev(r0, &(0x7f0000000a40)=[{&(0x7f00000004c0)="df015be2a1043cce", 0x8}], 0x1) writev(r0, &(0x7f0000000700)=[{&(0x7f0000000a80)}], 0x1) write$binfmt_misc(r0, &(0x7f0000000000)={'syz1', "855ee1cc"}, 0x8) readv(r0, &(0x7f0000000100)=[{&(0x7f00000002c0)=""/212, 0xd4}], 0x1) ioctl$TUNGETVNETHDRSZ(0xffffffffffffffff, 0x800454d7, &(0x7f0000000280)) fcntl$dupfd(r0, 0x406, 0xffffffffffffffff) syz_open_dev$mice(&(0x7f0000000180)='/dev/input/mice\x00', 0x0, 0x0) 22:13:28 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000012c0)={&(0x7f0000000000), 0xc, &(0x7f0000000040)={&(0x7f0000000900)=ANY=[@ANYBLOB="00000000000000001800120008000100736974000c0002000800030006000000"], 0x1}}, 0x0) 22:13:28 executing program 2: r0 = socket$pppoe(0x18, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f0000000080)={'bridge0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB='\a']}) 22:13:28 executing program 5: r0 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000040)=@req={0x80, 0x0, 0x3, 0x73d}, 0x29b) recvmmsg(r0, &(0x7f0000006c80)=[{{&(0x7f0000000500)=@un=@abs, 0x80, &(0x7f0000000980)=[{&(0x7f0000000580)=""/186, 0xba}], 0x1, &(0x7f0000000a00)=""/4096, 0x1000}}], 0x1, 0x0, &(0x7f0000006ec0)) sendto$inet6(r0, &(0x7f0000000000), 0x101d0, 0x0, 0x0, 0x0) 22:13:28 executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x1, 0x6, 0x5, 0x2}, 0x280) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000000c0)={r0, &(0x7f0000000280), &(0x7f0000000300)}, 0x20) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={r0, &(0x7f0000000100)='[', &(0x7f00000001c0), 0x1}, 0x20) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000040)={0xffffffffffffffff, &(0x7f00000005c0), &(0x7f0000000400)=""/115}, 0x18) 22:13:28 executing program 3: recvfrom(0xffffffffffffffff, &(0x7f00000022c0)=""/4096, 0xffffffffffffffd9, 0x0, &(0x7f0000002240)=@ipx={0x4, 0x0, 0x0, "5d6f634e9e66"}, 0x80) r0 = open(&(0x7f0000103ff8)='./file0\x00', 0x141042, 0x0) ftruncate(r0, 0x5) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x802, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendfile(r1, r0, &(0x7f0000000240), 0x40800fff) readv(r1, &(0x7f0000000100)=[{&(0x7f0000000080)=""/4, 0x4}], 0x2dc) 22:13:28 executing program 2: clock_getres(0x4000004, 0x0) 22:13:28 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r0, 0xd3c9) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) accept4(0xffffffffffffffff, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000480)=0x80, 0x0) sendto$inet6(r1, &(0x7f0000000040), 0xffb0, 0x0, &(0x7f0000000140)={0xa, 0x0, 0x0, @mcast2}, 0x1c) 22:13:28 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0x40, 0x31}) 22:13:28 executing program 2: r0 = syz_open_dev$evdev(&(0x7f0000000100)='/dev/input/event#\x00', 0x0, 0x0) r1 = dup(r0) ioctl$TIOCSBRK(r1, 0x40044591) r2 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x102) write$evdev(r2, &(0x7f0000057fa0)=[{}, {}], 0xfffffd24) ioctl$TUNSETVNETHDRSZ(r1, 0x400454d8, &(0x7f00000000c0)) munmap(&(0x7f000058e000/0x3000)=nil, 0x3000) 22:13:28 executing program 3: r0 = syz_open_dev$sndseq(&(0x7f0000000080)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000340)={{0x0, 0x1}, 0x0, 0xbf000000, 0x0, {}, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbf]}) 22:13:28 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl$EVIOCGMTSLOTS(0xffffffffffffffff, 0x8040450a, &(0x7f0000000300)=""/155) mlockall(0x0) r1 = creat(&(0x7f0000000080)='./file0\x00', 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) getresgid(&(0x7f0000000500), &(0x7f0000000540), &(0x7f0000000580)) write(r3, &(0x7f00000001c0), 0xffffffea) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000640)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), &(0x7f00000004c0)={0x20}, &(0x7f0000000140)={0x8, 0x0, 0x3f000000}, &(0x7f0000000200)={0x0, r4+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f00007a8fff), 0x0, 0x0, &(0x7f000006ffe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet6_buf(r0, 0x29, 0x0, &(0x7f0000c86000), &(0x7f0000000000)=0xfffffd62) vmsplice(r1, &(0x7f0000001980)=[{&(0x7f0000000840)="45b8ebec8eecb6a44649714cb5158100138cc94b8fe8d485dcf082ebccc9bcce62e8ea758cec0fdc5e8126488a079c8b25e41ba8b59856dfad71dfb000", 0x3d}], 0x1, 0x9) 22:13:28 executing program 4: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x80000000000045, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000140)="2f65786500000000000409004bddd9de91be10eebf000ee9a90f79805854fa07424adee901d2da75af1f0200f5ab26d7a071fb35331ce39c5a") perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x102, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x1000000000, 0x0, 0x0, 0xfff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x1ffffffffffffe, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r1, &(0x7f0000000180), 0x8402) 22:13:28 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0x40, 0x31, 0x1}) [ 184.399617] dccp_xmit_packet: Payload too large (65456) for featneg. 22:13:28 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f00000000c0)={0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x20, 0x0, &(0x7f0000000240)=[@exit_looper, @exit_looper, @free_buffer={0x40086303, r2}, @register_looper, @acquire={0x40046305, 0x751648df}], 0x69, 0x0, &(0x7f0000000280)="6a23980f12e093de53fb1c2a53d6d534c2fdd56f383af3376cfe8da4868c122c07fd05aab0cdfeff8e5f9d7ff4bb3bd2ae2f95b0cd58f340afb0faecaf2a59c02d91e140743a26c9a6f5c932fbae11a2ec107459d20181d8e367525b8a4698d3ae4a07b9da264d94c5"}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) lstat(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000600)={0xc8, 0x0, &(0x7f0000000080)=ANY=[], 0x0, 0x0, &(0x7f0000000500)}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ppoll(&(0x7f0000000040)=[{r0}], 0x1, &(0x7f0000000080), &(0x7f0000000100), 0x8) r3 = dup(0xffffffffffffffff) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000540)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000500)={0xffffffffffffffff}, 0x117}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r3, &(0x7f0000000580)={0x4, 0x8, 0xfa00, {r4, 0x3}}, 0x10) ioctl$DRM_IOCTL_GET_SAREA_CTX(r3, 0xc010641d, &(0x7f00000003c0)={0x0, &(0x7f0000000380)=""/1}) r5 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FIBMAP(r1, 0x1, &(0x7f00000004c0)=0x6) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000100)}}}], 0x97, 0x0, &(0x7f0000fedffe)}) 22:13:28 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24}, 0x1c) clock_gettime(0x0, &(0x7f0000000180)={0x0, 0x0}) ppoll(&(0x7f0000000000)=[{r0, 0x41a, 0x4b4}], 0x1, &(0x7f0000000200)={0x0, r1+30000000}, &(0x7f0000000240), 0x8) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) dup(0xffffffffffffffff) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 22:13:28 executing program 4: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x80000000000045, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000140)="2f65786500000000000409004bddd9de91be10eebf000ee9a90f79805854fa07424adee901d2da75af1f0200f5ab26d7a071fb35331ce39c5a") perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x102, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x1000000000, 0x0, 0x0, 0xfff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x1ffffffffffffe, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r1, &(0x7f0000000180), 0x8402) 22:13:29 executing program 1: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x0, 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f0000000080)={0x0, 0x0, 0x101, 'queue0\x00'}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc08c5336, &(0x7f0000000340)={0x0, 0x0, 0x1ff, 'queue1\x00'}) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000140)='IPVS\x00') getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000500)={0x0, 0x1c91}, &(0x7f0000000540)=0x8) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000000580)=@assoc_value={r3, 0xc000000000000}, &(0x7f00000005c0)=0x8) sendmsg$IPVS_CMD_DEL_DAEMON(r0, &(0x7f0000000440)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x81000}, 0xc, &(0x7f0000000400)={&(0x7f00000001c0)={0x12c, r2, 0x20, 0x70bd2b, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DAEMON={0x5c, 0x3, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x4}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x6}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @loopback}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast2}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_DAEMON={0x4}, @IPVS_CMD_ATTR_SERVICE={0x24, 0x1, [@IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'fo\x00'}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0xffffffff80000000}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x42}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e20}]}, @IPVS_CMD_ATTR_DEST={0x54, 0x2, [@IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x5}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x7}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x73}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xad74}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfff}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0xfffffffffffff001}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x7437893b}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x7}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x7}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0xfffffffffffffffb}]}, @IPVS_CMD_ATTR_SERVICE={0x40, 0x1, [@IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'sh\x00'}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e20}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'wrr\x00'}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x10}}]}]}, 0x12c}}, 0x1) [ 184.609489] binder: 7574:7578 BC_FREE_BUFFER u0000000000000000 no match [ 184.626036] binder: 7574:7578 ERROR: BC_REGISTER_LOOPER called without request [ 184.678222] binder: 7574:7585 ioctl 1 200004c0 returned -22 [ 184.679624] binder: 7574:7578 Acquire 1 refcount change on invalid ref 1964394719 ret -22 [ 184.776550] binder: 7578 RLIMIT_NICE not set [ 184.801313] binder: 7578 RLIMIT_NICE not set [ 184.817521] binder: 7574:7585 BC_FREE_BUFFER u0000000000000000 no match [ 184.838894] binder_alloc: binder_alloc_mmap_handler: 7574 20001000-20004000 already mapped failed -16 [ 184.843001] binder: 7574:7585 ERROR: BC_REGISTER_LOOPER called without request [ 184.895012] binder: 7574:7585 Acquire 1 refcount change on invalid ref 1964394719 ret -22 [ 184.895998] binder: BINDER_SET_CONTEXT_MGR already set [ 184.928091] binder: 7585 RLIMIT_NICE not set [ 184.940815] binder: 7574:7590 ioctl 1 200004c0 returned -22 [ 184.947668] binder: 7574:7578 ioctl 40046207 0 returned -16 [ 184.955118] binder: release 7574:7585 transaction 4 out, still active [ 184.962655] binder_alloc: 7574: binder_alloc_buf, no vma [ 184.968695] binder: release 7574:7578 transaction 4 in, still active [ 184.975723] binder: 7574:7589 transaction failed 29189/-3, size 0-0 line 2970 [ 184.983658] binder: send failed reply for transaction 4, target dead 22:13:29 executing program 4: mkdir(&(0x7f00000004c0)='./file0\x00', 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x0, 0x2, &(0x7f0000000140)=ANY=[@ANYBLOB="180000000000040000000000020000027f"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0xb1, &(0x7f0000000200)=""/177}, 0x48) mount(&(0x7f00008deff8), &(0x7f0000343ff8)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x0, &(0x7f0000000100)="03") 22:13:29 executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000080)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) read$FUSE(r0, &(0x7f00000040c0), 0x1000) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1, {0x7, 0x1b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}}, 0x50) 22:13:29 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f00000000c0)={0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x20, 0x0, &(0x7f0000000240)=[@exit_looper, @exit_looper, @free_buffer={0x40086303, r2}, @register_looper, @acquire={0x40046305, 0x751648df}], 0x69, 0x0, &(0x7f0000000280)="6a23980f12e093de53fb1c2a53d6d534c2fdd56f383af3376cfe8da4868c122c07fd05aab0cdfeff8e5f9d7ff4bb3bd2ae2f95b0cd58f340afb0faecaf2a59c02d91e140743a26c9a6f5c932fbae11a2ec107459d20181d8e367525b8a4698d3ae4a07b9da264d94c5"}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) lstat(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000600)={0xc8, 0x0, &(0x7f0000000080)=ANY=[], 0x0, 0x0, &(0x7f0000000500)}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ppoll(&(0x7f0000000040)=[{r0}], 0x1, &(0x7f0000000080), &(0x7f0000000100), 0x8) r3 = dup(0xffffffffffffffff) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000540)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000500)={0xffffffffffffffff}, 0x117}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r3, &(0x7f0000000580)={0x4, 0x8, 0xfa00, {r4, 0x3}}, 0x10) ioctl$DRM_IOCTL_GET_SAREA_CTX(r3, 0xc010641d, &(0x7f00000003c0)={0x0, &(0x7f0000000380)=""/1}) r5 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FIBMAP(r1, 0x1, &(0x7f00000004c0)=0x6) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000100)}}}], 0x97, 0x0, &(0x7f0000fedffe)}) [ 185.106450] binder: 7598:7599 BC_FREE_BUFFER u0000000000000000 no match [ 185.128747] binder: 7598:7599 ERROR: BC_REGISTER_LOOPER called without request [ 185.161821] binder: 7598:7608 ioctl 1 200004c0 returned -22 [ 185.193204] binder: 7598:7599 Acquire 1 refcount change on invalid ref 1964394719 ret -22 [ 185.237003] binder: 7599 RLIMIT_NICE not set [ 185.258208] binder: 7599 RLIMIT_NICE not set [ 185.294174] binder: release 7598:7612 transaction 7 out, still active [ 185.322000] binder: release 7598:7599 transaction 7 in, still active [ 185.328830] binder: send failed reply for transaction 7, target dead 22:13:30 executing program 2: 22:13:30 executing program 5: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000080)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) read$FUSE(r0, &(0x7f00000040c0), 0x1000) read$FUSE(r0, &(0x7f00000020c0), 0x1000) umount2(&(0x7f0000000040)='./file0\x00', 0x0) 22:13:30 executing program 1: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x0, 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f0000000080)={0x0, 0x0, 0x101, 'queue0\x00'}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc08c5336, &(0x7f0000000340)={0x0, 0x0, 0x1ff, 'queue1\x00'}) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000140)='IPVS\x00') getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000500)={0x0, 0x1c91}, &(0x7f0000000540)=0x8) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000000580)=@assoc_value={r3, 0xc000000000000}, &(0x7f00000005c0)=0x8) sendmsg$IPVS_CMD_DEL_DAEMON(r0, &(0x7f0000000440)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x81000}, 0xc, &(0x7f0000000400)={&(0x7f00000001c0)={0x12c, r2, 0x20, 0x70bd2b, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DAEMON={0x5c, 0x3, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x4}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x6}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @loopback}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast2}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_DAEMON={0x4}, @IPVS_CMD_ATTR_SERVICE={0x24, 0x1, [@IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'fo\x00'}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0xffffffff80000000}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x42}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e20}]}, @IPVS_CMD_ATTR_DEST={0x54, 0x2, [@IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x5}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x7}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x73}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xad74}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfff}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0xfffffffffffff001}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x7437893b}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x7}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x7}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0xfffffffffffffffb}]}, @IPVS_CMD_ATTR_SERVICE={0x40, 0x1, [@IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'sh\x00'}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e20}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'wrr\x00'}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x10}}]}]}, 0x12c}}, 0x1) 22:13:30 executing program 0: openat$rtc(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rtc0\x00', 0x8000, 0x0) fstat(0xffffffffffffff9c, &(0x7f0000000100)) getgroups(0x2, &(0x7f0000000180)=[0x0, 0xffffffffffffffff]) recvmmsg(0xffffffffffffffff, &(0x7f0000004540)=[{{0x0, 0x0, &(0x7f0000000400), 0x0, &(0x7f0000002e00)=""/58, 0x3a}}], 0x1, 0x0, &(0x7f0000004640)={0x0, 0x989680}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f000088cff6)='/dev/ptmx\x00', 0x1000000000001, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/hwrng\x00', 0x40000, 0x0) writev(r0, &(0x7f00000023c0), 0x1000000000000252) mlockall(0xfffffffffffffffe) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) 22:13:30 executing program 4: mkdir(&(0x7f00000004c0)='./file0\x00', 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x0, 0x2, &(0x7f0000000140)=ANY=[@ANYBLOB="180000000000040000000000020000027f"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0xb1, &(0x7f0000000200)=""/177}, 0x48) mount(&(0x7f00008deff8), &(0x7f0000343ff8)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x0, &(0x7f0000000100)="03") 22:13:30 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f00000000c0)={0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x20, 0x0, &(0x7f0000000240)=[@exit_looper, @exit_looper, @free_buffer={0x40086303, r2}, @register_looper, @acquire={0x40046305, 0x751648df}], 0x69, 0x0, &(0x7f0000000280)="6a23980f12e093de53fb1c2a53d6d534c2fdd56f383af3376cfe8da4868c122c07fd05aab0cdfeff8e5f9d7ff4bb3bd2ae2f95b0cd58f340afb0faecaf2a59c02d91e140743a26c9a6f5c932fbae11a2ec107459d20181d8e367525b8a4698d3ae4a07b9da264d94c5"}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) lstat(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000600)={0xc8, 0x0, &(0x7f0000000080)=ANY=[], 0x0, 0x0, &(0x7f0000000500)}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ppoll(&(0x7f0000000040)=[{r0}], 0x1, &(0x7f0000000080), &(0x7f0000000100), 0x8) r3 = dup(0xffffffffffffffff) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000540)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000500)={0xffffffffffffffff}, 0x117}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r3, &(0x7f0000000580)={0x4, 0x8, 0xfa00, {r4, 0x3}}, 0x10) ioctl$DRM_IOCTL_GET_SAREA_CTX(r3, 0xc010641d, &(0x7f00000003c0)={0x0, &(0x7f0000000380)=""/1}) r5 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FIBMAP(r1, 0x1, &(0x7f00000004c0)=0x6) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000100)}}}], 0x97, 0x0, &(0x7f0000fedffe)}) 22:13:30 executing program 4: 22:13:30 executing program 1: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x0, 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f0000000080)={0x0, 0x0, 0x101, 'queue0\x00'}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc08c5336, &(0x7f0000000340)={0x0, 0x0, 0x1ff, 'queue1\x00'}) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000140)='IPVS\x00') getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000500)={0x0, 0x1c91}, &(0x7f0000000540)=0x8) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000000580)=@assoc_value={r3, 0xc000000000000}, &(0x7f00000005c0)=0x8) sendmsg$IPVS_CMD_DEL_DAEMON(r0, &(0x7f0000000440)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x81000}, 0xc, &(0x7f0000000400)={&(0x7f00000001c0)={0x12c, r2, 0x20, 0x70bd2b, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DAEMON={0x5c, 0x3, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x4}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x6}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @loopback}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast2}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_DAEMON={0x4}, @IPVS_CMD_ATTR_SERVICE={0x24, 0x1, [@IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'fo\x00'}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0xffffffff80000000}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x42}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e20}]}, @IPVS_CMD_ATTR_DEST={0x54, 0x2, [@IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x5}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x7}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x73}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xad74}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfff}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0xfffffffffffff001}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x7437893b}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x7}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x7}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0xfffffffffffffffb}]}, @IPVS_CMD_ATTR_SERVICE={0x40, 0x1, [@IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'sh\x00'}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e20}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'wrr\x00'}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x10}}]}]}, 0x12c}}, 0x1) 22:13:30 executing program 2: [ 185.984279] binder: 7619:7627 BC_FREE_BUFFER u0000000000000000 no match [ 186.015992] binder: 7619:7627 ERROR: BC_REGISTER_LOOPER called without request [ 186.045998] binder: 7619:7627 Acquire 1 refcount change on invalid ref 1964394719 ret -22 [ 186.076783] binder: 7619:7634 ioctl 1 200004c0 returned -22 22:13:30 executing program 0: [ 186.111882] binder: 7627 RLIMIT_NICE not set 22:13:30 executing program 5: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000042000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_DELETE_PORT(r0, 0x40a85321, &(0x7f0000000200)={{}, 'port0\x00'}) 22:13:30 executing program 2: [ 186.140421] binder: 7627 RLIMIT_NICE not set 22:13:30 executing program 4: 22:13:30 executing program 1: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x0, 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f0000000080)={0x0, 0x0, 0x101, 'queue0\x00'}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc08c5336, &(0x7f0000000340)={0x0, 0x0, 0x1ff, 'queue1\x00'}) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000140)='IPVS\x00') getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000500)={0x0, 0x1c91}, &(0x7f0000000540)=0x8) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000000580)=@assoc_value={r3, 0xc000000000000}, &(0x7f00000005c0)=0x8) sendmsg$IPVS_CMD_DEL_DAEMON(r0, &(0x7f0000000440)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x81000}, 0xc, &(0x7f0000000400)={&(0x7f00000001c0)={0x12c, r2, 0x20, 0x70bd2b, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DAEMON={0x5c, 0x3, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x4}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x6}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @loopback}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast2}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bpq0\x00'}]}, @IPVS_CMD_ATTR_DAEMON={0x4}, @IPVS_CMD_ATTR_SERVICE={0x24, 0x1, [@IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'fo\x00'}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0xffffffff80000000}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x42}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e20}]}, @IPVS_CMD_ATTR_DEST={0x54, 0x2, [@IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x5}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x7}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x73}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xad74}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfff}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0xfffffffffffff001}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x7437893b}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x7}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x7}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0xfffffffffffffffb}]}, @IPVS_CMD_ATTR_SERVICE={0x40, 0x1, [@IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'sh\x00'}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x1}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e20}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'wrr\x00'}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x10}}]}]}, 0x12c}}, 0x1) 22:13:30 executing program 0: 22:13:30 executing program 2: 22:13:30 executing program 4: [ 186.272246] binder: release 7619:7634 transaction 9 out, still active 22:13:30 executing program 3: 22:13:30 executing program 5: 22:13:30 executing program 1: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x0, 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f0000000080)={0x0, 0x0, 0x101, 'queue0\x00'}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc08c5336, &(0x7f0000000340)={0x0, 0x0, 0x1ff, 'queue1\x00'}) syz_genetlink_get_family_id$ipvs(&(0x7f0000000140)='IPVS\x00') getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000500)={0x0, 0x1c91}, &(0x7f0000000540)=0x8) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000000580)=@assoc_value={r2, 0xc000000000000}, &(0x7f00000005c0)=0x8) 22:13:30 executing program 2: [ 186.382335] binder: release 7619:7627 transaction 9 in, still active [ 186.388898] binder: send failed reply for transaction 9, target dead 22:13:30 executing program 4: 22:13:30 executing program 0: 22:13:30 executing program 2: 22:13:30 executing program 5: 22:13:30 executing program 1: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x0, 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f0000000080)={0x0, 0x0, 0x101, 'queue0\x00'}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r1, 0xc08c5336, &(0x7f0000000340)={0x0, 0x0, 0x1ff, 'queue1\x00'}) syz_genetlink_get_family_id$ipvs(&(0x7f0000000140)='IPVS\x00') getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000500)={0x0, 0x1c91}, &(0x7f0000000540)=0x8) 22:13:30 executing program 3: 22:13:30 executing program 0: 22:13:31 executing program 4: 22:13:31 executing program 5: 22:13:31 executing program 2: 22:13:31 executing program 3: 22:13:31 executing program 0: 22:13:31 executing program 1: openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000000080)={0x0, 0x0, 0x101, 'queue0\x00'}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r0, 0xc08c5336, &(0x7f0000000340)={0x0, 0x0, 0x1ff, 'queue1\x00'}) syz_genetlink_get_family_id$ipvs(&(0x7f0000000140)='IPVS\x00') 22:13:31 executing program 2: 22:13:31 executing program 4: 22:13:31 executing program 3: 22:13:31 executing program 5: 22:13:31 executing program 2: 22:13:31 executing program 4: 22:13:31 executing program 1: openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000000080)={0x0, 0x0, 0x101, 'queue0\x00'}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r0, 0xc08c5336, &(0x7f0000000340)={0x0, 0x0, 0x1ff, 'queue1\x00'}) 22:13:31 executing program 0: 22:13:31 executing program 5: 22:13:31 executing program 3: 22:13:31 executing program 4: 22:13:31 executing program 2: 22:13:31 executing program 0: 22:13:31 executing program 1: openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x0, 0x0) r0 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r0, 0xc08c5336, &(0x7f0000000340)={0x0, 0x0, 0x1ff, 'queue1\x00'}) 22:13:31 executing program 3: 22:13:31 executing program 5: 22:13:31 executing program 4: 22:13:31 executing program 0: 22:13:31 executing program 1: openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000080)={0x0, 0x0, 0x101, 'queue0\x00'}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(0xffffffffffffffff, 0xc08c5336, &(0x7f0000000340)={0x0, 0x0, 0x1ff, 'queue1\x00'}) 22:13:31 executing program 3: 22:13:31 executing program 4: ioctl$KVM_SET_DEBUGREGS(0xffffffffffffffff, 0x4080aea2, &(0x7f0000000200)={[], 0x0, 0x40, 0xb0}) socket$inet6(0xa, 0x0, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000002740)={0xa, 0x0, 0x0, @dev}, 0x79) sendmmsg(0xffffffffffffffff, &(0x7f0000007e00), 0x136a88c8311572c, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000480)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000280)=[@text32={0x20, &(0x7f00000003c0)="0f20c035100000000f22c0c4c1f87766baf80cb8aedf018fef66bafc0c66ed0f01ef8149000f00000036f30f2000c4c37962530782670fc75b39643e2e0f01cf66baf80cb86c5fbb8aef66bafc0c66b8e07166ef", 0x54}], 0x1, 0x0, &(0x7f0000000040), 0xfffffffffffff29) openat$ashmem(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ashmem\x00', 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000002c0)={{{@in=@dev, @in=@broadcast}}, {{@in6=@mcast1}, 0x0, @in=@loopback}}, &(0x7f0000000000)=0xe8) ioctl$KVM_RUN(r2, 0xae80, 0x0) 22:13:31 executing program 2: 22:13:31 executing program 5: 22:13:31 executing program 0: 22:13:31 executing program 2: 22:13:31 executing program 1: openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000080)={0x0, 0x0, 0x101, 'queue0\x00'}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(0xffffffffffffffff, 0xc08c5336, &(0x7f0000000340)={0x0, 0x0, 0x1ff, 'queue1\x00'}) 22:13:31 executing program 3: 22:13:31 executing program 5: 22:13:31 executing program 0: 22:13:31 executing program 0: 22:13:31 executing program 5: 22:13:31 executing program 2: 22:13:32 executing program 4: 22:13:32 executing program 3: 22:13:32 executing program 1: openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000080)={0x0, 0x0, 0x101, 'queue0\x00'}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(0xffffffffffffffff, 0xc08c5336, &(0x7f0000000340)={0x0, 0x0, 0x1ff, 'queue1\x00'}) 22:13:32 executing program 0: r0 = mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f2, 0x1, &(0x7f0000000180)={0x0, 0x5, 0x6, 0x4}) mq_timedsend(r0, &(0x7f0000000040), 0x0, 0x0, &(0x7f00000000c0)={0x77359400}) mq_timedsend(r0, &(0x7f0000000040), 0x0, 0x200, &(0x7f0000000140)) mq_timedreceive(r0, &(0x7f0000000000)=""/24, 0xfffffffffffffef3, 0x0, 0x0) 22:13:32 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000200)={&(0x7f0000000180), 0xc, &(0x7f00000001c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="640000001c00010d0000000000000000000000000000000000000000000000000000000000000000e00000020000000000000000000000000000000000000000240009000000f4ffefff0000000000000000000000000000000000000000000000000000"], 0x1}}, 0x0) 22:13:32 executing program 2: 22:13:32 executing program 3: 22:13:32 executing program 0: 22:13:32 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000000080)={0x0, 0x0, 0x101, 'queue0\x00'}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r0, 0xc08c5336, &(0x7f0000000340)={0x0, 0x0, 0x1ff, 'queue1\x00'}) 22:13:32 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r0, 0x0, 0x27, &(0x7f0000000040)={@multicast2, @local, @remote}, 0xc) 22:13:32 executing program 2: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x78}], 0x1, 0x0) memfd_create(&(0x7f00000000c0)='fdinfo/3\x00', 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='fdinfo/3\x00') preadv(r0, &(0x7f0000000480), 0x10000000000001ed, 0x10000000000000) 22:13:32 executing program 4: r0 = getpgid(0x0) r1 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) read(r1, &(0x7f0000000140)=""/28, 0x1c) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000418f50)={{0x80}, "0a4ceaa05d9a00000000000000039b3fd4cec307e8ef3d13eb790ec9c65abaf90d229db692542e5b78f8b29e0a27800f0000000000000009fb42f376589701a4", 0xa9824f69d1376637, 0x10800a}) sched_setaffinity(r0, 0x8, &(0x7f0000000200)=0x101) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r1, 0x4040534e, &(0x7f000019ffe9)={0xc1, @time={0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000000300)={{}, 'port0\x00'}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r1, 0xc058534f, &(0x7f0000000000)) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x0, 0x0) 22:13:32 executing program 3: r0 = socket$kcm(0x2b, 0x1, 0x0) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) poll(&(0x7f0000000100)=[{r0}, {r1}], 0x2, 0x0) 22:13:32 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001540)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, 0x80, &(0x7f0000002900)}}], 0x1, 0x0, &(0x7f0000003280)) r0 = syz_open_procfs(0x0, &(0x7f0000000200)='oom_adj\x00') preadv(r0, &(0x7f00000017c0), 0x1d0, 0x0) 22:13:32 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000000080)={0x0, 0x0, 0x101, 'queue0\x00'}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r0, 0xc08c5336, &(0x7f0000000340)={0x0, 0x0, 0x1ff, 'queue1\x00'}) 22:13:32 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000005fd4)=ANY=[], 0x0, 0x0, &(0x7f0000002000)}) poll(&(0x7f0000000380)=[{r0}], 0x1, 0x4) 22:13:32 executing program 0: socket$inet_udp(0x2, 0x2, 0x0) r0 = syz_open_dev$loop(&(0x7f00000004c0)='/dev/loop#\x00', 0x0, 0x0) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, &(0x7f0000788000), 0x4) lsetxattr$trusted_overlay_redirect(&(0x7f00000001c0)='./bus\x00', &(0x7f0000000200)='trusted.overlay.redirect\x00', &(0x7f00000002c0)='./file0\x00', 0x8, 0x1) ioctl$BLKTRACESTART(r0, 0x1274, 0x0) ioctl$EVIOCGKEY(0xffffffffffffffff, 0x80404518, &(0x7f00000003c0)=""/49) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$IP_VS_SO_SET_STARTDAEMON(0xffffffffffffffff, 0x0, 0x48b, &(0x7f0000000180)={0x0, 'syzkaller0\x00'}, 0x18) sysinfo(&(0x7f0000000240)) r1 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r1, 0x208200) r2 = open(&(0x7f0000000780)='./bus\x00', 0x14103e, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r2, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX_OLD(0xffffffffffffffff, 0x84, 0x6b, &(0x7f00000000c0), 0x0) pipe(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000600)={0x0, @in={{0x2, 0x0, @multicast2}}, 0x8, 0x0, 0x0, 0x0, 0x40}, 0x98) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) 22:13:32 executing program 2: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r0, 0xd3c9) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000000480)=0x80, 0x0) setsockopt$inet6_opts(r2, 0x29, 0x37, &(0x7f0000000000)=@dstopts, 0x8) connect(r2, &(0x7f00007a8000)=@generic={0x0, "8c36b043d081c3c1503af6a768406b9267f60ac286da2338bd8e3f6ba990189977170a0705ea90c13e26ba0b966b9b9d3289c8784f16963ce7c312649ce2996cd4e7126f704ab2546e516d216ed2fb7a95ff906185874a2d44029a01f46a380e73c5477efe9e01548612afd6c667be500d748038f499a492ef8fe4e62653"}, 0x80) sendto$inet6(r1, &(0x7f0000000040), 0xffb0, 0x0, &(0x7f0000000140)={0xa, 0x0, 0x0, @mcast2}, 0x1c) 22:13:32 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) sendmmsg(r0, &(0x7f0000007d80), 0x6, 0x0) 22:13:32 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000000080)={0x0, 0x0, 0x101, 'queue0\x00'}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r0, 0xc08c5336, &(0x7f0000000340)={0x0, 0x0, 0x1ff, 'queue1\x00'}) 22:13:32 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x80000000000045, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000140)="2f65786500000000000409004bddd9de91be10eebf000ee9a90f79805854fa07424adee901d2da75af1f0200f5ab26d7a071fb35331ce39c5a") perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r0, r1, &(0x7f0000000180), 0x8402) [ 188.027696] dccp_xmit_packet: Payload too large (65456) for featneg. 22:13:32 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000080)={0x0, 0x0, 0x101, 'queue0\x00'}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r0, 0xc08c5336, &(0x7f0000000340)={0x0, 0x0, 0x1ff, 'queue1\x00'}) 22:13:32 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000280)={&(0x7f0000000040), 0xc, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fe8000000000000000000000000000aa0000000033000000fe8000000000000000000000000000bb000000000000000000000000000000000000000000000000000000000000007866000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff"], 0x1}}, 0x0) 22:13:33 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = bpf$PROG_LOAD(0x5, &(0x7f000000d000)={0xa, 0x3, &(0x7f0000008000)=ANY=[@ANYBLOB="85000000110000000700000000000000950000c700000000"], &(0x7f0000014ff5)="73797a6b610000000500f3", 0x2, 0x1000, &(0x7f0000014000)=""/4096}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000200)={r1, 0x0, 0xe, 0x9d, &(0x7f00000000c0)="e46001923406080000000a9b86dd", &(0x7f0000000300)=""/157, 0x619}, 0x28) 22:13:33 executing program 2: perf_event_open(&(0x7f000025c000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r0, 0x80089203, &(0x7f0000000180)) 22:13:33 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000000)={0xfffb, 0x1b, 0x0, 0xffffffffffffffff}) ioctl$DMA_BUF_IOCTL_SYNC(r1, 0x40086200, &(0x7f0000000140)=0x2) 22:13:33 executing program 3: setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000000580)={0x8, 0x0, 0x8200, 0x0, 0x1000}, 0x20) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000a40)={0x0, @in={{0x2, 0x4e20, @rand_addr=0x1}}, 0x0, 0x4, 0x8, 0x3}, &(0x7f0000000500)=0x98) syz_open_dev$mice(&(0x7f0000001f00)='/dev/input/mice\x00', 0x0, 0x4000) 22:13:33 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000000080)={0x0, 0x0, 0x0, 'queue0\x00'}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r0, 0xc08c5336, &(0x7f0000000340)={0x0, 0x0, 0x1ff, 'queue1\x00'}) 22:13:33 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000006200)={&(0x7f0000001a00), 0xc, &(0x7f0000001a40)={&(0x7f0000000140)=ANY=[@ANYBLOB="000000000000000000000000e4bf185c3d9f864a513065c6ee742c75357d38a9de3b76fa257d577634ab0e9547b3e92de115719ff4f2c23ddf9f36a6a0b14d891cabec6762"], 0x1}}, 0x0) recvmsg(r0, &(0x7f00000016c0)={&(0x7f0000000000)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @remote}}}, 0x80, &(0x7f0000001580)=[{&(0x7f00000000c0)=""/66, 0x42}, {&(0x7f0000000500)=""/4096, 0x1000}], 0x2, &(0x7f0000001600)=""/148, 0x94}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000340)={&(0x7f0000000080), 0xc, &(0x7f0000000300)={&(0x7f00000003c0)={0x14, 0x42, 0x105}, 0x14}}, 0x0) 22:13:33 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000001440)={'team0\x00', 0x0}) setsockopt$packet_add_memb(r1, 0x107, 0x1, &(0x7f0000001480)={r2, 0x1, 0x5, @local}, 0x10) 22:13:33 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000000080)={0x0, 0x0, 0x101, 'queue0\x00'}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(0xffffffffffffffff, 0xc08c5336, &(0x7f0000000340)={0x0, 0x0, 0x1ff, 'queue1\x00'}) [ 188.777101] device team0 entered promiscuous mode 22:13:33 executing program 0: rt_sigprocmask(0x0, &(0x7f000078b000)={0xfffffffffffffffa}, 0x0, 0x8) clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, &(0x7f0000000240), 0xffffffffffffffff) r0 = gettid() wait4(0x0, &(0x7f00000003c0), 0x80000000, &(0x7f0000000400)) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x12) ptrace$cont(0x1f, r0, 0x0, 0x0) ptrace$cont(0x20, r0, 0x0, 0x5) 22:13:33 executing program 2: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000280)='/dev/loop-control\x00', 0x0, 0x0) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) [ 188.797583] device team_slave_0 entered promiscuous mode [ 188.809401] device team_slave_1 entered promiscuous mode [ 188.833423] device team0 left promiscuous mode [ 188.841625] device team_slave_0 left promiscuous mode 22:13:33 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket$inet6(0xa, 0x800000803, 0x40000000000001) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0a5c2d023c126285718070") r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'lo\x00'}) sendmsg$nl_route_sched(r2, &(0x7f0000000240)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB="000000000c0000000000000008000100736671004800020000000000000000000000000000000000f3000000000000000000000000000000000011000000000000000000000000000000000000000000000000000000000000000000"], 0x1}}, 0x0) 22:13:33 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000000080)={0x0, 0x0, 0x101, 'queue0\x00'}) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r0, 0xc08c5336, &(0x7f0000000340)={0x0, 0x0, 0x0, 'queue1\x00'}) [ 188.860426] device team_slave_1 left promiscuous mode 22:13:33 executing program 3: r0 = socket$inet6(0xa, 0x1000000000006, 0x0) ioctl(r0, 0x8912, &(0x7f0000000040)="153f6234488dd25d766070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000018000)={&(0x7f0000000000), 0xc, &(0x7f0000013ff1)={&(0x7f0000000080)={0x20, 0x18, 0x301, 0x0, 0x0, {0x16}, [@typed={0xc, 0x3, @u64}]}, 0x20}}, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$EBT_SO_GET_INIT_INFO(0xffffffffffffffff, 0x0, 0x82, &(0x7f0000000140)={'broute\x00'}, &(0x7f0000000000)=0x78) getsockopt$inet_mtu(0xffffffffffffffff, 0x0, 0xa, &(0x7f0000000280), &(0x7f00000002c0)=0x4) [ 188.907647] device team0 entered promiscuous mode 22:13:33 executing program 0: openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vhost-vsock\x00', 0x2, 0x0) 22:13:33 executing program 2: r0 = openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f00000005c0)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) close(r0) creat(&(0x7f0000000380)='./file0\x00', 0x0) write$selinux_attr(r0, &(0x7f0000000000)='system_u:object_r:su_exec_t:s0\x00', 0x1f) [ 188.933397] device team_slave_0 entered promiscuous mode [ 188.948902] device team_slave_1 entered promiscuous mode 22:13:33 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl(0xffffffffffffffff, 0x0, &(0x7f00000002c0)) r0 = syz_open_procfs(0x0, &(0x7f0000000040)='\x00\x00\x00\x00\x00') r1 = openat$cgroup_ro(r0, &(0x7f0000000000)="6d656d00017937737761532e63757289c942abe3fa72656e7400", 0x0, 0x0) preadv(r1, &(0x7f0000000180)=[{&(0x7f00000000c0)=""/81, 0x20000111}], 0x1, 0x2000107c) [ 188.981120] device team0 left promiscuous mode [ 188.995590] device team_slave_0 left promiscuous mode [ 189.020915] device team_slave_1 left promiscuous mode 22:13:33 executing program 4: r0 = socket$inet6(0x10, 0x1000000003, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg(r0, &(0x7f0000002fc8)={&(0x7f0000000000)=@nl, 0x80, &(0x7f0000002000)=[{&(0x7f0000000340)="5500000018007f5300fe01b2a4a280930a06000000a84308910000003900090008000c00010000001900150006000000000000dc1338d54400009b84136ef75afb83de448daa7227c43ab8220000060cec4fab6513", 0x55}], 0x1, &(0x7f00000003c0)}, 0x0) 22:13:33 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) openat$sequencer(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/sequencer\x00', 0x4000, 0x0) 22:13:33 executing program 5: mkdir(&(0x7f00000004c0)='./file0\x00', 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x0, 0x2, &(0x7f0000000140)=ANY=[@ANYBLOB="180000000000040000000000020000027f"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0xb1, &(0x7f0000000200)=""/177}, 0x48) mount(&(0x7f00008deff8), &(0x7f0000343ff8)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x0, &(0x7f0000000100)="03") mount(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='rpc_pipefs\x00', 0x0, 0x0) 22:13:33 executing program 2: ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000240)) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000480)) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f00000005c0)) getpid() r0 = gettid() getpgid(r0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_user\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000600)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(0xffffffffffffffff, 0x84, 0x12, &(0x7f0000000300), 0x4) setsockopt$IP_VS_SO_SET_STOPDAEMON(r2, 0x0, 0x48c, &(0x7f0000000080)={0x0, 'veth1_to_bond\x00', 0x2}, 0x18) ioctl(r2, 0x800000000008982, &(0x7f0000000080)) openat$ppp(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ppp\x00', 0x0, 0x0) write$FUSE_NOTIFY_DELETE(r1, &(0x7f0000000540)=ANY=[@ANYBLOB="290000000600000000000000000000000400000000000000030000000000000000000000000000000069127fbcdab56d0f1f4cb25800000000000021b0c9e06ea050325f77726e71bff4c99eef500ade32c424020f322903f5bad93a"], 0x5c) mount(&(0x7f0000000380)=ANY=[@ANYBLOB="cb2b9b5255175d43fca389e340fe96132329bdfbaa11c5521288697c83a9f28c7ee9d8df70f2c6849d443d5bc274a1f1576385a885b764dc4babfdf01646fa6053ebc9"], &(0x7f0000000800)='./file0//ile0\x00', &(0x7f0000000200)='cgrQup2\x00', 0x2, 0x0) ioctl$TIOCNXCL(r1, 0x540d) r3 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x82) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000a80)=ANY=[], &(0x7f0000000100)) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000004fc8)={&(0x7f0000016000), 0xc, &(0x7f000000b000)={&(0x7f000002c000)=@mpls_newroute={0x20, 0x18, 0x21, 0x0, 0x0, {0x1c, 0x14, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x1}, [@RTA_DST={0x4, 0x9}]}, 0x20}}, 0x0) ioctl$SG_GET_PACK_ID(r1, 0x227c, &(0x7f0000000400)) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(0xffffffffffffffff, 0x84, 0x79, &(0x7f00000002c0), 0x8) ioctl$PERF_EVENT_IOC_RESET(r3, 0x2403, 0x2) r6 = memfd_create(&(0x7f0000000140)="6367726f7570320075b536e08f97e10c4289e296462f3c8fc6a418228027bf4d75931e238b41cf55afcf7dd2284567ed5a738f3382aae6349e10336adf686499eb1d9379eb28", 0x0) syz_open_dev$usbmon(&(0x7f0000000840)='/dev/usbmon#\x00', 0x0, 0x400880) r7 = socket$inet_tcp(0x2, 0x1, 0x0) io_setup(0x5, &(0x7f0000000000)=0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0xbd, &(0x7f00000014c0)}, &(0x7f0000000100)=0x10) io_submit(r8, 0x20000000000000c7, &(0x7f00000000c0)=[&(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x80000000000, r7, &(0x7f0000001000), 0xffffffffffffffe1, 0x9, 0x0, 0x0, 0xffffffffffffff9c}]) setsockopt$inet_sctp_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f00000001c0)={0xffff, 0x5, 0xc65b, 0x9, 0x80, 0x5, 0x1ff, 0x4, 0x20, 0x5, 0x7}, 0xb) pwritev(r6, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81806) sendmsg(0xffffffffffffffff, &(0x7f0000000dc0)={&(0x7f00000004c0)=@pppoe={0x18, 0x0, {0x0, @local, 'yam0\x00'}}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000e00)=ANY=[], 0x0, 0x840}, 0x0) ioctl$LOOP_CHANGE_FD(r4, 0x4c00, r6) memfd_create(&(0x7f0000000640)="000000000000000100000001000000768e05f7c155ad7dc6947c573e5a69244e76382c0aa63d575ea3597f8b1728277ef76b30544d7ba92dcf978f1f81dc1b7f8f7b3451dada02ecb4f1ddcc8b5241da8945666e0073c25a6201004dbea37aabd3eb9888c4c629419f50937a6848e0d281e4ee568c4de9a036c26f1922f64971d4df97fbab04e8ce4938b31dcf259b4bc60901e18661fab8fb2988cd2bc260c2f572353e6bb0a002fc164d4f189b068062d10100000000000000400c0c4ca57b546b9430172ea5362ee0141b3df06ad235e815d89eead3d9473409c09c2e27a952337a24f20188c013123cc0316a33d8b443453773e4a09edd8031124dee13ce9c75288f2ec833c7e66af5b19a00000000000000", 0x0) 22:13:33 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x80000000000045, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000140)="2f65786500000000000409004bddd9de91be10eebf000ee9a90f79805854fa07424adee901d2da75af1f0200f5ab26d7a071fb35331ce39c5a") sendfile(r0, r1, &(0x7f0000000180), 0x8402) 22:13:33 executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4004}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) read$FUSE(r0, &(0x7f0000003000), 0x1000) stat(&(0x7f0000000580)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INTERRUPT(r0, &(0x7f0000000200)={0x10, 0x0, 0x1}, 0x10) write$FUSE_ATTR(r0, &(0x7f0000000680)={0x78, 0x0, 0x2, {0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000}}}, 0x78) 22:13:33 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl(0xffffffffffffffff, 0x0, &(0x7f00000002c0)) socket$inet6_dccp(0xa, 0x6, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000040)='\x00\x00\x00\x00\x00') r1 = openat$cgroup_ro(r0, &(0x7f0000000000)="6d656d00017937737761532e63757289c942abe3fa72656e7400", 0x0, 0x0) syz_emit_ethernet(0x642, &(0x7f0000000100)={@local, @remote, [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x223, 0x0, 0x0, @local={0xfe, 0x8a00, [0x0, 0x0, 0x3, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x634]}, @local, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) preadv(r1, &(0x7f0000000180)=[{&(0x7f00000000c0)=""/81, 0x20000111}], 0x1, 0x2000107c) 22:13:33 executing program 3: r0 = timerfd_create(0x0, 0x0) timerfd_settime(r0, 0x3, &(0x7f0000000040)={{0x77359400}}, &(0x7f00000000c0)) clock_settime(0x0, &(0x7f0000000000)={0x77359400}) 22:13:33 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000440)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000080)={&(0x7f0000000040)={0x10, 0xffffff7f00000000}, 0xc, &(0x7f0000000000)={&(0x7f0000002f00)={0x14, 0x1c, 0xfffffffffffffffd, 0x0, 0x0, {0x1}}, 0x14}}, 0x0) 22:13:33 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000040)='\x00\x00\x00\x00\x00') r1 = openat$cgroup_ro(r0, &(0x7f0000000000)="6d656d00017937737761532e63757289c942abe3fa72656e7400", 0x0, 0x0) syz_emit_ethernet(0x642, &(0x7f0000000100)={@local, @remote, [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x223, 0x0, 0x0, @local={0xfe, 0x8a00, [0x0, 0x0, 0x3, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x634]}, @local, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) preadv(r1, &(0x7f0000000180)=[{&(0x7f00000000c0)=""/81, 0x20000111}], 0x1, 0x2000107c) 22:13:33 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) 22:13:33 executing program 4: r0 = openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) close(r0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000180)) 22:13:34 executing program 4: 22:13:34 executing program 0: 22:13:34 executing program 4: 22:13:34 executing program 2: ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000240)) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000480)) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f00000005c0)) getpid() r0 = gettid() getpgid(r0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_user\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000600)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(0xffffffffffffffff, 0x84, 0x12, &(0x7f0000000300), 0x4) setsockopt$IP_VS_SO_SET_STOPDAEMON(r2, 0x0, 0x48c, &(0x7f0000000080)={0x0, 'veth1_to_bond\x00', 0x2}, 0x18) ioctl(r2, 0x800000000008982, &(0x7f0000000080)) openat$ppp(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ppp\x00', 0x0, 0x0) write$FUSE_NOTIFY_DELETE(r1, &(0x7f0000000540)=ANY=[@ANYBLOB="290000000600000000000000000000000400000000000000030000000000000000000000000000000069127fbcdab56d0f1f4cb25800000000000021b0c9e06ea050325f77726e71bff4c99eef500ade32c424020f322903f5bad93a"], 0x5c) mount(&(0x7f0000000380)=ANY=[@ANYBLOB="cb2b9b5255175d43fca389e340fe96132329bdfbaa11c5521288697c83a9f28c7ee9d8df70f2c6849d443d5bc274a1f1576385a885b764dc4babfdf01646fa6053ebc9"], &(0x7f0000000800)='./file0//ile0\x00', &(0x7f0000000200)='cgrQup2\x00', 0x2, 0x0) ioctl$TIOCNXCL(r1, 0x540d) r3 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x82) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000a80)=ANY=[], &(0x7f0000000100)) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000004fc8)={&(0x7f0000016000), 0xc, &(0x7f000000b000)={&(0x7f000002c000)=@mpls_newroute={0x20, 0x18, 0x21, 0x0, 0x0, {0x1c, 0x14, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x1}, [@RTA_DST={0x4, 0x9}]}, 0x20}}, 0x0) ioctl$SG_GET_PACK_ID(r1, 0x227c, &(0x7f0000000400)) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(0xffffffffffffffff, 0x84, 0x79, &(0x7f00000002c0), 0x8) ioctl$PERF_EVENT_IOC_RESET(r3, 0x2403, 0x2) r6 = memfd_create(&(0x7f0000000140)="6367726f7570320075b536e08f97e10c4289e296462f3c8fc6a418228027bf4d75931e238b41cf55afcf7dd2284567ed5a738f3382aae6349e10336adf686499eb1d9379eb28", 0x0) syz_open_dev$usbmon(&(0x7f0000000840)='/dev/usbmon#\x00', 0x0, 0x400880) r7 = socket$inet_tcp(0x2, 0x1, 0x0) io_setup(0x5, &(0x7f0000000000)=0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0xbd, &(0x7f00000014c0)}, &(0x7f0000000100)=0x10) io_submit(r8, 0x20000000000000c7, &(0x7f00000000c0)=[&(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x80000000000, r7, &(0x7f0000001000), 0xffffffffffffffe1, 0x9, 0x0, 0x0, 0xffffffffffffff9c}]) setsockopt$inet_sctp_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f00000001c0)={0xffff, 0x5, 0xc65b, 0x9, 0x80, 0x5, 0x1ff, 0x4, 0x20, 0x5, 0x7}, 0xb) pwritev(r6, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81806) sendmsg(0xffffffffffffffff, &(0x7f0000000dc0)={&(0x7f00000004c0)=@pppoe={0x18, 0x0, {0x0, @local, 'yam0\x00'}}, 0x80, &(0x7f00000007c0), 0x0, &(0x7f0000000e00)=ANY=[], 0x0, 0x840}, 0x0) ioctl$LOOP_CHANGE_FD(r4, 0x4c00, r6) memfd_create(&(0x7f0000000640)="000000000000000100000001000000768e05f7c155ad7dc6947c573e5a69244e76382c0aa63d575ea3597f8b1728277ef76b30544d7ba92dcf978f1f81dc1b7f8f7b3451dada02ecb4f1ddcc8b5241da8945666e0073c25a6201004dbea37aabd3eb9888c4c629419f50937a6848e0d281e4ee568c4de9a036c26f1922f64971d4df97fbab04e8ce4938b31dcf259b4bc60901e18661fab8fb2988cd2bc260c2f572353e6bb0a002fc164d4f189b068062d10100000000000000400c0c4ca57b546b9430172ea5362ee0141b3df06ad235e815d89eead3d9473409c09c2e27a952337a24f20188c013123cc0316a33d8b443453773e4a09edd8031124dee13ce9c75288f2ec833c7e66af5b19a00000000000000", 0x0) 22:13:34 executing program 5: sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000002380)=[{&(0x7f0000000140)="d784a62dec7d3873d06c8ec959bf7858d91c", 0x12}], 0x1, &(0x7f0000000000)}, 0x0) mkdir(&(0x7f00000004c0)='./file0\x00', 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x0, 0x2, &(0x7f0000000140)=ANY=[@ANYBLOB="180000000000040000000000020000027f"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0xb1, &(0x7f0000000200)=""/177}, 0x48) mount(&(0x7f00008deff8), &(0x7f0000343ff8)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x0, &(0x7f0000000100)="03") mount(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='rpc_pipefs\x00', 0x0, 0x0) 22:13:34 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket(0x10, 0x3, 0xa) r2 = syz_open_procfs(0x0, &(0x7f0000000a80)="2f657865000000d400042a004bddd9de91be10eebf00f5e94aae22e89bb36cc7457accc3320c67a90f79805843e901d2da75af1f000000000000000045cc6158f031528844209c7ed05b160ef336721bf89686ff472f71dfca5353f6323ddf8006ffc1052d6a80985adc68017065648b35c7d321fc5c0466062fbfad5acbe7ff6cefe53c88c05ab970ceebdfa589098ad40d080deb2488f9e4069682b14483f113cb6979b2f390179a18e26b409307f31ed04a0a681f002e007436947475ab073711c98ae3b4259f1a1aff9b09aa66cb90ca43a1dbc6de15abb4ae739f9e8f047cd29ec76b9ef6beb7839f8071aaea4d247e6a9514748c93d0bb01a7c37ca6c856327af81f296d2c2c07c2d63b87d95e3d276ca6d608557fd69b9f8b30ab4eea4557181c0e72d9804ac668ac3935d8a9845f7de58cee0e918d90f659c8f66c303bf7bcc2b835840707ee0a73257f17d97b69a13f58453fee4129e7") sendfile(r1, r2, &(0x7f0000000040)=0x100d00, 0x100000001) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 22:13:34 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) poll(&(0x7f0000000380)=[{r0}], 0x1, 0x4) 22:13:34 executing program 3: 22:13:34 executing program 4: 22:13:34 executing program 3: 22:13:34 executing program 1: 22:13:34 executing program 4: 22:13:34 executing program 0: 22:13:34 executing program 3: 22:13:34 executing program 4: 22:13:34 executing program 2: 22:13:35 executing program 5: 22:13:35 executing program 1: 22:13:35 executing program 0: 22:13:35 executing program 4: 22:13:35 executing program 2: 22:13:35 executing program 3: 22:13:35 executing program 0: 22:13:35 executing program 2: 22:13:35 executing program 4: 22:13:35 executing program 3: 22:13:35 executing program 1: 22:13:35 executing program 5: 22:13:35 executing program 2: 22:13:35 executing program 3: 22:13:35 executing program 0: 22:13:35 executing program 5: 22:13:35 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000300)='fou\x00') sendmsg$FOU_CMD_ADD(r0, &(0x7f0000000200)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000180)={0x1c, r1, 0x7, 0x0, 0x0, {}, [@FOU_ATTR_TYPE={0x8, 0x4, 0x2}]}, 0x1c}}, 0x0) 22:13:35 executing program 4: 22:13:35 executing program 5: 22:13:35 executing program 4: 22:13:35 executing program 1: 22:13:35 executing program 0: 22:13:35 executing program 3: 22:13:35 executing program 2: 22:13:35 executing program 4: 22:13:35 executing program 0: 22:13:35 executing program 3: 22:13:35 executing program 5: 22:13:35 executing program 2: 22:13:35 executing program 1: 22:13:35 executing program 0: 22:13:35 executing program 4: 22:13:35 executing program 5: 22:13:35 executing program 3: 22:13:35 executing program 2: r0 = syz_open_dev$sndctrl(&(0x7f000000a000)='/dev/snd/controlC#\x00', 0x0, 0x0) perf_event_open(&(0x7f0000001000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000005000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$SNDRV_CTL_IOCTL_PVERSION(r0, 0xc1105511, &(0x7f0000001000)) 22:13:35 executing program 1: perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a94000/0x2000)=nil, 0x2000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) ioctl$int_in(0xffffffffffffffff, 0x0, &(0x7f00005ebff8)) mprotect(&(0x7f0000420000/0x2000)=nil, 0x2000, 0x0) 22:13:35 executing program 0: write$FUSE_OPEN(0xffffffffffffffff, &(0x7f0000000240)={0x20}, 0x20) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000440)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000080)={&(0x7f0000000040)={0x10, 0xffffff7f00000000}, 0xc, &(0x7f0000000000)={&(0x7f0000002f00)={0x14, 0x1c, 0xfffffffffffffffd, 0x0, 0x0, {0x1}}, 0x14}}, 0x0) 22:13:35 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000300)={0xc, 0x0, &(0x7f0000000240)=[@exit_looper, @acquire], 0x9, 0x0, &(0x7f0000000280)="6a23980f12e093de53"}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) dup(r0) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000100)}}}], 0x97, 0x0, &(0x7f0000fedffe)}) 22:13:35 executing program 4: 22:13:35 executing program 5: [ 191.436737] binder: 8047:8048 transaction failed 29189/-22, size 0-0 line 2855 22:13:35 executing program 2: ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000029fcc)={{0x0, 0x2, 0x0, 0xffefffffffffffff}}) setsockopt$netlink_NETLINK_RX_RING(0xffffffffffffffff, 0x29, 0x6, &(0x7f0000001000)={0x14, 0x0, 0x0, 0x24}, 0x14) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) ioctl(0xffffffffffffffff, 0x8916, &(0x7f0000000400)="52dc96ad54f22ba555cfa8a104688d640aa5ac18b62ce5a7c4e08d8e02ab3531de2a954c75f1375f2a52c8981701a2340f8f084e03b0da07c289ff1e82") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000540)='/dev/cuse\x00', 0x2500, 0x0) ioctl$GIO_FONTX(r1, 0x4b6b, &(0x7f00000009c0)=""/242) setsockopt$inet_msfilter(r1, 0x0, 0x29, &(0x7f0000000d40)=ANY=[@ANYBLOB="1414bb01000000030000000002f2ddffffffffac6b8b55daa4a12a93b5564c00000021ec861540621572c956623a63a2ae1396423b8fe080a61f090d08e4f012bd06993244535e29d5dfb9688cc98574127f1750c4efaa6d8c7e64a80800000000000000da48dcef0cfca5e77e807a1c217479a21eff14addc3d3034f1a0cea8ca207b1140d26c0500050000205700d476a30700377c2137e3ddd7fac673d75f23a1cbb38e3c7869af167f9718713e09d6ef327f9b49f554d216d74c3b7d63438827450688ea5ef86da36f91fcc413848ea24a6f26c98789ace0e765a3d249a5c4c99e6dbe6e42cf8006712072f3d5f7c7b59da9b38438e2f2c0ea3b60a49c622b2d16534d729db29e1bcc2aa0d30e0974a2e65d6344ee0a4d82866b9b975a04193150fd8ee768194b6fa42d51a2cf639d9a1cea831156f6cdd4bb1360b5b32ddd0ff4da413126c800a028c90c0890dc97f0111b3dafd3bb10fcf9b5a1081a601a946273d343c2eaf76f450112a5694818a0f5ed67435499fbe7668f2f7784339df74133e9307c5cc03dcca7123a8715bbdb33c89c18b6812f6d3eb9eed4b195fd3dee4587e9a1f18deb296c0a5294f8ffaa8a72f72a21530d6ac7c556b279e82f3d78b8997f9989d20aa7c9fc1b3598ecabfc293759479015334d09da137161d6ee9682a38918cbf3dde794d0b4efc41cb35360f9d3d22a2dfd7e11a2a31b0c25a806037b00ab64f1ce239750b394d99459875094ed74714a270b6c8f92e048ad60a5e726bcf53b95e847dfac3d5ff7f6632597ddffac9d256173865f1e8932cdfcf9f08c2c2f97d1a5a17328bda902e4585a8b7459ecbc4b1d648b9f9e4c"], 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x10000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r2, 0x11b, 0x2, &(0x7f0000000040)=0x800, 0xfffffffffffffdec) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f0000000080)={&(0x7f0000000340)=""/17, 0x10000}, 0x18) ioctl$IOC_PR_RESERVE(r0, 0x401070c9, &(0x7f00000000c0)={0x3, 0x3}) write$P9_RREMOVE(r2, &(0x7f00000001c0)={0x7, 0x7b, 0x2}, 0x7) r3 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x8001, 0x10000000240000) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000300), 0x106, 0x6}}, 0x20) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)="87f8bc14e1a825d5654da9b6652e2f636772", 0x1ff) fstat(r2, &(0x7f0000000140)) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)="2e2f6367726f75702e6370752f73797a3110", 0x1ff) r4 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000280)='/dev/loop-control\x00', 0x189000, 0x0) ioctl$LOOP_CTL_REMOVE(r4, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(0xffffffffffffffff, 0x4c80, 0x0) ioctl$TIOCCONS(r3, 0x541d) getresuid(&(0x7f0000000880), &(0x7f0000000600), &(0x7f0000000580)) r5 = ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82) ioctl$LOOP_CTL_ADD(r4, 0x4c80, r5) 22:13:35 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000440)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000080)={&(0x7f0000000040)={0x10, 0xffffff7f00000000}, 0xc, &(0x7f0000000000)={&(0x7f0000002f00)={0x14, 0x1c, 0xfffffffffffffffd, 0x0, 0x0, {0x1}}, 0x14}}, 0x0) 22:13:35 executing program 5: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xee6b}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r1, 0x0, 0x27, &(0x7f0000000000)={@multicast2, @loopback}, 0xc) dup3(r0, r1, 0x0) 22:13:35 executing program 1: r0 = socket(0x1e, 0x805, 0x0) r1 = socket$inet6(0xa, 0x3, 0x800000000000004) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d5c6070") socket$vsock_stream(0x28, 0x1, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000140)={0x2a}, &(0x7f0000000200)={0x0, r2+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8}) ioctl$FS_IOC_FIEMAP(0xffffffffffffffff, 0xc020660b, &(0x7f0000000340)) close(r0) 22:13:36 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000300)={0xc, 0x0, &(0x7f0000000240)=[@exit_looper, @acquire], 0x9, 0x0, &(0x7f0000000280)="6a23980f12e093de53"}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) dup(r0) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000100)}}}], 0x97, 0x0, &(0x7f0000fedffe)}) 22:13:36 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000440)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(r0, 0xc0045540, &(0x7f0000000000)=0x7) [ 191.714625] binder: 8075:8076 transaction failed 29189/-22, size 0-0 line 2855 22:13:36 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000300)={0xc, 0x0, &(0x7f0000000240)=[@exit_looper, @acquire], 0x9, 0x0, &(0x7f0000000280)="6a23980f12e093de53"}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) dup(r0) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000100)}}}], 0x97, 0x0, &(0x7f0000fedffe)}) 22:13:36 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_SET_VERSION(r0, 0xc0106407, &(0x7f0000000040)) [ 191.868722] binder: 8079:8081 transaction failed 29189/-22, size 0-0 line 2855 22:13:36 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x80000000000045, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000140)="2f65786500000000000409004bddd9de91be10eebf000ee9a90f79805854fa07424adee901d2da75af1f0200f5ab26d7a071fb35331ce39c5a") ioctl$TIOCCONS(r0, 0x541d) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x102, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x1000000000, 0x0, 0x0, 0xfff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x1ffffffffffffe, 0x0, 0x0, 0x2, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getpgid(0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000000)={&(0x7f0000ffd000/0x3000)=nil, 0x3000}, &(0x7f00000000c0)=0x10) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000680)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000640)={0xffffffffffffffff}, 0x111, 0x1}}, 0x20) write$RDMA_USER_CM_CMD_BIND_IP(r0, &(0x7f00000006c0)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e24, 0x10000, @empty, 0x7}, r3}}, 0x30) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_MRT6_ADD_MIF(r4, 0x29, 0xca, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x5}, 0xc) setsockopt$inet6_int(r4, 0x29, 0xcb, &(0x7f0000000140), 0x4) getrandom(&(0x7f00000001c0)=""/129, 0x81, 0x2) ioctl$RTC_PLL_GET(r0, 0x80207011, &(0x7f0000000100)) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, 0x9) fcntl$setlease(r0, 0x400, 0x2) ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0) tee(r1, r0, 0x5, 0xd) sendfile(r0, r1, &(0x7f0000000180), 0x8402) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r2, &(0x7f0000000080)={0x2000}) fcntl$setsig(r2, 0xa, 0x0) lstat(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)) sendmsg$netlink(r0, &(0x7f0000000580)={&(0x7f0000000280)=@kern={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000540)=[{&(0x7f00000003c0)=ANY=[@ANYBLOB="10000006000080000000000800000025"], 0x1}], 0x1, 0x0, 0x0, 0x800}, 0x1) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000400)={0x0, 0x80000, r0}) getresuid(&(0x7f0000000480), &(0x7f00000005c0), &(0x7f0000000600)) ioctl$DRM_IOCTL_GEM_FLINK(r0, 0xc008640a, &(0x7f0000000440)) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f00000004c0)=@sack_info={0x0, 0x95}, &(0x7f0000000500)=0xc) openat$full(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/full\x00', 0x8000, 0x0) 22:13:36 executing program 2: r0 = getpid() sched_setattr(r0, &(0x7f00000002c0)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) clone(0x84007ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) mknod(&(0x7f0000000340)='./file0\x00', 0x10001040, 0x0) execve(&(0x7f0000000240)='./file0\x00', &(0x7f0000000300), &(0x7f0000000340)) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f0000000640)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e3d63a98fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b5365c5dc26ca097ddda7c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df10010174a3ac8694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b2262d66ae793b6304a30b97077f1c131045cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f58e068af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb56d9b962d2fc43fa01a047526865c888c9ff36056cc4ac258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d8191643"}) ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f0000000040)=0x2) ioctl$KVM_RUN(r3, 0xae80, 0x0) 22:13:36 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCBRADDBR(r0, 0x89a0, &(0x7f0000000000)='team0\x00') clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) sendmsg$nl_route(r0, &(0x7f0000000080)={&(0x7f0000000180)={0x10, 0x1000000000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="0000000000000000140003007465616d3000000000000000000000005c2feb0560ad4fe60d1760b7d5c0743b5c8d4fca43ff52f0348623"], 0x1}}, 0x0) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") 22:13:36 executing program 1: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_int(r1, 0x1, 0x7, &(0x7f0000ac5000), 0x4) sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0x0) connect$unix(r1, &(0x7f00002ffff6)=@file={0x0, './file0\x00'}, 0xa) recvmmsg(0xffffffffffffffff, &(0x7f0000003d00), 0x0, 0x0, &(0x7f0000003e00)) close(r0) 22:13:36 executing program 3: ioctl$sock_SIOCBRADDBR(0xffffffffffffffff, 0x89a0, &(0x7f0000000080)='teql0\x00') clone(0x802102001ffb, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r0 = socket(0x10, 0x80002, 0x0) bind$netlink(r0, &(0x7f0000177ff4)={0x10, 0x0, 0x1}, 0xc) write(r0, &(0x7f00000002c0)="2600000022004701050000000000000005006d20002b1f00c05d080a4a71f10101c7033400b0", 0x26) connect$netlink(r0, &(0x7f0000e8f000)=@proc={0x10, 0x0, 0x1}, 0xc) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000025c0), 0x4) sendto(r0, &(0x7f0000000080), 0x16, 0x0, 0x0, 0xfd92) setsockopt$netlink_NETLINK_NO_ENOBUFS(r0, 0x10e, 0x5, &(0x7f0000000000)=0x7df, 0x4) 22:13:36 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000440)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000080)={&(0x7f0000000040)={0x10, 0xffffff7f00000000}, 0xc, &(0x7f0000000000)={&(0x7f0000002f00)={0x14, 0x1c, 0xfffffffffffffffd, 0x0, 0x0, {0x1}}, 0x14}}, 0x0) 22:13:36 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000004c0)="7374617475730042236739c16d17f90dc22322c94f133520785e91ea85ae107cc3819819c263540b1de1ba201e6de4b75a50115091eed530aa482e36594601ceb5d169c5baf41b35d8a5a09a82496613d86023865b57ef269f90d304969f687df53b611b40a44291b5a882208fbb835e54a41310a3b481d5bdbb0981742909a63b7cd1a18d405e5b011bfbe5a4d5bf299447e4c0dd4b63a367211c0078238b509d614100d33a5584aa3b3cb9b99e6e5f84719294d41b27117c47fb4f2b2be475eb25d5f69b6d10cf8422cade570c087b03f6b1818bc97077db23") socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setgroups(0x2a7, &(0x7f0000000140)) sendfile(r0, r1, &(0x7f0000000080), 0x71c) 22:13:36 executing program 5: setsockopt$RDS_GET_MR_FOR_DEST(0xffffffffffffffff, 0x114, 0x7, &(0x7f0000000280)={@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e24, @multicast2}, 0x0, 0x1, 0x1, 0x2}}, {&(0x7f00000001c0)=""/143, 0x8f}, &(0x7f00000000c0), 0x38}, 0xa0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000005340)={@remote}, &(0x7f0000005380)=0x14) r0 = creat(&(0x7f0000001140)='./file0\x00', 0x3) write$binfmt_script(r0, &(0x7f00000005c0)=ANY=[@ANYBLOB="0100202e2f07006c653020237a7d3975e93a69284781c694eb902e7c671d2cf67d21f5dd6393b48ddd93a343cd0d55906785815bc329caee315d1ea03bdb5071a8966df5920a2e1dee4eb3be4af9a410f6301abd910c7610e711b133c5db8eeb9a3d7be57f2b1862f08e969dd2a78567604669b742cd9d047402331d092e28c9da9cedc90ce38ef098bdc36f582b3d658bdf3c3cd467a5a48234127b8630b7290cac6e1cd53b726c600551cd3fa8c0de8c78e40b056c95a8d80164a5c5de7c3805a71f5cda9935bcab32ce3b4fc956a1c5bcd79ed02f09bba11766578cfdbdc8a7d954ef716735d8afdff002defc7768ce51e0eb9df947a5cd7a8c0768bc5e2d2a10e18a"], 0x104) close(r0) execve(&(0x7f0000000180)='./file0\x00', &(0x7f0000000140), &(0x7f0000000140)) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) utimes(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)={{0x77359400}, {r1, r2/1000+10000}}) 22:13:36 executing program 1: r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_SET_MASTER(r0, 0x641e) 22:13:36 executing program 3: r0 = syz_open_dev$admmidi(&(0x7f0000000100)='/dev/admmidi#\x00', 0x0, 0x0) setsockopt$RDS_GET_MR_FOR_DEST(r0, 0x114, 0x7, &(0x7f0000000280)={@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e24, @multicast2}, 0x0, 0x1, 0x1, 0x2}}, {&(0x7f00000001c0)=""/143, 0x8f}, &(0x7f00000000c0), 0x38}, 0xa0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = creat(&(0x7f0000001140)='./file0\x00', 0x3) write$binfmt_script(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="0100202e2f07006c653020237a7d3975e93a69284781c694eb902e7c671d2cf67d21f5dd6393b48ddd93a343cd0d55906785815bc329caee315d1ea03bdb5071a8966df5920a2e1dee4eb3be4af9a410f6301abd910c7610e711b133c5db8eeb9a3d7be57f2b1862f08e969dd2a78567604669b742cd9d047402331d092e28c9da9cedc90ce38ef098bdc36f582b3d658bdf3c3cd467a5a48234127b8630b7290cac6e1cd53b726c600551cd3fa8c0de8c78e40b056c95a8d80164a5c5de7c3805a71f5cda9935bcab32ce3b4fc956a1c5bcd79ed02f09bba11766578cfdbdc8a7d954ef716735d8afdff002defc7768ce51e0eb9df947a5cd7a8c0768bc5e2d2a10e18a"], 0x104) close(r1) execve(&(0x7f0000000180)='./file0\x00', &(0x7f0000000140), &(0x7f0000000140)) clock_gettime(0x0, &(0x7f0000000040)) 22:13:36 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x80000000000045, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000140)="2f65786500000000000409004bddd9de91be10eebf000ee9a90f79805854fa07424adee901d2da75af1f0200f5ab26d7a071fb35331ce39c5a") ioctl$TIOCCONS(r0, 0x541d) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x102, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x1000000000, 0x0, 0x0, 0xfff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x1ffffffffffffe, 0x0, 0x0, 0x2, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getpgid(0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000000)={&(0x7f0000ffd000/0x3000)=nil, 0x3000}, &(0x7f00000000c0)=0x10) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000680)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000640)={0xffffffffffffffff}, 0x111, 0x1}}, 0x20) write$RDMA_USER_CM_CMD_BIND_IP(r0, &(0x7f00000006c0)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e24, 0x10000, @empty, 0x7}, r3}}, 0x30) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_MRT6_ADD_MIF(r4, 0x29, 0xca, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x5}, 0xc) setsockopt$inet6_int(r4, 0x29, 0xcb, &(0x7f0000000140), 0x4) getrandom(&(0x7f00000001c0)=""/129, 0x81, 0x2) ioctl$RTC_PLL_GET(r0, 0x80207011, &(0x7f0000000100)) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, 0x9) fcntl$setlease(r0, 0x400, 0x2) ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0) tee(r1, r0, 0x5, 0xd) sendfile(r0, r1, &(0x7f0000000180), 0x8402) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r2, &(0x7f0000000080)={0x2000}) fcntl$setsig(r2, 0xa, 0x0) lstat(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)) sendmsg$netlink(r0, &(0x7f0000000580)={&(0x7f0000000280)=@kern={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000540)=[{&(0x7f00000003c0)=ANY=[@ANYBLOB="10000006000080000000000800000025"], 0x1}], 0x1, 0x0, 0x0, 0x800}, 0x1) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000400)={0x0, 0x80000, r0}) getresuid(&(0x7f0000000480), &(0x7f00000005c0), &(0x7f0000000600)) ioctl$DRM_IOCTL_GEM_FLINK(r0, 0xc008640a, &(0x7f0000000440)) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f00000004c0)=@sack_info={0x0, 0x95}, &(0x7f0000000500)=0xc) openat$full(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/full\x00', 0x8000, 0x0) 22:13:36 executing program 1: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x80000000000045, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000140)="2f65786500000000000409004bddd9de91be10eebf000ee9a90f79805854fa07424adee901d2da75af1f0200f5ab26d7a071fb35331ce39c5a") ioctl$TIOCCONS(r0, 0x541d) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x102, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x1000000000, 0x0, 0x0, 0xfff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x1ffffffffffffe, 0x0, 0x0, 0x2, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getpgid(0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000000)={&(0x7f0000ffd000/0x3000)=nil, 0x3000}, &(0x7f00000000c0)=0x10) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000680)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000640)={0xffffffffffffffff}, 0x111, 0x1}}, 0x20) write$RDMA_USER_CM_CMD_BIND_IP(r0, &(0x7f00000006c0)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e24, 0x10000, @empty, 0x7}, r3}}, 0x30) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_MRT6_ADD_MIF(r4, 0x29, 0xca, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x5}, 0xc) setsockopt$inet6_int(r4, 0x29, 0xcb, &(0x7f0000000140), 0x4) getrandom(&(0x7f00000001c0)=""/129, 0x81, 0x2) ioctl$RTC_PLL_GET(r0, 0x80207011, &(0x7f0000000100)) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, 0x9) fcntl$setlease(r0, 0x400, 0x2) ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0) tee(r1, r0, 0x5, 0xd) sendfile(r0, r1, &(0x7f0000000180), 0x8402) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r2, &(0x7f0000000080)={0x2000}) fcntl$setsig(r2, 0xa, 0x0) lstat(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)) sendmsg$netlink(r0, &(0x7f0000000580)={&(0x7f0000000280)=@kern={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000540)=[{&(0x7f00000003c0)=ANY=[@ANYBLOB="10000006000080000000000800000025"], 0x1}], 0x1, 0x0, 0x0, 0x800}, 0x1) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000400)={0x0, 0x80000, r0}) getresuid(&(0x7f0000000480), &(0x7f00000005c0), &(0x7f0000000600)) ioctl$DRM_IOCTL_GEM_FLINK(r0, 0xc008640a, &(0x7f0000000440)) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f00000004c0)=@sack_info={0x0, 0x95}, &(0x7f0000000500)=0xc) openat$full(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/full\x00', 0x8000, 0x0) 22:13:37 executing program 5: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x80000000000045, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000140)="2f65786500000000000409004bddd9de91be10eebf000ee9a90f79805854fa07424adee901d2da75af1f0200f5ab26d7a071fb35331ce39c5a") ioctl$TIOCCONS(r0, 0x541d) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x102, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x1000000000, 0x0, 0x0, 0xfff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x1ffffffffffffe, 0x0, 0x0, 0x2, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getpgid(0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000000)={&(0x7f0000ffd000/0x3000)=nil, 0x3000}, &(0x7f00000000c0)=0x10) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000680)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000640)={0xffffffffffffffff}, 0x111, 0x1}}, 0x20) write$RDMA_USER_CM_CMD_BIND_IP(r0, &(0x7f00000006c0)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e24, 0x10000, @empty, 0x7}, r3}}, 0x30) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_MRT6_ADD_MIF(r4, 0x29, 0xca, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x5}, 0xc) setsockopt$inet6_int(r4, 0x29, 0xcb, &(0x7f0000000140), 0x4) getrandom(&(0x7f00000001c0)=""/129, 0x81, 0x2) ioctl$RTC_PLL_GET(r0, 0x80207011, &(0x7f0000000100)) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, 0x9) fcntl$setlease(r0, 0x400, 0x2) ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, 0x0) tee(r1, r0, 0x5, 0xd) sendfile(r0, r1, &(0x7f0000000180), 0x8402) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r2, &(0x7f0000000080)={0x2000}) fcntl$setsig(r2, 0xa, 0x0) lstat(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)) sendmsg$netlink(r0, &(0x7f0000000580)={&(0x7f0000000280)=@kern={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000540)=[{&(0x7f00000003c0)=ANY=[@ANYBLOB="10000006000080000000000800000025"], 0x1}], 0x1, 0x0, 0x0, 0x800}, 0x1) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r0, 0xc00c642d, &(0x7f0000000400)={0x0, 0x80000, r0}) getresuid(&(0x7f0000000480), &(0x7f00000005c0), &(0x7f0000000600)) ioctl$DRM_IOCTL_GEM_FLINK(r0, 0xc008640a, &(0x7f0000000440)) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f00000004c0)=@sack_info={0x0, 0x95}, &(0x7f0000000500)=0xc) openat$full(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/full\x00', 0x8000, 0x0) 22:13:37 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000), 0x4) 22:13:37 executing program 4: r0 = socket(0x1e, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x0, @mcast2}, 0x1c) 22:13:37 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCGWINSZ(r0, 0x5413, &(0x7f0000000180)) 22:13:37 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000001440)={'team0\x00', 0x0}) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000001480)={r3, 0x1, 0x5, @local}, 0x10) 22:13:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000100)}}}], 0x97, 0x0, &(0x7f0000fedffe)}) 22:13:37 executing program 4: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket(0x10, 0x100000003, 0x0) recvmmsg(r0, &(0x7f0000001cc0), 0x4000000000002c0, 0x0, &(0x7f0000001540)) sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000), 0xc, &(0x7f0000000080)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001a000102000000000000000800000000f292610488580d58b0c130a80f8097c704d86b13dfffa2d61499206cb00aeff3fde40b05007adb57d7d6047efa738583b2b9a048aecccb0fa5aade3ddf67fce9117532d25ae4e6d14e573138ae1674731282220f754593cabcf33b0f97f8c315dd4ea359da5a67985728fadfae29c469f2df8125e2e4b38edf7bb9a792ff5d9ba7ee829f8fc0fd324c2564c9da85391c824d97e42f41aa5b773e686bd395797cdb55bbd5aad4bbb16f594bfff5a20106d4bc3ee1ee810cd91a5aa9f992eb6cf3e2cf51ed0a2baf8ea922e55a326cb0a3d55697e5cd2232bf451087382dd65a74fe380fd8f1"], 0x1}}, 0x0) [ 192.979994] device team0 entered promiscuous mode [ 192.998653] binder: 8157:8159 transaction failed 29189/-22, size 0-0 line 2855 [ 193.017391] device team_slave_0 entered promiscuous mode 22:13:37 executing program 0: r0 = socket(0x4000000000000a, 0x1, 0x0) getsockopt$inet_tcp_buf(r0, 0x6, 0x21, &(0x7f0000000600)=""/227, &(0x7f00000002c0)=0xe3) [ 193.035250] device team_slave_1 entered promiscuous mode [ 193.065518] device team0 left promiscuous mode [ 193.070217] device team_slave_0 left promiscuous mode 22:13:37 executing program 1: sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000002380)=[{&(0x7f0000000140)="d784a62dec7d3873d06c8ec959bf7858d91c", 0x12}], 0x1, &(0x7f0000000000)}, 0x0) mkdir(&(0x7f00000004c0)='./file0\x00', 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x0, 0x2, &(0x7f0000000140)=ANY=[@ANYBLOB="180000000000040000000000020000027f"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0xb1, &(0x7f0000000200)=""/177}, 0x48) mount(&(0x7f00008deff8), &(0x7f0000343ff8)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x0, &(0x7f0000000100)="03") mount(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='rpc_pipefs\x00', 0x0, 0x0) umount2(&(0x7f00000003c0)='./file0\x00', 0x0) [ 193.091866] device team_slave_1 left promiscuous mode 22:13:37 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000000)="2f65786500000000000409004bddd9de91be10ee9ed554fa07424adee9cbc699ec2ca576e50000bcd7a071fb35331ce39c5ad0cf73770bd4246847a1914e4fb0aa9b15eaa94bcd0e700ed63b44338e84ad4ec2f11f6f2adb8dc2fdb18231446f43142ebe700b2231e8fceed6b22a373c9409675ac8d0b53033123fb3037d66241aafe0f880e7a51d1b036ade31d2544d2581fe8653d0cff54369df8c2fce21dcb1cb965669f9a75345ac3479cd51dc7de364c9c272c83ed9e666ca25aad2e7a26e3d6c62d0f8b9065cfca311c06d0744db265aa0e486707c51fd108c0c6ccae6ff42274af94d30fce8836ff9d00bdd") ioctl$EXT4_IOC_SETFLAGS(r0, 0x40086607, &(0x7f00000002c0)) 22:13:37 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="00000000dfd81597b43c000000000000000000000000000000000000"], 0x1}}, 0x0) [ 193.121617] device team0 entered promiscuous mode [ 193.126596] device team_slave_0 entered promiscuous mode [ 193.136695] device team_slave_1 entered promiscuous mode [ 193.143804] device team0 left promiscuous mode [ 193.148481] device team_slave_0 left promiscuous mode [ 193.154655] device team_slave_1 left promiscuous mode 22:13:37 executing program 0: r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/rfkill\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$sndpcmp(&(0x7f0000000400)='/dev/snd/pcmC#D#p\x00', 0xffffffffffff0001, 0x0) dup3(r1, r0, 0x0) 22:13:38 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") unshare(0x400) r1 = openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000000)={0xfffb, 0x1b, 0x0, 0xffffffffffffffff}) ioctl$DMA_BUF_IOCTL_SYNC(r2, 0x40086200, &(0x7f0000000080)=0x5) ioctl$DMA_BUF_IOCTL_SYNC(r2, 0x40086200, &(0x7f0000000140)=0x2) 22:13:38 executing program 3: socketpair$unix(0x1, 0x40000000001, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r1, &(0x7f0000000680)={0x2, 0x0, @remote}, 0x10) r2 = socket(0xa, 0x1, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f00000002c0)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) write$binfmt_elf64(r1, &(0x7f00000006c0)={{0x7f, 0x45, 0x4c, 0x46, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40}, [{}]}, 0x78) 22:13:38 executing program 2: socket(0x1e, 0x805, 0x0) r0 = socket$inet6(0xa, 0x3, 0x800000000000004) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d5c6070") setsockopt$IP6T_SO_SET_ADD_COUNTERS(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000080)={'raw\x00', 0x2, [{}, {}]}, 0x48) socket$vsock_stream(0x28, 0x1, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0, 0x0}) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, &(0x7f0000000040), &(0x7f0000000080)=0x8) pselect6(0x40, &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000140)={0x2a}, &(0x7f0000000200)={0x0, r1+30000000}, &(0x7f0000000300)={&(0x7f00000002c0), 0x8}) vmsplice(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0) 22:13:38 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0xc, 0x0, &(0x7f0000000240)=[@register_looper, @acquire={0x40046305, 0x1}], 0x1, 0x0, &(0x7f0000000280)='j'}) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) dup(r0) 22:13:38 executing program 3: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETA(r0, 0x5406, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x9b4b62b}) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000040)={0x1a}) [ 193.668297] binder: 8192:8194 ERROR: BC_REGISTER_LOOPER called without request [ 193.684664] binder: 8192:8194 Acquire 1 refcount change on invalid ref 1 ret -22 [ 193.694834] binder: 8194 RLIMIT_NICE not set 22:13:38 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") unshare(0x400) r1 = openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000000)={0xfffb, 0x1b, 0x0, 0xffffffffffffffff}) ioctl$DMA_BUF_IOCTL_SYNC(r2, 0x40086200, &(0x7f0000000080)=0x5) ioctl$DMA_BUF_IOCTL_SYNC(r2, 0x40086200, &(0x7f0000000140)=0x2) [ 193.715189] binder: 8192:8201 ERROR: BC_REGISTER_LOOPER called without request [ 193.723140] binder: 8192:8201 Acquire 1 refcount change on invalid ref 1 ret -22 [ 193.730859] binder: 8201 RLIMIT_NICE not set 22:13:38 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) poll(&(0x7f00000001c0), 0x0, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000080)={&(0x7f0000000040)={0x10, 0xffffff7f00000000}, 0xc, &(0x7f0000000000)={&(0x7f0000002f00)={0x14, 0x1c, 0xfffffffffffffffd, 0x0, 0x0, {0x1}}, 0x14}}, 0x0) 22:13:38 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0xc, 0x0, &(0x7f0000000240)=[@register_looper, @acquire={0x40046305, 0x1}], 0x1, 0x0, &(0x7f0000000280)='j'}) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) dup(r0) 22:13:38 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_IRQP_READ(r0, 0x8008700b, &(0x7f0000000240)) 22:13:38 executing program 2: socket$inet6(0xa, 0x7ffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000000500)='em0nodeveth1lo\x00', 0x5) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0xfffffffffffffffe) ioctl$KVM_REINJECT_CONTROL(r0, 0xae71, &(0x7f00000000c0)) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0xb, &(0x7f00004aaffc)=0x2, 0xfeda) ioctl$KVM_SET_DEBUGREGS(r0, 0x4080aea2, &(0x7f0000000200)={[0x4, 0x2000], 0x800, 0x40, 0xb0}) getpid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) ioctl$IOC_PR_RELEASE(0xffffffffffffffff, 0x401070ca, &(0x7f0000000100)={0x1ff}) connect$inet6(r1, &(0x7f0000002740)={0xa, 0x0, 0x0, @dev, 0x4}, 0x79) sendmmsg(r1, &(0x7f0000007e00), 0x136a88c8311572c, 0x11) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000480)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r3, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000280)=[@text32={0x20, &(0x7f00000003c0)="0f20c035100000000f22c0c4c1f87766baf80cb8aedf018fef66bafc0c66ed0f01ef8149000f00000036f30f2000c4c37962530782670fc75b39643e2e0f01cf66baf80cb86c5fbb8aef66bafc0c66b8e07166ef", 0x54}], 0x1, 0x0, &(0x7f0000000040), 0xfffffffffffff29) openat$ashmem(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ashmem\x00', 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x401, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup(0xffffffffffffffff) socket$inet6_udp(0xa, 0x2, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000002c0)={{{@in=@dev, @in=@broadcast}}, {{@in6=@mcast1}, 0x0, @in=@loopback}}, &(0x7f0000000000)=0xe8) ioctl$KVM_RUN(r4, 0xae80, 0x0) write$P9_RSTAT(0xffffffffffffffff, &(0x7f0000000480)=ANY=[@ANYBLOB="610000007d010000005a000000c36d00002000000000000000010000000000000020006333cf738ed92377000000000000000b002f6465722f76736fe36b73fb784c6465768ed133e82f6465762f76736f636b00"], 0x54) sched_setattr(0x0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x3}, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) 22:13:38 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") unshare(0x400) r1 = openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000000)={0xfffb, 0x1b, 0x0, 0xffffffffffffffff}) ioctl$DMA_BUF_IOCTL_SYNC(r2, 0x40086200, &(0x7f0000000080)=0x5) ioctl$DMA_BUF_IOCTL_SYNC(r2, 0x40086200, &(0x7f0000000140)=0x2) 22:13:38 executing program 3: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r0, 0x40189206, &(0x7f0000000180)) [ 193.955630] binder: 8214:8215 ERROR: BC_REGISTER_LOOPER called without request [ 193.981855] binder: 8214:8215 Acquire 1 refcount change on invalid ref 1 ret -22 [ 193.989552] binder: 8215 RLIMIT_NICE not set 22:13:38 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f000000a000)='/dev/snd/controlC#\x00', 0x0, 0x0) perf_event_open(&(0x7f0000001000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000005000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$SNDRV_CTL_IOCTL_PVERSION(r0, 0xc4c85512, &(0x7f0000001000)) 22:13:38 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000004c0)="7374617475730042236739c16d17f90dc22322c94f133520785e91ea85ae107cc3819819c263540b1de1ba201e6de4b75a50115091eed530aa482e36594601ceb5d169c5baf41b35d8a5a09a82496613d86023865b57ef269f90d304969f687df53b611b40a44291b5a882208fbb835e54a41310a3b481d5bdbb0981742909a63b7cd1a18d405e5b011bfbe5a4d5bf299447e4c0dd4b63a367211c0078238b509d614100d33a5584aa3b3cb9b99e6e5f84719294d41b27117c47fb4f2b2be475eb25d5f69b6d10cf8422cade570c087b03f6b1818bc97077db23") socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$binfmt_elf64(0xffffffffffffffff, &(0x7f00000005c0)=ANY=[@ANYBLOB="7f454c46000000000000000000000000000000000000000079030000000000204000000000000000ab000000000000000000000000000000000000000000000000000000000000000000ffff00000000000000000000000000000000000000000000c2a3d27bd88efcf9bf892edbe0e0dff636085557fcc4d5d0b86b7e8800af5700e7f54040f41d0a6a31d20c72ea037ae542d7522ec71bafb01dd16eeb0db9b364f763f71b56713113bfa4cbc45447387f7ef18fe42220a2ee17893fb8c97af149981c000549e18cf57c56e3b61aeb3614441382a1ab0b94190e75ab2e6b1b2a42c6ed899f9ac5f7e8c5f7a25b9d0d1f9b7a211d9e9edad8538648134d5042b5b7e1f041b5b42f5bf1277880d9490d1786af42e2c73e55f72d8ab763fef92120c47146d84e6ef3ec523fdac523afd4c672f880041e03102aa84b7b8937ca85f551c24c3ef863e934f40103cc59e11c6eaace96fbc26fe8936913601c12ec1abdd9086da65d2dbf9685b34af537b4cf4ef1c6baf938702faa0fa7040d2134ea8109c31f6d240a9c63bb9a2b8cd7aff71cd68d428cd7b89618eabf4780"], 0x19d) fsetxattr(0xffffffffffffffff, &(0x7f00000003c0)=@random={'btrfs.', "7374617475730042236739c16d17f90dc22322c94f133520785e91ea85ae107cc3819819c263540b1de1ba201e6de4b75a50115091eed530aa482e36594601ceb5d169c5baf41b35d8a5a09a82496613d86023865b57ef269f90d304969f687df53b611b40a44291b5a882208fbb835e54a41310a3b481d5bdbb0981742909a63b7cd1a18d405e5b011bfbe5a4d5bf299447e4c0dd4b63a367211c0078238b509d614100d33a5584aa3b3cb9b99e6e5f84719294d41b27117c47fb4f2b2be475eb25d5f69b6d10cf8422cade570c087b03f6b1818bc97077db23"}, &(0x7f0000000240)='/dev/vhci\x00', 0xb6, 0x0) setgroups(0x2a7, &(0x7f0000000140)) sendfile(r0, r1, &(0x7f0000000080), 0x71c) 22:13:38 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") unshare(0x400) r1 = openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000000)={0xfffb, 0x1b, 0x0, 0xffffffffffffffff}) ioctl$DMA_BUF_IOCTL_SYNC(r2, 0x40086200, &(0x7f0000000080)=0x5) ioctl$DMA_BUF_IOCTL_SYNC(r2, 0x40086200, &(0x7f0000000140)=0x2) 22:13:38 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000004c0)="7374617475730042236739c16d17f90dc22322c94f133520785e91ea85ae107cc3819819c263540b1de1ba201e6de4b75a50115091eed530aa482e36594601ceb5d169c5baf41b35d8a5a09a82496613d86023865b57ef269f90d304969f687df53b611b40a44291b5a882208fbb835e54a41310a3b481d5bdbb0981742909a63b7cd1a18d405e5b011bfbe5a4d5bf299447e4c0dd4b63a367211c0078238b509d614100d33a5584aa3b3cb9b99e6e5f84719294d41b27117c47fb4f2b2be475eb25d5f69b6d10cf8422cade570c087b03f6b1818bc97077db23") setgroups(0x2a7, &(0x7f0000000140)) sendfile(r0, r1, &(0x7f0000000080), 0x71c) 22:13:38 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f000000a000)='/dev/snd/controlC#\x00', 0x0, 0x0) perf_event_open(&(0x7f0000001000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000005000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$SNDRV_CTL_IOCTL_PVERSION(r0, 0xc0405519, &(0x7f0000001000)) 22:13:38 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x2, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000001000)=ANY=[@ANYBLOB='\x00\x00'], 0x2) ioctl$TCSETA(r0, 0x5406, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x9b4b62b}) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000040)={0x17}) 22:13:38 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") unshare(0x400) r1 = openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000000)={0xfffb, 0x1b, 0x0, 0xffffffffffffffff}) ioctl$DMA_BUF_IOCTL_SYNC(r2, 0x40086200, &(0x7f0000000140)=0x2) 22:13:38 executing program 0: r0 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'syz_tun\x00', 0x0}) socket$inet_icmp_raw(0x2, 0x3, 0x1) bind$packet(r0, &(0x7f0000000140)={0x11, 0x4, r1, 0x1, 0x0, 0x6, @dev}, 0x14) syz_emit_ethernet(0x1e, &(0x7f0000000100)={@link_local, @remote, [], {@can={0xc, {{}, 0x0, 0x0, 0x0, 0x0, "199ac0f1ca9a7443"}}}}, &(0x7f0000000000)) 22:13:38 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x151) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x131f64) clone(0x2102001ff9, 0x0, 0xfffffffffffffffe, &(0x7f0000000140), 0xffffffffffffffff) sendto$unix(r1, &(0x7f0000000040), 0x0, 0x20004000, &(0x7f0000000180)=@abs, 0x6e) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000040)=[{0x4, 0x200}, {0xb, 0x4}, {}], 0x3) 22:13:39 executing program 2: socket$inet6(0xa, 0x7ffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000000500)='em0nodeveth1lo\x00', 0x5) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0xfffffffffffffffe) ioctl$KVM_REINJECT_CONTROL(r0, 0xae71, &(0x7f00000000c0)) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0xb, &(0x7f00004aaffc)=0x2, 0xfeda) ioctl$KVM_SET_DEBUGREGS(r0, 0x4080aea2, &(0x7f0000000200)={[0x4, 0x2000], 0x800, 0x40, 0xb0}) getpid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) ioctl$IOC_PR_RELEASE(0xffffffffffffffff, 0x401070ca, &(0x7f0000000100)={0x1ff}) connect$inet6(r1, &(0x7f0000002740)={0xa, 0x0, 0x0, @dev, 0x4}, 0x79) sendmmsg(r1, &(0x7f0000007e00), 0x136a88c8311572c, 0x11) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000480)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r3, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000280)=[@text32={0x20, &(0x7f00000003c0)="0f20c035100000000f22c0c4c1f87766baf80cb8aedf018fef66bafc0c66ed0f01ef8149000f00000036f30f2000c4c37962530782670fc75b39643e2e0f01cf66baf80cb86c5fbb8aef66bafc0c66b8e07166ef", 0x54}], 0x1, 0x0, &(0x7f0000000040), 0xfffffffffffff29) openat$ashmem(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ashmem\x00', 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x401, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup(0xffffffffffffffff) socket$inet6_udp(0xa, 0x2, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000002c0)={{{@in=@dev, @in=@broadcast}}, {{@in6=@mcast1}, 0x0, @in=@loopback}}, &(0x7f0000000000)=0xe8) ioctl$KVM_RUN(r4, 0xae80, 0x0) write$P9_RSTAT(0xffffffffffffffff, &(0x7f0000000480)=ANY=[@ANYBLOB="610000007d010000005a000000c36d00002000000000000000010000000000000020006333cf738ed92377000000000000000b002f6465722f76736fe36b73fb784c6465768ed133e82f6465762f76736f636b00"], 0x54) sched_setattr(0x0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x3}, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) 22:13:39 executing program 0: r0 = syz_open_dev$admmidi(&(0x7f0000000100)='/dev/admmidi#\x00', 0x0, 0x34182) setsockopt$RDS_GET_MR_FOR_DEST(r0, 0x114, 0x7, &(0x7f0000000280)={@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e24, @multicast2}, 0x0, 0x1, 0x1, 0x2}}, {&(0x7f00000001c0)=""/143, 0x8f}, &(0x7f00000000c0), 0x38}, 0xa0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000005340)={@remote}, &(0x7f0000005380)=0x14) r1 = creat(&(0x7f0000001140)='./file0\x00', 0x3) write$binfmt_script(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="0100202e2f07006c653020237a7d3975e93a69284781c694eb902e7c671d2cf67d21f5dd6393b48ddd93a343cd0d55906785815bc329caee315d1ea03bdb5071a8966df5920a2e1dee4eb3be4af9a410f6301abd910c7610e711b133c5db8eeb9a3d7be57f2b1862f08e969dd2a78567604669b742cd9d047402331d092e28c9da9cedc90ce38ef098bdc36f582b3d658bdf3c3cd467a5a48234127b8630b7290cac6e1cd53b726c600551cd3fa8c0de8c78e40b056c95a8d80164a5c5de7c3805a71f"], 0xc3) close(r1) execve(&(0x7f0000000180)='./file0\x00', &(0x7f0000000140), &(0x7f0000000140)) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) utimes(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)={{0x77359400}, {r2, r3/1000+10000}}) 22:13:39 executing program 3: mkdir(&(0x7f00000018c0)='./file0\x00', 0x0) mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000240)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f0000000380)) mount(&(0x7f0000000240), &(0x7f0000000140)='.', &(0x7f0000000340)='ext4\x00', 0x3002480, &(0x7f0000000700)) 22:13:39 executing program 4: r0 = getpid() sched_setattr(r0, &(0x7f00000002c0)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) clone(0x84007ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) mknod(&(0x7f0000000340)='./file0\x00', 0x10001040, 0x0) execve(&(0x7f0000000240)='./file0\x00', &(0x7f0000000300), &(0x7f0000000340)) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f0000000040)=0x2) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_SET_IRQCHIP(r2, 0x8208ae63, &(0x7f0000000280)={0x0, 0x0, @ioapic}) 22:13:39 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") unshare(0x400) r1 = openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000000)={0xfffb, 0x1b, 0x0, 0xffffffffffffffff}) ioctl$DMA_BUF_IOCTL_SYNC(r2, 0x40086200, &(0x7f0000000140)=0x2) 22:13:39 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") unshare(0x400) r1 = openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000000)={0xfffb, 0x1b, 0x0, 0xffffffffffffffff}) ioctl$DMA_BUF_IOCTL_SYNC(r2, 0x40086200, &(0x7f0000000140)=0x2) 22:13:39 executing program 3: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x800, 0x0) pipe2(&(0x7f00000000c0), 0x80800) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x0, 0x200000, 0x0, @perf_bp={&(0x7f0000abe000)}, 0x0, 0xffffffffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000ffe000/0x2000)=nil}) ioctl$KVM_SET_SREGS(r3, 0x4138ae84, &(0x7f00000003c0)={{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, 0x8005001f, 0x0, 0x0, 0x28}) ioctl$KVM_RUN(r3, 0xae80, 0x0) getpgid(0xffffffffffffffff) write$P9_RGETLOCK(r0, &(0x7f0000000100)=ANY=[@ANYBLOB='\t\x00/d'], 0x4) 22:13:39 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") unshare(0x400) openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000080)=0x5) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000140)=0x2) 22:13:39 executing program 0: r0 = syz_open_dev$admmidi(&(0x7f0000000100)='/dev/admmidi#\x00', 0x0, 0x34182) setsockopt$RDS_GET_MR_FOR_DEST(r0, 0x114, 0x7, &(0x7f0000000280)={@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e24, @multicast2}, 0x0, 0x1, 0x1, 0x2}}, {&(0x7f00000001c0)=""/143, 0x8f}, &(0x7f00000000c0), 0x38}, 0xa0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000005340)={@remote}, &(0x7f0000005380)=0x14) r1 = creat(&(0x7f0000001140)='./file0\x00', 0x3) write$binfmt_script(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="0100202e2f07006c653020237a7d3975e93a69284781c694eb902e7c671d2cf67d21f5dd6393b48ddd93a343cd0d55906785815bc329caee315d1ea03bdb5071a8966df5920a2e1dee4eb3be4af9a410f6301abd910c7610e711b133c5db8eeb9a3d7be57f2b1862f08e969dd2a78567604669b742cd9d047402331d092e28c9da9cedc90ce38ef098bdc36f582b3d658bdf3c3cd467a5a48234127b8630b7290cac6e1cd53b726c600551cd3fa8c0de8c78e40b056c95a8d80164a5c5de7c3805a71f"], 0xc3) close(r1) execve(&(0x7f0000000180)='./file0\x00', &(0x7f0000000140), &(0x7f0000000140)) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) utimes(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)={{0x77359400}, {r2, r3/1000+10000}}) [ 194.968565] *** Guest State *** [ 195.011830] CR0: actual=0x000000008005003f, shadow=0x000000008005001f, gh_mask=fffffffffffffff7 [ 195.020736] CR4: actual=0x0000000000002068, shadow=0x0000000000000028, gh_mask=ffffffffffffe871 22:13:39 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") unshare(0x400) openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000080)=0x5) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000140)=0x2) [ 195.070064] CR3 = 0x0000000000000000 [ 195.080217] PDPTR0 = 0x0000000000000000 PDPTR1 = 0x0000000000000000 [ 195.099574] PDPTR2 = 0x0000000000000000 PDPTR3 = 0x0000000000000000 22:13:39 executing program 0: r0 = socket$inet6(0xa, 0x80003, 0x800000000000006) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000180)=0x580, 0x4) sendto$inet6(r1, &(0x7f0000000140), 0x0, 0x0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @ipv4={[], [], @local}}, 0x1c) setsockopt$inet6_int(r1, 0x29, 0x31, &(0x7f0000000240)=0x8, 0x4) recvmsg(r1, &(0x7f0000000400)={&(0x7f0000000280)=@nl=@proc, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000000080)=""/36, 0xffffffffffffff1b}, 0x2000) [ 195.125062] RSP = 0x0000000000000000 RIP = 0x000000000000fff0 [ 195.141842] RFLAGS=0x00000002 DR7 = 0x0000000000000400 [ 195.188131] Sysenter RSP=0000000000000000 CS:RIP=0000:0000000000000000 [ 195.226247] CS: sel=0x0000, attr=0x10000, limit=0x00000000, base=0x0000000000000000 [ 195.252434] DS: sel=0x0000, attr=0x10000, limit=0x00000000, base=0x0000000000000000 [ 195.276256] SS: sel=0x0000, attr=0x10000, limit=0x00000000, base=0x0000000000000000 [ 195.293698] ES: sel=0x0000, attr=0x10000, limit=0x00000000, base=0x0000000000000000 [ 195.318538] FS: sel=0x0000, attr=0x10000, limit=0x00000000, base=0x0000000000000000 [ 195.331340] GS: sel=0x0000, attr=0x10000, limit=0x00000000, base=0x0000000000000000 [ 195.346403] GDTR: limit=0x00000000, base=0x0000000000000000 [ 195.360895] LDTR: sel=0x0000, attr=0x10000, limit=0x00000000, base=0x0000000000000000 [ 195.372291] IDTR: limit=0x00000000, base=0x0000000000000000 [ 195.380510] TR: sel=0x0000, attr=0x10000, limit=0x00000000, base=0x0000000000000000 [ 195.388950] EFER = 0x0000000000000000 PAT = 0x0007040600070406 [ 195.396806] DebugCtl = 0x0000000000000000 DebugExceptions = 0x0000000000000000 [ 195.404747] Interruptibility = 00000000 ActivityState = 00000000 [ 195.411314] *** Host State *** [ 195.414613] RIP = 0xffffffff81212b2e RSP = 0xffff88018e8d73d0 [ 195.420686] CS=0010 SS=0018 DS=0000 ES=0000 FS=0000 GS=0000 TR=0040 [ 195.427500] FSBase=0000000000000000 GSBase=ffff8801dae00000 TRBase=fffffe0000034000 [ 195.435582] GDTBase=fffffe0000032000 IDTBase=fffffe0000000000 [ 195.441715] CR0=0000000080050033 CR3=00000001b8fd9000 CR4=00000000001426f0 [ 195.448832] Sysenter RSP=fffffe0000033200 CS:RIP=0010:ffffffff87c013a0 [ 195.455766] EFER = 0x0000000000000d01 PAT = 0x0407050600070106 [ 195.462063] *** Control State *** [ 195.465622] PinBased=0000003f CPUBased=b5986dfa SecondaryExec=000000c2 22:13:39 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000280)='\x00\x00\x00\x00\x00') r1 = openat$cgroup_ro(r0, &(0x7f0000000000)="6d656d00017937737761532e63757289c942abe3fa72656e7400", 0x0, 0x0) preadv(r1, &(0x7f0000000180)=[{&(0x7f00000000c0)=""/81, 0x20000111}], 0x1, 0x0) 22:13:39 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") unshare(0x400) openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000080)=0x5) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000140)=0x2) 22:13:39 executing program 0: 22:13:39 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000300)={0xc, 0x0, &(0x7f0000000240)=[@exit_looper, @acquire], 0x13, 0x0, &(0x7f0000000280)="6a23980f12e093de53fb1c2a53d6d534c2fdd5"}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) dup(0xffffffffffffffff) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000100)}}}], 0x97, 0x0, &(0x7f0000fedffe)}) [ 195.472565] EntryControls=0000d1ff ExitControls=002fefff [ 195.478129] ExceptionBitmap=00060042 PFECmask=00000000 PFECmatch=00000000 [ 195.485311] VMEntry: intr_info=00000000 errcode=00000000 ilen=00000000 [ 195.492319] VMExit: intr_info=00000000 errcode=00000000 ilen=00000003 [ 195.498997] reason=80000021 qualification=0000000000000000 [ 195.505698] IDTVectoring: info=00000000 errcode=00000000 [ 195.511378] TSC Offset = 0xffffff95338e780e [ 195.515804] EPT pointer = 0x00000001cd96a01e [ 195.573819] *** Guest State *** [ 195.577192] CR0: actual=0x000000008005003f, shadow=0x000000008005001f, gh_mask=fffffffffffffff7 [ 195.592414] binder: 8324:8326 transaction failed 29189/-22, size 0-0 line 2855 22:13:40 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) add_key(&(0x7f0000000080)="646e735f7265736f6c7665727f", &(0x7f00000000c0)={"0200"}, &(0x7f0000000100), 0xfffff, 0xfffffffffffffffb) 22:13:40 executing program 0: r0 = syz_open_dev$admmidi(&(0x7f0000000100)='/dev/admmidi#\x00', 0x0, 0x34182) setsockopt$RDS_GET_MR_FOR_DEST(r0, 0x114, 0x7, &(0x7f0000000280)={@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e24, @multicast2}, 0x0, 0x1, 0x1}}, {&(0x7f00000001c0)=""/143, 0x8f}, &(0x7f00000000c0), 0x38}, 0xa0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = creat(&(0x7f0000001140)='./file0\x00', 0x3) write$binfmt_script(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="0100202e2f07006c653020237a7d3975e93a69284781c694eb902e7c671d2cf67d21f5dd6393b48ddd93a343cd0d55906785815bc329caee315d1ea03bdb5071a8966df5920a2e1dee4eb3be4af9a410f6301abd910c7610e711b133c5db8eeb9a3d7be57f2b1862f08e969dd2a78567604669b742cd9d047402331d092e28c9da9cedc90ce38ef098bdc36f582b3d658bdf3c3cd467a5a48234127b8630b7290cac6e1cd53b726c600551cd3fa8c0de8c78e40b056c95a8d80164a5c5de7c3805a71f5cda9935bcab32ce3b4fc956a1c5bcd79ed02f09bba11766578cfdbdc8a7d954ef"], 0xe4) close(r1) execve(&(0x7f0000000180)='./file0\x00', &(0x7f0000000140), &(0x7f0000000140)) clock_gettime(0x0, &(0x7f0000000040)) 22:13:40 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") unshare(0x400) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000000)={0xfffb, 0x1b, 0x0, 0xffffffffffffffff}) ioctl$DMA_BUF_IOCTL_SYNC(r1, 0x40086200, &(0x7f0000000080)=0x5) ioctl$DMA_BUF_IOCTL_SYNC(r1, 0x40086200, &(0x7f0000000140)=0x2) [ 195.621197] CR4: actual=0x0000000000002068, shadow=0x0000000000000028, gh_mask=ffffffffffffe871 [ 195.652906] CR3 = 0x0000000000000000 [ 195.686595] PDPTR0 = 0x0000000000000000 PDPTR1 = 0x0000000000000000 [ 195.720085] PDPTR2 = 0x0000000000000000 PDPTR3 = 0x0000000000000000 [ 195.746777] RSP = 0x0000000000000000 RIP = 0x000000000000fff0 [ 195.765403] RFLAGS=0x00000002 DR7 = 0x0000000000000400 [ 195.781849] Sysenter RSP=0000000000000000 CS:RIP=0000:0000000000000000 [ 195.812989] CS: sel=0x0000, attr=0x10000, limit=0x00000000, base=0x0000000000000000 [ 195.836908] DS: sel=0x0000, attr=0x10000, limit=0x00000000, base=0x0000000000000000 [ 195.847489] SS: sel=0x0000, attr=0x10000, limit=0x00000000, base=0x0000000000000000 [ 195.855945] ES: sel=0x0000, attr=0x10000, limit=0x00000000, base=0x0000000000000000 [ 195.864754] FS: sel=0x0000, attr=0x10000, limit=0x00000000, base=0x0000000000000000 [ 195.873943] GS: sel=0x0000, attr=0x10000, limit=0x00000000, base=0x0000000000000000 [ 195.882316] GDTR: limit=0x00000000, base=0x0000000000000000 [ 195.890403] LDTR: sel=0x0000, attr=0x10000, limit=0x00000000, base=0x0000000000000000 [ 195.898790] IDTR: limit=0x00000000, base=0x0000000000000000 [ 195.907315] TR: sel=0x0000, attr=0x10000, limit=0x00000000, base=0x0000000000000000 [ 195.915738] EFER = 0x0000000000000000 PAT = 0x0007040600070406 [ 195.922557] DebugCtl = 0x0000000000000000 DebugExceptions = 0x0000000000000000 [ 195.930062] Interruptibility = 00000000 ActivityState = 00000000 [ 195.936404] *** Host State *** [ 195.939616] RIP = 0xffffffff81212b2e RSP = 0xffff880190fd73d0 [ 195.945649] CS=0010 SS=0018 DS=0000 ES=0000 FS=0000 GS=0000 TR=0040 [ 195.952130] FSBase=0000000000000000 GSBase=ffff8801daf00000 TRBase=fffffe0000003000 [ 195.959945] GDTBase=fffffe0000001000 IDTBase=fffffe0000000000 [ 195.965924] CR0=0000000080050033 CR3=00000001b8fd9000 CR4=00000000001426e0 [ 195.972993] Sysenter RSP=fffffe0000002200 CS:RIP=0010:ffffffff87c013a0 [ 195.979680] EFER = 0x0000000000000d01 PAT = 0x0407050600070106 [ 195.985813] *** Control State *** [ 195.989270] PinBased=0000003f CPUBased=b5986dfa SecondaryExec=000000c2 [ 195.995973] EntryControls=0000d1ff ExitControls=002fefff [ 196.001473] ExceptionBitmap=00060042 PFECmask=00000000 PFECmatch=00000000 22:13:40 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000300)={0xc, 0x0, &(0x7f0000000240)=[@exit_looper, @acquire], 0x13, 0x0, &(0x7f0000000280)="6a23980f12e093de53fb1c2a53d6d534c2fdd5"}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) dup(0xffffffffffffffff) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000100)}}}], 0x97, 0x0, &(0x7f0000fedffe)}) 22:13:40 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000300)={0xc, 0x0, &(0x7f0000000240)=[@exit_looper, @exit_looper, @register_looper], 0x0, 0x0, &(0x7f0000000280)}) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) 22:13:40 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") unshare(0x400) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000000)={0xfffb, 0x1b, 0x0, 0xffffffffffffffff}) ioctl$DMA_BUF_IOCTL_SYNC(r1, 0x40086200, &(0x7f0000000080)=0x5) ioctl$DMA_BUF_IOCTL_SYNC(r1, 0x40086200, &(0x7f0000000140)=0x2) 22:13:40 executing program 4: 22:13:40 executing program 3: 22:13:40 executing program 0: r0 = syz_open_dev$admmidi(&(0x7f0000000100)='/dev/admmidi#\x00', 0x0, 0x34182) setsockopt$RDS_GET_MR_FOR_DEST(r0, 0x114, 0x7, &(0x7f0000000280)={@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e24, @multicast2}, 0x0, 0x1, 0x1}}, {&(0x7f00000001c0)=""/143, 0x8f}, &(0x7f00000000c0), 0x38}, 0xa0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = creat(&(0x7f0000001140)='./file0\x00', 0x3) write$binfmt_script(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="0100202e2f07006c653020237a7d3975e93a69284781c694eb902e7c671d2cf67d21f5dd6393b48ddd93a343cd0d55906785815bc329caee315d1ea03bdb5071a8966df5920a2e1dee4eb3be4af9a410f6301abd910c7610e711b133c5db8eeb9a3d7be57f2b1862f08e969dd2a78567604669b742cd9d047402331d092e28c9da9cedc90ce38ef098bdc36f582b3d658bdf3c3cd467a5a48234127b8630b7290cac6e1cd53b726c600551cd3fa8c0de8c78e40b056c95a8d80164a5c5de7c3805a71f5cda9935bcab32ce3b4fc956a1c5bcd79ed02f09bba11766578cfdbdc8a7d954ef"], 0xe4) close(r1) execve(&(0x7f0000000180)='./file0\x00', &(0x7f0000000140), &(0x7f0000000140)) clock_gettime(0x0, &(0x7f0000000040)) [ 196.008390] VMEntry: intr_info=00000000 errcode=00000000 ilen=00000000 [ 196.015123] VMExit: intr_info=00000000 errcode=00000000 ilen=00000000 [ 196.021791] reason=80000021 qualification=0000000000000000 [ 196.028111] IDTVectoring: info=00000000 errcode=00000000 [ 196.033601] TSC Offset = 0xffffff95338e780e [ 196.037924] EPT pointer = 0x00000001cd96a01e 22:13:40 executing program 4: [ 196.108309] binder: 8353:8359 transaction failed 29189/-22, size 0-0 line 2855 [ 196.110947] binder: 8355:8357 ERROR: BC_REGISTER_LOOPER called without request 22:13:40 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") unshare(0x400) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000000)={0xfffb, 0x1b, 0x0, 0xffffffffffffffff}) ioctl$DMA_BUF_IOCTL_SYNC(r1, 0x40086200, &(0x7f0000000080)=0x5) ioctl$DMA_BUF_IOCTL_SYNC(r1, 0x40086200, &(0x7f0000000140)=0x2) 22:13:40 executing program 1: [ 196.174978] binder: 8355:8364 ERROR: BC_REGISTER_LOOPER called without request 22:13:40 executing program 4: 22:13:40 executing program 3: 22:13:40 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000000)={0xfffb, 0x1b, 0x0, 0xffffffffffffffff}) ioctl$DMA_BUF_IOCTL_SYNC(r2, 0x40086200, &(0x7f0000000080)=0x5) ioctl$DMA_BUF_IOCTL_SYNC(r2, 0x40086200, &(0x7f0000000140)=0x2) 22:13:40 executing program 2: 22:13:40 executing program 1: 22:13:40 executing program 4: 22:13:40 executing program 3: 22:13:40 executing program 0: r0 = syz_open_dev$admmidi(&(0x7f0000000100)='/dev/admmidi#\x00', 0x0, 0x34182) setsockopt$RDS_GET_MR_FOR_DEST(r0, 0x114, 0x7, &(0x7f0000000280)={@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e24, @multicast2}, 0x0, 0x1, 0x1}}, {&(0x7f00000001c0)=""/143, 0x8f}, &(0x7f00000000c0), 0x38}, 0xa0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = creat(&(0x7f0000001140)='./file0\x00', 0x3) write$binfmt_script(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="0100202e2f07006c653020237a7d3975e93a69284781c694eb902e7c671d2cf67d21f5dd6393b48ddd93a343cd0d55906785815bc329caee315d1ea03bdb5071a8966df5920a2e1dee4eb3be4af9a410f6301abd910c7610e711b133c5db8eeb9a3d7be57f2b1862f08e969dd2a78567604669b742cd9d047402331d092e28c9da9cedc90ce38ef098bdc36f582b3d658bdf3c3cd467a5a48234127b8630b7290cac6e1cd53b726c600551cd3fa8c0de8c78e40b056c95a8d80164a5c5de7c3805a71f5cda9935bcab32ce3b4fc956a1c5bcd79ed02f09bba11766578cfdbdc8a7d954ef"], 0xe4) close(r1) execve(&(0x7f0000000180)='./file0\x00', &(0x7f0000000140), &(0x7f0000000140)) clock_gettime(0x0, &(0x7f0000000040)) 22:13:40 executing program 2: 22:13:40 executing program 1: 22:13:41 executing program 5: socket$inet6(0xa, 0x1000000000002, 0x0) r0 = openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000000)={0xfffb, 0x1b, 0x0, 0xffffffffffffffff}) ioctl$DMA_BUF_IOCTL_SYNC(r1, 0x40086200, &(0x7f0000000080)=0x5) ioctl$DMA_BUF_IOCTL_SYNC(r1, 0x40086200, &(0x7f0000000140)=0x2) 22:13:41 executing program 2: 22:13:41 executing program 4: 22:13:41 executing program 1: 22:13:41 executing program 3: 22:13:41 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000000)={0xfffb, 0x1b, 0x0, 0xffffffffffffffff}) ioctl$DMA_BUF_IOCTL_SYNC(r1, 0x40086200, &(0x7f0000000080)=0x5) ioctl$DMA_BUF_IOCTL_SYNC(r1, 0x40086200, &(0x7f0000000140)=0x2) 22:13:41 executing program 0: r0 = syz_open_dev$admmidi(&(0x7f0000000100)='/dev/admmidi#\x00', 0x0, 0x34182) setsockopt$RDS_GET_MR_FOR_DEST(r0, 0x114, 0x7, &(0x7f0000000280)={@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e24, @multicast2}, 0x0, 0x1, 0x1}}, {&(0x7f00000001c0)=""/143, 0x8f}, &(0x7f00000000c0), 0x38}, 0xa0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = creat(&(0x7f0000001140)='./file0\x00', 0x3) write$binfmt_script(r1, &(0x7f00000005c0)=ANY=[@ANYBLOB="0100202e2f07006c653020237a7d3975e93a69284781c694eb902e7c671d2cf67d21f5dd6393b48ddd93a343cd0d55906785815bc329caee315d1ea03bdb5071a8966df5920a2e1dee4eb3be4af9a410f6301abd910c7610e711b133c5db8eeb9a3d7be57f2b1862f08e969dd2a78567604669b742cd9d047402331d092e28c9da9cedc90ce38ef098bdc36f582b3d658bdf3c3cd467a5a48234127b8630b7290cac6e1cd53b726c600551cd3fa8c0de8c78e40b056c95a8d80164a5c5de7c3805a71f5cda9935bcab32ce3b4fc956a1c5bcd79ed02f09bba11766578cfdbdc8a7d954ef"], 0xe4) close(r1) execve(&(0x7f0000000180)='./file0\x00', &(0x7f0000000140), &(0x7f0000000140)) clock_gettime(0x0, &(0x7f0000000040)) 22:13:41 executing program 2: 22:13:41 executing program 4: 22:13:41 executing program 1: 22:13:41 executing program 2: 22:13:41 executing program 3: 22:13:41 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000000)={0xfffb, 0x1b, 0x0, 0xffffffffffffffff}) ioctl$DMA_BUF_IOCTL_SYNC(r1, 0x40086200, &(0x7f0000000080)=0x5) ioctl$DMA_BUF_IOCTL_SYNC(r1, 0x40086200, &(0x7f0000000140)=0x2) 22:13:41 executing program 4: 22:13:41 executing program 2: 22:13:41 executing program 1: 22:13:41 executing program 5: openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000000)={0xfffb, 0x1b, 0x0, 0xffffffffffffffff}) ioctl$DMA_BUF_IOCTL_SYNC(r0, 0x40086200, &(0x7f0000000080)=0x5) ioctl$DMA_BUF_IOCTL_SYNC(r0, 0x40086200, &(0x7f0000000140)=0x2) 22:13:41 executing program 3: 22:13:41 executing program 0: 22:13:41 executing program 2: 22:13:41 executing program 4: 22:13:41 executing program 1: 22:13:41 executing program 5: openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000000)={0xfffb, 0x1b, 0x0, 0xffffffffffffffff}) ioctl$DMA_BUF_IOCTL_SYNC(r0, 0x40086200, &(0x7f0000000080)=0x5) ioctl$DMA_BUF_IOCTL_SYNC(r0, 0x40086200, &(0x7f0000000140)=0x2) 22:13:41 executing program 4: 22:13:41 executing program 1: 22:13:41 executing program 2: 22:13:41 executing program 0: 22:13:41 executing program 3: 22:13:41 executing program 4: 22:13:41 executing program 1: 22:13:41 executing program 5: openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000000)={0xfffb, 0x1b, 0x0, 0xffffffffffffffff}) ioctl$DMA_BUF_IOCTL_SYNC(r0, 0x40086200, &(0x7f0000000080)=0x5) ioctl$DMA_BUF_IOCTL_SYNC(r0, 0x40086200, &(0x7f0000000140)=0x2) 22:13:41 executing program 3: 22:13:42 executing program 4: 22:13:42 executing program 0: 22:13:42 executing program 2: 22:13:42 executing program 1: 22:13:42 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000000)={0x0, 0x1b, 0x0, 0xffffffffffffffff}) ioctl$DMA_BUF_IOCTL_SYNC(r1, 0x40086200, &(0x7f0000000080)=0x5) ioctl$DMA_BUF_IOCTL_SYNC(r1, 0x40086200, &(0x7f0000000140)=0x2) 22:13:42 executing program 3: 22:13:42 executing program 0: 22:13:42 executing program 4: 22:13:42 executing program 1: 22:13:42 executing program 2: 22:13:42 executing program 0: 22:13:42 executing program 3: 22:13:42 executing program 4: 22:13:42 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000000)={0x0, 0x1b, 0x0, 0xffffffffffffffff}) ioctl$DMA_BUF_IOCTL_SYNC(r1, 0x40086200, &(0x7f0000000080)=0x5) ioctl$DMA_BUF_IOCTL_SYNC(r1, 0x40086200, &(0x7f0000000140)=0x2) 22:13:42 executing program 1: 22:13:42 executing program 2: 22:13:42 executing program 0: 22:13:42 executing program 3: 22:13:42 executing program 4: 22:13:42 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000300)={0xc, 0x0, &(0x7f0000000240)=[@free_buffer], 0x0, 0x0, &(0x7f0000000280)}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140), 0x0, 0x0, &(0x7f0000fedffe)}) 22:13:42 executing program 1: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f00000000c0)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x10, 0x0, &(0x7f0000000240)=[@exit_looper, @register_looper, @acquire={0x40046305, 0x1}], 0x70, 0x0, &(0x7f0000000280)="6a23980f12e093de53fb1c2a53d6d534c2fdd56f383af3376cfe8da4868c122c07fd05aab0cdfeff8e5f9d7ff4bb3bd2ae2f95b0cd58f340afb0faecaf2a59c02d91e140743a26c9a6f5c932fbae11a2ec107459d20181d8e367525b8a4698d3ae4a07b9da264d94c5efeeef88cf92f1"}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ppoll(&(0x7f0000000040)=[{r0}], 0x1, &(0x7f0000000080), &(0x7f0000000100), 0x8) r2 = dup(r0) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r2, &(0x7f0000000580)={0x4, 0x8}, 0x10) ioctl$DRM_IOCTL_GET_SAREA_CTX(r2, 0xc010641d, &(0x7f00000003c0)={0x0, &(0x7f0000000380)=""/1}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FIBMAP(r1, 0x1, &(0x7f00000004c0)=0x6) 22:13:42 executing program 0: r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000140)='cgroup\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000003) 22:13:42 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) add_key(&(0x7f0000000080)='dns_resolver\x00', &(0x7f00000000c0)={"0200"}, &(0x7f0000000100), 0xfffff, 0xfffffffffffffffb) 22:13:42 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000000)={0x0, 0x1b, 0x0, 0xffffffffffffffff}) ioctl$DMA_BUF_IOCTL_SYNC(r1, 0x40086200, &(0x7f0000000080)=0x5) ioctl$DMA_BUF_IOCTL_SYNC(r1, 0x40086200, &(0x7f0000000140)=0x2) 22:13:42 executing program 3: [ 198.184287] binder: 8507:8508 BC_FREE_BUFFER u0000000000000000 no match [ 198.234532] binder: 8507:8508 BC_FREE_BUFFER u0000000000000000 no match 22:13:42 executing program 0: 22:13:42 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl(0xffffffffffffffff, 0x0, &(0x7f00000002c0)) r0 = syz_open_procfs(0x0, &(0x7f0000000040)='\x00\x00\x00\x00\x00') r1 = openat$cgroup_ro(r0, &(0x7f0000000000)="6d656d00017937737761532e63757289c942abe3fa72656e7400", 0x0, 0x0) syz_emit_ethernet(0x642, &(0x7f0000000100)={@local, @remote, [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x223, 0x0, 0x0, @local={0xfe, 0x8a00, [0x0, 0x0, 0x3, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x634]}, @local, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) preadv(r1, &(0x7f0000000180)=[{&(0x7f00000000c0)=""/81, 0x20000111}], 0x1, 0x2000107c) 22:13:42 executing program 2: creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) mount(&(0x7f0000000240)=ANY=[], &(0x7f0000000180)='./file0\x00', &(0x7f0000000280)="3970f6", 0x0, &(0x7f0000000000)) 22:13:42 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000000)={0xfffb, 0x0, 0x0, 0xffffffffffffffff}) ioctl$DMA_BUF_IOCTL_SYNC(r1, 0x40086200, &(0x7f0000000080)=0x5) ioctl$DMA_BUF_IOCTL_SYNC(r1, 0x40086200, &(0x7f0000000140)=0x2) [ 198.337754] binder: 8514:8524 ERROR: BC_REGISTER_LOOPER called without request 22:13:42 executing program 2: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = perf_event_open(&(0x7f0000000040)={0x0, 0x70}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x0, 0x0) r3 = memfd_create(&(0x7f0000002b00)="0400d71d00000200a72317", 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_FIOGETOWN(r3, 0x8903, &(0x7f00000003c0)) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000400)={{{@in=@loopback, @in6=@mcast2}}, {{@in6=@ipv4={[], [], @remote}}, 0x0, @in=@remote}}, &(0x7f0000000500)=0xe8) ioctl$sock_SIOCGPGRP(r3, 0x8904, &(0x7f00000005c0)) stat(&(0x7f0000000600)='./file0\x00', &(0x7f0000000680)) fstat(r1, &(0x7f0000000700)) fcntl$getownex(r2, 0x10, &(0x7f0000000780)) geteuid() fstat(r4, &(0x7f00000007c0)) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000880)={0x0, r2, 0x0, 0x24, &(0x7f0000000840)="2d776c616e310473656c66776c616e316367726f75706b657972696e675c6e6f64657600", 0xffffffffffffffff}, 0x30) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000008c0)={{{@in=@rand_addr, @in6=@loopback}}, {{@in6=@loopback}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f00000009c0)=0xe8) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000a00), &(0x7f0000000a40)=0xc) ioctl$TIOCGPGRP(r3, 0x540f, &(0x7f0000000dc0)) getsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000e00)={{{@in6=@loopback, @in=@broadcast}}, {{@in6=@mcast1}, 0x0, @in=@local}}, &(0x7f0000000f00)=0xe8) getegid() ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000f40)) geteuid() lstat(&(0x7f0000000f80)='./file0\x00', &(0x7f0000000fc0)) r5 = syz_open_procfs(0x0, &(0x7f0000000000)="2f65786500000000000409004bddd9de91be10ee9ed554fa07424adee9cbc699ec2ca576e50000bcd7a071fb35331ce39c5ad0cf73770bd4246847a1914e4fb0aa9b15eaa94bcd0e700ed63b44338e84ad4ec2f11f6f2adb8dc2fdb18231446f43142ebe700b2231e8fceed6b22a373c9409675ac8d0b53033123fb3037d66241aafe0f880e7a51d1b036ade31d2544d2581fe8653d0cff54369df8c2fce21dcb1cb965669f9a75345ac3479cd51dc7de364c9c272c83ed9e666ca25aad2e7a26e3d6c62d0f8b9065cfca311c06d0744db265aa0e486707c51fd108c0c6ccae6ff42274af94d30fce8836ff9d00bdd") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) ioctl$EXT4_IOC_SETFLAGS(r5, 0x40086607, &(0x7f00000002c0)=0x7fffe) 22:13:42 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = gettid() timer_create(0x0, &(0x7f0000000000)={0x0, 0x12, 0x0, @thr={&(0x7f0000000080), &(0x7f0000000a00)}}, &(0x7f0000044000)) io_setup(0x5, &(0x7f0000002800)=0x0) io_getevents(r3, 0x3, 0x3, &(0x7f00000003c0)=[{}, {}, {}], &(0x7f0000000100)={0x77359400}) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x8}, {0x0, 0x1c9c380}}, &(0x7f0000040000)) tkill(r2, 0x401004000000016) [ 198.440717] binder: 8514:8524 Acquire 1 refcount change on invalid ref 1 ret -22 22:13:42 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000600)={0xc8, 0x0, &(0x7f0000000080)=ANY=[], 0x0, 0x0, &(0x7f0000000500)}) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000100)}}}], 0x97, 0x0, &(0x7f0000fedffe)}) [ 198.481296] binder: 8524 RLIMIT_NICE not set 22:13:42 executing program 1: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f00000000c0)={0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x20, 0x0, &(0x7f0000000240)=[@exit_looper, @exit_looper, @free_buffer={0x40086303, r2}, @register_looper, @acquire={0x40046305, 0x1}], 0x69, 0x0, &(0x7f0000000280)="6a23980f12e093de53fb1c2a53d6d534c2fdd56f383af3376cfe8da4868c122c07fd05aab0cdfeff8e5f9d7ff4bb3bd2ae2f95b0cd58f340afb0faecaf2a59c02d91e140743a26c9a6f5c932fbae11a2ec107459d20181d8e367525b8a4698d3ae4a07b9da264d94c5"}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) lstat(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000600)={0xc8, 0x0, &(0x7f0000000080)=ANY=[], 0x0, 0x0, &(0x7f0000000500)}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ppoll(&(0x7f0000000040)=[{r0}], 0x1, &(0x7f0000000080), &(0x7f0000000100), 0x8) r3 = dup(0xffffffffffffffff) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000540)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000500)={0xffffffffffffffff}, 0x117, 0x8}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r3, &(0x7f0000000580)={0x4, 0x8, 0xfa00, {r4, 0x3}}, 0x10) ioctl$DRM_IOCTL_GET_SAREA_CTX(r3, 0xc010641d, &(0x7f00000003c0)={0x0, &(0x7f0000000380)=""/1}) r5 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FIBMAP(r1, 0x1, &(0x7f00000004c0)=0x6) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000100)}}}], 0x97, 0x0, &(0x7f0000fedffe)}) 22:13:42 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000000)={0xfffb, 0x0, 0x0, 0xffffffffffffffff}) ioctl$DMA_BUF_IOCTL_SYNC(r1, 0x40086200, &(0x7f0000000080)=0x5) ioctl$DMA_BUF_IOCTL_SYNC(r1, 0x40086200, &(0x7f0000000140)=0x2) [ 198.582135] binder: 8548:8549 transaction failed 29189/-22, size 0-0 line 2855 [ 198.618701] binder: 8554:8557 BC_FREE_BUFFER u0000000000000000 no match 22:13:43 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000000)={0xfffb, 0x0, 0x0, 0xffffffffffffffff}) ioctl$DMA_BUF_IOCTL_SYNC(r1, 0x40086200, &(0x7f0000000080)=0x5) ioctl$DMA_BUF_IOCTL_SYNC(r1, 0x40086200, &(0x7f0000000140)=0x2) [ 198.627506] binder: 8548:8562 transaction failed 29189/-22, size 0-0 line 2855 [ 198.633946] binder: 8554:8557 ERROR: BC_REGISTER_LOOPER called without request [ 198.647932] binder: 8554:8557 Acquire 1 refcount change on invalid ref 1 ret -22 [ 198.663004] binder: 8557 RLIMIT_NICE not set [ 198.675607] binder: 8554:8565 ioctl 1 200004c0 returned -22 22:13:43 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f0000000380)=@in={0x2, 0x0, @local}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000400)=""/126, 0x7e}, {&(0x7f0000000480)=""/19, 0x13}, {&(0x7f00000004c0)=""/20, 0x14}, {&(0x7f0000000500)=""/127, 0x7f}], 0x4, &(0x7f00000005c0)=""/152, 0x98, 0x7}, 0x10000) 22:13:43 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000600)={0xc8, 0x0, &(0x7f0000000080)=ANY=[], 0x0, 0x0, &(0x7f0000000500)}) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000100)}}}], 0x97, 0x0, &(0x7f0000fedffe)}) [ 198.688364] binder: 8557 RLIMIT_NICE not set 22:13:43 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000000)={0xfffb, 0x1b, 0x0, 0xffffffffffffffff}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000080)=0x5) ioctl$DMA_BUF_IOCTL_SYNC(r1, 0x40086200, &(0x7f0000000140)=0x2) 22:13:43 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000004c0)="7374617475730042236739c16d17f90dc22322c94f133520785e91ea85ae107cc3819819c263540b1de1ba201e6de4b75a50115091eed530aa482e36594601ceb5d169c5baf41b35d8a5a09a82496613d86023865b57ef269f90d304969f687df53b611b40a44291b5a882208fbb835e54a41310a3b481d5bdbb0981742909a63b7cd1a18d405e5b011bfbe5a4d5bf299447e4c0dd4b63a367211c0078238b509d614100d33a5584aa3b3cb9b99e6e5f84719294d41b27117c47fb4f2b2be475eb25d5f69b6d10cf8422cade570c087b03f6b1818bc97077db23") socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$binfmt_elf64(0xffffffffffffffff, &(0x7f00000005c0)=ANY=[@ANYBLOB="7f454c46000000000000000000000000000000000000000079030000000000204000000000000000ab000000000000000000000000000000000000000000000000000000000000000000ffff00000000000000000000000000000000000000000000c2a3d27bd88efcf9bf892edbe0e0dff636085557fcc4d5d0b86b7e8800af5700e7f54040f41d0a6a31d20c72ea037ae542d7522ec71bafb01dd16eeb0db9b364f763f71b56713113bfa4cbc45447387f7ef18fe42220a2ee17893fb8c97af149981c000549e18cf57c56e3b61aeb3614441382a1ab0b94190e75ab2e6b1b2a42c6ed899f9ac5f7e8c5f7a25b9d0d1f9b7a211d9e9edad8538648134d5042b5b7e1f041b5b42f5bf1277880d9490d1786af42e2c73e55f72d8ab763fef92120c47146d84e6ef3ec523fdac523afd4c672f880041e03102aa84b7b8937ca85f551c24c3ef863e934f40103cc59e11c6eaace96fbc26fe8936913601c12ec1abdd9086da65d2dbf9685b34af537b4cf4ef1c6baf938702faa0fa7040d2134ea8109c31f6d240a9c63bb9a2b8cd7aff71cd68d428cd7b89618eabf4780f7ffb5b2bdfc79fa5ea424d57c9122bd877baecc12dbcf1eb695462b9ab625a3f8589660cd8f"], 0x1c3) fsetxattr(0xffffffffffffffff, &(0x7f00000003c0)=@random={'btrfs.', "7374617475730042236739c16d17f90dc22322c94f133520785e91ea85ae107cc3819819c263540b1de1ba201e6de4b75a50115091eed530aa482e36594601ceb5d169c5baf41b35d8a5a09a82496613d86023865b57ef269f90d304969f687df53b611b40a44291b5a882208fbb835e54a41310a3b481d5bdbb0981742909a63b7cd1a18d405e5b011bfbe5a4d5bf299447e4c0dd4b63a367211c0078238b509d614100d33a5584aa3b3cb9b99e6e5f84719294d41b27117c47fb4f2b2be475eb25d5f69b6d10cf8422cade570c087b03f6b1818bc97077db23"}, &(0x7f0000000240)='/dev/vhci\x00', 0xb6, 0x0) setgroups(0x2a7, &(0x7f0000000140)) sendfile(r0, r1, &(0x7f0000000080), 0x71c) [ 198.719340] binder: 8554:8557 BC_FREE_BUFFER u0000000000000000 no match [ 198.740700] binder: 8554:8557 ERROR: BC_REGISTER_LOOPER called without request 22:13:43 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000000)={@remote}, 0x14) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r1, 0x29, 0x1b, &(0x7f0000000040)={@remote}, 0x14) [ 198.788236] binder: 8554:8577 ioctl 1 200004c0 returned -22 [ 198.795497] binder: BINDER_SET_CONTEXT_MGR already set [ 198.822570] binder: 8554:8557 Acquire 1 refcount change on invalid ref 1 ret -22 [ 198.831273] binder: 8572:8576 ioctl 40046207 0 returned -16 22:13:43 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000000)={0xfffb, 0x1b, 0x0, 0xffffffffffffffff}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000080)=0x5) ioctl$DMA_BUF_IOCTL_SYNC(r1, 0x40086200, &(0x7f0000000140)=0x2) [ 198.838973] binder_alloc: 8554: binder_alloc_buf, no vma [ 198.846250] binder: BINDER_SET_CONTEXT_MGR already set [ 198.858998] binder: 8554:8565 ioctl 40046207 0 returned -16 [ 198.862358] binder: 8575:8580 transaction failed 29189/-3, size 0-0 line 2970 [ 198.865533] binder_alloc: 8554: binder_alloc_buf, no vma 22:13:43 executing program 3: r0 = socket$vsock_stream(0x28, 0x1, 0x0) getsockname(r0, &(0x7f0000009740)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000097c0)=0x80) [ 198.883907] binder: release 8554:8557 transaction 20 in, still active [ 198.889738] binder: 8554:8565 transaction failed 29189/-22, size 0-0 line 2855 [ 198.890713] binder: send failed reply for transaction 20 to 8554:8565 [ 198.905538] binder: 8572:8576 transaction failed 29189/-3, size 0-12288 line 2970 [ 198.926511] binder: 8557 RLIMIT_NICE not set 22:13:43 executing program 4: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000000)={@remote}, 0x14) [ 198.942879] binder: undelivered TRANSACTION_ERROR: 29189 [ 198.972063] binder_alloc: 8572: binder_alloc_buf, no vma 22:13:43 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000000)={0xfffb, 0x1b, 0x0, 0xffffffffffffffff}) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000080)=0x5) ioctl$DMA_BUF_IOCTL_SYNC(r1, 0x40086200, &(0x7f0000000140)=0x2) [ 198.988933] binder: undelivered TRANSACTION_ERROR: 29189 [ 198.995309] binder: 8572:8585 transaction failed 29189/-3, size 0-12288 line 2970 22:13:43 executing program 1: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f00000000c0)={0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x20, 0x0, &(0x7f0000000240)=[@exit_looper, @exit_looper, @free_buffer={0x40086303, r2}, @register_looper, @acquire={0x40046305, 0x1}], 0x69, 0x0, &(0x7f0000000280)="6a23980f12e093de53fb1c2a53d6d534c2fdd56f383af3376cfe8da4868c122c07fd05aab0cdfeff8e5f9d7ff4bb3bd2ae2f95b0cd58f340afb0faecaf2a59c02d91e140743a26c9a6f5c932fbae11a2ec107459d20181d8e367525b8a4698d3ae4a07b9da264d94c5"}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) lstat(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000600)={0xc8, 0x0, &(0x7f0000000080)=ANY=[], 0x0, 0x0, &(0x7f0000000500)}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ppoll(&(0x7f0000000040)=[{r0}], 0x1, &(0x7f0000000080), &(0x7f0000000100), 0x8) r3 = dup(0xffffffffffffffff) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000540)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000500)={0xffffffffffffffff}, 0x117, 0x8}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r3, &(0x7f0000000580)={0x4, 0x8, 0xfa00, {r4, 0x3}}, 0x10) ioctl$DRM_IOCTL_GET_SAREA_CTX(r3, 0xc010641d, &(0x7f00000003c0)={0x0, &(0x7f0000000380)=""/1}) r5 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FIBMAP(r1, 0x1, &(0x7f00000004c0)=0x6) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000140)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000100)}}}], 0x97, 0x0, &(0x7f0000fedffe)}) 22:13:43 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x803, 0x9) getpid() socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ppp\x00', 0x0, 0x0) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000100)) write$FUSE_IOCTL(r2, &(0x7f0000001280)={0x20, 0xffffffffffffffda, 0x6, {0x1, 0x4, 0x6, 0x80}}, 0x20) ioctl$KVM_NMI(r2, 0xae9a) r3 = memfd_create(&(0x7f0000000400)="e83779d80efa45bb7f48bebc95870bd0cd39bd2830ee47afe7b33fc778bde252c50d2e", 0x0) r4 = syz_open_dev$sndseq(&(0x7f0000000700)='/dev/snd/seq\x00', 0x0, 0x1) r5 = dup2(r4, r3) pselect6(0x40, &(0x7f0000000040)={0x8001, 0x3, 0x0, 0x0, 0x9a, 0x0, 0x7}, &(0x7f0000000080)={0x1220daf9, 0x0, 0x0, 0x7, 0x0, 0x81, 0x7, 0x7b}, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x2, 0x100000000, 0x7, 0x8, 0x49}, &(0x7f0000000100)={0x0, 0x1c9c380}, &(0x7f0000000180)={&(0x7f0000000140), 0x8}) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r5, 0xc08c5332, &(0x7f0000000280)={0x0, 0x0, 0x0, "7175657565310000000000000000313b0000000000000000000000000000000000000000060000000000ccbf7ddd00"}) write$P9_RREAD(r2, &(0x7f0000001400)={0xc, 0x75, 0x2, {0x1, "95"}}, 0xc) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(0xffffffffffffffff, 0xc08c5334, &(0x7f00000001c0)={0xf48b, 0x0, 0x0, 'queue1\x00'}) setsockopt$bt_BT_RCVMTU(r3, 0x112, 0xd, &(0x7f0000001240)=0x40, 0x2) write$sndseq(r3, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @connect}], 0xffffff76) mmap(&(0x7f0000011000/0x6000)=nil, 0x6000, 0x0, 0x32, 0xffffffffffffffff, 0x0) ioctl$TIOCGLCKTRMIOS(r3, 0x5456, &(0x7f0000001200)={0x3f, 0x851f000000, 0xd23, 0x4, 0xffffffffffffff0c, 0xfffffffffffffffa, 0x7, 0x4625b7ef, 0x0, 0x0, 0x708, 0xfffffffffffffff9}) ioctl$DRM_IOCTL_ADD_CTX(r5, 0xc0086420, &(0x7f0000000340)) ioctl$EVIOCGKEYCODE_V2(r3, 0x80284504, &(0x7f0000001440)=""/86) getsockopt$inet_mreqn(r2, 0x0, 0x24, &(0x7f00000014c0)={@loopback, @dev, 0x0}, &(0x7f0000001500)=0xc) ioctl$sock_inet6_SIOCDIFADDR(r5, 0x8936, &(0x7f0000001540)={@local, 0x5e, r6}) ioctl$DRM_IOCTL_RM_CTX(0xffffffffffffffff, 0xc0086421, &(0x7f0000000380)) fstatfs(r0, &(0x7f00000001c0)=""/4096) ioctl$TUNGETFEATURES(r5, 0x800454cf, &(0x7f00000000c0)) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000012c0)={{{@in=@broadcast, @in6}}, {{@in=@dev}, 0x0, @in=@multicast1}}, &(0x7f00000013c0)=0xe8) dup3(r1, r1, 0x0) ioctl$TUNSETVNETLE(r2, 0x400454dc, &(0x7f00000011c0)=0x1) [ 199.037433] binder: undelivered TRANSACTION_ERROR: 29189 22:13:43 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f00000000c0)={0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000300)={0x1c, 0x0, &(0x7f0000000240)=[@exit_looper, @free_buffer={0x40086303, r2}, @register_looper, @acquire={0x40046305, 0x1}], 0x17, 0x0, &(0x7f0000000280)="6a23980f12e093de53fb1c2a53d6d534c2fdd56f383af3"}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000600)={0xc8, 0x0, &(0x7f0000000080)=ANY=[], 0x0, 0x0, &(0x7f0000000500)}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ppoll(&(0x7f0000000040)=[{r0}], 0x1, &(0x7f0000000080), &(0x7f0000000100), 0x8) dup(r0) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140), 0x0, 0x0, &(0x7f0000fedffe)}) 22:13:43 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) madvise(&(0x7f0000000000/0x2000)=nil, 0x2000, 0xb) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x44, 0x0, &(0x7f0000000080)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000, &(0x7f0000000140), &(0x7f00000001c0)=[0x0]}}], 0x0, 0x0, &(0x7f0000000300)}) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f0000000380)=@in={0x2, 0x0, @local}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000400)=""/126, 0x7e}, {&(0x7f0000000480)=""/19, 0x13}, {&(0x7f00000004c0)=""/20, 0x14}, {&(0x7f0000000500)=""/127, 0x7f}], 0x4, &(0x7f00000005c0)=""/152, 0x98, 0x7}, 0x10000) 22:13:43 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000000)={0xfffb, 0x1b, 0x0, 0xffffffffffffffff}) ioctl$DMA_BUF_IOCTL_SYNC(r1, 0x40086200, &(0x7f0000000080)) ioctl$DMA_BUF_IOCTL_SYNC(r1, 0x40086200, &(0x7f0000000140)=0x2) [ 199.123893] binder: 8604:8605 BC_FREE_BUFFER u0000000000000000 no match [ 199.144389] binder: 8604:8605 ERROR: BC_REGISTER_LOOPER called without request [ 199.196510] binder: 8604:8605 Acquire 1 refcount change on invalid ref 1 ret -22 22:13:43 executing program 4: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000000)={@remote}, 0x14) 22:13:43 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000000)={0xfffb, 0x1b, 0x0, 0xffffffffffffffff}) ioctl$DMA_BUF_IOCTL_SYNC(r1, 0x40086200, &(0x7f0000000080)) ioctl$DMA_BUF_IOCTL_SYNC(r1, 0x40086200, &(0x7f0000000140)=0x2) [ 199.236898] binder: 8605 RLIMIT_NICE not set [ 199.252111] binder_alloc: 8616: binder_alloc_buf, no vma [ 199.262802] binder: 8616:8617 transaction failed 29189/-3, size 0-12288 line 2970 [ 199.270534] binder: 8618:8619 BC_FREE_BUFFER u0000000000000000 no match [ 199.308261] binder: 8618:8619 ERROR: BC_REGISTER_LOOPER called without request [ 199.329142] binder: undelivered TRANSACTION_ERROR: 29189 [ 199.346866] binder: 8618:8619 Acquire 1 refcount change on invalid ref 1 ret -22 22:13:43 executing program 2: sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x4000000, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x2, 0x0, 0x0, 0x400000000, 0x0, 0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, @perf_config_ext={0x64, 0x6}, 0x0, 0x0, 0x1, 0x0, 0x3, 0xe8d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e22, 0x0, @local, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x4e1f, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(r0, &(0x7f0000000440), 0x400000000000211, 0x810) 22:13:43 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000000)={0xfffb, 0x1b, 0x0, 0xffffffffffffffff}) ioctl$DMA_BUF_IOCTL_SYNC(r1, 0x40086200, &(0x7f0000000080)) ioctl$DMA_BUF_IOCTL_SYNC(r1, 0x40086200, &(0x7f0000000140)=0x2) [ 199.354910] binder: 8604:8615 ioctl 1 200004c0 returned -22 [ 199.367460] binder: BINDER_SET_CONTEXT_MGR already set [ 199.381761] binder: 8618:8625 ioctl 40046207 0 returned -16 [ 199.397918] binder: 8619 RLIMIT_NICE not set [ 199.402729] binder: 8605 RLIMIT_NICE not set 22:13:43 executing program 4: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$sock_buf(r0, 0x1, 0x1a, 0xfffffffffffffffe, &(0x7f000020a000)=0x1c) 22:13:43 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000000)={0xfffb, 0x1b, 0x0, 0xffffffffffffffff}) ioctl$DMA_BUF_IOCTL_SYNC(r1, 0x40086200, &(0x7f0000000080)=0x5) ioctl$DMA_BUF_IOCTL_SYNC(0xffffffffffffffff, 0x40086200, &(0x7f0000000140)=0x2) 22:13:43 executing program 4: socketpair$unix(0x1, 0x40000000001, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r1, &(0x7f0000000680)={0x2, 0x0, @remote}, 0x10) r2 = socket(0xa, 0x1, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f00000002c0)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000400)={{{@in6=@local, @in6=@ipv4={[], [], @multicast2}}}, {{@in=@broadcast}, 0x0, @in=@remote}}, 0xe8) [ 199.509462] binder: release 8604:8615 transaction 29 out, still active 22:13:43 executing program 1: ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000029fcc)={{0x0, 0x2, 0x0, 0xffefffffffffffff}}) setsockopt$netlink_NETLINK_RX_RING(0xffffffffffffffff, 0x29, 0x6, &(0x7f0000001000)={0x14, 0x0, 0x1, 0x24}, 0x14) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) ioctl(0xffffffffffffffff, 0x8916, &(0x7f0000000400)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000540)='/dev/cuse\x00', 0x2500, 0x0) ioctl$GIO_FONTX(r1, 0x4b6b, &(0x7f00000009c0)=""/242) setsockopt$inet_msfilter(0xffffffffffffffff, 0x0, 0x29, &(0x7f0000000d40)=ANY=[], 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x10000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r2, 0x11b, 0x2, &(0x7f0000000040)=0x800, 0xfffffffffffffdec) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f0000000080)={&(0x7f0000000340)=""/17, 0x10000}, 0x18) ioctl$IOC_PR_RESERVE(r0, 0x401070c9, &(0x7f00000000c0)={0x3, 0x3}) write$P9_RREMOVE(r2, &(0x7f00000001c0)={0x7, 0x7b, 0x2}, 0x7) r3 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x8001, 0x10000000240000) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000300), 0x106, 0x6}}, 0x20) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)="87f8bc14e1a825d5654da9b6652e2f636772", 0x1ff) fstat(0xffffffffffffffff, &(0x7f0000000140)) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)="2e2f6367726f75702e6370752f73797a3110", 0x1ff) r4 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000280)='/dev/loop-control\x00', 0x189000, 0x0) ioctl$LOOP_CTL_REMOVE(r4, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(0xffffffffffffffff, 0x4c80, 0x0) ioctl$TIOCCONS(r3, 0x541d) getresuid(&(0x7f0000000880), &(0x7f0000000600), &(0x7f0000000580)) r5 = ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82) ioctl$LOOP_CTL_ADD(r4, 0x4c80, r5) [ 199.584099] binder: release 8604:8605 transaction 29 in, still active [ 199.609647] binder: send failed reply for transaction 29, target dead 22:13:44 executing program 4: r0 = syz_open_dev$sndctrl(&(0x7f0000000440)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PVERSION(r0, 0xc008551b, &(0x7f0000001000)) 22:13:44 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r1 = memfd_create(&(0x7f0000000200)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0x0) execveat(r1, &(0x7f0000000000)='\x00', &(0x7f00000001c0), &(0x7f0000000240), 0x1100) 22:13:44 executing program 5: r0 = openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000000)={0xfffb, 0x1b, 0x0, 0xffffffffffffffff}) ioctl$DMA_BUF_IOCTL_SYNC(r1, 0x40086200, &(0x7f0000000080)=0x5) ioctl$DMA_BUF_IOCTL_SYNC(r1, 0x40086200, &(0x7f0000000140)) 22:13:44 executing program 3: r0 = openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f00000003c0)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) close(r0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCCBRK(r0, 0x5428) 22:13:44 executing program 2: r0 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) getdents64(r0, &(0x7f0000000080)=""/55, 0x37) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getdents64(r0, &(0x7f0000000500)=""/127, 0x11) 22:13:44 executing program 4: r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/rfkill\x00', 0x0, 0x0) r1 = syz_open_dev$sndpcmp(&(0x7f0000000400)='/dev/snd/pcmC#D#p\x00', 0xffffffffffff0001, 0x0) ioctl$FICLONE(r0, 0x40049409, r1) 22:13:44 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000040)='/dev/loop#\x00', 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$LOOP_SET_CAPACITY(r0, 0x4c07) [ 200.031427] binder: 8618:8625 BC_FREE_BUFFER u0000000000000000 no match [ 200.038226] binder: 8618:8625 ERROR: BC_REGISTER_LOOPER called without request [ 200.045772] binder: 8618:8625 Acquire 1 refcount change on invalid ref 1 ret -22 [ 200.053574] binder: 8625 RLIMIT_NICE not set 22:13:44 executing program 5: 22:13:44 executing program 1: 22:13:44 executing program 3: 22:13:44 executing program 2: openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x0, 0x0) pipe2(&(0x7f00000000c0)={0xffffffffffffffff}, 0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={r0, 0x0, 0x4}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000, 0x0, @perf_bp={&(0x7f0000abe000)}, 0x0, 0xffffffffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000ffe000/0x2000)=nil}) ioctl$KVM_SET_SREGS(r3, 0x4138ae84, &(0x7f00000003c0)={{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, 0x8005001f, 0x0, 0x0, 0x28}) ioctl$KVM_RUN(r3, 0xae80, 0x0) 22:13:44 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r1, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") sendmsg$unix(r0, &(0x7f00000009c0)={&(0x7f0000000040)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000000840), 0x0, &(0x7f0000000900)=[@rights={0x18, 0x1, 0x1, [r1]}, @rights={0x18, 0x1, 0x1, [r0]}], 0x30}, 0x0) 22:13:44 executing program 5: r0 = socket$inet6(0xa, 0x3, 0x4) r1 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_ADD_MAP(r1, 0x40087602, &(0x7f0000000100)={&(0x7f0000ffa000/0x3000)=nil, 0x0, 0x0, 0x0, &(0x7f0000ffa000/0x3000)=nil}) dup2(r0, r1) 22:13:44 executing program 0: 22:13:44 executing program 1: 22:13:44 executing program 3: 22:13:44 executing program 4: 22:13:44 executing program 5: [ 200.410036] *** Guest State *** [ 200.425823] CR0: actual=0x000000008005003f, shadow=0x000000008005001f, gh_mask=fffffffffffffff7 22:13:44 executing program 1: [ 200.501930] CR4: actual=0x0000000000002068, shadow=0x0000000000000028, gh_mask=ffffffffffffe871 [ 200.540963] CR3 = 0x0000000000000000 22:13:44 executing program 0: 22:13:44 executing program 3: 22:13:44 executing program 4: [ 200.556798] PDPTR0 = 0x0000000000000000 PDPTR1 = 0x0000000000000000 [ 200.592361] PDPTR2 = 0x0000000000000000 PDPTR3 = 0x0000000000000000 [ 200.641584] RSP = 0x0000000000000000 RIP = 0x000000000000fff0 [ 200.666670] RFLAGS=0x00000002 DR7 = 0x0000000000000400 [ 200.691651] Sysenter RSP=0000000000000000 CS:RIP=0000:0000000000000000 [ 200.714740] CS: sel=0x0000, attr=0x10000, limit=0x00000000, base=0x0000000000000000 [ 200.742851] DS: sel=0x0000, attr=0x10000, limit=0x00000000, base=0x0000000000000000 [ 200.751319] SS: sel=0x0000, attr=0x10000, limit=0x00000000, base=0x0000000000000000 [ 200.759582] ES: sel=0x0000, attr=0x10000, limit=0x00000000, base=0x0000000000000000 [ 200.768460] FS: sel=0x0000, attr=0x10000, limit=0x00000000, base=0x0000000000000000 [ 200.777549] GS: sel=0x0000, attr=0x10000, limit=0x00000000, base=0x0000000000000000 [ 200.787606] GDTR: limit=0x00000000, base=0x0000000000000000 [ 200.796804] LDTR: sel=0x0000, attr=0x10000, limit=0x00000000, base=0x0000000000000000 [ 200.805577] IDTR: limit=0x00000000, base=0x0000000000000000 [ 200.813953] TR: sel=0x0000, attr=0x10000, limit=0x00000000, base=0x0000000000000000 [ 200.822357] EFER = 0x0000000000000000 PAT = 0x0007040600070406 [ 200.828797] DebugCtl = 0x0000000000000000 DebugExceptions = 0x0000000000000000 [ 200.836684] Interruptibility = 00000000 ActivityState = 00000000 [ 200.843354] *** Host State *** [ 200.846739] RIP = 0xffffffff81212b2e RSP = 0xffff88018a0373d0 [ 200.853409] CS=0010 SS=0018 DS=0000 ES=0000 FS=0000 GS=0000 TR=0040 [ 200.859847] FSBase=0000000000000000 GSBase=ffff8801dae00000 TRBase=fffffe0000003000 [ 200.867899] GDTBase=fffffe0000001000 IDTBase=fffffe0000000000 [ 200.874161] CR0=0000000080050033 CR3=000000018b001000 CR4=00000000001426f0 [ 200.881532] Sysenter RSP=fffffe0000002200 CS:RIP=0010:ffffffff87c013a0 [ 200.888577] EFER = 0x0000000000000d01 PAT = 0x0407050600070106 [ 200.894835] *** Control State *** [ 200.898432] PinBased=0000003f CPUBased=b5986dfa SecondaryExec=000000c2 [ 200.905319] EntryControls=0000d1ff ExitControls=002fefff [ 200.911150] ExceptionBitmap=00060042 PFECmask=00000000 PFECmatch=00000000 [ 200.918262] VMEntry: intr_info=00000000 errcode=00000000 ilen=00000000 [ 200.925221] VMExit: intr_info=00000000 errcode=00000000 ilen=00000003 [ 200.931988] reason=80000021 qualification=0000000000000000 [ 200.938575] IDTVectoring: info=00000000 errcode=00000000 22:13:45 executing program 2: 22:13:45 executing program 5: 22:13:45 executing program 1: 22:13:45 executing program 3: 22:13:45 executing program 0: 22:13:45 executing program 4: [ 200.946464] TSC Offset = 0xffffff925975dd17 [ 200.951288] EPT pointer = 0x00000001c034c01e 22:13:45 executing program 5: 22:13:45 executing program 4: 22:13:45 executing program 0: 22:13:45 executing program 1: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0) fchdir(r0) open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) 22:13:45 executing program 3: 22:13:45 executing program 2: 22:13:45 executing program 5: 22:13:45 executing program 2: 22:13:45 executing program 0: 22:13:45 executing program 4: 22:13:45 executing program 1: 22:13:45 executing program 3: 22:13:45 executing program 5: 22:13:45 executing program 4: 22:13:45 executing program 0: 22:13:45 executing program 2: 22:13:45 executing program 1: 22:13:45 executing program 5: 22:13:45 executing program 3: 22:13:45 executing program 4: 22:13:45 executing program 2: 22:13:45 executing program 1: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ion\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40042409, 0x0) 22:13:46 executing program 5: socket$inet6(0xa, 0x1000000000002, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000280)='/dev/vcs\x00', 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x85, 0x0, 0x8000000, 0x0, 0x261, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xe49, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x0, 0xfffffffffffffffd) ioctl$KVM_GET_MSR_INDEX_LIST(0xffffffffffffffff, 0xc008ae09, &(0x7f0000000040)=ANY=[]) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb)={0x0}, &(0x7f0000cab000)=0xc) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000200), 0xffffffffffffffff) r3 = inotify_init1(0x0) fcntl$setown(r3, 0x8, 0xffffffffffffffff) fcntl$getownex(r3, 0x10, &(0x7f0000000080)={0x0, 0x0}) process_vm_readv(r4, &(0x7f0000000000)=[{&(0x7f0000001300)=""/4096, 0x1000}], 0x1, &(0x7f0000003600)=[{&(0x7f0000003580)=""/121, 0x79}], 0x1, 0x0) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, &(0x7f0000000040), &(0x7f00000000c0)=0x8) syz_open_dev$sg(&(0x7f0000000080)='/dev/sg#\x00', 0x0, 0x0) perf_event_open(&(0x7f00000002c0)={0xfffffffffffffffd, 0x70, 0x4b58, 0x100000000, 0x400, 0x4, 0x0, 0x0, 0x4408, 0x2, 0x401, 0x80000001, 0xfffffffffffffffa, 0x24, 0xffff, 0xfffffffffffffffe, 0xfff, 0x3f, 0x101, 0x80000000, 0x1, 0x4, 0x0, 0x100, 0x9, 0x800, 0x80, 0x7, 0x2, 0x2, 0x3, 0x3, 0x3a52, 0x4, 0x3ff, 0x7568c879, 0x0, 0x71, 0x0, 0x6, 0x7, @perf_config_ext={0x100000000, 0x3}, 0x0, 0x5, 0x5, 0x7, 0x3, 0x0, 0x400}, r2, 0xb, r0, 0x8) ioctl$FS_IOC_SETFLAGS(r1, 0x40086602, &(0x7f0000000180)=0x1000) 22:13:46 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000040)={0x40, 0x31, 0x0, 0xffffffffffffffff}) ppoll(&(0x7f0000000000)=[{r2}], 0x1, &(0x7f0000000080)={0x0, 0x989680}, &(0x7f0000000100), 0x8) 22:13:46 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00'}) sendmsg$nl_route(r0, &(0x7f0000000240)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="ffff9e000a000200aaaaaaaaaaaa20f216a0f69bcc66e3b8ba34d2c9882e43ff6add7261dac859c90023d83a4e098146d272804340e2511917e79fd8093e0ce269ad0d97cee56f4638f36b7e77988f4342776620025ea11a7be09d895269247100000000000000"], 0x1}}, 0x0) 22:13:46 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") unshare(0x400) inotify_rm_watch(0xffffffffffffffff, 0x0) 22:13:46 executing program 2: r0 = socket$inet6(0xa, 0x3, 0x7) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x34000}, 0xc, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB="2c0000002f0029080000000000000000020000001800000014000100040000d83293e9e700879f6835004002"], 0x1}}, 0x0) [ 201.706392] ptrace attach of "/root/syz-executor5"[5579] was attempted by "/root/syz-executor5"[8789] 22:13:46 executing program 5: socket$inet6(0xa, 0x1000000000002, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000280)='/dev/vcs\x00', 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x85, 0x0, 0x8000000, 0x0, 0x261, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xe49, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x0, 0xfffffffffffffffd) ioctl$KVM_GET_MSR_INDEX_LIST(0xffffffffffffffff, 0xc008ae09, &(0x7f0000000040)=ANY=[]) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb)={0x0}, &(0x7f0000cab000)=0xc) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000200), 0xffffffffffffffff) r3 = inotify_init1(0x0) fcntl$setown(r3, 0x8, 0xffffffffffffffff) fcntl$getownex(r3, 0x10, &(0x7f0000000080)={0x0, 0x0}) process_vm_readv(r4, &(0x7f0000000000)=[{&(0x7f0000001300)=""/4096, 0x1000}], 0x1, &(0x7f0000003600)=[{&(0x7f0000003580)=""/121, 0x79}], 0x1, 0x0) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, &(0x7f0000000040), &(0x7f00000000c0)=0x8) syz_open_dev$sg(&(0x7f0000000080)='/dev/sg#\x00', 0x0, 0x0) perf_event_open(&(0x7f00000002c0)={0xfffffffffffffffd, 0x70, 0x4b58, 0x100000000, 0x400, 0x4, 0x0, 0x0, 0x4408, 0x2, 0x401, 0x80000001, 0xfffffffffffffffa, 0x24, 0xffff, 0xfffffffffffffffe, 0xfff, 0x3f, 0x101, 0x80000000, 0x1, 0x4, 0x0, 0x100, 0x9, 0x800, 0x80, 0x7, 0x2, 0x2, 0x3, 0x3, 0x3a52, 0x4, 0x3ff, 0x7568c879, 0x0, 0x71, 0x0, 0x6, 0x7, @perf_config_ext={0x100000000, 0x3}, 0x0, 0x5, 0x5, 0x7, 0x3, 0x0, 0x400}, r2, 0xb, r0, 0x8) ioctl$FS_IOC_SETFLAGS(r1, 0x40086602, &(0x7f0000000180)=0x1000) 22:13:46 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={"6e72300100", 0x2}) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r1) ioctl$TUNSETLINK(r0, 0x400454cd, 0x207) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000380)="6e7230010060a19ef9d2c673d9a1571cb9e1369bcd61ef7e49793ae18712eceb1daa769497800b7fbbd35b170c10751d39aeb660d863e49b8c4f3b3cad48902b5b2d6cfd0abd372c63bcf5d70df3fd4d2e8d443c88c60fd7140fbc0e5637dd82fc3435bed4de5d693c9a781c863e05d8a6f8689a5be29216061f3ff53f8b6b396678e7ba155ef9152d7e43b1eccb2331eb8eb1ed5586dcf8b3b0b999361a44ff2c22c2abbef42dd24eabe6723346a6e46c0499a21442d8d00dcb57f013ff7595edd0ff076930de3675d34117a44eb0e4f832936da44e") 22:13:46 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_emit_ethernet(0xff27, &(0x7f000000a000)={@broadcast=[0xff, 0xe0], @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0xfec3, 0x0, 0x0, 0x0, 0x2f, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}, @multicast1}, @udp={0x0, 0x8864, 0x8}}}}}, 0x0) 22:13:46 executing program 2: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer\x00', 0x0, 0x0) r1 = syz_open_dev$sndtimer(&(0x7f00000001c0)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000029fcc)={{0x0, 0x2, 0x0, 0xffefffffffffffff}}) ioctl$SNDRV_TIMER_IOCTL_START(r1, 0x54a0) dup3(r0, r1, 0x0) 22:13:46 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKPBSZGET(r0, 0x127c, &(0x7f0000000280)) 22:13:46 executing program 3: r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @remote, 0x9}, 0x1c) r1 = socket$l2tp(0x18, 0x1, 0x1) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, &(0x7f00000001c0), &(0x7f0000000200)=0x8) connect$l2tp(r1, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmmsg(r1, &(0x7f0000005fc0)=[{{&(0x7f0000005680)=@sco, 0x80, &(0x7f0000005b00)}}], 0x1, 0x0) 22:13:46 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) syz_open_dev$usbmon(&(0x7f0000000240)='/dev/usbmon#\x00', 0x0, 0x0) open(&(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x0) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, &(0x7f0000000140)={0x84, @broadcast, 0x0, 0x0, 'mh\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 '}, 0x2c) bind$alg(r0, &(0x7f0000000100)={0x26, 'hash\x00', 0x0, 0x0, 'sha1_mb\x00'}, 0x58) keyctl$reject(0x13, 0x0, 0x0, 0x0, 0x0) r1 = accept4(r0, 0x0, &(0x7f00000000c0), 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ipv6_route\x00') sendfile(r1, r2, &(0x7f00000002c0), 0x10000000000443) [ 201.927884] ptrace attach of "/root/syz-executor5"[5579] was attempted by "/root/syz-executor5"[8814] 22:13:46 executing program 4: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x8912, &(0x7f00000002c0)="153f6234488dd25d766070") sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000300)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x1}}, 0x0) r1 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r1, &(0x7f0000000140), 0x6b7, 0x0) 22:13:46 executing program 2: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer\x00', 0x0, 0x0) r1 = syz_open_dev$sndtimer(&(0x7f00000001c0)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000029fcc)={{0x0, 0x2, 0x0, 0xffefffffffffffff}}) ioctl$SNDRV_TIMER_IOCTL_START(r1, 0x54a0) dup3(r0, r1, 0x0) 22:13:46 executing program 1: r0 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r0, 0x8912, &(0x7f00000000c0)="153f6234418dd25d766070") clone(0x210007fa, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) 22:13:46 executing program 5: socket$inet6(0xa, 0x1000000000002, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000280)='/dev/vcs\x00', 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x85, 0x0, 0x8000000, 0x0, 0x261, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xe49, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x0, 0xfffffffffffffffd) ioctl$KVM_GET_MSR_INDEX_LIST(0xffffffffffffffff, 0xc008ae09, &(0x7f0000000040)=ANY=[]) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb)={0x0}, &(0x7f0000cab000)=0xc) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000200), 0xffffffffffffffff) r3 = inotify_init1(0x0) fcntl$setown(r3, 0x8, 0xffffffffffffffff) fcntl$getownex(r3, 0x10, &(0x7f0000000080)={0x0, 0x0}) process_vm_readv(r4, &(0x7f0000000000)=[{&(0x7f0000001300)=""/4096, 0x1000}], 0x1, &(0x7f0000003600)=[{&(0x7f0000003580)=""/121, 0x79}], 0x1, 0x0) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, &(0x7f0000000040), &(0x7f00000000c0)=0x8) syz_open_dev$sg(&(0x7f0000000080)='/dev/sg#\x00', 0x0, 0x0) perf_event_open(&(0x7f00000002c0)={0xfffffffffffffffd, 0x70, 0x4b58, 0x100000000, 0x400, 0x4, 0x0, 0x0, 0x4408, 0x2, 0x401, 0x80000001, 0xfffffffffffffffa, 0x24, 0xffff, 0xfffffffffffffffe, 0xfff, 0x3f, 0x101, 0x80000000, 0x1, 0x4, 0x0, 0x100, 0x9, 0x800, 0x80, 0x7, 0x2, 0x2, 0x3, 0x3, 0x3a52, 0x4, 0x3ff, 0x7568c879, 0x0, 0x71, 0x0, 0x6, 0x7, @perf_config_ext={0x100000000, 0x3}, 0x0, 0x5, 0x5, 0x7, 0x3, 0x0, 0x400}, r2, 0xb, r0, 0x8) ioctl$FS_IOC_SETFLAGS(r1, 0x40086602, &(0x7f0000000180)=0x1000) 22:13:46 executing program 1: r0 = socket$inet6(0xa, 0x81000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e20, @broadcast}, 0x10) sendto$inet(r1, &(0x7f0000000200), 0xfffffffffffffeb4, 0x2000800e, &(0x7f0000db4ff0)={0x2, 0x4e20, @loopback, [0x2, 0x7000028]}, 0x10) recvfrom(r1, &(0x7f0000f9cf9b)=""/101, 0x389756b1353686c0, 0x120, 0x0, 0xffffffffffffffeb) 22:13:46 executing program 2: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer\x00', 0x0, 0x0) r1 = syz_open_dev$sndtimer(&(0x7f00000001c0)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000029fcc)={{0x0, 0x2, 0x0, 0xffefffffffffffff}}) ioctl$SNDRV_TIMER_IOCTL_START(r1, 0x54a0) dup3(r0, r1, 0x0) 22:13:46 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000003fe8)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}}) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$sock_SIOCETHTOOL(r2, 0x89b0, &(0x7f00000001c0)={'veth1_to_bond\x00', &(0x7f0000000180)=@ethtool_test}) close(r2) close(0xffffffffffffffff) 22:13:46 executing program 4: r0 = openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) write$apparmor_exec(r0, &(0x7f0000000280)={'stack ', '&&\x00'}, 0x9) 22:13:46 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'hash\x00', 0x0, 0x0, 'sha1_mb\x00'}, 0x58) r1 = accept4(r0, 0x0, &(0x7f00000000c0), 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ipv6_route\x00') sendfile(r1, r2, &(0x7f00000002c0), 0x10000000000443) [ 202.203492] ptrace attach of "/root/syz-executor5"[5579] was attempted by "/root/syz-executor5"[8854] 22:13:46 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f000001e000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000140)="b805000000b9008000000f01c1f080a4b000600000000fc3180f09c744240000000000c744240200080000c7442406000000000f0114240f08f3a5650f050f20da0f01cf", 0x44}], 0x1, 0x1, &(0x7f0000000380), 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000020000/0x18000)=nil, &(0x7f00000000c0)=[@text64={0x40, &(0x7f0000000000)="f2a766ba610066ed48b813c4830f000000000f23d00f21f835300000000f23f866ba2000edc441175d392e67450f01cb0fc72cbe67400f001066ba4100b0a8ee36420f015900", 0x46}], 0x1, 0x0, &(0x7f0000000100), 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r1, 0x84, 0x13, &(0x7f00000001c0)=0x3f, 0x4) sendmsg$IPVS_CMD_SET_CONFIG(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000240), 0xc, &(0x7f00000003c0)={&(0x7f00000002c0)={0x64, 0x0, 0x104, 0x0, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DAEMON={0x30, 0x3, [@IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bridge_slave_0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x101}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8}]}, 0x64}}, 0x4000) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) 22:13:46 executing program 2: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer\x00', 0x0, 0x0) r1 = syz_open_dev$sndtimer(&(0x7f00000001c0)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000029fcc)={{0x0, 0x2, 0x0, 0xffefffffffffffff}}) ioctl$SNDRV_TIMER_IOCTL_START(r1, 0x54a0) dup3(r0, r1, 0x0) [ 202.298595] audit: type=1400 audit(1539728026.690:31): apparmor="DENIED" operation="stack_onexec" info="label not found" error=-2 profile="unconfined" name="&&" pid=8869 comm="syz-executor4" [ 202.317606] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. 22:13:46 executing program 4: r0 = openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) write$apparmor_exec(r0, &(0x7f0000000280)={'stack ', '&&\x00'}, 0x9) 22:13:46 executing program 5: socket$inet6(0xa, 0x1000000000002, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000280)='/dev/vcs\x00', 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x85, 0x0, 0x8000000, 0x0, 0x261, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xe49, 0x8}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x0, 0xfffffffffffffffd) ioctl$KVM_GET_MSR_INDEX_LIST(0xffffffffffffffff, 0xc008ae09, &(0x7f0000000040)=ANY=[]) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb)={0x0}, &(0x7f0000cab000)=0xc) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000200), 0xffffffffffffffff) r3 = inotify_init1(0x0) fcntl$setown(r3, 0x8, 0xffffffffffffffff) fcntl$getownex(r3, 0x10, &(0x7f0000000080)={0x0, 0x0}) process_vm_readv(r4, &(0x7f0000000000)=[{&(0x7f0000001300)=""/4096, 0x1000}], 0x1, &(0x7f0000003600)=[{&(0x7f0000003580)=""/121, 0x79}], 0x1, 0x0) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, &(0x7f0000000040), &(0x7f00000000c0)=0x8) syz_open_dev$sg(&(0x7f0000000080)='/dev/sg#\x00', 0x0, 0x0) perf_event_open(&(0x7f00000002c0)={0xfffffffffffffffd, 0x70, 0x4b58, 0x100000000, 0x400, 0x4, 0x0, 0x0, 0x4408, 0x2, 0x401, 0x80000001, 0xfffffffffffffffa, 0x24, 0xffff, 0xfffffffffffffffe, 0xfff, 0x3f, 0x101, 0x80000000, 0x1, 0x4, 0x0, 0x100, 0x9, 0x800, 0x80, 0x7, 0x2, 0x2, 0x3, 0x3, 0x3a52, 0x4, 0x3ff, 0x7568c879, 0x0, 0x71, 0x0, 0x6, 0x7, @perf_config_ext={0x100000000, 0x3}, 0x0, 0x5, 0x5, 0x7, 0x3, 0x0, 0x400}, r2, 0xb, r0, 0x8) ioctl$FS_IOC_SETFLAGS(r1, 0x40086602, &(0x7f0000000180)=0x1000) 22:13:46 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'hash\x00', 0x0, 0x0, 'sha1_mb\x00'}, 0x58) r1 = accept4(r0, 0x0, &(0x7f00000000c0), 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ipv6_route\x00') sendfile(r1, r2, &(0x7f00000002c0), 0x10000000000443) [ 202.449523] kasan: CONFIG_KASAN_INLINE enabled 22:13:46 executing program 2: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer\x00', 0x0, 0x0) r1 = syz_open_dev$sndtimer(&(0x7f00000001c0)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000029fcc)={{0x0, 0x2, 0x0, 0xffefffffffffffff}}) dup3(r0, r1, 0x0) [ 202.478758] ptrace attach of "/root/syz-executor5"[5579] was attempted by "/root/syz-executor5"[8888] [ 202.496429] kasan: GPF could be caused by NULL-ptr deref or user memory access 22:13:46 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x8}, 0x1c) r1 = openat$ion(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/ion\x00', 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000009fe8)={0xfffb, 0x1a, 0x0, 0xffffffffffffffff}) mmap(&(0x7f0000004000/0x4000)=nil, 0x4000, 0x0, 0x6012, r3, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r0, r4, &(0x7f0000000040)=0x100000, 0x8001) [ 202.531741] general protection fault: 0000 [#1] PREEMPT SMP KASAN [ 202.535920] kobject: 'kvm' (000000007fdd46e9): kobject_uevent_env [ 202.538009] CPU: 1 PID: 8886 Comm: syz-executor4 Not tainted 4.19.0-rc8+ #189 [ 202.549439] kobject: 'loop5' (000000004e89098e): kobject_uevent_env [ 202.551486] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 202.551508] RIP: 0010:memcmp+0x28/0x160 [ 202.551523] Code: 00 00 48 85 d2 0f 84 0a 01 00 00 48 b8 00 00 00 00 00 fc ff df 55 48 89 f9 48 89 e5 48 c1 e9 03 41 54 53 48 89 fb 48 83 ec 18 <0f> b6 04 01 48 89 f9 83 e1 07 38 c8 7f 08 84 c0 0f 85 98 00 00 00 [ 202.551531] RSP: 0018:ffff8801bfabef48 EFLAGS: 00010296 [ 202.557963] kobject: 'loop5' (000000004e89098e): fill_kobj_path: path = '/devices/virtual/block/loop5' [ 202.567284] RAX: dffffc0000000000 RBX: 1ffff10037f57e40 RCX: 03fffe2006feafc8 [ 202.567293] RDX: 0000000000000002 RSI: ffffffff883ba280 RDI: 1ffff10037f57e40 [ 202.567302] RBP: ffff8801bfabef70 R08: ffff8801beb800c0 R09: ffffed003b5e4732 [ 202.567310] R10: ffffed003b5e4732 R11: ffff8801daf23993 R12: 0000000000000002 [ 202.567319] R13: ffffffff883ba280 R14: 1fff7901f7a17140 R15: dffffc0000000000 [ 202.567335] FS: 0000000000000000(0000) GS:ffff8801daf00000(0063) knlGS:00000000f5ff3b40 [ 202.591734] kobject: 'kvm' (000000007fdd46e9): fill_kobj_path: path = '/devices/virtual/misc/kvm' [ 202.595939] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 202.595955] CR2: 0000000008148000 CR3: 000000018b259000 CR4: 00000000001426e0 [ 202.595969] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 202.616167] x86/PAT: syz-executor5:8900 map pfn RAM range req write-combining for [mem 0x188510000-0x188513fff], got write-back [ 202.619947] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 202.619952] Call Trace: [ 202.619972] ? _raw_spin_unlock_irq+0x27/0x80 [ 202.619993] strnstr+0x4b/0x70 [ 202.666809] x86/PAT: syz-executor5:8902 map pfn RAM range req write-combining for [mem 0x188510000-0x188513fff], got write-back [ 202.672153] __aa_lookupn_ns+0xc1/0x570 [ 202.672172] ? aa_find_ns+0x30/0x30 [ 202.672188] ? lock_acquire+0x1ed/0x520 [ 202.672207] ? __aa_lookupn_ns+0x570/0x570 [ 202.720571] kobject: 'loop5' (000000004e89098e): kobject_uevent_env [ 202.724159] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 202.724178] ? check_preemption_disabled+0x48/0x200 [ 202.724194] ? kasan_check_read+0x11/0x20 [ 202.724215] ? rcu_dynticks_curr_cpu_in_eqs+0x9f/0x160 [ 202.740236] kobject: 'loop5' (000000004e89098e): fill_kobj_path: path = '/devices/virtual/block/loop5' [ 202.742422] ? rcu_bh_qs+0xc0/0xc0 [ 202.742440] ? print_usage_bug+0xc0/0xc0 [ 202.742454] ? __switch_to_asm+0x34/0x70 [ 202.742472] ? __switch_to_asm+0x40/0x70 [ 202.788038] ? __switch_to_asm+0x34/0x70 [ 202.792111] aa_lookupn_ns+0x88/0x1e0 [ 202.795917] aa_fqlookupn_profile+0x1b9/0x1010 [ 202.800502] ? aa_lookup_profile+0x30/0x30 [ 202.804726] ? __lock_acquire+0x7ec/0x4ec0 [ 202.808945] ? graph_lock+0x170/0x170 [ 202.812741] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 202.818267] ? refcount_inc_not_zero_checked+0x1e5/0x2f0 [ 202.823746] ? refcount_add_not_zero_checked+0x330/0x330 [ 202.829183] ? mark_held_locks+0x130/0x130 [ 202.833415] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 202.838954] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 202.844480] fqlookupn_profile+0x80/0xc0 [ 202.848528] aa_label_strn_parse+0xa3a/0x1230 [ 202.853031] ? aa_label_printk+0x850/0x850 [ 202.857263] ? __lock_acquire+0x7ec/0x4ec0 [ 202.861501] ? lock_acquire+0x1ed/0x520 [ 202.865462] ? __might_sleep+0x95/0x190 [ 202.869419] ? graph_lock+0x170/0x170 [ 202.873205] ? __lock_acquire+0x7ec/0x4ec0 [ 202.877427] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 202.882981] ? refcount_inc_not_zero_checked+0x1e5/0x2f0 [ 202.888419] ? refcount_add_not_zero_checked+0x330/0x330 [ 202.893854] ? graph_lock+0x170/0x170 [ 202.897639] ? find_held_lock+0x36/0x1c0 [ 202.901688] aa_label_parse+0x42/0x50 [ 202.905486] aa_change_profile+0x513/0x3260 [ 202.909807] ? lock_acquire+0x1ed/0x520 [ 202.913769] ? aa_change_hat+0x1890/0x1890 [ 202.917993] ? is_bpf_text_address+0xd3/0x170 [ 202.922477] ? __mutex_lock+0x85e/0x1700 [ 202.926528] ? proc_pid_attr_write+0x28a/0x540 [ 202.931128] ? mutex_trylock+0x2b0/0x2b0 [ 202.935193] ? save_stack+0xa9/0xd0 [ 202.938806] ? save_stack+0x43/0xd0 [ 202.942417] ? kasan_kmalloc+0xc7/0xe0 [ 202.946288] ? __kmalloc_track_caller+0x14a/0x750 [ 202.951124] ? memdup_user+0x2c/0xa0 [ 202.954822] ? proc_pid_attr_write+0x198/0x540 [ 202.959387] ? graph_lock+0x170/0x170 [ 202.963176] ? __ia32_sys_write+0x71/0xb0 [ 202.968004] ? graph_lock+0x170/0x170 [ 202.971794] ? mark_held_locks+0x130/0x130 [ 202.976028] apparmor_setprocattr+0xaa4/0x1150 [ 202.980624] ? apparmor_task_kill+0xcb0/0xcb0 [ 202.985120] ? lock_downgrade+0x900/0x900 [ 202.989255] ? arch_local_save_flags+0x40/0x40 [ 202.993835] security_setprocattr+0x66/0xc0 [ 202.998154] proc_pid_attr_write+0x301/0x540 [ 203.002569] __vfs_write+0x119/0x9f0 [ 203.006273] ? check_preemption_disabled+0x48/0x200 [ 203.011276] ? proc_loginuid_write+0x4f0/0x4f0 [ 203.015865] ? kernel_read+0x120/0x120 [ 203.019740] ? __lock_is_held+0xb5/0x140 [ 203.023790] ? rcu_read_lock_sched_held+0x108/0x120 [ 203.028795] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 203.034316] ? __sb_start_write+0x1b2/0x370 [ 203.038622] vfs_write+0x1fc/0x560 [ 203.042160] ksys_write+0x101/0x260 [ 203.045786] ? __ia32_sys_read+0xb0/0xb0 [ 203.049841] ? __bpf_trace_preemptirq_template+0x30/0x30 [ 203.055292] __ia32_sys_write+0x71/0xb0 [ 203.059256] do_fast_syscall_32+0x34d/0xfb2 [ 203.063572] ? do_int80_syscall_32+0x890/0x890 [ 203.068145] ? entry_SYSENTER_compat+0x68/0x7f [ 203.072717] ? trace_hardirqs_off_caller+0xbb/0x310 [ 203.077718] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 203.082548] ? trace_hardirqs_on_caller+0x310/0x310 [ 203.087558] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 203.092569] ? recalc_sigpending_tsk+0x180/0x180 [ 203.097310] ? kasan_check_write+0x14/0x20 [ 203.101533] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 203.106369] entry_SYSENTER_compat+0x70/0x7f [ 203.110762] RIP: 0023:0xf7ff7ca9 [ 203.114114] Code: 85 d2 74 02 89 0a 5b 5d c3 8b 04 24 c3 8b 0c 24 c3 8b 1c 24 c3 90 90 90 90 90 90 90 90 90 90 90 90 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 [ 203.133013] RSP: 002b:00000000f5ff30cc EFLAGS: 00000296 ORIG_RAX: 0000000000000004 [ 203.140728] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000020000280 [ 203.148005] RDX: 0000000000000009 RSI: 0000000000000000 RDI: 0000000000000000 [ 203.155266] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 203.162519] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 203.169772] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 203.177026] Modules linked in: 22:13:47 executing program 1: r0 = socket$inet6(0xa, 0x81000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e20, @broadcast}, 0x10) sendto$inet(r1, &(0x7f0000000200), 0xfffffffffffffeb4, 0x2000800e, &(0x7f0000db4ff0)={0x2, 0x4e20, @loopback, [0x2, 0x7000028]}, 0x10) recvfrom(r1, &(0x7f0000f9cf9b)=""/101, 0x389756b1353686c0, 0x120, 0x0, 0xffffffffffffffeb) 22:13:47 executing program 2: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer\x00', 0x0, 0x0) r1 = syz_open_dev$sndtimer(&(0x7f00000001c0)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000029fcc)={{0x0, 0x2, 0x0, 0xffefffffffffffff}}) dup3(r0, r1, 0x0) 22:13:47 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x8}, 0x1c) r1 = openat$ion(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/ion\x00', 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000009fe8)={0xfffb, 0x1a, 0x0, 0xffffffffffffffff}) mmap(&(0x7f0000004000/0x4000)=nil, 0x4000, 0x0, 0x6012, r3, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00') sendfile(r0, r4, &(0x7f0000000040)=0x100000, 0x8001) 22:13:47 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'hash\x00', 0x0, 0x0, 'sha1_mb\x00'}, 0x58) r1 = accept4(r0, 0x0, &(0x7f00000000c0), 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ipv6_route\x00') sendfile(r1, r2, &(0x7f00000002c0), 0x10000000000443) [ 203.185431] ---[ end trace 903798e702396e09 ]--- [ 203.186370] kobject: 'loop0' (0000000027bf4c34): kobject_uevent_env [ 203.190348] RIP: 0010:memcmp+0x28/0x160 [ 203.200736] Code: 00 00 48 85 d2 0f 84 0a 01 00 00 48 b8 00 00 00 00 00 fc ff df 55 48 89 f9 48 89 e5 48 c1 e9 03 41 54 53 48 89 fb 48 83 ec 18 <0f> b6 04 01 48 89 f9 83 e1 07 38 c8 7f 08 84 c0 0f 85 98 00 00 00 [ 203.211177] kobject: 'loop0' (0000000027bf4c34): fill_kobj_path: path = '/devices/virtual/block/loop0' [ 203.219835] RSP: 0018:ffff8801bfabef48 EFLAGS: 00010296 22:13:47 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'hash\x00', 0x0, 0x0, 'sha1_mb\x00'}, 0x58) r1 = accept4(r0, 0x0, &(0x7f00000000c0), 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ipv6_route\x00') sendfile(r1, r2, &(0x7f00000002c0), 0x10000000000443) [ 203.256227] x86/PAT: syz-executor5:8911 map pfn RAM range req write-combining for [mem 0x18b3b0000-0x18b3b3fff], got write-back [ 203.258060] kobject: 'loop1' (000000008eef88b6): kobject_uevent_env [ 203.276788] RAX: dffffc0000000000 RBX: 1ffff10037f57e40 RCX: 03fffe2006feafc8 [ 203.293698] kobject: 'loop1' (000000008eef88b6): fill_kobj_path: path = '/devices/virtual/block/loop1' [ 203.322127] RDX: 0000000000000002 RSI: ffffffff883ba280 RDI: 1ffff10037f57e40 [ 203.324215] kobject: 'loop0' (0000000027bf4c34): kobject_uevent_env [ 203.345196] RBP: ffff8801bfabef70 R08: ffff8801beb800c0 R09: ffffed003b5e4732 [ 203.354141] kobject: 'loop0' (0000000027bf4c34): fill_kobj_path: path = '/devices/virtual/block/loop0' [ 203.368717] kobject: 'loop2' (0000000071713a96): kobject_uevent_env [ 203.375931] kobject: 'loop2' (0000000071713a96): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 203.376688] R10: ffffed003b5e4732 R11: ffff8801daf23993 R12: 0000000000000002 [ 203.401807] kobject: 'loop5' (000000004e89098e): kobject_uevent_env [ 203.408265] kobject: 'loop5' (000000004e89098e): fill_kobj_path: path = '/devices/virtual/block/loop5' [ 203.421687] R13: ffffffff883ba280 R14: 1fff7901f7a17140 R15: dffffc0000000000 [ 203.436419] FS: 0000000000000000(0000) GS:ffff8801daf00000(0063) knlGS:00000000f5ff3b40 [ 203.449685] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 203.455959] CR2: 0000000021000000 CR3: 000000018b259000 CR4: 00000000001426e0 [ 203.463482] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 203.470799] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 203.478144] Kernel panic - not syncing: Fatal exception [ 203.484483] Kernel Offset: disabled [ 203.488105] Rebooting in 86400 seconds..