0x22, 0x15, {[@main=@item_012={0x1, 0x0, 0x8, "96"}, @global=@item_012={0x1, 0x1, 0x5, 't'}, @global=@item_4={0x3, 0x1, 0x4, "d628113f"}, @global=@item_012={0x1, 0x1, 0x6, "a1"}, @main=@item_4={0x3, 0x0, 0xc, "095ca76a"}, @main=@item_4={0x3, 0x0, 0xb, "76789e42"}]}}, &(0x7f0000000180)={0x0, 0x21, 0x9, {0x9, 0x21, 0x0, 0x1, 0x1, {0x22, 0xaa4}}}}, &(0x7f0000000480)={0x2c, &(0x7f0000000200)={0x20, 0x1, 0xd7, "2f730a1dcb71b55a6e85f0658c0c042619d8e57cfe40a2c3f6e89ff68ae3282519744219031f85d2c7b3be44fdfc1958af0887752129c6a88811054ade2c86e93eda6476d3c3198f7086cf682b643c1860811113086554c2dd129f2c7b6ef49c7716f82e4cd464ac0abc09ee8d9df45d1eea7351c2636dc4d8a99d51688930be0e82195e011f56ca13baa7e78f8c17c34c7cbc35f224477a08254f6cb4ba28ff237373f98840d95835d03dff42488a4c5a3202d29139715ca9c8fd0a2724029f5900eaac6eb4ad4f431b17ee2aa6d319ae36ef1c51f758"}, &(0x7f0000000300)={0x0, 0xa, 0x1, 0x9}, &(0x7f0000000340)={0x0, 0x8, 0x1, 0x6}, &(0x7f0000000380)={0x20, 0x1, 0xaf, "96a8486f615a8a35393efc34e3e46fdd419a8593f3efb50ec6d306567dcd1498256a494cc859434ba2c2cf492e63c8973100a333c3dfeb2f486467b3bcf6cbe49c38b0357719055e457d5baa7f5e1f6dc700b5ff277dae8dad9b9df3a1ff8a862f0a2ad62a22fc8d0a191150684d6f938362a56c90e542a6121d6ff16b1b0b3d3f6fd7f7b6dbb6c0921e1be9d4a138287e24213278365f16dde324c20bca795c23844cc6c89619fc2da44d821b3f00"}, &(0x7f0000000440)={0x20, 0x3, 0x1, 0x9}}) ioctl$GIO_SCRNMAP(0xffffffffffffffff, 0x4b40, &(0x7f00000004c0)=""/166) r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f00000005c0)={0x7, 0x0, 0x1}) syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000580)=0x2) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046210, 0x0) [ 2089.091141][T25593] binder: 25557:25593 ioctl c0306201 0 returned -14 [ 2089.138283][T25595] binder: 25590:25595 ioctl 40046210 0 returned -22 02:34:51 executing program 0: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100)='/dev/hwrng\x00', 0x82, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x2, 0x0) syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/capi/capi20\x00', 0x402, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) r3 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, 0x0) ioctl$BINDER_SET_MAX_THREADS(r3, 0x40046210, 0x0) 02:34:51 executing program 1: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r0, 0x4b6b, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000040)=0x1) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/capi/capi20\x00', 0x4800, 0x0) ioctl$TIOCGSERIAL(r1, 0x541e, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=""/251}) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r2 = syz_open_dev$ptys(0xc, 0x3, 0x1) ioctl$VT_GETMODE(r2, 0x5601, &(0x7f0000000080)) r3 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) write$vga_arbiter(r1, &(0x7f0000000280)=@unlock_all='unlock all\x00', 0xb) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, 0x0) ioctl$BINDER_SET_MAX_THREADS(r3, 0x541b, 0x0) 02:34:51 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080)={0xffffffffffffffff}, 0x13f, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, &(0x7f0000000100)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000040)=0x1, r1, 0x0, 0x2, 0x4}}, 0x20) 02:34:51 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100)='/dev/hwrng\x00', 0x288900, 0x0) setsockopt$inet_udp_int(r1, 0x11, 0x1, &(0x7f0000000040)=0x7ce3, 0x4) r2 = syz_open_dev$tty1(0xc, 0x4, 0x3) ioctl$TIOCMBIC(r2, 0x5417, &(0x7f0000000080)=0x400) ioctl$SNDRV_CTL_IOCTL_HWDEP_NEXT_DEVICE(r0, 0xc0045520, &(0x7f00000000c0)=0xffffffff) ioctl$TIOCSTI(r2, 0x5421, 0x100003ffffe) [ 2089.265078][T25600] binder: 25598:25600 ioctl c0306201 0 returned -14 [ 2089.296318][T25600] binder: 25598:25600 ioctl 541b 0 returned -22 [ 2089.338062][T25606] binder: 25603:25606 ioctl c0306201 0 returned -14 [ 2089.350090][T25608] binder: 25598:25608 ioctl c0306201 0 returned -14 [ 2089.368631][T25606] binder: 25603:25606 ioctl c0306201 0 returned -14 [ 2089.415981][T25606] binder: 25603:25606 ioctl c0306201 0 returned -14 [ 2089.442630][T25606] binder: 25603:25606 ioctl c0306201 0 returned -14 [ 2089.459811][T25606] binder: 25603:25606 ioctl 40046210 0 returned -22 02:34:51 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) recvmmsg(r0, &(0x7f0000004640)=[{{0x0, 0x0, &(0x7f0000003000)=[{0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x9, &(0x7f00000030c0)=""/161, 0xa1}, 0x9}], 0x1, 0x2, 0x0) 02:34:51 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5421, 0x200400000) ioctl$MEDIA_REQUEST_IOC_QUEUE(r0, 0x7c80, 0x0) ioctl$KDSETMODE(r0, 0x4b3a, 0x0) 02:34:51 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0xa8, 0x0, &(0x7f0000000300)=[@request_death={0x400c630e, 0x1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000140)={@ptr={0x70742a85, 0x0, &(0x7f0000000040)=""/167, 0xa7, 0x2, 0x1a}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/15, 0xf, 0x0, 0x2f}, @fda={0x66646185, 0x8, 0x0, 0xf}}, &(0x7f00000001c0)={0x0, 0x28, 0x50}}, 0x1000}, @release={0x40046306, 0x2}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000240)={@ptr={0x70742a85, 0x1, &(0x7f0000000200)=""/41, 0x29, 0x0, 0x2b}, @fd={0x66642a85, 0x0, r0}, @flat=@binder={0x73622a85, 0x100, 0x3}}, &(0x7f00000002c0)={0x0, 0x28, 0x40}}}], 0xaf, 0x0, &(0x7f00000003c0)="1efd17c5852a66dcb0eb2c41b7bfc8922b71c9d5f534cd0e956417d8e7221a82399af6351a48ce87808fdd3e8424bdf4379226a47287d0a80d74856e1ebc326f27e050a4e73f0e05f3b551f341ff67e84e03e27b79bbd3536ccd727436e611dd22c06f4e216bdad3cade78cc9d29456d57b2f482a7e492423a17bfe52e8ac283a3e7ff6b20c20023531d24ef5db5728e2c25b5ef331f79cea03f60506f63aca19c39f6a2b70de21c824270cd2b1832"}) 02:34:51 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) sendmsg$RDMA_NLDEV_CMD_SYS_GET(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="300000000614040027bd7000fddbdf25080001090040000000000000010000000800010000000000080026e7431617007cb9e1117060865e38c7c99021c28d44022987510516ca1ff4a3763925a74e3d12354dc427d493c910dc72a00a80488c6dbc96f135e49aac73621b57ddc859c54ba0e706c52f5d68f1d0f0ff01a598f20000000000000000"], 0x30}, 0x1, 0x0, 0x0, 0x914}, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x28, 0x1410, 0x300, 0x70bd2b, 0x25dfdbfd, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8}, @RDMA_NLDEV_ATTR_STAT_RES={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x80}, 0xc) 02:34:51 executing program 0: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r0, 0x4b6b, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000040)=0x1) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/capi/capi20\x00', 0x4800, 0x0) ioctl$TIOCGSERIAL(r1, 0x541e, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=""/251}) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r2 = syz_open_dev$ptys(0xc, 0x3, 0x1) ioctl$VT_GETMODE(r2, 0x5601, &(0x7f0000000080)) r3 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) write$vga_arbiter(r1, &(0x7f0000000280)=@unlock_all='unlock all\x00', 0xb) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, 0x0) ioctl$BINDER_SET_MAX_THREADS(r3, 0x541b, 0x0) 02:34:51 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x204102, 0x0) ioctl$SCSI_IOCTL_SYNC(r1, 0x4) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) [ 2089.867644][T25621] binder: 25617:25621 ioctl 40046210 0 returned -22 [ 2089.876885][T25622] binder: 25614:25622 ioctl 541b 0 returned -22 02:34:52 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) ioctl$SNDRV_CTL_IOCTL_HWDEP_NEXT_DEVICE(0xffffffffffffffff, 0xc0045520, &(0x7f0000000040)=0x3) 02:34:52 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x400) mmap$binder(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x4) syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) [ 2089.920823][T25629] binder: 25614:25629 ioctl 541b 0 returned -22 [ 2089.930343][T25623] binder: 25618:25623 ioctl c0306201 0 returned -14 [ 2089.946960][T25623] binder: 25618:25623 ioctl 541b 0 returned -22 02:34:52 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5421, 0x400000) r1 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$SOCK_DESTROY(r1, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000040)={&(0x7f0000000180)={0x2388, 0x15, 0x100, 0x70bd26, 0x25dfdbfb, {0x1d, 0xc}, [@INET_DIAG_REQ_BYTECODE={0xed, 0x1, "1d00c4330e2daedb19fcaecb69517aff87f140b39c64e910960f61c3fc5a06b95266d8965062bd66706dc17ae5173a520ad81da071c782a7629a92db665a26bbadc5d6dc81d03af94cd7b8e000d3e79385b5696063005d4ff350ce46ee0be715e0415c8f5349db0aeaedd4bad33cee3eb92e840119a073c542bdbc7377a07f3ff70f42b6ddaab5e4b3cb1588d5a77502f1664e57c1280eb2658c43ec799bcf65dceabd0ff4a6c84c9f9a14b726ebb38518035d4db233867f6a164ef8cbd273488f50d62f95e74e75fde42c7a229d3e02674af6789464368b917ad946e522688238a00c1f4f99eb243e"}, @INET_DIAG_REQ_BYTECODE={0x5b, 0x1, "e10ed817f77ab3159134277f2e7e31816c0e23ab3b926609c7712d613c4e795819bece4c115bd7a3ae5bdeba0f221aca029ea9433221d012d8c8b074d2ba696f3a1f4a1721883c67ed54233fbf62740be31bac5c68ea2b"}, @INET_DIAG_REQ_BYTECODE={0x1004, 0x1, "bef84f8aed3a792bb702b37c04cbfa4a17cd7efeeebe623ec0203aa00e0e9574fd4177f6809d78d5e8bb990e68da21d3d61efe6e598f8560660bbc37f0231fdba160c2a9a5b0e78ea0073d843b20d5ac6a75af19daade54929f64cd3b63516e7ef3908ca270577d806322ba67243458d5a243270930295e18ef6e6acd90119c71fb9e7b082b990cb7d8ae994081bec03556a2c84734c7bb1b5d4d1ef49edc96333ed23bc5d4441586bfd6f43447e9d27d376a339b1f84dbff2494feea19abe0bd763f062f5a91279c226bb812178c78940f02a19ace2cf5f9904ba8009339549fd3ee5df06a25315b49a9bdb4b214d40d68366415089ff99b56a0e54c376b107fe7770bbf54de14cad6bd3924cc7f808dd59e16c8ab16d885965ddcc79b396639b92cd05ef2e71ffa2aa30d1af6fd291ce04fbca5c5834c937a5210a7c295406eb117108477730f728e8b31fd282fe8636c81c6f6f7c8d695fda018a5bf300d67f510835cf430d484986453f24847c04f2d64ee90c8394ca21e23c169346fe19c94862ec9f1704ae8101bb296a967490679ff8dfbfc56f6e75326e9d601ea4c2abca6d1eebc2a33ddac386377b8cda43ff0352ffa71b5435fe33490fdd5935c41386fcbb3c0e45fff279c8b905ef928add4aab80b3cbd8a861109cb9654df3ea277ff39163a35b64c3d08f4cfae37a7b6b66c11e7f13c2a2afa0bed9a91acf48e82d6475196881794dcbfc437c43a52f397fe47edea18973b2b73245c0ae0447823673a03ad7c3c85ffd1439aa34c3b97e66956cae336193cfb482f88124428dfb3e3e1a15737abd059f93762ebbe8b77bf7f58cb4a3e01b227c1841881639bd7f85520aa9e9a8446b12570556563e18a3fd50f7f33182ce688427544ebaf97a466acccf8785587c85bbf0a5f0b51ad537c7b7bc7b25786bba3e38ac4c897116f129499d90a7531075b3b6aabd35ca0f375be447cbd00bcc3326973d6c9274c97c08ce7a051ef35a6729dabb5223e690e845f78fbed1efd4f5d826a2ba1eb6b243c4fb2e39449656334ba5a5d452514855540467dedf54103995bfd93ac447ad688e231e62c06b2da01ee302584741a2bf8b66156d672774c39cba9edd3a4e7c9329e1da28f11a4b996e3853bd88374438ad501f830a375dcd1a7d1d6c407dc1f863459c0f0248162d6a90cd1acf64181062808fa4140d302713f457eddfc3e62febb2eada96ef8e86f60f6509801e171660f1ddbb177101aa49dfd0b9edb9daaa71023f26643124789956d7c4214cc77e41342928bb4e9022a7c56cce45bc05e7a8d0fe34ac1ca0546d5d0b2e4b10a7df0e98b81a1d10b2ea763d129dbe0b49613f90b38bd91955537966bcc1e99667a0cbf2dbfd99e9153ca43f6d02503cafd94b3297a7c28070d5b10290382faf1d523ba3baf3a9b20c88a1e805c37914fd13c272ef29821c2fd4bfcc3b66140746b0bb8eca39b6f66961ea2dc15c8d0b5529bb47a223b3671aed8c55bf8d6fc42bc73ea995a601997c5c36279ea0b1725fc32c3fb3c2de6ffa2d5d667801e6bbe827b981c5afd1a5f8b6eb4439e7ea174d4674d799f7258e5afc2457709a920ffc651469908b6409a245b83bcf130dc8a14e89012cb57fe0d0ffbe828a047ca637403fddb17287f800d9fb91d7fb06ae4706bd5c4a9ca2785330b61df328b7fc37fcdc3585a214c73e1d6cafe52168088f2c311842a1c2627cc5417b9469dbd6af47b13783e50da882d97bcdb576ba63dcd16d9a796056166fd02d4930231d2673779008adbc202d3aae0e5e4e1aaa46a1479bd9346146b927c03f4ba63b8e894c58f7093ebf344e4f566cfc39cedade834f7f3593e92d115d933ba680e4421df49b214b057412875cf3142e10de442207f0c26de3d93d57ccc701dbfcf0f2f9c7b4c7931d9317efa890ed36a03c489424774ad7e3851aff45179aee9c80298dd7d8ad8944001f9951f7b6c234abe90ea22547ee9181a6b0a3107e0cf9574b52004e9ea98436ecdcadea7cdceeca813d9e9b85dbecb4bb9e256b6ac8aca65f1fbfa9864c005ea9d3a067240d0ad3eb9e2c22afc7101b91a24d342cd2b86640801ff01d0fd45913c30cc5a511358122b581204af15de81632211b2f5291d6c282e11d0696c234aee7391796991876df230d1c488f3c5ad8c181a80c198d992a5125b0e054f35172f9a39dfe52e96446d8ea8be8aa9518d989a2c8bc28be2264417e4e415a332dd3424e01d3a9a9d120f2f73fcdb9f2c7f4835c0ef5a467408e627443947c608c8b49e06eaf079f7504ef0c8a26b7bc9faf47c4685c299cb5438e45df0614119a7b846030445b4a2a8c7eb6922050adf8673987dd4d7550a46f14d6e1cfdc95931b220cd9371cadaacaab162c8d526c63a6e70a0a51f5ddd5866a65581c4b8abe59b35411b0a3b096bead653380204426ec04cfc4be95a89ce3e704408c3f53742434e80670fce6c62ee2cea9f249c55339e4c3cb472f16b1275af6c0fefc63e5e0170b1cad074d97850a899e7a503365ad0117ef3589c2d0721620e951cd31512117deee57f23bf5a1ba7e57c822f6b6b3eebfe51992bbc53bf6209cc36c90a2c05b621d96719f79854113ebe8baba894442127b4b03ccc6f7946987477b7613f52f326b6d43be11872faa101dc8dea745b20a20ba55422efe504703946576f0eeff9d306496f77793c6ddc4149afe3eacd9189cd6c4408d488019d8de25c4c080c42c9b0c5d5495c77705984eb3b5d2eae8e90eb5330c9fa3915fdec0abe684534e77f841f2312669aae2af2f00d0a5bd9fcaee004d24d923968613bdc52163bf3efb8587f34091ab850d4b2f1ec1fa24c8446613695331182f316d527680b230e7cf3fa836fa98efc6f57c9cebb01f83068276e45aaeadb744b30feb7aafdd384d683cfc3f5dad6e9f39cfb162e9c3f36f4c0bc10f587b76c1aa9c679d7b097ac0b464f64e13de7bbc176a8d2055a6d4e2779270274862fc675e1a82abef68707d59a815647aacea04b0b11784d54fd477d83e84fadde963acdf8a64111951a1e9500873a4ba8906e9dc30ae297d507991c8595923b85cb912151e1e48c7d180fadbeb458096607f3fc0e692d1edb943ddd32240739ee2f83bba9915af3f411ccb56991555a9118eb01c86957c4a95cb17b6d322dda774b4af8ae9c4419b4c291ecf0f4a4b77b058da28a6636abe899d471b48fbd898afa68167dd28c4b1dd1d31a17b83c0131ddd2f5cbfc0bfda26993af22034860c8003541f12c727a90ad3d818331994f06d5a1c78343030a09be1081226d1a4dc409572dfc50f05d60ef7dc75bc07a7d6875e456a9ce62cf0b5ed3d8cfc930d003b39717d1567f10536bde0fe259abdbfcd6c8506d86bb5109c69886c8e32d734ecc20aee027f48d5f666b2652f30c0f07fa3e104a8ac5ac7cc4060ce6a9a2e69f57f26869f9d3ecb3dacdcae5ecbf89c3e9dccfefed9d8d20b13937626ef12468df4e9c6076108e4e2e976484065ff852511a24bd861f45685f426eb11ee5783a862d6b4b0eb0c6d389569471b6a1a553b3b92739f83c27f472641baa6d48ad8bf3171b307cb282a3e4dc9e227a64f6d5f27ab1ab690de979cc5064057af8f5fb7af3c0d1c6aa6442d751032331266ac762be5044f1298cc67aa9ec718803e6e1403e03035fa519360dadd8e9919113687c6a3be0ee3d0fffbd63b4388255ad9eeb78fb2bd1366de219dbc7d34338ea5ef022fed19011711883d4056e37f486a76112095f2531a9249e9d1c469ce8f85a28cfcd99f64680cc965b2bd273f893c66404e7d6b452863418cf4c5c5b9ae0de5b1969113c0f2e5a01f236f1f85135a99a6fce780a9c84043896d3c8b8a69be3091a59add8c3657b859c1b4cd3b42e9e8d2f12cb0e97a45f86e452f5eb5a8e189923f0662d9685ce7c95dc3a03f22760e4e51b192e74b940042012d00266aeb58fff15846d8b8e16e1b21eb239b4431659be2443065d01fb3671ca055ac58a0ee67cbc2a298b43c10442be45411bada6125b5cec890aee4f6867aae1163f8eec6ef2c8793a0b8da30a7f5258971b2c1dc092d81e6d394ad1c2c78b7c6493878b61e134e737ced8d785b8fddb1bb3f0fa8442141b541aa22e4615574707870b6c5938954c522f4b67351fcf8950dabd01b156bc1e9a53a7703a5db6fc4ce15119aabaaeb639836de517e19f159d2b9e947562eacf805c528a3811e4809dc45e1c71facd55336b965a9cbf5fc6f63bf56813b7fa71a26612dbe6bbff1e58d2bc18ccad699d80ab04785593dafc98d1f9e60b018dea3a1a5a608c378bc8e99dc6113db4c4f8a6bb956a794b8281c136df7df41c6f9ba4ebc9bcae463625122206a4307e7baa524bc5613da532d8fad2f0103c41b7caeaf05edd1798c474e6e66f616f39955528b10f50b384120829c3cb81f38a33352bbcbf728fa8a1dccd8df11e88823e312c56a3073236ccf6655a9ef28f32b2fb819c01b02898ec2f01868b53a8e4870544d0d12cc83286df5aee685b9a6c3bf4f17b5549050df9512a7443396bfd37aa4baa5354e3fe863941fa704c8295e67feca77577b0efb4d24e777a9eb764448ad0f174e65e4d801c75247bbf2e7b49f286ec8034f7b8f5ecbffe961e27d151f0b83322a927128e6306ec99102db4742df016ef1d47a1e0268779b044ff7412c9f958746c62c339742a2f375080fc2cdf953abfcdf15d143b386d19e8984dca485f1a675f48c99319d940b083c343497a3206ab4c55809b2e3378eb99342ca7d55160becb72f3c2c8671e5744567a42b3c9d1f11370c654147ed8794b71190e90b0b9d3a1349e6adb8100a44accbcc5449e3e41d988fc4c27cbff69757f4b6cec86d56d15f2e6de3d3abf3c9dbf05c11010232039946313ad1ed9dad74e62d565f07f1e6fb86766907c469203cc440ba4d3967c162c6f6aeadcd985e22db77d2e4ec58f0b30aebad0963f620ed0db8fa895832fbafbb58487938090c4e7c3c7ac11c243c544b73256c76cf04774e3ffec546fa36d06de0edb44680633dacc6abdb16dfbf70ed6b78d52261e25b7ea3393264be2ac7e4743d748784bb94b5e51603b3b855c8d51240a772dc53d9092cf7cae61e64e0b37d7fbec95698d213ce0ca15368f00d0208d33f02d6ef69ab216e1ffbbc14b02feccbc662d3f84f92b72f96f6f4c7a6f0348154b4e567d67d0a4a37c8a6681e77ac37d0d87b4d4c938572780539f8f8ebbd5370acc0f95b7270647dce5a284aec76bc5239a109bd7446af9d11f83d3bda67b4d60da5bde5171980122bff19e085a34242e6d551a860a8527fb86adae5cf965d0456bdc0514e0b30eca5085a7942cddcc5721931ae357d0d47966bfe7fd8284df760bdc2b3113c8b917771b58d34e085ccb0a966c34ac8e4b86a7c4875b8d1740d5c4b488c9c14c576526e5ace6b3b8f5f4dcb4d59a0c6514949b3240e9fe63c8fbb4277a249540d84ccb607d15734dd3f90d4bfd1ef29377afd11b0d50999aeed875b58741a55ae0d0f453c6a2c05714bdb0725e6aad8c004a6418340e4c72f6eb9d7db08125fb18242f3d3dd7733e70826536eecb3218f3cde3d9bf5b8a84accdbe1b782802a2893e3b9fe51019da08bfe65543b26f0c67a89bb11578618fc2e37aee67162a0824cbc233049a11caea15da25dce7601258cb0651263c6335c534c2b821d75b4f13564d5026aa991121dfbee14b5071dd39d42766889e725a087b83cf4220b477e10799a0445b012f93b940d31a9e0689b"}, @INET_DIAG_REQ_BYTECODE={0x1004, 0x1, "9de84935d1e62a0305161e202cde0f6c677f42a5bb6e24046ef8b2ce422164ba1845f3566db95a129a4fa97b4563e067e8607498c891f3dec3152aa8080b52447da1530f944b0d11edee7d7534e11eb6f74ef56eeb98043ac630c4eccfb52ad6a4da94acbe62a38ae30a24c3d10967b5213bb6f2756c90ed2863643a98bba9efb8db5ae47a2d7718aaec755a431d4e723766132274b4cb508dcc7cfbd3c7015ad5dda361edcfff5d940fc1379e6b414452de5f0230fe78299136794084c9207e23716386c578dbd8c139ed321984890ffe0335ce9a7815a2e82df66f5dceed27fd01bfdef44a86266b9ba1f86ac054ffa378da29c2f96868bae49009b7d6dead65e907e052f349c3617bc7929d3ef2df46dfce1f877a47d25685ce88fb11ada5ca6cd5ff660cbc2f345a9eba29bb633196deb70d881cefd81fe1e6147ac43b08b4dfc0315b7ba22f6a558d9c5e953f33ca4952fd755896d5f5a558f9beaa99f02b04ab40b6783419003c8332479d20656604285ff917036adb2c53d8e7dfa84ef2b0f7f96917b5e5fbac2f1b416912ddccf76b2ea34c1ca04f24e9860b1826e82025ee6e7ae8cf21ff9bdcc1383df307cb20b8aa86d479d81d99b603badf500873c09836dd3910d8da14796c14614054662b98b6f5b12cfc67fd172ace0e3c315acadf17861cf840ca7b10b06daecf8bc788002432307076ece6255c09c2476dfcd2af8910345c08eb06a1b3390178fa5c0647a93e20694ae8ed2b2ca40005263c9a2cfaa1a4f0fcc38ce9a48a65bb3fb8e767c3141c14da03d19c1422b2a289d21e97f301ab273656305b8118bf754e02ef74ce63045c0bcbfdd9ea089a99dc1b137f23e49f5c9beb13c684d8cd17016f6daa66afda7ca211b30ac554ac5739aa595b951853299db985a8983bc84790ae6649bf8a5cf679fb2655372694ad8f7f2007ff79b05d098ecd9a1e672acf1d371693d9067f239551c388ab76621398e25fcc760d2a5e5de2425c870c2294714429b20da36e27393c3f4e1127bd51f82fc00f12e36cc9d6e8dd575a471d8073976dec53cb526d860d4677e4786f08a5686ae9eef3328e0586ae1dc3c84b069a4c5bd4e087895dee3f6446267c597f9b6cbf8d0c2219f92a83d52044b02d10042a7169c672b747d82abafb4672788db84178c65c0d9b427f75a5c906d576b24601ad4759ed6a13e11be7391358f76dda3709d0c6c1acc7bd86928f7629fb7ae0bcea33079d2b72b221b99cc1968673e16e456d11726c0ab1fcaf6d3481b8deee186267e3b1082c497fa099225d77d0fb706e98a53b2d8c60cf88c2b4cd65c777d9d11e7c58108652afe7c758c8011afa22e25649513b9824d1d5f6cf4997c77a9c0abfc68e10943a8a351a4467b57086223b231b25585323e66b5a907a399b1df09aeeb35e000d19fbd26462736e06a19985db673c9a736c21e908af216b76d4c521156fc26d0aab9e3cb1d8a21953795ae491b11997613802b9d05a88bdade5c6047682bd4e1561289b00ee53ec5f6ace0988f0e36bf711543b6b69f542035440419cf88d7e112f669a02d3c81ce4ae18b136588d4973ffe8bc9b7214d0f2c9e17eb30fe72bf7b0abb2bf34762e22b67ae8e4d4ac8d28363e0a5d262752c52cc9d508812d87460e8299c490e62442b00caf55688fd93e8379db21b2e2d2c5d3ebe43cfbaa9738585da872cb4e6742e28b59f4021bb4ab7166756b9f26df038a67cc490624cedeaad7dc9b4b7ba1d172d4f89fd81ab7ae4ebf33ce560cae451eed6cfaae781bd24e4a3ca3802528c91a3ef79a6864bc099ce695f0cc8d428b3db72c5fe2e65f30c530a9957e11350458349297229a21cbecedfac4befa378a97a30cf2352040d19e7751cbf818d9b6dda6d6165aef8624fe3f7ff5480cd360f6d8bb5d544251f10458cb1fe3d8fee76cbf2a2f902a1b8397de835ecb1ecfb73009ec91bde1eb37b3642ee217cc946b5e896e8bd528e1557b86ccf66f6287334c28e3af578bf36652f03a51d09fb40b07a48f32161d7007bbb34ca09907996a435e540942d2a3ba596ab3ee79a94facfdddbcabfea87155bfebed1e9cc7c947fecdbe60922e8e66cd2b0236022599c071cfd5ddbc722f7fdb5a44101c045990e9d43bdc51e046012eee59552bcdddaab68c861135dc057ba1d60cf071e5eca0a3eb5c74f278ea0fb883adedb8cea73cad200e76b01e7f84029a2779df16d8b0a163f35925332f5b5622083f2b736bbeacd3c728188d7464b709d2e24632b3f7a7779489755afc9f20d1a3e268b61275fa7cb4239aefb5bd13ee607a414f4fd2ac8dd59af2fe35c722d4905c01e4724811149b9eab554324396c35896ad57a7a316200f148243e427e1686bb4a5cc1f10256b1d393c28205ba8d5ba34612a3084c484188bf942e9f6d56b52068b6eb4783f594ac968b46a2a216052603499c188e7c91cb9229a0220171aa2195cbe980c2e7b2920d2056c4a5d789295d54ebc68a47d8570a43b83d02741ed5f741460a9d982aa36b2a1ec97a0a0f0b38fd92b0969ac981bbcd145dd84a49d83fd827cf2cfce05f90a7245c752eef4c1398d131a47a69159b7efc295bde3572f580e74b849902cc73dde27d1b89f15e4bdab989ac18cd75a13360c2aef3ad52076efbce359f12fced31649886b5c2706fab424f2d26dc9709fa1f7aeebd83df8b7753a8073f24f83414c922b51d994e56386e0aec1e07d0bfec26e19c8b372da2438b582007795ae0cf483d81fd0ccec71dbdb8cabdb30615e4b3875e85ac3f7c44f90fc87678d2b3db18c67df1b4803f386d1b517086528e82c3f906d1f81df297b4faa2fd0766f3737f1ba8cd6719841dfe36a8a597091e0086a8b4df2959c9115ff26b1a79ee747a4a74f04f14b8dc90ac8a68f1a16c760ee578342ef889b587aa8f8e5246c72a2d22d448c669e6a0081f269dea5d738d1e0ef1887865f172ad5943017a572687cafed784a0ef52774e11d020bf7554acbade106c74de1d2b28856f16322a0351a6af0299bbe31e38f40f9fba92130575d8411d1c33a37b3e17e8f0703c9c8cb5897e2114153662f56427f40cfa984a2c63701f45bd5cc4c1c2f71bddb346205e3350ddeb6e6d7d5f553b33cfb591eeb5dd6e690e25e07484d993b7357ee14df5cba2c675bf00ee8ecc17a69c9e106bd0e8a23b9b0d4db564b1807f30ec0e32a7d1a6fc653b5b63f26d11e65ca2ee4f8b32b6fd322f89b275450f008c5a792acba105413610836f6c6c1aab3baca23883a31ab7caa66f7d6fc8d8307ffd9e38f8bcb0878e3954fcd351a0390b1f1ed9f0cb4f2345f2e7ffb18a88e10e4f7d6a93e4e2b3c911a2c2455e74e38ad9d162693f07004ca275e793be59ae694a63e07fcb84591a7c7f161abed91b0ae0b4e5d06603884ce39323f660c33b9b9af2a3ac9935b64b0b80b71310498c6ada51370bb2b2d9004a882be3dcb0ab8e0fc70b270ee18ba8361ca89f7b4ba334aa28e753bef6fed098c175ec5b2471d2e2b27f201a76f41ed1955020c729c1dd1115eb4714459183f99e8c65e1751ee5c196457f9a0a5759345ca4edd3bc6c9d38bdcd1ecdb342889d68fda77ec532eed6fccf1ed46f38fb3efd50cf32fed9be40608f0f7f2863c7e34fffb4657ce322b47e55139c6997a87e27afb5dce429a0064f2cbbbbb5b75987574793884b42361385124d6fe6f8f1ad0c6c1cafc03187a5589c6b1a8d9793f26b6bd4a551dffd03c845ddb4b3f84f605b52784048c1a00bb6d9ee6444b8871305359ec54e676e51a7de12f23a4c4eb6ca342b16876026f90d80c2ba8abd2fb0fcf3656c534a07c100d9020a893679f09c007af4add06b036374c6061f4dff875348d024ea62d55eae7a8e03c190bab4b7fa69fbfade03e5e7275861379228c24cd46808b799fd7a9eca74c6365aa6ba5c94f18dd681197d0cc2a8efb95015b6f91e66e5ee9920e4581c016eab9eb1f51ac853e2b195e77fc5b2ac8d3d7e5ddbb3822a63e933579f8d555ab1469e22c7d1ddcccb0b1981321f4f3eb6d705a5f6338c60365b1416af38f6fe61b81bf3b4ea49b4a56ea8e424631044036c19277a5f82b12bb04c8b01d0243d705bc3a71762d7d8ef518c8ba03c4be9f76c7e9fbfdeca1a5170c8bf3e44af969febd2f2db10d8863ffe5a868c2a98a962167f3f36b57bbeb4f895b0a463a164a46e53cfd1734151d950dd23d8236a180a0ad5d9eed830bed3a3171acee4e2404a5f39ca7f9e6e06aa40f54289437ee1918b0d734dd7ae5b2d379678f68993c08d18829ea97a60e4b19521744fb2aa7c279f36a42fe53f71a1386490e08934d18a7b6287315e9899b288234449ccacdbf76d7b36726a07237753837799ffe5cc22825c50f32cd3495324c7456c8ad56aa042ca97c15437bf41eaf1da18779fe9490d3139019a215f1ca3f94dd47d56c4b1a340b85cb192c87ad75d7ee1f481e5b43b675724cb2eb5b0046e8cec91dfa365d422a7f716173d54d373410af650e8528f15fcc66e94a7fe7a10cf0e6bff6a4c56455a4922a460d281356d0c9e7708905a082d4ba2d12b7ee6803b0840cebbf23c01463a3d48e6a3b84ee1ec1e011fcc0259363540507107954322d1a8d2468403e74dd0b43d345411ae46ea6856711cded9c33e8203c4e28d5e8f86764c4d4a4a48329a9cdfcd38fb9ce37428b4b4065e1827412f60341e72a367f3554f3af0d87aeada792fbd84145e81f2c35aaf9c872730ee6cd4031e5557695fc0574704b5ab1e9dc794dc01ed2242e337fe9ba1fae984f35545c495c2036ee7db208fa39922e7322000064eb6c3dda5f07ec56f4f5436d32404757910bfdd4494a00f223299430aa7f5929fe45b0e1a42ec91e904f7ea79d5e3e2496d55a661593506c058340b2f52ceca031391c008056960236849f94592d749cf7b6659d01de37a75a981828ccd54fcdccb72820b2c7d3f17b6e418a8121538383044ee1d3807f88b4aa11815005ba1e1cf558266803e723257f5c25da83b7c33ae973b708312b8889c1d0f79b940b8bd783d02f327dbf0bc9e191aa6dceeb81d161f7507df41bebedc3707ff72ee34d7358c724cd6959a9a2aa2fa884980d9fe7a56e8c571a5ec3aaafb75089cc7013bb4ce4ef3f280e46086535498fdac4572226171f48db4253bd89f196a33c7e7fdf953e4f71bacab0a06205445cbb9b28f71fa0caa52cb7533eb86c7a1db487cc8fd8858dc2961c3927e828c70def149b66629c898f0ad8cd4b49cb93eb09424cd3a486e1e01437e13f19136a551b1eb6dfc60653d5fc91b046321a5aad75b52212cfa484e520297b6dd01a54ebb8204014b585e13ebd0e314395ddb2fbf506a0bab714fe56d205a87a0476786a9a7591cf29f63ed66ea8bc977b13ee501090efe681ca3dae88ba21290c969b14ae5bf9e3db34643c1e3ce2dbde45458eec391716bf70b9308fe0ec118136d484fe3f5c91b585e1a1e1d199d817772afc57dd5eaacc041501be2c2ca136e39f70c61aa8e994355c53f40cb2ea8b9eef177cae5410e05d699a942ba8354ffe049cb68e659a161463947569c8385f0fbcd75893dc7edf3edd0040168fd5a1b753475de66d12066e719337165793e9c1f5404baf237d8a80d00978c4e87bd38900e83742ae7d0a82f493e90e71836d8c457a65800a130da0656bb24386b599af4caaf4cd462e1093edcee6224ca4f210b4d434d22e85d5973a0ff7dbae80b24d6b013a299d86151d2a91a74e0b2bcac77ba5573aa6daeb2a7"}, @INET_DIAG_REQ_BYTECODE={0x17, 0x1, "70f7d1bd4bd98a65c2ecc1bd62014c93135536"}, @INET_DIAG_REQ_BYTECODE={0xc4, 0x1, "bf73c101fa8411d68d676d26fbc1b65a15449b008a586331286da3f1c4c51f9dbfde59914f719344d51beb41b18382e831c462d46a5fe823e7f338c41e22cc9c377ca130fd6a48c35fcadf30e8fb61840cb6da680097bb5bfe5237ff401be613ad1dcee1f0c6268079454e4e87b71dd6b85e75f13c12f8d02411fc76191aa06f5ada9a18d2ebcd92351d014a2c14984a9d9ab4bdc72626d7a3c3d66a72243ab4a04bf5ea9bed398a1d901059e7719c3c845822315823f2213bd0122b15d1eb3a"}, @INET_DIAG_REQ_BYTECODE={0xa6, 0x1, "4ddc91ea3e8d04881225f2644d8c516e84c5628745376fd420cf6fd4ec9988d144f352c86b41e1a7cd14ef063272cb7115b81bce2c106d0684ad103ec35519de4d396110b909480de36fd3ab43a51533e2ec064cb7d832a633053f8364f5882ba0cab8d114fd0eb764828b25c9e45ac723d229d725f940199f26c2195005e6fb2851d431d9f7635cd513dff95f6f5dbb4e9c1b4e8e71a253f36d1715b5e82919aa29"}, @INET_DIAG_REQ_BYTECODE={0x5f, 0x1, "74442dcc3ae87f713e992f3ec3233934785f26d44038bc508031c83072a605b35ef5349a1b66477ba5bb84ade8e68b3b1a6fe347dd6f411c2607206e2bbcc4138581eee7a1926e21de3458921a4e20d564890d895a8a2eb33f6755"}, @INET_DIAG_REQ_BYTECODE={0x3c, 0x1, "d2531adaa32b323f6d3196a530c4dc311f2689f09c140fa714d3e6fc6f1f407d5018ae64d4b1beaa084af8206ce31282d46bab2b6bde250c"}]}, 0x2388}, 0x1, 0x0, 0x0, 0x8800}, 0x841) r2 = accept4(r1, 0x0, &(0x7f0000008640), 0x80000) setsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r2, 0x84, 0x8, &(0x7f0000008680)=0x9, 0x4) 02:34:52 executing program 0: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r0, 0x4b6b, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000040)=0x1) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/capi/capi20\x00', 0x4800, 0x0) ioctl$TIOCGSERIAL(r1, 0x541e, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=""/251}) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r2 = syz_open_dev$ptys(0xc, 0x3, 0x1) ioctl$VT_GETMODE(r2, 0x5601, &(0x7f0000000080)) r3 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) write$vga_arbiter(r1, &(0x7f0000000280)=@unlock_all='unlock all\x00', 0xb) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, 0x0) ioctl$BINDER_SET_MAX_THREADS(r3, 0x541b, 0x0) 02:34:52 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f0000000080)=0x8c8) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) [ 2090.057145][T25633] binder: 25631:25633 ioctl 40046210 0 returned -22 02:34:52 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r0, 0xc0405519, 0x0) ioctl$SNDRV_CTL_IOCTL_TLV_READ(r0, 0xc008551a, &(0x7f0000000040)={0x8, 0xc, [0x7, 0x200b2ba, 0x8]}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x200400, 0x0) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r2, 0xc0405519, 0x0) sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(r2, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x34, 0x140f, 0x10, 0x70bd26, 0x25dfdbfd, "", [@RDMA_NLDEV_ATTR_CHARDEV_TYPE={0xb, 0x45, 'smc_ib\x00'}, @RDMA_NLDEV_ATTR_CHARDEV_TYPE={0x7, 0x45, 'cm\x00'}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x34}}, 0x518a015859f1dd5) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(r1, 0xc008551c, &(0x7f00000000c0)={0x400, 0xc, [0x400, 0x3, 0xd3d5]}) sendmsg$GTP_CMD_GETPDP(r1, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x38, 0x0, 0xe05, 0x70bd26, 0x25dfdbff, {}, [@GTPA_NET_NS_FD={0x8, 0x7, r0}, @GTPA_TID={0xc, 0x3, 0x4}, @GTPA_I_TEI={0x8, 0x8, 0x4}, @GTPA_VERSION={0x8}]}, 0x38}, 0x1, 0x0, 0x0, 0x40}, 0x4000000) r3 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r3, 0x5460, 0x0) [ 2090.156194][T25641] binder: 25638:25641 ioctl 541b 0 returned -22 [ 2090.247377][T25642] binder: 25640:25642 ioctl c0306201 0 returned -14 [ 2090.262500][T25642] binder: 25640:25642 ioctl 541b 0 returned -22 02:34:52 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) recvmmsg(r0, &(0x7f0000004640)=[{{0x0, 0x0, &(0x7f0000003000)=[{0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x9}, 0x9}], 0x1, 0x2, 0x0) 02:34:52 executing program 5: write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000240)={0xffffffffffffffff}, 0x111, 0x8}}, 0x20) write$RDMA_USER_CM_CMD_QUERY(0xffffffffffffffff, &(0x7f00000002c0)={0x13, 0x10, 0xfa00, {&(0x7f0000000040), r0, 0x2}}, 0x18) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046210, 0x0) 02:34:52 executing program 4: write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, &(0x7f0000000080)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000000), 0xffffffffffffffff, 0x0, 0x1, 0x4}}, 0x20) r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x14402, 0x0) ioctl$TIOCSTI(r0, 0x5421, 0x400000) ioctl$KDGETLED(0xffffffffffffffff, 0x4b31, &(0x7f00000000c0)) 02:34:52 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) 02:34:52 executing program 3: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) 02:34:52 executing program 0: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r0, 0x4b6b, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000040)=0x1) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/capi/capi20\x00', 0x4800, 0x0) ioctl$TIOCGSERIAL(r1, 0x541e, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=""/251}) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r2 = syz_open_dev$ptys(0xc, 0x3, 0x1) ioctl$VT_GETMODE(r2, 0x5601, &(0x7f0000000080)) r3 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) write$vga_arbiter(r1, &(0x7f0000000280)=@unlock_all='unlock all\x00', 0xb) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, 0x0) ioctl$BINDER_SET_MAX_THREADS(r3, 0x541b, 0x0) [ 2090.802965][T25656] binder: 25650:25656 ioctl 40046210 0 returned -22 [ 2090.811587][T25655] binder: 25652:25655 ioctl 541b 0 returned -22 02:34:52 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r1, 0x4b6b, 0x0) socketpair(0x29, 0xa, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0x60, 0x0, &(0x7f0000000280)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000480)={@ptr={0x70742a85, 0xfffffffd, &(0x7f0000000100)=""/128, 0x80, 0x1, 0x2}, @ptr={0x70742a85, 0x1, &(0x7f00000003c0)=""/135, 0x87, 0x0, 0x30}, @fd={0x66642a85, 0x0, r2}}, &(0x7f0000000240)={0x0, 0x28, 0x50}}}, @register_looper, @clear_death={0x400c630f, 0x2}], 0x34, 0x0, &(0x7f0000000300)="32d75804fa98b814dea1f75347110d39a2e87ab9393fb1f7bf52a771161346111b8ced413efeee944607ed4fefb73aa4d36107a9"}) r3 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x1000, 0x80) ioctl$TIOCPKT(0xffffffffffffffff, 0x5420, &(0x7f00000000c0)=0x3f) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(r3, 0xc0045540, &(0x7f0000000080)=0x8) ioctl$KDGKBLED(r1, 0x4b64, &(0x7f0000000380)) 02:34:52 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5421, 0x400000) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) sendmsg$RDMA_NLDEV_CMD_STAT_DEL(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x30, 0x1412, 0x200, 0x70bd29, 0x25dfdbfd, "", [@RDMA_NLDEV_ATTR_STAT_RES={0x8}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x1}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x3}, @RDMA_NLDEV_ATTR_RES_LQPN={0x8, 0x15, 0x4}]}, 0x30}, 0x1, 0x0, 0x0, 0x40080c0}, 0x40000) 02:34:52 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$KDGETLED(0xffffffffffffffff, 0x4b31, &(0x7f0000000040)) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) [ 2090.863832][T25657] binder: 25653:25657 ioctl c0306201 0 returned -14 [ 2090.889642][T25657] binder: 25653:25657 ioctl 541b 0 returned -22 02:34:53 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x1000, 0x3}) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) 02:34:53 executing program 0: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r0, 0x4b6b, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000040)=0x1) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/capi/capi20\x00', 0x4800, 0x0) ioctl$TIOCGSERIAL(r1, 0x541e, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=""/251}) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r2 = syz_open_dev$ptys(0xc, 0x3, 0x1) ioctl$VT_GETMODE(r2, 0x5601, &(0x7f0000000080)) r3 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) write$vga_arbiter(r1, &(0x7f0000000280)=@unlock_all='unlock all\x00', 0xb) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, 0x0) [ 2091.027361][T25669] binder: 25665:25669 ioctl 541b 0 returned -22 02:34:53 executing program 4: r0 = syz_init_net_socket$nl_rdma(0xffffffffffffffff, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_QP_GET(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x28, 0x140a, 0x2, 0x70bd2c, 0x25dfdbfd, "", [@RDMA_NLDEV_ATTR_RES_LQPN={0x8, 0x15, 0x5}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x4}]}, 0x28}, 0x1, 0x0, 0x0, 0x14}, 0x100008c0) sendmsg$RDMA_NLDEV_CMD_GET(r0, &(0x7f0000000200)={&(0x7f0000000100), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x18, 0x1401, 0x100, 0x70bd27, 0xa4c, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}]}, 0x18}, 0x1, 0x0, 0x0, 0x4040801}, 0x800) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r1, 0x5421, 0x400000) [ 2091.069063][T25674] binder: 25665:25674 ioctl 541b 0 returned -22 [ 2091.075823][T25675] binder: 25668:25675 ioctl 40046210 0 returned -22 [ 2091.127095][T25677] binder: 25668:25677 ioctl 40046210 0 returned -22 [ 2091.144413][T25676] binder: 25672:25676 ioctl c0306201 0 returned -14 02:34:53 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) recvmmsg(r0, &(0x7f0000004640)=[{{0x0, 0x0, &(0x7f0000003000)=[{0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x9}}], 0x1, 0x2, 0x0) 02:34:53 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0xc02) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) 02:34:53 executing program 1: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r0, 0x4b6b, 0x0) write$cgroup_netprio_ifpriomap(0xffffffffffffffff, &(0x7f0000000200)={'vcan0', 0x32, 0x34}, 0x8) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$TIOCGLCKTRMIOS(r0, 0x5456, &(0x7f0000000180)={0x8001, 0x1ff, 0x400, 0x4, 0x3, "a1d2f746ba8d72e421819e62b4ca5d39df9075"}) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000040)={0x6, 0x118, 0xfa00, {{0x40, 0xa59, "0d9996ce41a057cb7d27061b669c276c895cf2de3d7ab258a57ddf61d9f569a1516385882ea03ddb7dad97685d5c34807374fca76dfc35a28d20859108e59e4ae687b43503e9af71f349d766eb65ff5ce095c4f65ba342f2c319ea1b64e6460d4559b2eb4fa50c5184a5f40da599261c1af7c7847422bdc632608a96506dc5a6e380eb487afe04bb8a1dc2a8b3f751cc70291c434751a72cb1163a60b6c57fd8c7960dff45ac371c3667b3bccc886500bccf18b8162c65aba3f1be631872c2973a221705a6e49a0ab408488c9569b009aa228a7ad0512a8df1f5203b7bc79d68cf6173945b08622a81e5a56f132ec29d043aa519ed777151dadc98e40c08da39", 0x11, 0x62, 0x3c, 0x80, 0x2, 0xff, 0xfd, 0x1}}}, 0x120) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x541b, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r2, 0x4b6b, 0x0) ioctl$KDGETLED(r2, 0x4b31, &(0x7f0000000240)) ioctl$VT_RESIZE(r0, 0x5609, &(0x7f00000001c0)={0xf8e9, 0xda5, 0x8}) 02:34:53 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$TIOCPKT(0xffffffffffffffff, 0x5420, &(0x7f0000000040)=0x7) 02:34:53 executing program 0: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r0, 0x4b6b, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000040)=0x1) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/capi/capi20\x00', 0x4800, 0x0) ioctl$TIOCGSERIAL(r1, 0x541e, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=""/251}) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r2 = syz_open_dev$ptys(0xc, 0x3, 0x1) ioctl$VT_GETMODE(r2, 0x5601, &(0x7f0000000080)) syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) write$vga_arbiter(r1, &(0x7f0000000280)=@unlock_all='unlock all\x00', 0xb) 02:34:53 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x20, 0x0, &(0x7f0000000040)=[@clear_death, @clear_death={0x400c630f, 0x1}], 0xa1, 0x0, &(0x7f0000000080)="ebb03cf857abf6da4309ef7a85d2c6c59a5614d3580f5732e0ac21c58b3d3d14c860a699993faa8b84322dfccc3130524ec53215bcae749351c9a0062eb7193e66a354eb8a583baebd3014e85a05af8867cb37b75d7cf70cc3d6abb544738d3caf80a588842e1f580fb6ecedec1f5e5a09525117a74d991b2d97c48643c64167c3855f1cbfcc9721133a42eb683787b58fd63d7209c7d44b1f1795c8255423c94b"}) ioctl$TIOCSTI(r0, 0x5421, 0x400000) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r1, 0x4b6b, 0x0) ioctl$VT_RESIZEX(r1, 0x560a, &(0x7f0000000000)={0x4f72, 0x18, 0x5, 0x7f, 0x0, 0x200}) [ 2091.741082][T25687] binder: 25684:25687 ioctl 40046210 0 returned -22 [ 2091.768674][T25687] binder: 25684:25687 ioctl 40046210 0 returned -22 [ 2091.792835][T25693] binder: 25689:25693 ioctl c0306201 0 returned -14 [ 2091.821851][T25693] binder: 25689:25693 ioctl 541b 0 returned -22 02:34:53 executing program 5: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x2180, 0x0) r1 = syz_genetlink_get_family_id$gtp(&(0x7f00000000c0)='gtp\x00') ioctl$sock_ipv6_tunnel_SIOCGETPRL(0xffffffffffffffff, 0x89f4, &(0x7f0000000900)={'sit0\x00', &(0x7f0000001980)={'syztnl2\x00', 0x0, 0x2f, 0x1, 0x9, 0x2622, 0x2, @private0={0xfc, 0x0, [], 0x3f}, @mcast1, 0x7800, 0x7800, 0x5, 0xffffff80}}) sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000001a80)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000001a40)={&(0x7f0000001a00)={0x2c, r1, 0x180, 0x70bd26, 0x25dfdbfc, {}, [@GTPA_FLOW={0x6, 0x6, 0x2}, @GTPA_LINK={0x8}, @GTPA_LINK={0x8, 0x1, r2}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20008050}, 0x0) r3 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r3, 0x40046210, 0x0) r4 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, 0x0) ioctl$BINDER_THREAD_EXIT(r4, 0x40046208, 0x0) 02:34:53 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000040)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_DIRENT(r1, &(0x7f0000002080)={0x140, 0x0, r2, [{0x2, 0xff, 0xd, 0x7, '/dev/binder#\x00'}, {0x7, 0xe3, 0x1, 0x2, '#'}, {0x3, 0x0, 0x3, 0x7ff, '$K#'}, {0x5, 0xea, 0xd, 0x81, '/dev/binder#\x00'}, {0x6, 0x4, 0xd, 0x8, '/dev/binder#\x00'}, {0x5, 0xffffffffffffffff, 0xd, 0x1, '/dev/binder#\x00'}, {0x2, 0x7, 0xd, 0x0, '/dev/binder#\x00'}, {0x1, 0x6, 0xd, 0x4, '/dev/binder#\x00'}]}, 0x140) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) 02:34:53 executing program 0: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r0, 0x4b6b, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000040)=0x1) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/capi/capi20\x00', 0x4800, 0x0) ioctl$TIOCGSERIAL(r1, 0x541e, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=""/251}) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r2 = syz_open_dev$ptys(0xc, 0x3, 0x1) ioctl$VT_GETMODE(r2, 0x5601, &(0x7f0000000080)) syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) [ 2091.959935][T25699] binder: 25689:25699 ioctl c0306201 0 returned -14 02:34:54 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) openat$cgroup_netprio_ifpriomap(r0, &(0x7f0000000000)='net_prio.ifpriomap\x00', 0x2, 0x0) ioctl$TIOCSTI(r0, 0x5421, 0x400000) [ 2092.001764][T25693] binder: 25689:25693 ioctl 541b 0 returned -22 [ 2092.015905][T25703] binder: 25698:25703 ioctl 40046210 0 returned -22 [ 2092.054439][T25703] binder: 25698:25703 ioctl c0306201 0 returned -14 02:34:54 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r1, 0x40045542, &(0x7f0000000040)=0x6) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) r2 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ttyprintk\x00', 0x40102, 0x0) ioctl$TIOCSPTLCK(r2, 0x40045431, &(0x7f00000000c0)) 02:34:54 executing program 0: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r0, 0x4b6b, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000040)=0x1) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/capi/capi20\x00', 0x4800, 0x0) ioctl$TIOCGSERIAL(r1, 0x541e, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=""/251}) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r2 = syz_open_dev$ptys(0xc, 0x3, 0x1) ioctl$VT_GETMODE(r2, 0x5601, &(0x7f0000000080)) [ 2092.108302][T25708] binder: 25698:25708 ioctl 40046210 0 returned -22 [ 2092.115617][T25703] binder: 25698:25703 ioctl c0306201 0 returned -14 [ 2092.266990][T25717] binder: 25715:25717 ioctl 541b 0 returned -22 [ 2092.319465][T25719] binder: 25715:25719 ioctl 541b 0 returned -22 02:34:54 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) recvmmsg(r0, &(0x7f0000004640)=[{{0x0, 0x0, &(0x7f0000003000)=[{0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x9}}], 0x1, 0x0, 0x0) 02:34:54 executing program 3: socket$inet6_sctp(0xa, 0x0, 0x84) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) 02:34:54 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) 02:34:54 executing program 4: openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r0, 0x4b6b, 0x0) r1 = syz_open_dev$ptys(0xc, 0x3, 0x0) ioctl$TIOCSTI(r1, 0x5421, 0x8) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r2, 0xc0405519, 0x0) sendmsg$RDMA_NLDEV_CMD_STAT_DEL(r2, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x28, 0x1412, 0x8, 0x70bd2a, 0x25dfdbff, "", [@RDMA_NLDEV_ATTR_RES_LQPN={0x8, 0x15, 0x5}, @RDMA_NLDEV_ATTR_STAT_RES={0x8}, @RDMA_NLDEV_ATTR_RES_LQPN={0x8, 0x15, 0x5}]}, 0x28}, 0x1, 0x0, 0x0, 0x11}, 0x8000) 02:34:54 executing program 0: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r0, 0x4b6b, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000040)=0x1) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/capi/capi20\x00', 0x4800, 0x0) ioctl$TIOCGSERIAL(r1, 0x541e, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=""/251}) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) syz_open_dev$ptys(0xc, 0x3, 0x1) 02:34:54 executing program 1: sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000000c0)={&(0x7f0000000140)={0x18, 0x140f, 0x300, 0x70bd2b, 0x25dfdbfc, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x18}, 0x1, 0x0, 0x0, 0x20040014}, 0x44008880) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) [ 2092.787625][T25728] binder: 25723:25728 ioctl 541b 0 returned -22 [ 2092.814663][T25731] binder: 25723:25731 ioctl 541b 0 returned -22 [ 2092.833805][T25734] binder: 25724:25734 ioctl 40046210 0 returned -22 02:34:54 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x4000, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) ioctl$GIO_FONTX(r1, 0x4b6b, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x2) ioctl$TIOCSTI(r2, 0x5421, 0x10000007fbf) 02:34:54 executing program 0: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r0, 0x4b6b, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000040)=0x1) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/capi/capi20\x00', 0x4800, 0x0) ioctl$TIOCGSERIAL(r1, 0x541e, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=""/251}) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) 02:34:55 executing program 1: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r0, 0x89f4, &(0x7f0000000340)={'syztnl1\x00', &(0x7f0000000040)={'ip6tnl0\x00', 0x0, 0x29, 0x80, 0xff, 0x3, 0x2, @mcast2, @mcast2, 0x700, 0x80, 0x400, 0x1}}) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x541b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000100)=[@reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)=ANY=[@ANYBLOB="8561646600000000090000000000000001000000000000001000000000000000856164660000006d630000000000000002000000000000000600000000000000852a626397b3bf26030000000000000000000000000000001014888b7f974b6045915d94cfc14302b0c26ffb1611378b67d3cf51244fff11a762bf024da26fabcc41edec6d4f1753f94fe225a15eb3949f8008d8040091e2a787641739a60b82fcdbae5e6dc6abafcb0000d6e635d212e1500b9809cfb995239dc363c2213288a90baa0a326d6c27c2bfd655bb806a5c8f793d51683b65628abe15df428bc21fd24e7326a8532a7abb25ae8c079088571db4f074d58a1d0c4c6f45fe34eb78b30bfb817eb65aff999ef86f0ed5bc37173e57f33bd89e461663e171f5aeb5059c28dd9138c9adeb1ca671e8bd208fd4572e9dae409045e714a8d75e40339cb29d8aca42ec721d4fbea7b49ca2e8e3d103"], &(0x7f00000000c0)={0x0, 0x20, 0x40}}}], 0xb4, 0x0, &(0x7f0000000180)="585df3ca1851e4ae09fe2ee9e4acf24d4b9d184f3b57af4d00ba7463d5c070b3cf42e1de272c3dab1f2212a928877956551aea67098d5e17f65fe9a915295e709a9fbd7da92d79bb39a5a4ea888864e7da8989752733ec1830e0180c23834004dc2bfe79313b8c9c149c6e966de8e1cc82c4555dddc7feee191f68c6ed4c64cdeabffeae952561ccc4cb13e81a814368eb5be38cf4d181e8bb09fedb4b5e55b238260e989fe053a03ffddba62f3893d1929962ee"}) 02:34:55 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x800) 02:34:55 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, &(0x7f0000000040)='net_prio.ifpriomap\x00', 0x2, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) ioctl$SNDRV_CTL_IOCTL_PVERSION(r1, 0x80045500, &(0x7f0000000080)) 02:34:55 executing program 0: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r0, 0x4b6b, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000040)=0x1) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/capi/capi20\x00', 0x4800, 0x0) ioctl$TIOCGSERIAL(r1, 0x541e, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=""/251}) [ 2093.106394][T25751] binder: 25745:25751 ioctl 40046210 0 returned -22 [ 2093.126620][T25751] binder: 25745:25751 ioctl 40046210 0 returned -22 [ 2093.137844][T25754] binder: 25744:25754 ioctl 541b 0 returned -22 [ 2093.192159][T25754] binder: 25744:25754 ioctl 541b 0 returned -22 02:34:55 executing program 0: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r0, 0x4b6b, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000040)=0x1) openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/capi/capi20\x00', 0x4800, 0x0) 02:34:55 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5421, 0x400000) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r1, 0xc4c85513, &(0x7f0000000180)={{0x5, 0x4, 0x7, 0x4, 'syz1\x00', 0x2}, 0x0, [0x1f, 0xffff, 0x56, 0xb8, 0x0, 0x8, 0x3ff, 0x59d, 0x6, 0x0, 0x400, 0x1, 0x7fffffff, 0x1ff, 0x400, 0xffff, 0xcaf, 0x3, 0xa24, 0x8, 0x7f, 0x8000, 0x9, 0x8000, 0x400, 0x2, 0x2, 0x4, 0x2, 0x2, 0x4, 0x5, 0x800, 0x6, 0x4e, 0x4, 0x5, 0x8000, 0x2, 0x0, 0x100000001, 0x40000000000000, 0x10001, 0x6, 0x4, 0x67259b6e, 0xfffffffffffffff7, 0x80, 0x0, 0xb856, 0xfffffffffffffff8, 0x8001, 0x3, 0x3f, 0x1ff, 0x5, 0x757c, 0x7, 0x200, 0x9, 0x7832, 0x0, 0x5, 0x347e, 0x1000, 0x2, 0x9, 0x7, 0x2, 0x7, 0xfffffffffffffff7, 0x9, 0x0, 0x6, 0xfff, 0x3, 0xffff, 0xf4a, 0x6, 0x10001, 0x66a, 0xffffffff, 0xff, 0x2c, 0x100000001, 0x8000, 0xfff, 0x0, 0x5, 0xffffffffbf7cdec1, 0x1ff, 0x800, 0x6, 0x1, 0x52f, 0xd63, 0x8001, 0x100000000, 0x6, 0x80000001, 0x6, 0x47c, 0x7fff, 0x272, 0x400, 0x1, 0x8000, 0x5, 0x10000, 0x1, 0x401, 0x8, 0x6, 0x4dc0, 0x7, 0x3f, 0x7fffffff, 0x0, 0x8, 0x9, 0xfff, 0x9, 0x9, 0x45, 0x200, 0x0, 0x10001]}) 02:34:55 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) 02:34:55 executing program 2: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r0, 0x89f4, &(0x7f0000000340)={'syztnl1\x00', &(0x7f0000000040)={'ip6tnl0\x00', 0x0, 0x29, 0x80, 0xff, 0x3, 0x2, @mcast2, @mcast2, 0x700, 0x80, 0x400, 0x1}}) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x541b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000100)=[@reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)=ANY=[@ANYBLOB="8561646600000000090000000000000001000000000000001000000000000000856164660000006d630000000000000002000000000000000600000000000000852a626397b3bf26030000000000000000000000000000001014888b7f974b6045915d94cfc14302b0c26ffb1611378b67d3cf51244fff11a762bf024da26fabcc41edec6d4f1753f94fe225a15eb3949f8008d8040091e2a787641739a60b82fcdbae5e6dc6abafcb0000d6e635d212e1500b9809cfb995239dc363c2213288a90baa0a326d6c27c2bfd655bb806a5c8f793d51683b65628abe15df428bc21fd24e7326a8532a7abb25ae8c079088571db4f074d58a1d0c4c6f45fe34eb78b30bfb817eb65aff999ef86f0ed5bc37173e57f33bd89e461663e171f5aeb5059c28dd9138c9adeb1ca671e8bd208fd4572e9dae409045e714a8d75e40339cb29d8aca42ec721d4fbea7b49ca2e8e3d103"], &(0x7f00000000c0)={0x0, 0x20, 0x40}}}], 0xb4, 0x0, &(0x7f0000000180)="585df3ca1851e4ae09fe2ee9e4acf24d4b9d184f3b57af4d00ba7463d5c070b3cf42e1de272c3dab1f2212a928877956551aea67098d5e17f65fe9a915295e709a9fbd7da92d79bb39a5a4ea888864e7da8989752733ec1830e0180c23834004dc2bfe79313b8c9c149c6e966de8e1cc82c4555dddc7feee191f68c6ed4c64cdeabffeae952561ccc4cb13e81a814368eb5be38cf4d181e8bb09fedb4b5e55b238260e989fe053a03ffddba62f3893d1929962ee"}) 02:34:55 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN_UNNAMED(0x11, &(0x7f0000000100), 0x10) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="56a90000"], 0x3f, 0x0, &(0x7f0000000080)="970237efe4cd599f020277466adf955df4a6010f425b27bc47cfab30ae4d392c4597d3d20dec4435c89af3472a01e5a9d859bd2244d221acca28c0d751143b"}) read$FUSE(0xffffffffffffffff, &(0x7f0000000980)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_LK(0xffffffffffffffff, &(0x7f0000000140)={0x28, 0x0, r2, {{0x0, 0x9, 0x0, 0xffffffffffffffff}}}, 0x28) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) 02:34:55 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) [ 2093.810216][T25775] binder: 25770:25775 ioctl c0306201 0 returned -14 [ 2093.813305][T25776] binder: 25769:25776 ioctl 40046210 0 returned -22 [ 2093.823226][T25778] binder: 25771:25778 ioctl 541b 0 returned -22 [ 2093.841424][T25775] binder: 25770:25775 unknown command 43350 02:34:55 executing program 0: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r0, 0x4b6b, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000040)=0x1) 02:34:56 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5421, 0x400000) recvmsg$can_j1939(r0, &(0x7f0000000440)={&(0x7f0000000000)=@pppoe={0x18, 0x0, {0x0, @random}}, 0x80, &(0x7f0000000100)=[{&(0x7f0000000180)=""/241, 0xf1}, {&(0x7f0000000480)=""/259, 0x103}, {&(0x7f0000000080)=""/99, 0x63}, {&(0x7f0000000380)=""/130, 0x82}], 0x4}, 0x100) 02:34:56 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f0000000040)=0xffff6bad) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) syz_open_dev$binderN(&(0x7f0000000700)='/dev/binder#\x00', 0x0, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r2, 0x4b6b, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_SCRNMAP(0xffffffffffffffff, 0x4b40, &(0x7f00000006c0)=""/50) ioctl$GIO_FONTX(r3, 0x4b6b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x118, 0x0, &(0x7f0000000500)=[@acquire_done={0x40106309, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@weak_handle={0x77682a85, 0xa, 0x3}, @fda={0x66646185, 0x5, 0x1}, @flat=@weak_binder={0x77622a85, 0x0, 0x8}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@fda={0x66646185, 0x9, 0x0, 0x9}, @ptr={0x70742a85, 0x1, &(0x7f0000000140)=""/153, 0x99, 0x0, 0x1b}, @ptr={0x70742a85, 0x1, &(0x7f0000000200)=""/149, 0x95, 0x1, 0x6}}, &(0x7f0000000340)={0x0, 0x20, 0x48}}}, @dead_binder_done, @enter_looper, @increfs_done={0x40106308, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000440)={@fd={0x66642a85, 0x0, r2}, @fd={0x66642a85, 0x0, r3}, @ptr={0x70742a85, 0x1, &(0x7f0000000380)=""/150, 0x96, 0x2, 0x28}}, &(0x7f00000004c0)={0x0, 0x18, 0x30}}, 0x1000}, @dead_binder_done], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) [ 2093.879910][T25775] binder: 25770:25775 ioctl c0306201 200000c0 returned -22 [ 2093.916759][T25783] binder: 25773:25783 ioctl 541b 0 returned -22 02:34:56 executing program 1: r0 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f0000000040)=0x1) [ 2093.968886][T25785] binder: 25770:25785 unknown command 43350 [ 2093.997425][T25785] binder: 25770:25785 ioctl c0306201 200000c0 returned -22 02:34:56 executing program 2: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r0, 0x89f4, &(0x7f0000000340)={'syztnl1\x00', &(0x7f0000000040)={'ip6tnl0\x00', 0x0, 0x29, 0x80, 0xff, 0x3, 0x2, @mcast2, @mcast2, 0x700, 0x80, 0x400, 0x1}}) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x541b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000100)=[@reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)=ANY=[@ANYBLOB="8561646600000000090000000000000001000000000000001000000000000000856164660000006d630000000000000002000000000000000600000000000000852a626397b3bf26030000000000000000000000000000001014888b7f974b6045915d94cfc14302b0c26ffb1611378b67d3cf51244fff11a762bf024da26fabcc41edec6d4f1753f94fe225a15eb3949f8008d8040091e2a787641739a60b82fcdbae5e6dc6abafcb0000d6e635d212e1500b9809cfb995239dc363c2213288a90baa0a326d6c27c2bfd655bb806a5c8f793d51683b65628abe15df428bc21fd24e7326a8532a7abb25ae8c079088571db4f074d58a1d0c4c6f45fe34eb78b30bfb817eb65aff999ef86f0ed5bc37173e57f33bd89e461663e171f5aeb5059c28dd9138c9adeb1ca671e8bd208fd4572e9dae409045e714a8d75e40339cb29d8aca42ec721d4fbea7b49ca2e8e3d103"], &(0x7f00000000c0)={0x0, 0x20, 0x40}}}], 0xb4, 0x0, &(0x7f0000000180)="585df3ca1851e4ae09fe2ee9e4acf24d4b9d184f3b57af4d00ba7463d5c070b3cf42e1de272c3dab1f2212a928877956551aea67098d5e17f65fe9a915295e709a9fbd7da92d79bb39a5a4ea888864e7da8989752733ec1830e0180c23834004dc2bfe79313b8c9c149c6e966de8e1cc82c4555dddc7feee191f68c6ed4c64cdeabffeae952561ccc4cb13e81a814368eb5be38cf4d181e8bb09fedb4b5e55b238260e989fe053a03ffddba62f3893d1929962ee"}) 02:34:56 executing program 0: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000040)=0x1) 02:34:56 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x0, 0x3}) [ 2094.134178][T25793] binder: 25790:25793 ioctl c0306201 0 returned -14 [ 2094.151076][T25794] binder: 25791:25794 ioctl 541b 0 returned -22 02:34:56 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x424000, 0x0) ioctl$TIOCSTI(r0, 0x5421, 0x400000) [ 2094.186178][T25794] binder: 25791:25794 ioctl c0306201 0 returned -14 [ 2094.246943][T25794] binder: 25791:25794 ioctl 541b 0 returned -22 [ 2094.253329][T25804] binder: 25790:25804 ioctl 40046210 0 returned -22 02:34:56 executing program 0: ioctl$TIOCSPTLCK(0xffffffffffffffff, 0x40045431, &(0x7f0000000040)=0x1) [ 2094.310741][T25804] binder: 25790:25804 ioctl c0306201 0 returned -14 [ 2094.334735][T25809] binder: 25795:25809 ioctl 541b 0 returned -22 02:34:56 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0xf8a28f30487c88b8) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f0000000040)) 02:34:56 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5421, 0x400000) r1 = syz_open_dev$tty1(0xc, 0x4, 0x2) ioctl$KDGETLED(r1, 0x4b31, &(0x7f0000000000)) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r2, 0x4b6b, 0x0) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_NOTIFY(r4, &(0x7f00000001c0)={0xf, 0x8, 0xfa00, {r5}}, 0x10) write$RDMA_USER_CM_CMD_CONNECT(r0, &(0x7f0000000180)={0x6, 0x118, 0xfa00, {{0x200, 0x3, "f59c10e60a1e138c6c185e4a3d21e70a44316e8c9c3a5ae53312da4ff865eb63bbde45c638b8e79b168e4f015ea89b20c2c0bcaba605c596cf6b496df545896f2effc70603ed63c577ef5ca75866dfd8a3366b44d1dd8b0d694bb9c72548d11b9d37c9c2fac421030169b04f9d38df8afb060bbd2d392d324670fe5434f99e05a4b7b75022bbf5f5cfe855bd9be233cfccf4010019c0c40a22dd271ab9e939ed41843e9417b70fc1b859d06a96eeacb6da3e2e352af86edc335673ba22ca186157727187618d13a38070e9d72f51a20c7bf97a50483f7997f5a8e60466fc4c931c777595b179a6f8e38b9d27b83b246254cde10915a5fc0c4f16abe14e3d0458", 0x3, 0x6, 0xb9, 0x2, 0x8, 0x4, 0x40}, r5}}, 0x120) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f00000000c0)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000080), 0xffffffffffffffff, 0x0, 0x2, 0x4}}, 0x20) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r6, 0x4b6b, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x3) r7 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r7, 0x4b6b, 0x0) ioctl$GIO_CMAP(r7, 0x4b70, &(0x7f0000000040)) 02:34:56 executing program 2: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r0, 0x89f4, &(0x7f0000000340)={'syztnl1\x00', &(0x7f0000000040)={'ip6tnl0\x00', 0x0, 0x29, 0x80, 0xff, 0x3, 0x2, @mcast2, @mcast2, 0x700, 0x80, 0x400, 0x1}}) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x541b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000240)={0x44, 0x0, &(0x7f0000000100)=[@reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)=ANY=[@ANYBLOB="8561646600000000090000000000000001000000000000001000000000000000856164660000006d630000000000000002000000000000000600000000000000852a626397b3bf26030000000000000000000000000000001014888b7f974b6045915d94cfc14302b0c26ffb1611378b67d3cf51244fff11a762bf024da26fabcc41edec6d4f1753f94fe225a15eb3949f8008d8040091e2a787641739a60b82fcdbae5e6dc6abafcb0000d6e635d212e1500b9809cfb995239dc363c2213288a90baa0a326d6c27c2bfd655bb806a5c8f793d51683b65628abe15df428bc21fd24e7326a8532a7abb25ae8c079088571db4f074d58a1d0c4c6f45fe34eb78b30bfb817eb65aff999ef86f0ed5bc37173e57f33bd89e461663e171f5aeb5059c28dd9138c9adeb1ca671e8bd208fd4572e9dae409045e714a8d75e40339cb29d8aca42ec721d4fbea7b49ca2e8e3d103"], &(0x7f00000000c0)={0x0, 0x20, 0x40}}}], 0xb4, 0x0, &(0x7f0000000180)="585df3ca1851e4ae09fe2ee9e4acf24d4b9d184f3b57af4d00ba7463d5c070b3cf42e1de272c3dab1f2212a928877956551aea67098d5e17f65fe9a915295e709a9fbd7da92d79bb39a5a4ea888864e7da8989752733ec1830e0180c23834004dc2bfe79313b8c9c149c6e966de8e1cc82c4555dddc7feee191f68c6ed4c64cdeabffeae952561ccc4cb13e81a814368eb5be38cf4d181e8bb09fedb4b5e55b238260e989fe053a03ffddba62f3893d1929962ee"}) 02:34:56 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x800) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x800, 0x0) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x313f03, 0x0) ioctl$SCSI_IOCTL_SYNC(r2, 0x4) 02:34:56 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) sendmsg$RDMA_NLDEV_CMD_SYS_GET(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x28, 0x1406, 0xe7856d19a75713e2, 0x70bd2d, 0x25dfdbfb, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x10) 02:34:56 executing program 0: ioctl$TIOCSPTLCK(0xffffffffffffffff, 0x40045431, &(0x7f0000000040)=0x1) 02:34:56 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x402200, 0x0) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f0000000080)={0x2}) 02:34:56 executing program 0: ioctl$TIOCSPTLCK(0xffffffffffffffff, 0x40045431, &(0x7f0000000040)=0x1) [ 2094.681899][T25830] binder: 25823:25830 ioctl 40046210 0 returned -22 [ 2094.711080][T25833] binder: 25821:25833 ioctl 541b 0 returned -22 [ 2094.748564][T25830] binder: 25823:25830 ioctl 40046210 0 returned -22 02:34:56 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_bt_hidp_HIDPCONNADD(0xffffffffffffffff, 0x400448c8, &(0x7f0000001040)={0xffffffffffffffff, r1, 0x0, 0x1000, &(0x7f0000000040)="90f60fcdc3e8b90653f86013d82492b7d4f41a15ea092718cf3a2d79e7f5d1a6deefc6b4126a3a6cbd8106d0c6ae3a4a22cc6c7ba35efe2119848d9d041fd35fc3abee77701973e4796fe9ec3ed1583af7bc3b43f2037a7deda08e1cb9aa1bcd389ebd23bc93a9bdf0de8963a18ef73e127997ad62e6dd012ec3e4d6f78c0aef7ac7b7b21eeec675113bc0826844d65203777fea15da9e09d7251946c4b59a715a3c89deeb3b0948204941ad6347523e63d8603f5d2c2b784417c2c38842393d5fee216575f4802e20af68aab204a3b1c87ef67b7e289f296e101c3188b8f5d03c68379197110b3198628687eec0134e857a3e58560ef2a233bc8b877c53a7e7c65bd746aad3a0499646b2d4f9b1c80cdd47a645a9876b6d63410c824cc3c0eb84b227fbfbcf5f8dfe78aee4080093491c6eb332939416a1eb8cf64f82694bf12cc106a214e486c9db6ea832d703e522e7903981b148601b7ce1934c7debb8c2421f0f2f884cef71da7aa6c545a2c219648fd9463087bb99d5ddc412c4fd60c61ae9b78eff08e6053b14f86f3683c29c5bb4d4d8ee156c30c3873c8d05aa4a66527a88042f6ebd3b2e435d6d194095ac3aaf497f9f360b47efb142efb19586fa5a5e8127c128ab4db366c645e7c61f7ac4083659a021d76da7e5fb6e557a30ab0af681b6bdf71f0441810372cd6739eaabf12ed800e08c59c3dc454a885864019950f38eaeb2c606aa9e2c0679ec1d512082d3fb129030b6ba5370178f50e2fd859aec3942a4bd142720ec6545d28cbf2d27f8d04b354c67f352f8e17e35cd8a851e8b097aec6e0dd7ae9e2b6f7e7851c814cf446708bfbad633ef2551dfae7619f75efc696a4eb313dcf56b710fa38cb75c35fa38af64beac08f38eba1648a1092b43ebb06bf4791bdcae8bc0fe47839386645aecfd29ff8ac9b1fc8e09e286484a2c44f161fae5a0ac737b5e5ee442228ebe7b07a9ebabdbbd601718350dce4af7d2051348f4fc267915e47ea8d49973f10ce30e9e29da11973dbed1f1b59a417cba54476796e8a8676864b22bcd332289e096905b00f7295bc8c82768d8932734d019140a29aca2048aa892da97c7dafa8f50bbda2b0a1d6d61b449b22a7d4042e848ef92bf516623fe231c3202ab7c7c156b61e1ce2b254451741e3ba2c82764b98fe15666e5ca79dae7a191835204c377e1186c8fa1c962361b7f16653eada05b7a17075155008808e8d71aeb8bbebf3c0784d5d8b1f41f5f412f31fb283fde5830ca983d63365becfc8e4d606410bc5ed680c60ddf05112b30f40cef74459928793f73c6056e33fc89ff742cc91681cbdd8d527c76c733f9f1671720266232bd46c8f61ac5258282a5b9db4e725d243d038dcfe1cad9ea8bd9e1de6eef822a800becf5a465ee09067441938e114f1654a86ab498596fe5f46e0efd921fadab8e0f054e962f3b87c9e208bd15124270b46f502052195ee5f43b3e19d4f2265b2250786727de71e4b2497a692cef85769b8969c60067376191549d4cde0ca1fe32d26281e50fad29b61fdb57254dba553dba706daf2ac210c4634006921da2f8512694de723940f569af089c6886c1809c6d0b48bd0ca971a09739ba187125abf97eac42e900d2e084a513bbf0285037aea366170030b62f3c6a315bd7e6829bc5d8c3efd4e58ea43d9baf6d5db88814dd8f81fe2d9c385d594d68adeb46c1747e3548db058f53bd9f6b000aa4d783972df6f62db5c6ce19103dbc017c579da010ed6f8148fda787764cd829610175e7856d0816f52f2fa005957d2319d65b7c5a460a649a3806e36152cdf340b4ad6c2795b8f0f972ec9b9ee117168c5f0a1575c8b8441c789273c973e413b248e4323f30efa2413976aea2843a30036e6b3fcbe3f0ffafa9cea0c6447f6a7f00968295c32e62780f6b75f1de87b4eb4c828a6f51c4991a522f4db8563dd7cd6d1832480c00bfe990a6a2aab261331aa8c8aac88c00ca9a232fa794bcca3c6595ed3a165b5f7a6e0f442355a3e0b683188d09c790f9ccfdcaaa9116defcb4aedca9fa7cde4452909d47c4bfbcb214ab0a59e48ff596d3532e25414630685439a906fd7c030a218df9afb2fece9cfc32e3b6dcc8f78e3390eb21bb159e8a1d668d14fb7791b47c614d0ed3b86b58c89da79a9e60c4e0cf1b63622b2a0509aaed30582759e79886da626c00d4c86aed1aa2e66bb2ef8cd3b61ef46f4157bc6688ea84471903979a0ef5631e4dab5153023573643d2b26940830427c22e318c8415384bfe8359888591e8fc30fd541118a2dac24929a11c592b4963457f99c9cc72ebd37f9bf7216b278372388f77012caf4c93a83c173289e5a7459eb241b8e229f1f643332530131d185c1fb3208a8490793200d79dc458a1b38fb4331fa06033d6ecac437fea9f7bfda6ef456e48fd251d4fb2011bcb78bd192b173c8581a9b6d8af6519a3d54dffc9fc5d980ea81c55e54ff7b2845f4215fda345712898d25821a657f2f0f8f64461b5d2647fa6203e928d9d33a808861eff24b6e67d8b68126bb782de2c20e6c54c0bb7993b3f5f1aea5d65ca2c39d162e1f0b6bd5d20ec59d3a1462a91d419a843805acfe5939be258b94348984e097b67dd96a25d5b354781cf8d245411bc337d14812a006329f9dcfdf06f29932c15f01f016dcc882c63899d3ba4a8a0a377e4f34156f0f29fcd14333ffb1048e8f45ec01966d0a235aae26096b7264b561140917dd26551ffc8ddfea48233202aa00714c067b9d88a9e08928e33bdc5554f59129dacae5e55386c7dd1c88d118fc260c93c5312eb2fcea841d0820d0a54832733c64d5fb72c3631753825265d8780fa43482a3bd5016b2996b5adba3b30365832fd738c80da6b28ce1f579fc0c590ed8323c22fca93fade3a5b7188c1025a9b3b208207b84c1db0a4a6dc4b5163d919507ece2e7ec9ef7ab22da66c45097c5e01eda08d205f17c79030bf0dcad2dbc3f4ea4371bbfc6d2200226e905e52da5893545c3ed725aef167dbcb3145d7e2563fb4d1c4bf362f7c429c79e7974952d5fd6b880cae224ada34cc3471e40292ced908cd2d5971381195d36974b1383f26339ade8c00d58cd13633591066de6a3912cfaf6ef9773814dc820e0ac8b203ac38022488c27b655041bc3f4016e09eb29e9237667ad1310bec19d8e9f8391344a958a3643f8a6c52507df7c486f00bd8c5f6180631d12e2c84b85d55397a9fed1a0678a4c0657a9d2a7e537212ecf3b60c660d13ecc4a147c5019f423f3cb347dcc8920b1cefb14a803b674d018e2b85a277a603b16f24cd15ce5ab199513dd576e88d663ac4bf3f7274b205ae5b071f938306395f7870ce1f9321a8040f4491a65959e991fa8efacf43da67267d51ff1f79c1e7a6f991668445f7fc280b13fe1dc8f01113ca208ce21cc8a3c90a2b439caab8b8e8f805fc105f5e089b8c561319a8fe50c94bd9e164ee6ba77e3c900ccce5e839c158575c5e5a877accaa4b8eba3cd01288e35436053baba136eeb222ada5debca53605029bf664dfe38ed59203f58339f647f5744bd73a11c2ec97e35e10295599ea7ccce907a4331aa830ad46a85b7a060abf1cd106eb8d7fe971b4ad71b0413f5e6e1d2b6e2c18c752460643b9146b7925212f298d9ea0c1f1ad8c743feb7d2adb97f31b023871a184a55f5bffc76d3fe7a0a9f53ae4a8391a4b811d9124527795fe55e5203eed35d4b33a0d170f8703ca914eed7722e27d94fcc7b56879248d9cc8b94640ccab7981088d2fa1818a23b4aa361d5081596ff124747cdbe76edaf334d2ba88790dbd35583d213d37d907f0bfa62cdf6d28eb77405b0d5d1aaa4d266dda13c37eca0a589523611924cf6f6059cf38299bdd42af008b439bf18f58a85fa6c27f2342ea89c4af8e35a27cdee00049ded06848e2765dbeaac122ecbb3e598b57a55beb4a0212db7e3cac2a3b26bba2f032180b0184d1436cf60744f13e1f9baedf11b43f8385b9c6d1fa82cc94bebfd95aae33095614e4988b1f9f3cba210d39027786e9e53646d527941b07973de86102c6cf61ad5d7b5573f5f93e6e14355252802e12d8f755879645f4c7f23328c4389241da399acfa00a2afc4bb50266507cb9522f20ecc990476396143ed748e4bd8dde299516baf4c5b532f95871b00468021aaa9dc69b6cfa4222339a22b7576c9e2768c454fbc03776974188bedf395e8771382008e6a46746bca4cc112d1dee2a95375c57a49d2300cbc8f0c6de053025b3e856ad1e4433ad0559793541b38b22fc4d15dd515a46ee8b74e4ec10992cd8f3d5389967579921ec28852fce69c35cda27ea1edfb166666d7292831a0d87ace4a55d039b704d088038456424c74a8058a2f1a6335f958e9fb8c1a75ab64e3a91c1eee818da2bb515d7323e7ce463143a7381c894670e8d2e05845426e00545e167a25a9413a0fdfc03fd7af54c4de00017948da4c747e77553360f5e86e05159a4103fee78c475a4117ce43bf3ef2d8b43ccad50f97bc49e61ac21e25b2d2f2f52def462aabc22e52aa9f276faf9004b34f61ee43c814cb9b831e017d78649c40c2c0e5212cfbe8a51e2d79c466c40f51624f7be5f2d8bd4496d85677dea9994163fe977561ead34806336e42e968985b50ccb19fa3ba287f89e5befda3c98d031a5530e9e822ff68c248b18e00655c46b2583a6c472336f12966f3381e88d5722bd0d7ff8e635d5dddc51bb439964ef83b5d8473761dc513897ec3693fa9d7ad26791246902126d8fb90b762b1e871d181f9d82ea0d18605430bd8612405e6e4c865d46d10328b854b12754590810576648e5c78a1af5ef3a138929d46e022f83ad5e5476c1dab41a11e5e8b935235abfb8f4d8699853a25e428a2d3e6b7617608a1382888d96cc25af9492f511ec90dcb04a49e6a0b561433edf44d97b1723143c4ba67a728614abfb6aa45069d8140d96fbae6c3dcc0a3f64492818ffbe7015f2ee87f5b2c3900310b66a14fbb8b3292cfade3d0b51968d02233b4c30b124238ba828043c5de6122b45a34c686401a486a113360519718f4af3c47767878df4740c380e0b2ee83b33c37d21ac7db4b37a61aaa2f9b1fec6a4aa66eb795d5d4630c42c8ad47725da7dd9afc1c6e6da80bfc8fb7b578d87426bd9a4a304126c45a186f52c0be930e573ff27496f1a76485b561ead4760ab5ad7db34ec05ecc5b479e4660492ab2e34ae38506454b6a51129d0bdfa05518375b16c9c26e3c6f539a7d1cf041ebe3ae48cbf6e9052a5e999391e7a8105bb9c5089c674a83af3544337546dfae4acc96ece241b92b98b3ec7a1d112ee61f7d94abb59f194b1b37c244d757462d1e1dd7723903d07367b023cc343e803ba51354c35031187442b1b822d9fa59a6fe07c308f891e245c7be61a326fd4b950f61617f2431d39963c602da2d8b3e2f48f7b5466e74a20b85c9da2ec225b6589df7855b0ab3167bb4093f49cf1b7c9402e32520d88c90d64ff026a114abe682d6c7fb4265da3dc5aa7187fe3be578d9b5e19bbdd84c9baf8c88d81d9484b676f7b0bd744a7810fc6c63d3355db5ef4e31d3e77bc832ede50f5707b9cb11bd7d0f3d3b620d4dc5b01cf890cb25e49b00c62e14c813787babdf0df04d73abbdc1c7f026b9212c1aefeb0e27fe68fff7db9ce005d77ee2f8cb892699d28feee88e0c3e6dce7e7f87994d90edc25f657e4b91601eb20940326b81c73252915df0cb684402ff140cea87d5deb9c5055dc759a8686d4d0d80", 0x8, 0x3f, 0x4, 0x9, 0x2, 0x1, 0xffff7fff, 'syz1\x00'}) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) 02:34:56 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x800) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x80002, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(0xffffffffffffffff, 0x89fb, &(0x7f0000000240)={'syztnl2\x00', &(0x7f00000001c0)={'syztnl0\x00', 0x0, 0x2f, 0x3, 0x5, 0xffff, 0x45, @local, @local, 0x796, 0x1, 0x9, 0x1}}) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x1d, 0x5, &(0x7f0000000080)=@raw=[@generic={0xb0, 0x0, 0x8, 0x1ff, 0x6}, @btf_id={0x18, 0x4, 0x3, 0x0, 0x1}, @map_val={0x18, 0x0, 0x2, 0x0, r2, 0x0, 0x0, 0x0, 0x3f}], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0xa4, &(0x7f0000000100)=""/164, 0x41100, 0x12, [], r3, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000280)={0x5, 0x1}, 0x8, 0x10, &(0x7f00000002c0)={0x2, 0x1, 0x3ff, 0x10001}, 0x10, 0xffffffffffffffff}, 0x78) socket$can_raw(0x1d, 0x3, 0x1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) 02:34:56 executing program 2: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r0, 0x89f4, &(0x7f0000000340)={'syztnl1\x00', &(0x7f0000000040)={'ip6tnl0\x00', 0x0, 0x29, 0x80, 0xff, 0x3, 0x2, @mcast2, @mcast2, 0x700, 0x80, 0x400, 0x1}}) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x541b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 02:34:56 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r0, 0xc018620c, &(0x7f0000000000)) ioctl$TIOCSTI(r0, 0x5421, 0x1) 02:34:57 executing program 0: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000040)=0x1) [ 2094.933501][T25843] binder: 25840:25843 ioctl 541b 0 returned -22 02:34:57 executing program 1: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f0000000240)={0x5, 0x10, 0xfa00, {&(0x7f0000000040)}}, 0x18) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x541b, 0x0) write$RDMA_USER_CM_CMD_QUERY(r0, &(0x7f0000000480)={0x13, 0x10, 0xfa00, {&(0x7f0000000280), 0xffffffffffffffff, 0x1}}, 0x18) [ 2095.023940][T25851] binder: 25844:25851 ioctl 40046210 0 returned -22 [ 2095.034733][T25850] binder: 25845:25850 ioctl c0306201 0 returned -14 [ 2095.074147][T25856] binder: 25845:25856 ioctl c0306201 0 returned -14 [ 2095.110115][T25858] binder: 25846:25858 ioctl 541b 0 returned -22 02:34:57 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) r1 = socket$phonet_pipe(0x23, 0x5, 0x2) accept$phonet_pipe(r1, 0x0, 0x0) accept$phonet_pipe(r1, &(0x7f0000000080), &(0x7f00000000c0)=0x10) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x301400, 0x0) 02:34:57 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5421, 0x400000) recvmmsg(r0, &(0x7f0000002c00)=[{{&(0x7f0000000000)=@phonet, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)=""/218, 0xda}], 0x1, &(0x7f0000000280)=""/219, 0xdb}, 0x1}, {{&(0x7f00000000c0)=@rc, 0x80, &(0x7f0000000840)=[{&(0x7f0000000380)=""/149, 0x95}, {&(0x7f0000000440)=""/214, 0xd6}, {&(0x7f0000000540)=""/238, 0xee}, {&(0x7f0000000640)=""/144, 0x90}, {&(0x7f0000000700)=""/80, 0x50}, {&(0x7f0000000780)=""/135, 0x87}], 0x6, &(0x7f00000008c0)=""/189, 0xbd}, 0xb857}, {{&(0x7f0000000980)=@pppoe={0x18, 0x0, {0x0, @local}}, 0x80, &(0x7f0000002b80)=[{&(0x7f0000000a00)=""/27, 0x1b}, {&(0x7f0000000a40)=""/1, 0x1}, {&(0x7f0000000a80)=""/4096, 0x1000}, {&(0x7f0000001a80)=""/50, 0x32}, {&(0x7f0000001ac0)=""/4096, 0x1000}, {&(0x7f0000002ac0)=""/161, 0xa1}], 0x6}, 0x6}], 0x3, 0x20, &(0x7f0000002cc0)) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r1, 0x4b6b, 0x0) ioctl$TIOCGSERIAL(r1, 0x541e, &(0x7f0000002d40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000002d00)=""/31}) 02:34:57 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x404) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) 02:34:57 executing program 0: syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSPTLCK(0xffffffffffffffff, 0x40045431, &(0x7f0000000040)=0x1) [ 2095.214608][T25864] binder: 25861:25864 ioctl 541b 0 returned -22 02:34:57 executing program 2: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r0, 0x89f4, &(0x7f0000000340)={'syztnl1\x00', &(0x7f0000000040)={'ip6tnl0\x00', 0x0, 0x29, 0x80, 0xff, 0x3, 0x2, @mcast2, @mcast2, 0x700, 0x80, 0x400, 0x1}}) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x541b, 0x0) [ 2095.275356][T25864] binder: 25861:25864 ioctl 541b 0 returned -22 02:34:57 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000540)='/proc/capi/capi20\x00', 0x80, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(r1, 0xc0206434, &(0x7f00000001c0)={0x11d, 0x0, 0x10000}) r3 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r3, 0xc0405519, 0x0) ioctl$DRM_IOCTL_SG_ALLOC(r3, 0xc0106438, &(0x7f0000000200)={0x200, r2}) r4 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x2c0, 0x0) ioctl$MEDIA_REQUEST_IOC_QUEUE(r4, 0x7c80, 0x0) r5 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x8) r6 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000440)='/dev/hwrng\x00', 0x2002, 0x0) ioctl$DRM_IOCTL_SG_ALLOC(r6, 0xc0106438, &(0x7f0000000480)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000080)={0x4c, 0x0, &(0x7f0000000240)=[@free_buffer={0x40086303, r5}, @increfs_done={0x40106308, 0x3}, @dead_binder_done, @request_death, @dead_binder_done, @exit_looper], 0x98, 0x0, &(0x7f00000000c0)="566b2c594880f910cb64545ea492fd39168ca44b1e9a3d78027e01df68cfcebfe6fc533e2ea89093d48ed7dc87780bd5cc0835e77d01a01b250ebf6436dc94c7c2138c54494afc10569e3ac4783596e40644641dff9a2447a4b627e73c04925a202a4268dd36b17ea1c5f819266d95036b889304258de90ca5b3acc5e8437329e38a11e2039f2d7ee6b19fb664468bdc25028a3e"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000400)) ioctl$DRM_IOCTL_AGP_ALLOC(r6, 0xc0206434, &(0x7f00000004c0)={0x4, 0x0, 0x20002}) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f0000000500)={0x0, r7}) [ 2095.374763][T25871] binder: 25866:25871 ioctl 40046210 0 returned -22 [ 2095.413802][T25871] binder: 25866:25871 ioctl 40046210 0 returned -22 02:34:57 executing program 0: syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSPTLCK(0xffffffffffffffff, 0x40045431, &(0x7f0000000040)=0x1) [ 2095.452430][T25878] binder: 25869:25878 ioctl c0306201 0 returned -14 [ 2095.492033][T25878] binder: 25869:25878 ioctl c0306201 0 returned -14 02:34:57 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5421, 0x400000) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r1, 0x4b6b, 0x0) ioctl$VT_GETMODE(r1, 0x5601, &(0x7f0000000000)) [ 2095.514002][T25881] binder: 25873:25881 ioctl 541b 0 returned -22 02:34:57 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) ioctl$SNDRV_CTL_IOCTL_HWDEP_NEXT_DEVICE(0xffffffffffffffff, 0xc0045520, &(0x7f0000000040)=0x40000000) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) r1 = mmap$binder(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x100000001) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x134, 0x0, &(0x7f00000003c0)=[@transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x18, 0x0, 0x0, 0x50, 0x18, &(0x7f00000005c0)=ANY=[@ANYBLOB="852a68771410000000000000000000000000000000000000852a62738a1000000300000000000000000000000000ec7bc4b57f98c800008561644900000000080000000000000002000000000000003f0000000000000094540162fa596de6e870197ad46487635f0978feb5e6ecda1a4d0807c7cf7a90107e1c643a7a77d11b74fe81899a8b17dc08e39dffce68aae235c1b692fd3505b696cb23feae09c912653d979c6941b35aa942e088d8"], &(0x7f0000000100)={0x0, 0x18, 0x30}}}, @free_buffer={0x40086303, r1}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000240)={@flat=@binder={0x73622a85, 0x1101, 0x2}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/233, 0xe9, 0x0, 0x1}, @fda={0x66646185, 0x2, 0x1, 0x6}}, &(0x7f00000002c0)={0x0, 0x18, 0x40}}, 0x1000}, @request_death={0x400c630e, 0x1}, @request_death={0x400c630e, 0x3}, @acquire_done, @decrefs, @register_looper, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x18, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x1000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x2}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000380)={0x0, 0x18, 0x30}}}, @increfs_done={0x40106308, 0x2}], 0x62, 0x0, &(0x7f0000000500)="53d52bd4ac89a51a37d6ee8dedd4a77d1bcf21563b28e85048713fb25a0ffe87466f604ef1760b91d03a441ae6c7bd2f9d52568cb661b1f3b25452d4552e51e6cb3fdc622b8fee02cd5d431f2513989c2d8f32361bdaf05897e98bcf87382bd26bab"}) [ 2095.585655][T25886] binder: 25883:25886 ioctl 541b 0 returned -22 02:34:57 executing program 3: write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f00000000c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000080)={0xffffffffffffffff}, 0x1, 0xffffffffffffffff, 0x30, 0x0, @in6={0xa, 0x4e20, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x591}}}, 0xa0) write$RDMA_USER_CM_CMD_LEAVE_MCAST(0xffffffffffffffff, &(0x7f0000000180)={0x11, 0x10, 0xfa00, {&(0x7f0000000040), r0}}, 0x18) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/capi/capi20\x00', 0x10341, 0x0) write$RDMA_USER_CM_CMD_NOTIFY(r1, &(0x7f0000000200)={0xf, 0x8, 0xfa00, {0xffffffffffffffff, 0xa}}, 0x10) r2 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r2, 0x5460, 0x0) [ 2095.637655][T25886] binder: 25883:25886 ioctl 541b 0 returned -22 02:34:57 executing program 2: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r0, 0x89f4, &(0x7f0000000340)={'syztnl1\x00', &(0x7f0000000040)={'ip6tnl0\x00', 0x0, 0x29, 0x80, 0xff, 0x3, 0x2, @mcast2, @mcast2, 0x700, 0x80, 0x400, 0x1}}) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) 02:34:57 executing program 0: syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSPTLCK(0xffffffffffffffff, 0x40045431, &(0x7f0000000040)=0x1) 02:34:57 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x80840, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$SG_SET_TIMEOUT(r1, 0x2201, &(0x7f0000000080)=0x4) [ 2095.744956][T25894] binder: 25891:25894 ioctl 40046210 0 returned -22 [ 2095.796794][T25898] binder: 25891:25898 ioctl 40046210 0 returned -22 02:34:57 executing program 3: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0xd0041, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x5) ioctl$BINDER_SET_MAX_THREADS(r1, 0x5460, 0x0) 02:34:57 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5421, 0x400000) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000014c0)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000001480)={&(0x7f0000001400)=@newneigh={0x6c, 0x1c, 0x4, 0x70bd29, 0x25dfdbfe, {0x1c, 0x0, 0x0, 0x0, 0x8, 0x0, 0x5}, [@NDA_VNI={0x8, 0x7, 0x20}, @NDA_CACHEINFO={0x14, 0x3, {0x3, 0x9, 0x0, 0x10000}}, @NDA_VLAN={0x6, 0x5, 0x2}, @NDA_IFINDEX={0x8}, @NDA_VNI={0x8, 0x7, 0xb5d}, @NDA_PROBES={0x8, 0x4, 0xce3}, @NDA_CACHEINFO={0x14, 0x3, {0xea79, 0x4, 0x9, 0x5}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x840}, 0x4004) 02:34:58 executing program 0: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSPTLCK(r0, 0x40045431, 0x0) 02:34:58 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) r1 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000080)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) r3 = syz_open_dev$binderN(&(0x7f0000002100)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000002380)={0x44, 0x0, &(0x7f0000002200)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000002140)={@fda={0x66646185, 0xa, 0x2, 0x1e}, @flat=@weak_binder={0x77622a85, 0x47bcb310e07af96d, 0x2}, @fda={0x66646185, 0x2, 0x2, 0x1b}}, &(0x7f00000021c0)={0x0, 0x20, 0x38}}}], 0xd3, 0x0, &(0x7f0000002280)="2a718126405eeee1e169bc3fb661deab40823d1de46b9f414ca590fb25f9166a973a061105961196187c37c8865c585bfdc6324bb046e90767026e98c69af687730fb0e9a228e6e527c4f1bd3f9076f6dfbb317a0b31e71da839945b1d23c47321b996ad589c34864bc6bb5969928881a8c43111942fbc7a052061f1d5de1deff3e140b132453a49decbff2e82ca191cce5e9f0f0df385bf7c667f97a78c488988fe2aad58800343d8cd40f4cc4d1c46c9b2a0bbb377e42e5154b73c7f12b2ef931877d39c834b6293e9e3e7821a03bceebe7a"}) r4 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r4, 0xc0405519, 0x0) write$FUSE_LK(0xffffffffffffffff, &(0x7f00000020c0)={0x28, 0x0, 0x0, {{0x6862, 0x1, 0x0, r2}}}, 0x28) [ 2095.955314][T25908] binder: 25902:25908 ioctl 541b 0 returned -22 02:34:58 executing program 2: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r0, 0x89f4, &(0x7f0000000340)={'syztnl1\x00', &(0x7f0000000040)={'ip6tnl0\x00', 0x0, 0x29, 0x80, 0xff, 0x3, 0x2, @mcast2, @mcast2, 0x700, 0x80, 0x400, 0x1}}) [ 2095.997984][T25908] binder: 25902:25908 ioctl c0306201 0 returned -14 [ 2096.062879][T25908] binder: 25902:25908 ioctl 541b 0 returned -22 [ 2096.065081][T25914] binder: 25909:25914 ioctl c0306201 0 returned -14 [ 2096.079630][T25917] binder: 25902:25917 ioctl c0306201 0 returned -14 [ 2096.094655][T25918] binder: 25911:25918 ioctl c0306201 0 returned -14 02:34:58 executing program 4: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x3, &(0x7f0000000180)=@framed, &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x58, &(0x7f0000000200)=""/88, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5421, 0x400000) [ 2096.115192][T25918] binder: 25911:25918 ioctl 40046210 0 returned -22 [ 2096.133519][T25922] binder: 25909:25922 ioctl c0306201 0 returned -14 02:34:58 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(r1, 0xc008551c, &(0x7f0000000040)={0x0, 0x14, [0xf, 0x7, 0x7ff, 0x8000, 0x9]}) 02:34:58 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r2, 0x4b6b, 0x0) ioctl$TIOCMBIC(r2, 0x5417, &(0x7f0000000040)=0x9) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) [ 2096.174623][T25923] binder: 25911:25923 ioctl c0306201 0 returned -14 [ 2096.206926][T25923] binder: 25911:25923 ioctl 40046210 0 returned -22 02:34:58 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) ioctl$SNDRV_CTL_IOCTL_HWDEP_NEXT_DEVICE(0xffffffffffffffff, 0xc0045520, &(0x7f0000000040)=0x40000000) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) r1 = mmap$binder(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x100000001) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000580)={0x134, 0x0, &(0x7f00000003c0)=[@transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x18, 0x0, 0x0, 0x50, 0x18, &(0x7f00000005c0)=ANY=[@ANYBLOB="852a68771410000000000000000000000000000000000000852a62738a1000000300000000000000000000000000ec7bc4b57f98c800008561644900000000080000000000000002000000000000003f0000000000000094540162fa596de6e870197ad46487635f0978feb5e6ecda1a4d0807c7cf7a90107e1c643a7a77d11b74fe81899a8b17dc08e39dffce68aae235c1b692fd3505b696cb23feae09c912653d979c6941b35aa942e088d8"], &(0x7f0000000100)={0x0, 0x18, 0x30}}}, @free_buffer={0x40086303, r1}, @transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000240)={@flat=@binder={0x73622a85, 0x1101, 0x2}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/233, 0xe9, 0x0, 0x1}, @fda={0x66646185, 0x2, 0x1, 0x6}}, &(0x7f00000002c0)={0x0, 0x18, 0x40}}, 0x1000}, @request_death={0x400c630e, 0x1}, @request_death={0x400c630e, 0x3}, @acquire_done, @decrefs, @register_looper, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x18, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@binder={0x73622a85, 0x1000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x2}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000380)={0x0, 0x18, 0x30}}}, @increfs_done={0x40106308, 0x2}], 0x62, 0x0, &(0x7f0000000500)="53d52bd4ac89a51a37d6ee8dedd4a77d1bcf21563b28e85048713fb25a0ffe87466f604ef1760b91d03a441ae6c7bd2f9d52568cb661b1f3b25452d4552e51e6cb3fdc622b8fee02cd5d431f2513989c2d8f32361bdaf05897e98bcf87382bd26bab"}) 02:34:58 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) connect$phonet_pipe(0xffffffffffffffff, &(0x7f0000000080)={0x23, 0x7, 0x4, 0x3}, 0x10) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) ioctl$sock_bt_hidp_HIDPCONNDEL(r1, 0x400448c9, &(0x7f00000000c0)={@any, 0x6}) syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x2) 02:34:58 executing program 2: ioctl$sock_ipv6_tunnel_SIOCGETPRL(0xffffffffffffffff, 0x89f4, &(0x7f0000000340)={'syztnl1\x00', &(0x7f0000000040)={'ip6tnl0\x00', 0x0, 0x29, 0x80, 0xff, 0x3, 0x2, @mcast2, @mcast2, 0x700, 0x80, 0x400, 0x1}}) 02:34:58 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x282583, 0x0) ioctl$TIOCSTI(r0, 0x5421, 0x1ffffffffffc) [ 2096.423225][T25934] binder: 25932:25934 ioctl 40046210 0 returned -22 [ 2096.423578][T25936] binder: 25931:25936 ioctl c0306201 0 returned -14 [ 2096.440768][T25937] binder: 25930:25937 ioctl 541b 0 returned -22 [ 2096.474796][T25939] binder: 25935:25939 ioctl 40046210 0 returned -22 [ 2096.481852][T25937] binder: 25930:25937 ioctl 541b 0 returned -22 [ 2096.519922][T25945] binder: 25931:25945 ioctl 4b6b 0 returned -22 [ 2096.551632][T25947] binder: 25935:25947 ioctl 40046210 0 returned -22 02:34:58 executing program 1: r0 = accept4(0xffffffffffffffff, &(0x7f0000000040)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000000c0)=0x80, 0x800) sendmsg$DCCPDIAG_GETSOCK(r0, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000200)={&(0x7f0000000140)={0x98, 0x13, 0x100, 0x70bd29, 0x25dfdbfc, {0x8, 0x3, 0x20, 0x7, {0x4e23, 0x4e22, [0x6, 0x3, 0x5, 0xa1c], [0x3ff, 0xfff, 0x7f, 0x9], 0x0, [0x8, 0x3]}, 0x80000000, 0x3f}, [@INET_DIAG_REQ_BYTECODE={0x4c, 0x1, "d9454f670873048b77c3033dc8d45ba748304664360d4642843fcdd7b30104295568521fb1da9d0ff7ef124f044667b8274e958b2ce2cdfb8cb98f8efcc6a251e637d2e74bfd3d5d"}]}, 0x98}, 0x1, 0x0, 0x0, 0x8840}, 0x40400d4) r1 = accept4(r0, &(0x7f0000001940)=@pptp={0x18, 0x2, {0x0, @broadcast}}, &(0x7f00000019c0)=0x80, 0x0) sendmsg$GTP_CMD_GETPDP(r1, &(0x7f0000001b00)={&(0x7f0000001a00)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000001ac0)={&(0x7f0000001a40)={0x44, 0x0, 0x1, 0x70bd2b, 0x25dfdbfc, {}, [@GTPA_NET_NS_FD={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_PEER_ADDRESS={0x8, 0x4, @initdev={0xac, 0x1e, 0x0, 0x0}}, @GTPA_VERSION={0x8, 0x2, 0x1}, @GTPA_FLOW={0x6, 0x6, 0x4}, @GTPA_PEER_ADDRESS={0x8, 0x4, @multicast1}]}, 0x44}, 0x1, 0x0, 0x0, 0xbc2e5f62b585a66d}, 0x40) r2 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r2, 0x541b, 0x0) 02:34:58 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x800) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x80002, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(0xffffffffffffffff, 0x89fb, &(0x7f0000000240)={'syztnl2\x00', &(0x7f00000001c0)={'syztnl0\x00', 0x0, 0x2f, 0x3, 0x5, 0xffff, 0x45, @local, @local, 0x796, 0x1, 0x9, 0x1}}) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x1d, 0x5, &(0x7f0000000080)=@raw=[@generic={0xb0, 0x0, 0x8, 0x1ff, 0x6}, @btf_id={0x18, 0x4, 0x3, 0x0, 0x1}, @map_val={0x18, 0x0, 0x2, 0x0, r2, 0x0, 0x0, 0x0, 0x3f}], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0xa4, &(0x7f0000000100)=""/164, 0x41100, 0x12, [], r3, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000280)={0x5, 0x1}, 0x8, 0x10, &(0x7f00000002c0)={0x2, 0x1, 0x3ff, 0x10001}, 0x10, 0xffffffffffffffff}, 0x78) socket$can_raw(0x1d, 0x3, 0x1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) 02:34:58 executing program 4: sendmsg$RDMA_NLDEV_CMD_SYS_SET(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x18, 0x1407, 0x20c, 0x70bd2b, 0x25dfdbff, "", [@RDMA_NLDEV_NET_NS_FD={0x8}]}, 0x18}, 0x1, 0x0, 0x0, 0x40}, 0x0) sendmsg$GTP_CMD_NEWPDP(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x24, 0x0, 0x2, 0x70bd26, 0x25dfdbff, {}, [@GTPA_I_TEI={0x8}, @GTPA_FLOW={0x6, 0x6, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x4000011) r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x4545c2, 0x0) ioctl$TIOCSTI(r0, 0x5421, 0x400000) 02:34:58 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) 02:34:58 executing program 2: ioctl$sock_ipv6_tunnel_SIOCGETPRL(0xffffffffffffffff, 0x89f4, &(0x7f0000000340)={'syztnl1\x00', &(0x7f0000000040)={'ip6tnl0\x00', 0x0, 0x29, 0x80, 0xff, 0x3, 0x2, @mcast2, @mcast2, 0x700, 0x80, 0x400, 0x1}}) 02:34:58 executing program 5: write$FUSE_GETXATTR(0xffffffffffffffff, &(0x7f0000000040)={0x18, 0xffffffffffffffda, 0x0, {0x2}}, 0x18) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) [ 2096.763914][T25956] binder: 25951:25956 ioctl 541b 0 returned -22 02:34:58 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5421, 0x400000) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000100)={'syztnl2\x00', &(0x7f0000000080)={'ip6tnl0\x00', 0x0, 0x0, 0xc1, 0xa3, 0x5, 0x48, @private0={0xfc, 0x0, [], 0x1}, @private0, 0x1, 0x7800, 0x692, 0x5}}) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r0, 0x89f4, &(0x7f000000a840)={'ip6tnl0\x00', &(0x7f000000a7c0)={'ip6tnl0\x00', 0x0, 0x2f, 0x1f, 0x0, 0x1, 0x60, @rand_addr=' \x01\x00', @local, 0x10, 0x700, 0xc28e, 0x800}}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f000000a980)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f000000a940)={&(0x7f000000a880)=@bridge_getlink={0xa4, 0x12, 0x200, 0x70bd25, 0x25dfdbff, {0x7, 0x0, 0x0, 0x0, 0x25004, 0x40020}, [@IFLA_LINKINFO={0x70, 0x12, 0x0, 0x1, @vti={{0x8, 0x1, 'vti\x00'}, {0x64, 0x2, 0x0, 0x1, [@vti_common_policy, @IFLA_VTI_LOCAL={0x8, 0x4, @multicast2}, @IFLA_VTI_LOCAL={0x8, 0x4, @private=0xa010102}, @IFLA_VTI_REMOTE={0x8, 0x5, @remote}, @IFLA_VTI_REMOTE={0x8, 0x5, @empty}, @vti_common_policy=[@IFLA_VTI_OKEY={0x8, 0x3, 0x2}, @IFLA_VTI_LINK={0x8, 0x1, r1}, @IFLA_VTI_OKEY={0x8, 0x3, 0x6}, @IFLA_VTI_FWMARK={0x8, 0x6, 0x8}, @IFLA_VTI_LINK={0x8, 0x1, r2}, @IFLA_VTI_FWMARK={0x8, 0x6, 0x4}, @IFLA_VTI_FWMARK={0x8, 0x6, 0x2}, @IFLA_VTI_OKEY={0x8, 0x3, 0x1}]]}}}, @IFLA_IFALIAS={0x14, 0x14, 'team_slave_0\x00'}]}, 0xa4}, 0x1, 0x0, 0x0, 0x4}, 0x2400c040) [ 2096.824318][T25960] binder: 25952:25960 ioctl c0306201 0 returned -14 02:34:58 executing program 2: ioctl$sock_ipv6_tunnel_SIOCGETPRL(0xffffffffffffffff, 0x89f4, &(0x7f0000000340)={'syztnl1\x00', &(0x7f0000000040)={'ip6tnl0\x00', 0x0, 0x29, 0x80, 0xff, 0x3, 0x2, @mcast2, @mcast2, 0x700, 0x80, 0x400, 0x1}}) 02:34:58 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x141600, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x541b, 0x0) 02:34:58 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) 02:34:59 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x800) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x80002, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(0xffffffffffffffff, 0x89fb, &(0x7f0000000240)={'syztnl2\x00', &(0x7f00000001c0)={'syztnl0\x00', 0x0, 0x2f, 0x3, 0x5, 0xffff, 0x45, @local, @local, 0x796, 0x1, 0x9, 0x1}}) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x1d, 0x5, &(0x7f0000000080)=@raw=[@generic={0xb0, 0x0, 0x8, 0x1ff, 0x6}, @btf_id={0x18, 0x4, 0x3, 0x0, 0x1}, @map_val={0x18, 0x0, 0x2, 0x0, r2, 0x0, 0x0, 0x0, 0x3f}], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0xa4, &(0x7f0000000100)=""/164, 0x41100, 0x12, [], r3, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000280)={0x5, 0x1}, 0x8, 0x10, &(0x7f00000002c0)={0x2, 0x1, 0x3ff, 0x10001}, 0x10, 0xffffffffffffffff}, 0x78) socket$can_raw(0x1d, 0x3, 0x1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) [ 2096.932737][T25964] binder: 25963:25964 ioctl 40046210 0 returned -22 [ 2096.971220][T25967] binder: 25963:25967 ioctl 40046210 0 returned -22 02:34:59 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5421, 0x400000) recvmmsg(r0, &(0x7f0000001840)=[{{&(0x7f0000000000)=@alg, 0x80, &(0x7f0000000180)=[{&(0x7f0000000080)=""/20, 0x14}, {&(0x7f00000000c0)=""/108, 0x6c}], 0x2, &(0x7f00000001c0)=""/20, 0x14}, 0x9}, {{&(0x7f0000000200)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x80, &(0x7f0000000340)=[{&(0x7f0000000280)=""/3, 0x3}, {&(0x7f00000002c0)=""/127, 0x7f}], 0x2, &(0x7f0000000380)=""/240, 0xf0}, 0x40}, {{&(0x7f0000000480)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, 0x80, &(0x7f00000006c0)=[{&(0x7f0000000500)=""/195, 0xc3}, {&(0x7f0000000600)=""/177, 0xb1}], 0x2, &(0x7f0000000700)=""/91, 0x5b}, 0x40cf}, {{&(0x7f0000000780)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @empty}}, 0x80, &(0x7f0000001800)=[{&(0x7f0000000800)=""/4096, 0x1000}], 0x1}, 0x1c}], 0x4, 0x41, &(0x7f0000001940)={0x77359400}) 02:34:59 executing program 2: socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCGETPRL(0xffffffffffffffff, 0x89f4, &(0x7f0000000340)={'syztnl1\x00', &(0x7f0000000040)={'ip6tnl0\x00', 0x0, 0x29, 0x80, 0xff, 0x3, 0x2, @mcast2, @mcast2, 0x700, 0x80, 0x400, 0x1}}) [ 2097.083180][T25974] binder: 25968:25974 ioctl c0306201 0 returned -14 02:34:59 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r1, 0x4b6b, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r2, 0x4b6b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0xd4, 0x0, &(0x7f00000004c0)=[@transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x58, 0x18, &(0x7f00000006c0)=ANY=[@ANYBLOB="852a646600000006ae1f221e0826a77753744a871ce46c38dffb4feba42de281a2320b593f82a6aa2b11317ae808061757cdd01285d3acb980fb25d3970882802e35132d3e9ac8334d4dd887a516a671b434a5161f164b80da6206a2a1f7380887850d00", @ANYRES32=r1, @ANYBLOB="00000000000000000000000085616466000000000500000000000000000000000000000009000000000000008561646600000000030000000000000002000000000000001d00000000000000"], &(0x7f00000000c0)={0x0, 0x18, 0x38}}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000180)={@fd={0x66642a85, 0x0, r0}, @ptr={0x70742a85, 0x1, &(0x7f0000000100)=""/85, 0x55, 0x1, 0xd}, @fd={0x66642a85, 0x0, r2}}, &(0x7f0000000200)={0x0, 0x18, 0x40}}}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000400)={@ptr={0x70742a85, 0x0, &(0x7f0000000240)=""/241, 0xf1, 0x0, 0x28}, @ptr={0x70742a85, 0x0, &(0x7f0000000340)=""/153, 0x99, 0x1, 0x18}, @flat=@binder={0x73622a85, 0xa, 0x3}}, &(0x7f0000000480)={0x0, 0x28, 0x50}}}, @decrefs], 0xb3, 0x0, &(0x7f0000000780)="3ec4964064a99bc785d8d4580497edcc6a06e4702563e6d5e7f5b67a540acd14deca851032ff25e5d34e18e4730a83ae8f09eb0768260d0bcc433a345d9adfec4e3501c9601a5188c176b1174b148bbd80d655328a424215eaf40a0cf895655cf181663a1d214ffe45fea5565998efb4df025dec0daf751a70fbea2a74f4d82bc2f6d20c596a74ed5e1f09ed1a984a3ad395bfe25737f8b78451a84d3a12d999e914fa624cf54c7b923e53cae08b3e79cbb036"}) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) [ 2097.129383][T25974] binder: 25968:25974 ioctl c0306201 0 returned -14 [ 2097.139626][T25976] binder: 25973:25976 ioctl c0306201 0 returned -14 02:34:59 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x80000, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)={0x1b, 0x3, 0x7ff, 0x13c, 0x120, 0xffffffffffffffff, 0x4, [], 0x0, r1, 0x1, 0x1, 0x3}, 0x40) [ 2097.169892][T25974] binder: 25968:25974 ioctl c0306201 0 returned -14 [ 2097.206223][T25974] binder: 25968:25974 ioctl 541b 0 returned -22 02:34:59 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x800) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x80002, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(0xffffffffffffffff, 0x89fb, &(0x7f0000000240)={'syztnl2\x00', &(0x7f00000001c0)={'syztnl0\x00', 0x0, 0x2f, 0x3, 0x5, 0xffff, 0x45, @local, @local, 0x796, 0x1, 0x9, 0x1}}) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x1d, 0x5, &(0x7f0000000080)=@raw=[@generic={0xb0, 0x0, 0x8, 0x1ff, 0x6}, @btf_id={0x18, 0x4, 0x3, 0x0, 0x1}, @map_val={0x18, 0x0, 0x2, 0x0, r2, 0x0, 0x0, 0x0, 0x3f}], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0xa4, &(0x7f0000000100)=""/164, 0x41100, 0x12, [], r3, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000280)={0x5, 0x1}, 0x8, 0x10, &(0x7f00000002c0)={0x2, 0x1, 0x3ff, 0x10001}, 0x10, 0xffffffffffffffff}, 0x78) socket$can_raw(0x1d, 0x3, 0x1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) [ 2097.241520][T25974] binder: 25968:25974 ioctl c0306201 0 returned -14 [ 2097.269353][T25984] binder: 25968:25984 ioctl c0306201 0 returned -14 02:34:59 executing program 4: openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)) 02:34:59 executing program 2: socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCGETPRL(0xffffffffffffffff, 0x89f4, &(0x7f0000000340)={'syztnl1\x00', &(0x7f0000000040)={'ip6tnl0\x00', 0x0, 0x29, 0x80, 0xff, 0x3, 0x2, @mcast2, @mcast2, 0x700, 0x80, 0x400, 0x1}}) 02:34:59 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)={0x2}) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r0, 0xc018620c, &(0x7f0000000080)={0x2}) [ 2097.357806][T25988] binder: 25981:25988 ioctl 40046210 0 returned -22 [ 2097.431607][T25993] binder: 25981:25993 ioctl 40046210 0 returned -22 [ 2097.463726][T25994] binder: 25990:25994 ioctl c0306201 0 returned -14 02:34:59 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) [ 2097.491378][T25996] binder: 25992:25996 ioctl c0306201 0 returned -14 02:34:59 executing program 2: socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCGETPRL(0xffffffffffffffff, 0x89f4, &(0x7f0000000340)={'syztnl1\x00', &(0x7f0000000040)={'ip6tnl0\x00', 0x0, 0x29, 0x80, 0xff, 0x3, 0x2, @mcast2, @mcast2, 0x700, 0x80, 0x400, 0x1}}) 02:34:59 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) [ 2097.557371][T26000] binder: 25995:26000 ioctl c018620c 20000080 returned -1 [ 2097.591167][T26002] binder: 25995:26002 ioctl c018620c 20000080 returned -1 02:34:59 executing program 0: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x800) r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x80002, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(0xffffffffffffffff, 0x89fb, &(0x7f0000000240)={'syztnl2\x00', &(0x7f00000001c0)={'syztnl0\x00', 0x0, 0x2f, 0x3, 0x5, 0xffff, 0x45, @local, @local, 0x796, 0x1, 0x9, 0x1}}) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x1d, 0x5, &(0x7f0000000080)=@raw=[@generic={0xb0, 0x0, 0x8, 0x1ff, 0x6}, @btf_id={0x18, 0x4, 0x3, 0x0, 0x1}, @map_val={0x18, 0x0, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0x3f}], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0xa4, &(0x7f0000000100)=""/164, 0x41100, 0x12, [], r2, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000280)={0x5, 0x1}, 0x8, 0x10, &(0x7f00000002c0)={0x2, 0x1, 0x3ff, 0x10001}, 0x10, 0xffffffffffffffff}, 0x78) socket$can_raw(0x1d, 0x3, 0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 02:34:59 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x105402, 0x0) ioctl$TIOCSTI(r0, 0x5421, 0x400000) 02:34:59 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x802) ioctl$KDGKBENT(0xffffffffffffffff, 0x4b46, &(0x7f0000000000)={0x9, 0x0, 0x4}) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) 02:34:59 executing program 3: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x3) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) [ 2097.780573][T26012] binder: 26008:26012 ioctl 40046210 0 returned -22 02:34:59 executing program 2: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r0, 0x89f4, 0x0) [ 2097.822530][T26013] binder: 26009:26013 ioctl c0306201 0 returned -14 02:34:59 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f0000000040)=0x7) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) [ 2097.875053][T26017] binder: 26014:26017 ioctl 541b 0 returned -22 02:35:00 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x501700, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) read$FUSE(r0, &(0x7f0000000180)={0x2020, 0x0, 0x0}, 0x2020) read$FUSE(r0, &(0x7f00000021c0)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) r4 = geteuid() r5 = geteuid() read$FUSE(r0, &(0x7f0000004200)={0x2020, 0x0, 0x0, 0x0}, 0x2020) read$FUSE(r0, &(0x7f0000006240)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_DIRENTPLUS(r1, &(0x7f0000008280)={0x340, 0xea647b851e6419ab, r2, [{{0x3, 0x0, 0x1, 0x80000000, 0xe930, 0x8, {0x6, 0xfffffffffffff2cb, 0x5d1, 0x80000001, 0x40, 0x9, 0x7fff, 0x3, 0xfffff084, 0xa000, 0x4, 0x0, r3, 0x5, 0x8001}}, {0x0, 0x244, 0x2, 0x7, '%.'}}, {{0x2, 0x2, 0x3, 0x20, 0x100, 0xff, {0x5, 0x80000000, 0x3, 0x44, 0x8, 0x5ade, 0xc8, 0x0, 0x4, 0x1000, 0x6, r4, 0xee01, 0x5, 0x4}}, {0x3, 0xfffffffffffff800, 0x0, 0x200}}, {{0x2, 0x3, 0xffffffffffffffe1, 0xffffffffffffff7b, 0x3ff, 0xffffffc0, {0x3, 0x6, 0x100000001, 0xffffffff00000001, 0x9, 0x227, 0x5, 0x10001, 0xfffffff6, 0x6000, 0x10001, r5, 0xffffffffffffffff, 0x6, 0xff}}, {0x5, 0x264, 0x12, 0x9, '/proc/capi/capi20\x00'}}, {{0x0, 0x2, 0x8, 0x4, 0x1210, 0x3, {0x0, 0xea, 0x0, 0x7fffffff, 0xffff, 0x3, 0x6, 0xffff, 0x3, 0x8000, 0x0, r6, r7, 0x6, 0x7f}}, {0x0, 0x6, 0x12, 0x8000, '/proc/capi/capi20\x00'}}, {{0x2, 0x0, 0x3, 0x4, 0x7f, 0x2, {0x1, 0x5, 0x2, 0x800, 0x1, 0x5, 0x4, 0x2, 0x40, 0x4000, 0x195a, 0x0, 0xee00, 0x9, 0x9}}, {0x2, 0x8000, 0x0, 0x3}}]}, 0x340) ioctl$TIOCSTI(r0, 0x5421, 0x400000) 02:35:00 executing program 0: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x800) syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x80002, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(0xffffffffffffffff, 0x89fb, &(0x7f0000000240)={'syztnl2\x00', &(0x7f00000001c0)={'syztnl0\x00', 0x0, 0x2f, 0x3, 0x5, 0xffff, 0x45, @local, @local, 0x796, 0x1, 0x9, 0x1}}) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x1d, 0x5, &(0x7f0000000080)=@raw=[@generic={0xb0, 0x0, 0x8, 0x1ff, 0x6}, @btf_id={0x18, 0x4, 0x3, 0x0, 0x1}, @map_val={0x18, 0x0, 0x2, 0x0, r0, 0x0, 0x0, 0x0, 0x3f}], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0xa4, &(0x7f0000000100)=""/164, 0x41100, 0x12, [], r1, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000280)={0x5, 0x1}, 0x8, 0x10, &(0x7f00000002c0)={0x2, 0x1, 0x3ff, 0x10001}, 0x10, 0xffffffffffffffff}, 0x78) socket$can_raw(0x1d, 0x3, 0x1) [ 2097.921537][T26020] binder: 26014:26020 ioctl 541b 0 returned -22 02:35:00 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(0xffffffffffffffff, 0x40045532, &(0x7f0000000040)=0x8000) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)={0x2}) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r2, 0xc0405519, 0x0) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r2, 0x81785501, &(0x7f00000000c0)=""/218) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) 02:35:00 executing program 2: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r0, 0x89f4, 0x0) [ 2098.067390][T26028] binder: 26023:26028 ioctl 40046210 0 returned -22 [ 2098.120621][T26030] binder: 26023:26030 ioctl 40046210 0 returned -22 02:35:00 executing program 4: sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x420000}, 0xc, &(0x7f0000000040)={&(0x7f0000000180)={0x150, 0x1403, 0x100, 0x70bd2b, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'bond_slave_1\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'batadv_slave_0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'macsec0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'geneve1\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ip6tnl0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'hsr0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netdevsim0\x00'}}]}, 0x150}}, 0x4044810) socketpair(0x25, 0x3, 0x4, &(0x7f0000003ac0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$RDMA_NLDEV_CMD_RES_QP_GET(r0, &(0x7f0000003c00)={&(0x7f0000003b00)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000003bc0)={&(0x7f0000003b40)={0x58, 0x140a, 0x1, 0x70bd27, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_RES_LQPN={0x8, 0x15, 0x2}, @RDMA_NLDEV_ATTR_RES_LQPN={0x8, 0x15, 0x2}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x2}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x2}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x3}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x4}, @RDMA_NLDEV_ATTR_RES_LQPN={0x8, 0x15, 0x3}]}, 0x58}, 0x1, 0x0, 0x0, 0x20008000}, 0x20000000) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r1, 0x5421, 0x400000) 02:35:00 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) write$FUSE_DIRENTPLUS(0xffffffffffffffff, &(0x7f0000000240)={0x160, 0x0, 0x0, [{{0x1, 0x3, 0x1, 0x20000000, 0x1, 0x80, {0x0, 0x3f, 0x91e, 0xe5, 0xe9ed, 0xa42f, 0x7fff, 0x435589e0, 0x9, 0x6000, 0xfffffff8, 0xffffffffffffffff, 0xffffffffffffffff, 0x6d25, 0x9}}, {0x5, 0x9000000000000000, 0x12, 0x1, '/proc/capi/capi20\x00'}}, {{0x6, 0x3, 0x7, 0x7f, 0x7f, 0xa8f, {0x5, 0x1, 0x155, 0x7, 0x25, 0x1, 0x2e3, 0x7, 0x0, 0x4000, 0x0, 0x0, 0xffffffffffffffff, 0x1ff, 0x1000}}, {0x0, 0x10001, 0x8, 0x40, '\'.]}:{[('}}]}, 0x160) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x400) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/capi/capi20\x00', 0x100500, 0x0) r3 = syz_genetlink_get_family_id$gtp(&(0x7f0000000140)='gtp\x00') sendmsg$GTP_CMD_GETPDP(r2, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000001c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="02002bbd7000fedbdf250200000008000900030000000800020001000000bd6aa422a5dd06466517371969349e907992f5"], 0x24}, 0x1, 0x0, 0x0, 0x810}, 0x8080) r4 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000080)='/proc/capi/capi20\x00', 0x2800, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r4, 0x20003) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0xfff) [ 2098.186837][T26033] binder: 26029:26033 ioctl c0306201 0 returned -14 02:35:00 executing program 0: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x800) syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x80002, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(0xffffffffffffffff, 0x89fb, &(0x7f0000000240)={'syztnl2\x00', &(0x7f00000001c0)={'syztnl0\x00', 0x0, 0x2f, 0x3, 0x5, 0xffff, 0x45, @local, @local, 0x796, 0x1, 0x9, 0x1}}) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x1d, 0x5, &(0x7f0000000080)=@raw=[@generic={0xb0, 0x0, 0x8, 0x1ff, 0x6}, @btf_id={0x18, 0x4, 0x3, 0x0, 0x1}, @map_val={0x18, 0x0, 0x2, 0x0, r0, 0x0, 0x0, 0x0, 0x3f}], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0xa4, &(0x7f0000000100)=""/164, 0x41100, 0x12, [], r1, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000280)={0x5, 0x1}, 0x8, 0x10, &(0x7f00000002c0)={0x2, 0x1, 0x3ff, 0x10001}, 0x10, 0xffffffffffffffff}, 0x78) 02:35:00 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x100, 0x0) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f0000000080)={0x3}) [ 2098.267667][T26037] binder: 26035:26037 ioctl 541b 0 returned -22 [ 2098.276658][T26033] binder: 26029:26033 ioctl c0306201 0 returned -14 [ 2098.287242][T26037] binder: 26035:26037 ioctl c0306201 0 returned -14 02:35:00 executing program 2: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r0, 0x89f4, 0x0) [ 2098.349305][T26044] binder: 26035:26044 ioctl 541b 0 returned -22 02:35:00 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$KDDELIO(0xffffffffffffffff, 0x4b35, 0x81) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) [ 2098.397045][T26046] binder: 26042:26046 ioctl 40046210 0 returned -22 [ 2098.433612][T26044] binder: 26035:26044 ioctl c0306201 0 returned -14 [ 2098.448577][T26046] binder: 26042:26046 ioctl 40046210 0 returned -22 02:35:00 executing program 4: openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCSTI(r0, 0x5421, 0x400000) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r1, 0x4b6b, 0x0) ioctl$KDSKBLED(r1, 0x4b65, 0x70d45132) 02:35:00 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$TIOCGLCKTRMIOS(0xffffffffffffffff, 0x5456, &(0x7f0000000040)={0x0, 0x4, 0x3, 0x80000001, 0x7, "e24d58896ec8ed3aece29a14e03cccf2a99238"}) 02:35:00 executing program 0: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x800) syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x80002, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x1d, 0x5, &(0x7f0000000080)=@raw=[@generic={0xb0, 0x0, 0x8, 0x1ff, 0x6}, @btf_id={0x18, 0x4, 0x3, 0x0, 0x1}, @map_val={0x18, 0x0, 0x2, 0x0, r0, 0x0, 0x0, 0x0, 0x3f}], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0xa4, &(0x7f0000000100)=""/164, 0x41100, 0x12, [], 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000280)={0x5, 0x1}, 0x8, 0x10, &(0x7f00000002c0)={0x2, 0x1, 0x3ff, 0x10001}, 0x10, 0xffffffffffffffff}, 0x78) 02:35:00 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x1802) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(0xffffffffffffffff, 0xc0045540, &(0x7f0000000200)=0x2) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f0000000000)=0x20) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/hwrng\x00', 0x101800, 0x0) sendmsg$L2TP_CMD_NOOP(r1, &(0x7f00000001c0)={&(0x7f0000000100), 0xc, &(0x7f0000000180)={&(0x7f0000000240)={0x28, 0x0, 0x4, 0x70bd25, 0x25dfdbfb, {}, [@L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x1}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @remote}]}, 0x28}, 0x1, 0x0, 0x0, 0x44040}, 0x40000) r2 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000080)={0x2}) 02:35:00 executing program 2: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r0, 0x89f4, &(0x7f0000000340)={'syztnl1\x00', 0x0}) 02:35:00 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x6, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x6}, [@ldst={0x1, 0x0, 0x3, 0x0, 0x3, 0xc, 0xffffffffffffffff}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffffa}, @ldst={0x1, 0x0, 0x6, 0x7, 0x5, 0x40, 0x4}]}, &(0x7f0000000080)='syzkaller\x00', 0x9, 0x34, &(0x7f00000000c0)=""/52, 0x40f00, 0x1, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000100)={0x9, 0x4}, 0x8, 0x10, &(0x7f0000000140)={0x0, 0xc, 0x9, 0x1000}, 0x10}, 0x78) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x54, 0x0, &(0x7f00000002c0)=[@clear_death={0x400c630f, 0x3}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@fda={0x66646185, 0x2, 0x2, 0x29}, @fda={0x66646185, 0x6, 0x2, 0x1b}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000280)={0x0, 0x20, 0x40}}}], 0x42, 0x0, &(0x7f0000000340)="1196f03980f74d8cc5359b13324cdae5a8e63335015ab6339ae76977ac313ed9de7730882bb22f57cd265bf1d102de0934fc2842757b9d59f7493d732a2068c9716c"}) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r2, 0xc0405519, 0x0) clock_gettime(0x0, &(0x7f0000000400)={0x0, 0x0}) ioctl$vim2m_VIDIOC_QUERYBUF(r2, 0xc0585609, &(0x7f0000000440)={0xfffffff9, 0x1, 0x4, 0x0, 0x200, {r3, r4/1000+10000}, {0x1, 0x5, 0x6c, 0x3a, 0x6, 0x6, "99c8c404"}, 0x2ecf, 0x4, @fd, 0x7fffffff}) [ 2098.718680][T26064] binder: 26058:26064 ioctl 40046210 0 returned -22 02:35:00 executing program 0: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x800) syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x1d, 0x5, &(0x7f0000000080)=@raw=[@generic={0xb0, 0x0, 0x8, 0x1ff, 0x6}, @btf_id={0x18, 0x4, 0x3, 0x0, 0x1}, @map_val={0x18, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x3f}], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0xa4, &(0x7f0000000100)=""/164, 0x41100, 0x12, [], 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000280)={0x5, 0x1}, 0x8, 0x10, &(0x7f00000002c0)={0x2, 0x1, 0x3ff, 0x10001}, 0x10, 0xffffffffffffffff}, 0x78) [ 2098.778506][T26066] binder: 26060:26066 ioctl 541b 0 returned -22 [ 2098.815092][T26066] binder: 26060:26066 ioctl c0306201 0 returned -14 02:35:00 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0xe0242, 0x0) ioctl$TIOCSTI(r0, 0x5421, 0x400000) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000000)={0x0, 0x0, 0x10000}) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000080)={0x7, 0x3, 0x8000, 0xffffffff, 'syz1\x00'}) socket$l2tp6(0xa, 0x2, 0x73) ioctl$DRM_IOCTL_AGP_FREE(r0, 0x40206435, &(0x7f0000000040)={0x0, r1}) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r2, 0x4b6b, 0x0) ioctl$TIOCSPTLCK(r2, 0x40045431, &(0x7f00000000c0)) 02:35:00 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r2, 0xc0405519, 0x0) clock_gettime(0x0, &(0x7f0000000200)={0x0, 0x0}) ioctl$vim2m_VIDIOC_QUERYBUF(r2, 0xc0585609, &(0x7f0000000240)={0x9, 0x3, 0xa7, 0x40, 0x6, {r3, r4/1000+60000}, {0x4, 0x1, 0x44, 0x81, 0x3f, 0x1, "8bfbf978"}, 0x0, 0x3, @offset=0x3, 0x3}) ioctl$vim2m_VIDIOC_QUERYBUF(r2, 0xc0585609, &(0x7f00000002c0)={0x1, 0x2, 0x4, 0x800, 0x0, {}, {0x5, 0x2, 0x2, 0x1f, 0xbd, 0x7f, 'FocH'}, 0x5, 0x3, @fd, 0xfffffff8}) r5 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) r6 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) r7 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x2000, 0x0) ioctl$SNDRV_CTL_IOCTL_POWER_STATE(r7, 0x800455d1, &(0x7f0000000080)) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, 0x0) ioctl$BINDER_SET_MAX_THREADS(r6, 0x40046205, &(0x7f0000000000)=0xffff) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, 0x0) ioctl$BINDER_SET_MAX_THREADS(r5, 0x40046210, 0x0) r8 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r8, 0xc0405519, 0x0) sendmsg$RDMA_NLDEV_CMD_DELLINK(r8, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x20, 0x1404, 0x10, 0x70bd2c, 0x25dfdbfd, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x20}, 0x1, 0x0, 0x0, 0x24000014}, 0x20004000) [ 2098.869921][T26066] binder: 26060:26066 ioctl 541b 0 returned -22 [ 2098.895743][T26072] binder: 26060:26072 ioctl c0306201 0 returned -14 02:35:01 executing program 2: sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x420000}, 0xc, &(0x7f0000000040)={&(0x7f0000000180)={0x150, 0x1403, 0x100, 0x70bd2b, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'bond_slave_1\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'batadv_slave_0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'macsec0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'geneve1\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ip6tnl0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'hsr0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netdevsim0\x00'}}]}, 0x150}}, 0x4044810) socketpair(0x25, 0x3, 0x4, &(0x7f0000003ac0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$RDMA_NLDEV_CMD_RES_QP_GET(r0, &(0x7f0000003c00)={&(0x7f0000003b00)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000003bc0)={&(0x7f0000003b40)={0x58, 0x140a, 0x1, 0x70bd27, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_RES_LQPN={0x8, 0x15, 0x2}, @RDMA_NLDEV_ATTR_RES_LQPN={0x8, 0x15, 0x2}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x2}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x2}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x3}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x4}, @RDMA_NLDEV_ATTR_RES_LQPN={0x8, 0x15, 0x3}]}, 0x58}, 0x1, 0x0, 0x0, 0x20008000}, 0x20000000) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r1, 0x5421, 0x400000) 02:35:01 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) ioctl$TIOCSPTLCK(0xffffffffffffffff, 0x40045431, &(0x7f0000000040)=0x1) 02:35:01 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x1000) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0xc00) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000080)='/proc/capi/capi20\x00', 0x507000, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/hwrng\x00', 0xc0800, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) 02:35:01 executing program 0: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x800) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x1d, 0x5, &(0x7f0000000080)=@raw=[@generic={0xb0, 0x0, 0x8, 0x1ff, 0x6}, @btf_id={0x18, 0x4, 0x3, 0x0, 0x1}, @map_val={0x18, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x3f}], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0xa4, &(0x7f0000000100)=""/164, 0x41100, 0x12, [], 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000280)={0x5, 0x1}, 0x8, 0x10, &(0x7f00000002c0)={0x2, 0x1, 0x3ff, 0x10001}, 0x10, 0xffffffffffffffff}, 0x78) [ 2099.049781][T26082] binder: 26078:26082 ioctl c0306201 0 returned -14 [ 2099.077556][T26082] binder: 26078:26082 ioctl c0306201 0 returned -14 [ 2099.142305][T26082] binder: 26078:26082 ioctl c0306201 0 returned -14 [ 2099.175018][T26082] binder: 26078:26082 ioctl c0306201 0 returned -14 02:35:01 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(0xffffffffffffffff, 0xc0405519, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r0, 0x89f4, &(0x7f0000004fc0)={'syztnl1\x00', &(0x7f0000004f40)={'ip6_vti0\x00', 0x0, 0x29, 0x80, 0x0, 0x3, 0x0, @private2={0xfc, 0x2, [], 0x1}, @dev={0xfe, 0x80, [], 0x3b}, 0x8, 0x40, 0x7, 0x660c8c08}}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000005140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000005100)={&(0x7f0000005000)=@ipv6_delroute={0xf0, 0x19, 0x8, 0x70bd2a, 0x25dfdbfe, {0xa, 0x20, 0x0, 0x1, 0xfe, 0x0, 0xfe, 0x4, 0x2a00}, [@RTA_GATEWAY={0x14, 0x5, @empty}, @RTA_IIF={0x8}, @RTA_OIF={0x8, 0x4, r1}, @RTA_IIF={0x8, 0x3, r1}, @RTA_METRICS={0x9d, 0x8, 0x0, 0x1, "1b3ffd62750b1e8ef10a7567e677ad0d1b98fb04bb8ffd4329833518a09e55e32ca09d0e995458837f37042f5280b26b1d984eaa13e356735d94a3be1bc5780124291e261fb35fc0cd718b8087959834681a0d54682887aa3983e23ebb4e82de120826030a1d23580a16174a16c95c79375da6d0c12f0334a63b9c68a896262cfd0af30cb132d500008f2f1e7ec9e5fe7d9e7a95f59a971d00"}, @RTA_EXPIRES={0x8, 0x17, 0x6}]}, 0xf0}, 0x1, 0x0, 0x0, 0x20080000}, 0x4080) [ 2099.190347][T26088] binder: 26085:26088 ioctl 541b 0 returned -22 [ 2099.217782][T26082] binder: 26078:26082 ioctl 40046210 0 returned -22 [ 2099.231134][T26088] binder: 26085:26088 ioctl 541b 0 returned -22 02:35:01 executing program 2: sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x420000}, 0xc, &(0x7f0000000040)={&(0x7f0000000180)={0x150, 0x1403, 0x100, 0x70bd2b, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'bond_slave_1\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'batadv_slave_0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'macsec0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'geneve1\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ip6tnl0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'hsr0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netdevsim0\x00'}}]}, 0x150}}, 0x4044810) socketpair(0x25, 0x3, 0x4, &(0x7f0000003ac0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$RDMA_NLDEV_CMD_RES_QP_GET(r0, &(0x7f0000003c00)={&(0x7f0000003b00)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000003bc0)={&(0x7f0000003b40)={0x58, 0x140a, 0x1, 0x70bd27, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_RES_LQPN={0x8, 0x15, 0x2}, @RDMA_NLDEV_ATTR_RES_LQPN={0x8, 0x15, 0x2}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x2}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x2}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x3}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x4}, @RDMA_NLDEV_ATTR_RES_LQPN={0x8, 0x15, 0x3}]}, 0x58}, 0x1, 0x0, 0x0, 0x20008000}, 0x20000000) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r1, 0x5421, 0x400000) [ 2099.259132][T26082] binder: 26078:26082 ioctl c0306201 0 returned -14 [ 2099.261049][T26091] binder: 26086:26091 ioctl c0306201 0 returned -14 [ 2099.273810][T26092] binder: 26078:26092 ioctl c0306201 0 returned -14 [ 2099.299337][T26093] binder: 26078:26093 ioctl c0306201 0 returned -14 [ 2099.308325][T26095] binder: 26078:26095 ioctl 40046210 0 returned -22 [ 2099.315515][T26082] binder: 26078:26082 ioctl c0306201 0 returned -14 [ 2099.335847][T26097] binder: 26086:26097 ioctl c0306201 0 returned -14 02:35:01 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) 02:35:01 executing program 0: bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x1d, 0x5, &(0x7f0000000080)=@raw=[@generic={0xb0, 0x0, 0x8, 0x1ff, 0x6}, @btf_id={0x18, 0x4, 0x3, 0x0, 0x1}, @map_val={0x18, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x3f}], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0xa4, &(0x7f0000000100)=""/164, 0x41100, 0x12, [], 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000280)={0x5, 0x1}, 0x8, 0x10, &(0x7f00000002c0)={0x2, 0x1, 0x3ff, 0x10001}, 0x10, 0xffffffffffffffff}, 0x78) [ 2099.379173][T26097] binder: 26086:26097 ioctl c0306201 0 returned -14 [ 2099.419310][T26097] binder: 26086:26097 ioctl c0306201 0 returned -14 02:35:01 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000080)={0xffffffffffffffff}, 0x106, 0x3}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e22, 0x7fffffff, @mcast1, 0xfffffffb}, {0xa, 0x4e21, 0x7, @mcast2, 0x29bf}, r1, 0xe49}}, 0x48) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$RDMA_NLDEV_CMD_DELLINK(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYBLOB="3800000414000129bd7000ffdbdf2508000100008d110008000100020000000800010000000000e7ff00000100000088000100010000007a6f6c3318faf909a32117d496a3d64ef36400"], 0x38}, 0x1, 0x0, 0x0, 0x24000000}, 0x1) r2 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a, 0x3}) sendmsg$RDMA_NLDEV_CMD_RES_MR_GET(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x20, 0x140d, 0x303, 0x70bd28, 0x25dfdbfd, "", [@RDMA_NLDEV_ATTR_RES_MRN={0x8, 0x3e, 0x4}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x4008001) 02:35:01 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5421, 0x400000) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f0000000300)={0x5, 0x10, 0xfa00, {&(0x7f0000000880)}}, 0x18) recvmmsg(r0, &(0x7f00000007c0)=[{{0x0, 0x0, &(0x7f0000000440), 0x0, &(0x7f00000004c0)=""/240, 0xf0}, 0xe2a3}, {{&(0x7f00000005c0)=@can, 0x80, &(0x7f0000000700)=[{&(0x7f0000000640)=""/163, 0xa3}], 0x1, &(0x7f0000000740)=""/101, 0x65}, 0x100}], 0x2, 0x40, &(0x7f0000000000)) 02:35:01 executing program 3: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$VT_RESIZEX(r0, 0x560a, &(0x7f0000000000)={0x200, 0x0, 0x7, 0x3, 0x2, 0xca6}) r1 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x2) syz_init_net_socket$nl_rdma(0xffffffffffffffff, 0x3, 0x14) ioctl$BINDER_SET_MAX_THREADS(r1, 0x5460, 0x0) [ 2099.512428][T26106] binder: 26102:26106 ioctl 541b 0 returned -22 02:35:01 executing program 2: sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x420000}, 0xc, &(0x7f0000000040)={&(0x7f0000000180)={0x150, 0x1403, 0x100, 0x70bd2b, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'bond_slave_1\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'batadv_slave_0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'macsec0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'geneve1\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ip6tnl0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'hsr0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netdevsim0\x00'}}]}, 0x150}}, 0x4044810) socketpair(0x25, 0x3, 0x4, &(0x7f0000003ac0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$RDMA_NLDEV_CMD_RES_QP_GET(r0, &(0x7f0000003c00)={&(0x7f0000003b00)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000003bc0)={&(0x7f0000003b40)={0x58, 0x140a, 0x1, 0x70bd27, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_RES_LQPN={0x8, 0x15, 0x2}, @RDMA_NLDEV_ATTR_RES_LQPN={0x8, 0x15, 0x2}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x2}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x2}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x3}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x4}, @RDMA_NLDEV_ATTR_RES_LQPN={0x8, 0x15, 0x3}]}, 0x58}, 0x1, 0x0, 0x0, 0x20008000}, 0x20000000) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r1, 0x5421, 0x400000) 02:35:01 executing program 1: ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x541b, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) [ 2099.650209][T26110] binder: 26107:26110 ioctl 40046210 0 returned -22 [ 2099.690246][T26110] binder: 26107:26110 ioctl c0306201 0 returned -14 02:35:01 executing program 0: bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) [ 2099.735729][T26110] binder: 26107:26110 ioctl 40046210 0 returned -22 [ 2099.752248][T26115] binder: 26107:26115 ioctl c0306201 0 returned -14 02:35:01 executing program 2: sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x420000}, 0xc, &(0x7f0000000040)={&(0x7f0000000180)={0x150, 0x1403, 0x100, 0x70bd2b, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'bond_slave_1\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'batadv_slave_0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'macsec0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'geneve1\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ip6tnl0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'hsr0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netdevsim0\x00'}}]}, 0x150}}, 0x4044810) socketpair(0x25, 0x3, 0x4, &(0x7f0000003ac0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$RDMA_NLDEV_CMD_RES_QP_GET(r0, &(0x7f0000003c00)={&(0x7f0000003b00)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000003bc0)={&(0x7f0000003b40)={0x58, 0x140a, 0x1, 0x70bd27, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_RES_LQPN={0x8, 0x15, 0x2}, @RDMA_NLDEV_ATTR_RES_LQPN={0x8, 0x15, 0x2}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x2}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x2}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x3}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x4}, @RDMA_NLDEV_ATTR_RES_LQPN={0x8, 0x15, 0x3}]}, 0x58}, 0x1, 0x0, 0x0, 0x20008000}, 0x20000000) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) 02:35:01 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) recvmsg$can_raw(r0, &(0x7f0000000380)={&(0x7f0000000180)=@rc={0x1f, @none}, 0xfffffffffffffedc, &(0x7f0000000580)=[{&(0x7f0000000080)}, {&(0x7f00000005c0)=""/150, 0x96}, {&(0x7f00000000c0)=""/74, 0x4a}], 0x3, &(0x7f0000000280)=""/248, 0xf8}, 0x10000) ioctl$TIOCSTI(r0, 0x5421, 0x400000) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) recvmsg$can_raw(r1, &(0x7f0000000540)={&(0x7f00000003c0)=@pppoe={0x18, 0x0, {0x0, @local}}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000440)=""/210, 0xd2}], 0x1}, 0x20000002) 02:35:01 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000080)='/proc/capi/capi20\x00', 0x101002, 0x0) ioctl$vim2m_VIDIOC_DQBUF(0xffffffffffffffff, 0xc0585611, &(0x7f0000000140)={0xffffffff, 0x2, 0x4, 0xe000, 0xffffffff, {}, {0x1, 0x2, 0x7f, 0x0, 0x5, 0x7, "227f59cd"}, 0x3f, 0x2, @planes=&(0x7f0000000040)={0x7, 0x3, @fd, 0x2}, 0x178, 0x0, r1}) 02:35:01 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) 02:35:01 executing program 1: setrlimit(0x3, &(0x7f0000000000)={0x8001, 0x81}) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)={0x10, 0x7, 0x2, 0x4, 0x204, 0x1, 0x2, [], 0x0, 0xffffffffffffffff, 0x3, 0x1, 0x2}, 0x40) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) 02:35:02 executing program 2: sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x420000}, 0xc, &(0x7f0000000040)={&(0x7f0000000180)={0x150, 0x1403, 0x100, 0x70bd2b, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'bond_slave_1\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'batadv_slave_0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'macsec0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'geneve1\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ip6tnl0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'hsr0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netdevsim0\x00'}}]}, 0x150}}, 0x4044810) socketpair(0x25, 0x3, 0x4, &(0x7f0000003ac0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$RDMA_NLDEV_CMD_RES_QP_GET(r0, &(0x7f0000003c00)={&(0x7f0000003b00)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000003bc0)={&(0x7f0000003b40)={0x58, 0x140a, 0x1, 0x70bd27, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_RES_LQPN={0x8, 0x15, 0x2}, @RDMA_NLDEV_ATTR_RES_LQPN={0x8, 0x15, 0x2}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x2}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x2}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x3}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x4}, @RDMA_NLDEV_ATTR_RES_LQPN={0x8, 0x15, 0x3}]}, 0x58}, 0x1, 0x0, 0x0, 0x20008000}, 0x20000000) 02:35:02 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000b80)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000ac0)="dc"}) ioctl$TIOCSTI(0xffffffffffffffff, 0x5421, 0x400000) ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046205, &(0x7f00000001c0)=0x5) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x7) syz_open_dev$tty20(0xc, 0x4, 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0xb, 0x8, 0x80000000, 0xe9, 0x60, 0xffffffffffffffff, 0x4, [], 0x0, 0xffffffffffffffff, 0x5, 0x5, 0x2}, 0x40) getsockopt$bt_sco_SCO_CONNINFO(0xffffffffffffffff, 0x11, 0x2, &(0x7f0000000040)=""/65, &(0x7f00000000c0)=0x41) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0xa4, 0x0, &(0x7f0000000380)=[@free_buffer={0x40086303, r2}, @register_looper, @increfs_done={0x40106308, 0x2}, @free_buffer, @acquire_done={0x40106309, 0x3}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000100)={@flat=@handle={0x73682a85, 0x310b, 0x3}, @fda={0x66646185, 0x1, 0x2, 0x21}, @ptr={0x70742a85, 0x2, &(0x7f0000000bc0)=""/4096, 0x1000, 0x0, 0x2e}}, &(0x7f0000000180)={0x0, 0x18, 0x38}}}, @free_buffer={0x40086303, r2}, @free_buffer, @register_looper], 0x6c, 0x0, &(0x7f0000000280)="448047442c9ffed320566e07305414a92eb83773176a2ba88362247943524c35ddc9b189fcb00a7f238f398d098adb3fd8b10a38eb4a17efc004008d498d071957000050694da07a97fabd694f426750f17f28e656729806831018aaecc2dbb0a8249ca0d30f98671ed72600"}) 02:35:02 executing program 0: bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) 02:35:02 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r1, 0x40405515, &(0x7f0000000100)={0x5, 0x5, 0x7, 0x4, 'syz1\x00', 0x81}) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x1800) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r2, 0xc018620c, &(0x7f0000000080)) [ 2100.059649][T26138] binder: 26134:26138 ioctl 40046210 0 returned -22 [ 2100.073589][T26139] binder: 26135:26139 ioctl c0306201 0 returned -14 [ 2100.096000][T26139] binder: 26135:26139 ioctl 541b 0 returned -22 [ 2100.126738][T26143] binder: 26134:26143 ioctl 40046210 0 returned -22 [ 2100.143279][T26144] binder: 26135:26144 ioctl c0306201 0 returned -14 [ 2100.172026][T26145] binder: 26140:26145 ioctl c0306201 0 returned -14 [ 2100.178199][T26144] binder: 26135:26144 ioctl 541b 0 returned -22 02:35:02 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x50, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000180)={@flat=@weak_binder={0x77622a85, 0x1000, 0x3}, @flat=@weak_handle={0x77682a85, 0xa, 0x3}, @fda={0x66646185, 0x2, 0x2, 0x3e}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}, 0x40}, @register_looper], 0x95, 0x0, &(0x7f0000000280)="7b02812b2dc89f3d1c5de7a78609435592af262956c018be1e55e75e524960453f6bdb93070e575414b4be70a6aecc114e0ca8826da2dc25225e217673c0fb2278a7eafc470875ad3e3473429ac4cc641e76c7658dce7f41989b0f6dbda85fa8d0f96dd055d792b3c83a8384fbd059e16dd81387ca21b3665728ca251a6f85364b813e8efca3c9ad8dbbf5151e30875a59ccaef370"}) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r2, 0xc0405519, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(0xffffffffffffffff, 0x40405515, &(0x7f00000000c0)={0x2, 0x2, 0x9, 0x8, 'syz1\x00', 0x7fffffff}) syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046210, 0x0) 02:35:02 executing program 2: sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x420000}, 0xc, &(0x7f0000000040)={&(0x7f0000000180)={0x150, 0x1403, 0x100, 0x70bd2b, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'bond_slave_1\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'batadv_slave_0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'macvlan0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'macsec0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'geneve1\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ip6tnl0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'hsr0\x00'}}, {{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'netdevsim0\x00'}}]}, 0x150}}, 0x4044810) socketpair(0x25, 0x3, 0x4, &(0x7f0000003ac0)) 02:35:02 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) setsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x67, &(0x7f0000000040)=0x1, 0x4) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) [ 2100.234225][T26145] binder: 26140:26145 ioctl c0306201 0 returned -14 [ 2100.264572][T26150] binder: 26148:26150 ioctl c018620c 20000080 returned -1 02:35:02 executing program 0: bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) 02:35:02 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5421, 0x400000) ioctl$GIO_CMAP(r0, 0x4b70, &(0x7f0000000000)) [ 2100.321114][T26152] binder: 26148:26152 ioctl c018620c 20000080 returned -1 02:35:02 executing program 3: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) [ 2100.412493][T26158] binder: 26154:26158 ioctl 541b 0 returned -22 [ 2100.453679][T26160] binder: 26154:26160 ioctl 541b 0 returned -22 [ 2100.467845][T26163] binder: 26155:26163 ioctl c0306201 0 returned -14 02:35:02 executing program 2: socketpair(0x25, 0x3, 0x4, &(0x7f0000003ac0)) [ 2100.502621][T26163] binder: 26155:26163 ioctl c0306201 0 returned -14 02:35:02 executing program 0: bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x1d, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x0, 0xa4, &(0x7f0000000100)=""/164, 0x41100, 0x12, [], 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000280)={0x5, 0x1}, 0x8, 0x10, &(0x7f00000002c0)={0x2, 0x1, 0x3ff, 0x10001}, 0x10, 0xffffffffffffffff}, 0x78) 02:35:02 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x509a80, 0x0) openat$cgroup_freezer_state(r1, &(0x7f0000000080)='freezer.state\x00', 0x2, 0x0) [ 2100.567549][T26163] binder: 26155:26163 ioctl c0306201 0 returned -14 [ 2100.589633][T26170] binder: 26155:26170 ioctl c0306201 0 returned -14 02:35:02 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x20401, 0x0) ioctl$TIOCSTI(r0, 0x5421, 0x400000) 02:35:02 executing program 3: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) ioctl$KDSETMODE(0xffffffffffffffff, 0x4b3a, 0x1) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0xa}) 02:35:02 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x200000, 0x0) r2 = mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x1ff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x68, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x3}, @exit_looper, @clear_death={0x400c630f, 0x2}, @free_buffer={0x40086303, r2}, @exit_looper, @increfs={0x40046304, 0x2}, @release={0x40046306, 0x1}, @register_looper, @increfs_done={0x40106308, 0x2}, @acquire_done={0x40106309, 0x17430836}], 0x72, 0x0, &(0x7f0000000100)="3a76e966dbacdf3ace0003a02ef3f744f8475e589d84bf53fa3597f87b18447cdb31e232d16147f701dc8aceacbe6d6abf03ba67938c04d64758445f252c9ac92532659db82b6cafdf81ef7515003ff85a1283ec0b59a569e12efa8a8e6a9b33715c0912f1d240012101639ef1b70f237210"}) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) [ 2100.720839][T26176] binder: 26174:26176 ioctl 541b 0 returned -22 02:35:02 executing program 0: bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x1d, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x0, 0xa4, &(0x7f0000000100)=""/164, 0x41100, 0x12, [], 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000280)={0x5, 0x1}, 0x8, 0x10, &(0x7f00000002c0)={0x2, 0x1, 0x3ff, 0x10001}, 0x10, 0xffffffffffffffff}, 0x78) [ 2100.791149][T26176] binder: 26174:26176 ioctl 541b 0 returned -22 02:35:02 executing program 2: socketpair(0x0, 0x3, 0x4, &(0x7f0000003ac0)) 02:35:02 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) [ 2100.898063][T26185] binder: 26183:26185 ioctl 40046210 0 returned -22 [ 2100.905166][T26184] binder: 26182:26184 ioctl c0306201 0 returned -14 02:35:03 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5421, 0x400000) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r0, 0x40045542, &(0x7f0000000000)=0x3f) [ 2100.950840][T26184] binder: 26182:26184 ioctl c0306201 0 returned -14 [ 2100.956036][T26187] binder: 26183:26187 ioctl 40046210 0 returned -22 02:35:03 executing program 0: bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x1d, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x0, 0xa4, &(0x7f0000000100)=""/164, 0x41100, 0x12, [], 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000280)={0x5, 0x1}, 0x8, 0x10, &(0x7f00000002c0)={0x2, 0x1, 0x3ff, 0x10001}, 0x10, 0xffffffffffffffff}, 0x78) [ 2100.997271][T26190] binder: 26182:26190 ioctl c0306201 0 returned -14 [ 2101.026963][T26190] binder: 26182:26190 ioctl c0306201 0 returned -14 02:35:03 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r0, 0xc018620c, &(0x7f00000001c0)={0x3}) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(0xffffffffffffffff, 0xc1105517, &(0x7f0000000080)={{0x5, 0x3, 0x40, 0xffff, '\x00', 0x10000}, 0x6, 0x20, 0x2, 0xffffffffffffffff, 0x3, 0xfffffff9, 'syz1\x00', &(0x7f0000000000)=['\x00', '/dev/binder#\x00', '\x00'], 0xf, [], [0x100, 0x100, 0x1, 0x7]}) [ 2101.085751][T26195] binder: 26191:26195 ioctl 541b 0 returned -22 02:35:03 executing program 2: socketpair(0x0, 0x3, 0x4, &(0x7f0000003ac0)) 02:35:03 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r1, 0x4b6b, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0x10) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) 02:35:03 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) clock_gettime(0x0, &(0x7f0000000000)={0x0, 0x0}) ioctl$vim2m_VIDIOC_PREPARE_BUF(r1, 0xc058565d, &(0x7f0000000180)={0x9, 0x3, 0x4, 0x8, 0x81, {r2, r3/1000+60000}, {0x4, 0x1, 0x20, 0x79, 0x9, 0x30, "5826151f"}, 0x4ffffffc, 0x4, @planes=&(0x7f0000000040)={0x40546ecc, 0x4, @mem_offset=0x5f63, 0x8b6}, 0x8, 0x0, r0}) clock_gettime(0x7, &(0x7f0000000100)) ioctl$TIOCSTI(r0, 0x5421, 0x400000) 02:35:03 executing program 1: write$FUSE_DIRENT(0xffffffffffffffff, &(0x7f0000000400)={0x38, 0x0, 0x0, [{0x5, 0x1, 0xd, 0x5, '/dev/binder#\x00'}]}, 0x38) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_NOTIFY(r1, &(0x7f00000001c0)={0xf, 0x8, 0xfa00, {r2}}, 0x10) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, &(0x7f0000000040)={0x7, 0x8, 0xfa00, {r2, 0x20}}, 0x10) r3 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r3, 0x541b, 0x0) r4 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000080)='/proc/capi/capi20\x00', 0x8000, 0x0) r5 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000200)='/proc/capi/capi20\x00', 0x4d2000, 0x0) write$RDMA_USER_CM_CMD_GET_EVENT(r5, &(0x7f00000003c0)={0xc, 0x8, 0xfa00, {&(0x7f0000000240)}}, 0x10) ioctl$BINDER_SET_MAX_THREADS(r4, 0x40046205, &(0x7f00000000c0)=0xbe3e) 02:35:03 executing program 0: bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x1d, 0x3, &(0x7f0000000080)=@raw=[@generic={0xb0, 0x0, 0x8, 0x1ff, 0x6}, @btf_id={0x18, 0x4, 0x3, 0x0, 0x1}], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0xa4, &(0x7f0000000100)=""/164, 0x41100, 0x12, [], 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000280)={0x5, 0x1}, 0x8, 0x10, &(0x7f00000002c0)={0x2, 0x1, 0x3ff, 0x10001}, 0x10, 0xffffffffffffffff}, 0x78) [ 2101.275585][T26204] binder: 26200:26204 ioctl 40046210 0 returned -22 [ 2101.309909][T26204] binder: 26200:26204 ioctl c018620c 200001c0 returned -1 [ 2101.349139][T26204] binder: 26200:26204 ioctl 40046210 0 returned -22 [ 2101.361289][T26211] binder: 26200:26211 ioctl c018620c 200001c0 returned -1 02:35:03 executing program 2: socketpair(0x0, 0x3, 0x4, &(0x7f0000003ac0)) [ 2101.468721][T26217] binder: 26210:26217 ioctl 541b 0 returned -22 02:35:03 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) ioctl$KDGETLED(0xffffffffffffffff, 0x4b31, &(0x7f0000000040)) 02:35:03 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) 02:35:03 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x80, 0x0) write$cgroup_netprio_ifpriomap(r1, &(0x7f0000000180)=ANY=[@ANYBLOB="6970365f76746930323300d134ca0c0a1fd7cb4ada20371702e23818ecd4ed712be70cf8a892fb0cce022de061371e8eb43306ff010000e1cda3a6d1095b01e4ec558a3630b13b3480612e8211f8a99ea700dd3277c9339cbe8cfa7ee830d7af120eb7959512522a7e45c507c7b1f031f1cc4af547d86c702a89b3092fb1023a2d293bd15d73a343a4fd26c1359b45830e0e38a3ee1de54f037f93ae526d2a53bc118c9a9d722f3d804c11030b5ba8f7fc06507dbced622d548cc23b0636e7"], 0xb) ioctl$TIOCSTI(r0, 0x5421, 0x400000) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000080)='/proc/capi/capi20\x00', 0x204480, 0x0) r3 = mmap$binder(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x7d) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r4, 0x4b6b, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000600)={0xdc, 0x0, &(0x7f0000000400)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000240)={@flat=@weak_binder={0x77622a85, 0x1, 0x1}, @fda={0x66646185, 0xa, 0xffffffffffff0001, 0x2b}, @fda={0x66646185, 0x6, 0x1, 0x1f}}, &(0x7f00000002c0)={0x0, 0x18, 0x38}}}, @release={0x40046306, 0x1}, @free_buffer, @free_buffer={0x40086303, r3}, @acquire={0x40046305, 0x1}, @acquire_done={0x40106309, 0x1}, @dead_binder_done, @enter_looper, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000340)={@flat=@handle={0x73682a85, 0x10b, 0x3}, @fd={0x66642a85, 0x0, r4}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/56, 0x38, 0x1, 0x3}}, &(0x7f00000003c0)={0x0, 0x18, 0x30}}}], 0xd0, 0x0, &(0x7f0000000500)="db6ffdd24cd67a64eaecc21bdbc43ba91d6fbfbf8d6da53a297f27f9be2818afa599220bc113ab6c7c9149a9ce11372fb579ea51e4f273e0a4a7c543786a86f2cd7352567ba31e32a52810328d3a903ab5cea0989a9ed663c2acc09ca255c57a98724cc775dd0e0457e983def6b8a02f737729bc3852aeed14cbe0596b5958b083ddc8c8d4d14a04041a2b7dc5a9fd6528378010cc6d56939a8bdb6e8cab977466cd2fd4f0c49db4bbdae263484062f5d6c0e09ea779212581e260166632abe3b0c6aa11bde62bfdc1e32d74161cd4a5"}) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x0, 0x0) r5 = syz_open_dev$ptys(0xc, 0x3, 0x1) ioctl$KDGKBLED(r5, 0x4b64, &(0x7f00000000c0)) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000100)='/proc/capi/capi20\x00', 0x0, 0x0) 02:35:03 executing program 0: bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x1d, 0x1, &(0x7f0000000080)=@raw=[@generic={0xb0, 0x0, 0x8, 0x1ff, 0x6}], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0xa4, &(0x7f0000000100)=""/164, 0x41100, 0x12, [], 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000280)={0x5, 0x1}, 0x8, 0x10, &(0x7f00000002c0)={0x2, 0x1, 0x3ff, 0x10001}, 0x10, 0xffffffffffffffff}, 0x78) [ 2101.554610][T26217] binder: 26210:26217 ioctl 541b 0 returned -22 02:35:03 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(0xffffffffffffffff, 0xc008551c, &(0x7f0000000040)={0x7}) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(0xffffffffffffffff, 0xc008551c, &(0x7f0000000080)={0x4, 0x8, [0x7a2f, 0x1]}) 02:35:03 executing program 2: socketpair(0x25, 0x0, 0x4, &(0x7f0000003ac0)) [ 2101.694955][T26229] binder: 26223:26229 ioctl 40046210 0 returned -22 02:35:03 executing program 0: bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x1d, 0x0, &(0x7f0000000080), &(0x7f00000000c0)='syzkaller\x00', 0x0, 0xa4, &(0x7f0000000100)=""/164, 0x41100, 0x12, [], 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000280)={0x5, 0x1}, 0x8, 0x10, &(0x7f00000002c0)={0x2, 0x1, 0x3ff, 0x10001}, 0x10, 0xffffffffffffffff}, 0x78) 02:35:03 executing program 5: ioctl$GIO_SCRNMAP(0xffffffffffffffff, 0x4b40, &(0x7f0000000040)=""/245) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) 02:35:03 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) sendmsg$TCPDIAG_GETSOCK(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x5c, 0x12, 0x200, 0x70bd28, 0x9, {0x2c, 0x5, 0x61, 0xff, {0x4e21, 0x6e20, [0x2, 0x6, 0x7ff, 0x7], [0x3, 0x7f, 0x4, 0x1], 0x0, [0x7, 0x3ff]}, 0x1, 0x83}, [@INET_DIAG_REQ_BYTECODE={0xd, 0x1, "7c6409a949ed8f71db"}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20000010}, 0x4000800) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) [ 2101.806305][T26236] binder: 26234:26236 ioctl 541b 0 returned -22 02:35:03 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5421, 0x400000) [ 2101.864731][T26236] binder: 26234:26236 ioctl 541b 0 returned -22 02:35:04 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = accept4$phonet_pipe(0xffffffffffffffff, 0x0, &(0x7f0000000040), 0x800) recvmmsg(r1, &(0x7f0000004c80)=[{{&(0x7f0000000080)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @remote}}}, 0x80, &(0x7f00000011c0)=[{&(0x7f0000000100)=""/4096, 0x1000}, {&(0x7f0000001100)=""/151, 0x97}], 0x2, &(0x7f0000001200)=""/74, 0x4a}, 0x4}, {{&(0x7f0000001280)=@isdn, 0x80, &(0x7f0000004480)=[{&(0x7f0000001300)=""/4096, 0x1000}, {&(0x7f0000002300)=""/118, 0x76}, {&(0x7f0000002380)=""/55, 0x37}, {&(0x7f00000023c0)=""/4096, 0x1000}, {&(0x7f00000033c0)=""/4096, 0x1000}, {&(0x7f00000043c0)=""/171, 0xab}], 0x6}}, {{&(0x7f0000004500)=@in6, 0x80, &(0x7f0000004600)=[{&(0x7f0000004580)=""/114, 0x72}], 0x1, &(0x7f0000004640)=""/91, 0x5b}, 0x8e5}, {{&(0x7f00000046c0)=@l2={0x1f, 0x0, @fixed}, 0x80, &(0x7f0000004bc0)=[{&(0x7f0000004740)=""/194, 0xc2}, {&(0x7f0000004840)=""/15, 0xf}, {&(0x7f0000004880)=""/248, 0xf8}, {&(0x7f0000004980)=""/209, 0xd1}, {&(0x7f0000004a80)=""/204, 0xcc}, {&(0x7f0000004b80)=""/41, 0x29}], 0x6, &(0x7f0000004c40)=""/51, 0x33}, 0x3f}], 0x4, 0x100, &(0x7f0000004d80)={0x0, 0x3938700}) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) r3 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r3, 0xc0405519, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r2, 0x89fb, &(0x7f000000aac0)={'syztnl1\x00', &(0x7f000000aa40)={'ip6tnl0\x00', 0x0, 0x4, 0x49, 0x6, 0x2, 0x14, @private2={0xfc, 0x2, [], 0x1}, @local, 0x80, 0x8000, 0x7f, 0x5}}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f000000ab80)={0x0, 0x3, &(0x7f0000004dc0)=@raw=[@func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @map_val={0x18, 0x3, 0x2, 0x0, r3}], &(0x7f0000004e00)='syzkaller\x00', 0xffff, 0x55, &(0x7f0000004e40)=""/85, 0x40f00, 0x10, [], r4, 0x0, 0xffffffffffffffff, 0x8, &(0x7f000000ab00)={0xa, 0x4}, 0x8, 0x10, &(0x7f000000ab40)={0x1, 0xc, 0x7f, 0x5}, 0x10}, 0x78) 02:35:04 executing program 2: socketpair(0x25, 0x0, 0x0, &(0x7f0000003ac0)) 02:35:04 executing program 0: bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x1d, 0x0, &(0x7f0000000080), &(0x7f00000000c0)='syzkaller\x00', 0x0, 0xa4, &(0x7f0000000100)=""/164, 0x41100, 0x12, [], 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000280)={0x5, 0x1}, 0x8, 0x10, &(0x7f00000002c0)={0x2, 0x1, 0x3ff, 0x10001}, 0x10, 0xffffffffffffffff}, 0x78) [ 2101.972180][T26245] binder: 26241:26245 ioctl 40046210 0 returned -22 02:35:04 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x2) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x800) mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x50000000000) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) [ 2102.028191][T26249] binder: 26241:26249 ioctl 40046210 0 returned -22 02:35:04 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) r1 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCSLCKTRMIOS(r1, 0x5457, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x802) r3 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000100)='/proc/capi/capi20\x00', 0x40, 0x0) ioctl$GIO_CMAP(r3, 0x4b70, &(0x7f0000000140)) ioctl$BINDER_THREAD_EXIT(r2, 0x40046208, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x3) ioctl$VT_RESIZE(r4, 0x5609, &(0x7f00000000c0)={0x2, 0x7, 0x401}) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f0000000080)=0x2) 02:35:04 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSLCKTRMIOS(r0, 0x5457, &(0x7f0000000000)) ioctl$TIOCSTI(r0, 0x5421, 0x400000) openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x800, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x7) [ 2102.158375][T26255] binder: 26251:26255 ioctl 541b 0 returned -22 02:35:04 executing program 2: socketpair(0x25, 0x0, 0x0, 0x0) 02:35:04 executing program 0: bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x1d, 0x0, &(0x7f0000000080), &(0x7f00000000c0)='syzkaller\x00', 0x0, 0xa4, &(0x7f0000000100)=""/164, 0x41100, 0x12, [], 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000280)={0x5, 0x1}, 0x8, 0x10, &(0x7f00000002c0)={0x2, 0x1, 0x3ff, 0x10001}, 0x10, 0xffffffffffffffff}, 0x78) [ 2102.199523][T26255] binder: 26251:26255 ioctl 541b 0 returned -22 [ 2102.269382][T26263] binder: 26259:26263 ioctl 40046210 0 returned -22 02:35:04 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f0000000040)=0x81) [ 2102.340289][T26263] binder: 26259:26263 ioctl 40046210 0 returned -22 02:35:04 executing program 3: ioctl$sock_bt_hidp_HIDPCONNDEL(0xffffffffffffffff, 0x400448c9, &(0x7f00000000c0)={@any, 0x4}) r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r0, 0xc0405519, 0x0) ioctl$SNDRV_CTL_IOCTL_TLV_READ(r0, 0xc008551a, &(0x7f0000000100)={0x81, 0x8, [0x8, 0x9]}) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x5460, 0x0) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(0xffffffffffffffff, 0x81785501, &(0x7f0000000040)=""/115) 02:35:04 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5421, 0x400000) 02:35:04 executing program 0: bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x1d, 0x1, &(0x7f0000000080)=@raw=[@generic={0x0, 0x0, 0x8, 0x1ff, 0x6}], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0xa4, &(0x7f0000000100)=""/164, 0x41100, 0x12, [], 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000280)={0x5, 0x1}, 0x8, 0x10, &(0x7f00000002c0)={0x2, 0x1, 0x3ff, 0x10001}, 0x10, 0xffffffffffffffff}, 0x78) 02:35:04 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_GET_NODE_INFO_FOR_REF(0xffffffffffffffff, 0xc018620c, &(0x7f0000000080)={0x2}) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000040)) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) 02:35:04 executing program 2: socketpair(0x25, 0x0, 0x0, 0x0) [ 2102.466669][T26276] binder: 26275:26276 ioctl 541b 0 returned -22 [ 2102.504224][T26276] binder: 26275:26276 ioctl 541b 0 returned -22 02:35:04 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180)='/dev/hwrng\x00', 0x0, 0x0) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r2, 0xc018620c, &(0x7f0000000040)={0x20}) openat$cgroup_netprio_ifpriomap(r2, &(0x7f0000000080)='net_prio.ifpriomap\x00', 0x2, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) r3 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x800) r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vga_arbiter\x00', 0x452000, 0x0) write$vga_arbiter(r4, &(0x7f0000000140)=@unlock_all='unlock all\x00', 0xb) ioctl$BINDER_THREAD_EXIT(r3, 0x40046208, 0x0) 02:35:04 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) 02:35:04 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5421, 0x0) 02:35:04 executing program 0: bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x1d, 0x1, &(0x7f0000000080)=@raw=[@generic={0x0, 0x0, 0x0, 0x1ff, 0x6}], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0xa4, &(0x7f0000000100)=""/164, 0x41100, 0x12, [], 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000280)={0x5, 0x1}, 0x8, 0x10, &(0x7f00000002c0)={0x2, 0x1, 0x3ff, 0x10001}, 0x10, 0xffffffffffffffff}, 0x78) [ 2102.667311][T26287] binder: 26281:26287 ioctl c0306201 0 returned -14 [ 2102.705399][T26287] binder: 26281:26287 ioctl 40046210 0 returned -22 02:35:04 executing program 2: socketpair(0x25, 0x0, 0x0, 0x0) [ 2102.764466][T26287] binder: 26281:26287 ioctl c0306201 0 returned -14 [ 2102.795127][T26295] binder: 26289:26295 ioctl c0306201 0 returned -14 [ 2102.857481][T26295] binder: 26289:26295 ioctl 541b 0 returned -22 02:35:04 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) r1 = accept(0xffffffffffffffff, &(0x7f0000000040)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000000c0)=0x80) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(0xffffffffffffffff, 0x40405515, &(0x7f0000000180)={0x0, 0x4, 0xfffffff8, 0x6, 'syz1\x00', 0x8}) setsockopt$inet_sctp_SCTP_INITMSG(r1, 0x84, 0x2, &(0x7f0000000100)={0x465, 0x800, 0x4, 0x5}, 0x8) r2 = syz_open_dev$binderN(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_THREAD_EXIT(r2, 0x40046208, 0x0) 02:35:05 executing program 0: bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x1d, 0x1, &(0x7f0000000080)=@raw=[@generic={0x0, 0x0, 0x0, 0x0, 0x6}], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0xa4, &(0x7f0000000100)=""/164, 0x41100, 0x12, [], 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000280)={0x5, 0x1}, 0x8, 0x10, &(0x7f00000002c0)={0x2, 0x1, 0x3ff, 0x10001}, 0x10, 0xffffffffffffffff}, 0x78) [ 2102.904892][T26302] binder: 26289:26302 ioctl c018620c 20000040 returned -1 02:35:05 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_QUERY(r0, &(0x7f0000000000)={0x13, 0x10, 0xfa00, {&(0x7f0000000180), 0xffffffffffffffff, 0x1}}, 0x18) ioctl$TIOCSTI(r0, 0x5421, 0x400000) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x10) 02:35:05 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_IP(r1, &(0x7f0000000240)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @private0}, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x48) sendmsg$RDMA_NLDEV_CMD_DELLINK(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000010}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x28, 0x1404, 0x200, 0x70bd25, 0x25dfdbff, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x28}, 0x1, 0x0, 0x0, 0x40000}, 0x2) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) [ 2102.950084][T26299] binder: 26289:26299 ioctl 541b 0 returned -22 02:35:05 executing program 2: bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x1d, 0x1, &(0x7f0000000080)=@raw=[@generic={0x0, 0x0, 0x8, 0x1ff, 0x6}], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0xa4, &(0x7f0000000100)=""/164, 0x41100, 0x12, [], 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000280)={0x5, 0x1}, 0x8, 0x10, &(0x7f00000002c0)={0x2, 0x1, 0x3ff, 0x10001}, 0x10, 0xffffffffffffffff}, 0x78) 02:35:05 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r1, 0x4b6b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0xc0, 0x0, &(0x7f00000006c0)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x18, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000340)=ANY=[@ANYBLOB="853a6e3580000000d98a2bec3246dd7a3d919de9075f0bd29b4f6fe6e5bf9c2587cc7716a2af6afdd006908fbdd6567ec287ab28df324e4fbba3955023901445200763c2634fcc06bd8a", @ANYRESHEX=r1, @ANYBLOB="0000000000000000000000008561646600000000050000000000000000000000000000003400000000000000852a646600000000", @ANYRES32=r0, @ANYBLOB='\x00'/12], &(0x7f00000000c0)={0x0, 0x18, 0x38}}}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000040)={@ptr={0x70742a85, 0x0, &(0x7f0000000600)=""/146, 0x92}, @flat=@weak_handle={0x77682a85, 0x100, 0x2}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/186, 0xba, 0x0, 0x2f}}, &(0x7f0000000240)={0x0, 0x28, 0x40}}}, @clear_death={0x400c630f, 0x1}, @release={0x40046306, 0x2}, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @increfs={0x40046304, 0x2}], 0x31, 0x0, &(0x7f0000000440)="fc85e0215d6652a05313789768c56f3884d91d1e7cb74e94abbbc09a8880fe31df0a3b77e07c532e228e83dda0282b8aec"}) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r2, 0xc0405519, 0x0) ioctl$SNDRV_CTL_IOCTL_PVERSION(r2, 0x80045500, &(0x7f00000004c0)) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) ioctl$KDSKBLED(r2, 0x4b65, 0x6) [ 2103.068378][T26306] binder: 26303:26306 ioctl 40046210 0 returned -22 [ 2103.109686][T26306] binder: 26303:26306 ioctl 40046210 0 returned -22 02:35:05 executing program 0: bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x1d, 0x1, &(0x7f0000000080)=@raw=[@generic], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0xa4, &(0x7f0000000100)=""/164, 0x41100, 0x12, [], 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000280)={0x5, 0x1}, 0x8, 0x10, &(0x7f00000002c0)={0x2, 0x1, 0x3ff, 0x10001}, 0x10, 0xffffffffffffffff}, 0x78) 02:35:05 executing program 5: r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) ioctl$FUSE_DEV_IOC_CLONE(0xffffffffffffffff, 0x8004e500, &(0x7f0000000080)=r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000140)='/dev/fuse\x00', 0x2, 0x0) read$FUSE(r0, &(0x7f0000002300)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) getgroups(0x7, &(0x7f0000004640)=[0xee01, 0xee00, 0xee00, 0xee01, 0x0, 0xee00, 0xffffffffffffffff]) r4 = getuid() syz_fuse_handle_req(r1, &(0x7f0000000180)="4209a9fbe24f011df98ca6abf2e0fca6fb89c8bd07d322d9047c3f1357fd529baf075526b123bccf8d89fa4f8e6ae20cb08918db9170f4c0b2265d43faf6827d2ad1f8082a79d3a9393307891991b8c917fdbcbe424c69cb9750b21a1074d8e6bc65832f66edfda24b954e377c098c86d2f088ce0bf9c630062632878fa30fceeac880305e858a4f4d753b42c8c80f7d8d93e2d735ac6453e2be57ffe424bb03f8a081a6703a42133898dc844b9a47df7e7c63e0e3cd70b8bf15bb876c31638a75849db4bed1849b76a98b88743edadcccd6842238717bae12a5836253486af18c17801ad3369d1ac1fca6e7c7e37c648d419e86230e7af03480b21da22d3bb194ba7a58ddbee67dd8b6723e5daef87736b63c9b367bca804a1d4228e4618954aa700dfb433457fa1954eb8f29b1593aa0d42ca4ef109bb52f5394cda0438715c62804ff55a2864ecdd56ad77332370780ccd389818e10876a16b5ade82bba3220e9b31500e6e08a8bdf133b631285e037fb56083ff6253a86f8809dd054eb635c98d9dba528bcc5afc501539b03fab76c4fc6ddae1db7cabedbb1f8335a01cf40380b27e368b0fd02af35d83c4863d844af65efd8cd6365813f322e0b412d26a703ed0e61145aae8cccf2da1bebd7644f6a619c591fb6981b4a7ce833aba3f480e890524c7eebee3dbee4c2355b2ff22571bf941de55e08735c0940816458226791c564aa1f421fb24b1efe89cfef313f8e88b7e736f28135e5691431dc19b482990cdd83b274d3f059d0281e188169a3a00d00c2bc1d53a2750838d13d38f42cdba292ac1f44377eed195afe68b533ecfb6067bcbc76edb1ef1f3def57a3791029c7b6d883ab0a1411c2a88ee4d1b5bce8a6bbe823c0e406caf26a39b5ae35e78d22082cfcc5b2c481480f07b3609bec75736b4b99e96eeb0d09fb491d8125886557f15782c6f1fec565cb8aec2419ccfcf64d744d34474db4ca464d142f203dc7decbdcd670affbd077ae3897c7ff1630d1f908284461d4be53817e2bb9c22dd09bc021e36f040d568c44b14328318763bfc5feb1d1ceac94bdc9e7f05e2892a61830ce60f896a050e154dac843d69eca72a9311ad702346ed28b30ec5a64b5dd4246896cd2682bc06ede530bb9e68a07bb454eff60877974bb247189090d8123bbe0375fd6de50495dd01b4ea2c536cb62c6a0271079b8310bbb87391949ee67543e25a3394ea3232d7cece8cfd9304dc5fe32a304f627563aa60917397b26c9e4e9ef401dd938f15a1c1b92f04f0913311219c8b2f506594ee8528fc826c4f074c90ed2e8b64456e47c2e802501f15ceed980670a3107b4734df6441f44038012f73454d7bf2761f02d58d3f5661b93d01ec20111f6a77b6d470323fb2497f00b7721c4edf426d512ef8478e22611f3ae49ddd8ae2ddfbf4fc09fb3126969928aa22eafafd47ee26dfa124bc8a3d7f796f0fd32c57ad5d27eed9507eeebda8cd8d3be8cc864ce2649ee760850aacf17799c664004edb3a8a9a189f6ff3acf1b5908c33aed9d455e36f17fa07b2f7f41b7d9c595674a3b5989de3473700957fc2f0ce6e346c3c4d62f948b766a59d7771e3c7518256f340d375f59069c52723c2a49b0a777f450f77f59be8a81dc1c34c9a6a60d94c04f412a2b5a53871c2aaca5de325dff30e220b44c5107c2b5222458318584bf99a56393d3d4d1fa362bb912c75c2b711e43c95c0232c8fadb2da93bfa1af439dd8919cb29e30708dcf43d9bfd1a87b4d577f08a75fa63bee89a0b5b57100a33d80130d15b0d059d6a8b69e505cba4c9acf3448ad9adc4ccdf6660dffef062f7fd894829bb0f416b056ab6c372c66de1c04a4c81b6855d06051bac85e1fb02ed9d2322a8c7192fca7e7a6ad89a7fd544124440ed5ae5b228869d8ee158b99508993203271ee2dec90dd697718539be2b089b1dae63a7784a0fd3c9a56026bee57b3197625f81e5db203619bea8a947815030a2eb8a6a13ec27592d827848102ef1690c1bf0e2c8980200d81500057dece40aac12457afc19bde88d72460542d7b762eddb3b866a50b11c76637dd4bed363bdd3e080bba3ab2a83f1b7446a612299757d6f66196b4321a411922a3b38ce72cfe336e7bcd35612f0254fb4c5cc7dbb2fc5d8dc04c38a83d90fd46a29f9c0772ee6acffdc32078fc67a43656dd5d6d0606692811ecc08cf5f78581453c7211e5e7975818e04a886993bd48574d864893bb89485d980829ef52623a7a6e9f7147335112c40fc55dc7128b3b5722e0324d194018c0ef71b911928310f07696a867c9ffd3a69ab81a0056c886fb7fe3801db190b446b9663259cac9d63edef22b4a27b85d867d18fab38afb624e8ad3434f8d94474816a4ebb42b33546b336ae744fa0fe9b915df71743b8b1da966dc8283e938b46b9eb0671b9179959294c069b8e918167b2f1c427283bb3d896f92d0870f4323a8658f51d67ae3b67ece2557391f4d62ef09b4860566db73938cff91db4f90f903b43f080be96038212c5fd5fdbe31229e4c778aca8314059eee99265dbc2b980d0d6693348d941a090def4199abd68c44919a735799a7373088ca4ab382aa3588997e09cc43438ef0d29addb79c62e8ee898681daa517d34b1d9c2f94444911e32de66e146562e7f5a3cdbf6695b6eae50dad681f2f9262172fe66f3cfa55b0c7bd4b0ec57c9df4fdd99bf824e5dd090a2729b7ed1228d9966da8d46d64a429f08324f0a15104a35fa2dbf7975e5342926a9f1ec4a240befdcbbd0e17777bee0795a6bceafb53dea98c2756346ecf732bf04fbda3a5f78c0170fc73732f0f1024c8e12fb41e6e35c1f174a5eaa5c7f9c4e737f4f4be92784781ad3bf7face5b8f6899e48386b6ebdb625b403cac63f8a8c5501d80e31dd09c4e97d5f4cb61f9894347995230baf1518c24c4f38bb4275247c01ed25ff1eac01b3786a96092382308d3b4c470cc5aeacd7ff748f6e125f2cdfaad1c214e9fdbb8ae4dda152a33351731b422c7fbba72d7151f0dff0436e513a6d2d5b89bb9b55300d3c5dfbdd8d7a59aa35f94b0d7ae9931cc56d4427e910235b4a272b4e53274122fb3be2e2aa10251191a5f4c933825eee007ce777839c5d0fc133c9c6bc64fd52900d76724221423b0a147c33125846424c8174b1278bfbfb713a3825f5e9d1c3517d513162c922299786d8c365b03ac36ab3b8c958d4dc394aaaf70acc0a534c4337efd101069c2ec2028130daba268e225f7d487616eea1e200ea45042b7e4df296560df87593c6bbefa78b0656cb840cf1ce1dd289595ca1d0d6e3450f46cabd446af6c9ce1a99689b60670a8e5726095f6d37141d78ee91bafe45fd7ea5f5b36e9ffe4da31c606967c696fbc2b9e9bfc1b37c87fbca20c3736dd8aa90c0d72cb399711445ba6eb5069c2a4c7a4a49a7f9c6bf26a7228f24d06cbe16078d3f54ef119db081f1c01f7e5f1a5c7dd51d9cc16971ca437942bbe323287b0d445732450e05aa61023f5518614920f940f3bbec7b24c31df8c32e043b9ea611bf3912f1dc812cfc3ce7523a1a87028fa85412ae4ee1d3d464a1faba14712a403d8099b4f557d18b24e74f5af42d05fac9cdc1296b19f8abf88879e60d700c968a0705991d5ec2d182bc50973ed4dec6a1e293df8e88ccfc716d011a6868a2161d03b7fce2d16a609b549e87b433025d5aa4751ac407443c4d6ae452c2e4df246216a6b544252e9dbcc026fc28bcfc2232a8c079ad298ba3a5f56e9a44cf5be53f193676e04c11bc745f43cf2282f16cdd1010e7f60e969046a793b524492b00f2b4e0b11d48efb3e26ed630951b6bed0602cfc30170c98f2bc28234675dd6e661b3bfee649cc33e5ebb6e3a9eca55ed5e353623887c56e4ce309adfd4fc9e50067c51b6c9099f1dc82ebd7911b5873a2d84a75619c6915057860f7e896eaf44b2a38ff490f8f2f9e5f647ee8448f4882e3dfd812b78f32f9ae61a1820b192034c5ada379cad3a3ae6029cf51a20c952d9d7887a4b45e9bdccf3f789bc34bdb08af25fe510f052ef2509f4dadecd19dcd987b66fc63ba64799e6ff9692803d56a99edc64ebc50ee16a106c66839c9f06b3857524febb3c1d3e9ec110422de77a70253f1687a69f1e6a60e516264b25266a4b0a0594b2d66a18152f1ab2689238379b547bdebfdcb12aaf42f41c2fd88227fb134de9316668a27428d576939910e3ba716ec14f14e6ef942a48ca631f90d02074736aec988d5e222fdb13495a16c48be9cf959dc111528437370a2176e899ae761776f0b0c1acecfe2a3827bc15798273b8f4c947831177056f99e5eb85614e65f9665b3b6c3ba1d96a17ff5639e061820b86d6daf66ef0fe7b6140abd2f60747565c5fcb32fe1506d794c031888cebc965fb774226a51f2d1210bfc366049ca0adc6e4c5b69120c3084b080d565d733cacc797c6cb2ee840f4c4977a07246bc7477de3710669e4f679d68f33290db91f9382c08dbeda8f3500e521f4895d0404cd9f53a3118c6c7b4d7ec86243292148ecd6fe1372bfb79ce34eb5c5ecdcacb5198222fb2a1b0f0205d9fc533a99cdb1587317cf2229c871519272b5ccb9a3341f984df3badc5d2f6f1826485fa9079655bf7ba80ceda2f1515e05b63826d473e0de2b2e08b8e6395c803521689d795f946066a49330831d9345a315c31749467529be59734593ac6dcc70cc4c38203dca9629999a28aadb78356decb46e17850b87ddbaa82708d0d3770091b24f48be1060fb7d9361bb8f188d1bfa5f0d3442e22b8dc89aacb49db780c003760a949131a6b9ddabadd80e475140913c945af46824bbc661b1490161a6579ac761fea363f5b81e580906da119aa0e10c0196336ad86c7d59b2d118f234a3d27f7bbce914bef143c91a80465a1a97a53ccbe0910e287d46ac58be4e2f648b0b6f8ab811a0df9103663a877585a2780206c00ef2af13af340ec1ebd9b47f79ed25f1f8b9bbc5386c5d1ac17355bb3e4cb2abb30d2a0896e6c1211dbca4b9f13dedd37a4f519fbbdc58b8fbda568b58b84863b0c749c5c6ce460759599426dfb4f87d88b707c53ea4480870dc76d0ec009d6dac94a7b62eb7f8bd5785efc18f83b04058e61aa949ef0d2d5e40daf4eee92b60c65f340010bd297f5fe6c8404a3074e281ec36ab7310d911b124369d6b4565c46f8df78ce225184c87432647a779729e17657b3efeb23452b0c463a2512991cea85500c3c0eb1c6d0fde6ed2cb296ef7cafb2fe21a922378e0e329b2f809d61b1c6aaff983a8d4e9dd89926328ee02af088c58a6ee48759599b212c7df9230da52008e8450976d4b31014c14d5a20fc0dfa2746fa06e0f9ef6ebbfd673024a29f6c6580f6949f8ca960ef21e1d8276d4f3a0e4291b08a578be010b597fde19998894d2739be6f768ba00b352de93511614083a6195e9f80f79aaeb06dcab6d9bb2a75055b8f881a637dff59d194ba9a5040253235e3aa49aaea8e4f477c7a985b338c545d752a7f467bac010155686a5c05abf9ba4a3eead9df22b6c550d48bd28f716f404e6566dbd1ff0a669b77d8601392320257d4dc327007893335ce8892322ed59f9a7d93d22833c63330379da8db9b5fb40544cd8fd286b89cc2b36a23aac26bcaab43fd8169763eab56e136bad4d1169d62e55adf825dad2f465825da470b0146d50fabe96fb586962a6f42f7eb6f647a2a8a17325439becf6e1a3a6f34a7ae0edfa21e0b6e91f62a8f27e07130b844a5233637810f0298ac3594d576502c86170c86064c6ed659665ee69d2ab2973647701217edd40a22c55e5536008c31cea96a3aae3e82d2965f4029d66556d6d89c1161342198d9b33eacbf75db22f0ae90a1f5cc2575362d531659a24d504d88021300aa2cebd4519c85eba376c0920866aebab470631190a204e8bd17530bc54994deec64a34efdda607252a1aa9ef52d81d3aa54917c10816e49c406f3dcc364807d4377dfd772a4d5f643f39c1bac6b96ad3abbec568b5ba410db78e705899cd84c6f1fc4c34cf2f1b3383f8a4d9f38fef7bddf01e6d814c660399c21faeafc6a2a2aa83f99daa93f4759d847e7ab732bf16b0519415671564d96da1232c9573107301c4e09c186c7f0e9a72c30408f2261d4101a3535178c60955e3bea9b7aae65dfa16d9b5452995c9bbd33aadc3fbe44c5280295577ce64a633027d33bc59a541a1cea8049d673f2c932cae7cd7d3bae0a9510cabb8b5619feafd965926f2b0981ac362ace1b44bff23b8a87773671998c4a2821024ad1a74cf3fa66ab56f62fa25f1f138f5b68eea3d79c685754d1af326a63fd2082950ad292c6ecd4e8c7cb8e94e2d0b39d0bf6a4f793582a488effb3bf23e0e8d81d4042599f85d5f6aa718719eea31bec302fe35aea5655d8023f28410edf39e87aca135bc1cc5ff70dcb2a3dd69b2a1de34ef26bcb078a857a0dfc52ebf5dd1ad0cce02573a7aba0b7f9813d9bd1de2924b06131ac8dfd74ab2e8899928ca528780eabbe7832cdb3748d31667dc7548b7fa23adc694d21607a4a4f4f56f4317ec1dc44772c981506c9c5772961b164b59710b997d7d5d20b77a86f88bee0bac90e6463f9fb1f8ce0a3633f19a7a966f1203b804edc6f8c9ee52145f0829f812d01d1daa4c2c0cee758898760545ae650a017b7d935c9000591a46e3521b562df854f43fabe64f478c605d0db34172bcd420ad5f583758d86de83f0f3cb0033d9e6be43f5351b6a4d49392caf93857d7eb3c0b702eb97fc74a15ef1ea2b8f5510c4fd374656bf9feaa6ee93cb9ffca9aa6acd7bcdfac6e9d1dab82fbba9f71c8857a755f6388e7c1af2cd75dc2a5eaaa30124b07c411013425df2b56d84173d823a00395847262ad5b11a3e5d5cef8fa6dba03e260c177bbcab225c435d45dc1afba94e6cc754499b9a94e27ee9219d60b62bb49c6ec80b40f824da906ab832bb033dfadbcaa13d1312a7c4ad92707772b9e80b902a3baeaf528783494edcc0f351b599bc3977da2af4c4c2b38bd6f22a79ad8f1e4faef08d3c2db189f5abc7dcab0347dfac618eaa69bbc148b56b8be6c24e821ee27be22016c09ae1a5ff9281d730babf6b15e4a8806030371e992b7889e8e9ce7cbc41dbe6d58354d0a5c05f1600b4b17996fee2a443ae010dbaeace0f78c4c3aebe046199e94907b8b08f4ea53d6042aadfafb1ad594d029c6d94188f0caee94e62c70b1aa68ca9bd1336c7e3437e50022716bdc3d50ca410aff36da22d5b23ae9d0e2d04e95b4d3c96d7fa70ff0bfff25c0e8987c55022de7753bf69fe05096451d9b39996e7de74b64c6e2d965128440a78b34a7962766248e1677b747f9769c815d831ab31573a4798ef7155a683d2e7ef232c93ee0100a36830959c81f2f95ae85465440429a7cd55b406be24bba654a5ca52a347134b5a616eed54ab2fb57e7d0642c934703960348a4b36387d3e6f6c859345ea329b0ce0c2bd578f971ef7b4c9d9d650b2c6afb63d4a648dbc9f4ba3aa556e35d7afb6f67066cdd9ea7a89ac80970288dfc6708a600d437373389326ca676ac48d1ee47dc1498b32e3b828567e459e4d0812c0378ac6c2f1d3f4a8b010343756202f3a81ea88aa5659f7feabc80cb5cf382365c0c85ae963b1d34e87b51ba8a4fb39e63132c7ecbcf6b6dc3dd931a7810a29faffbb66bfe44d97d07ccc811f63123d2f695d82ee12a248574cc6a5ffe6e68d9fcb1b67b4dcb6cd849dd6e27ff89e46b9ee649faf8ba29b4ea49a5578d73b46ecce53e9e3f9594732f672e957c2fd5b352e1befbb5a8373b1a5adff2d33b1db7e15649ce83075c0e2918fae0766d6f0a0e2ee7256c662a8ed0ebf1d169f291f6bf042785703b90ef912a99eac89ec99c8ca2fdad972cd5b9fc8dfc806e83b836783a173bead764c0924064c585b3e4b42574cbe8f6255ff1ac34d9b025c6a7cb1764502043aae099cd0d6ee75d56ba13e48b163b0917e90468496f5b78c26c5ff8997fb3d5bcff0e6e1401bbab6cce30e23c0312fbd126fe7b0119e64a06dabc924d660282f57c6669deb327eba1d67be038eb8059932b05edb87730db9202563e75ca1013e14c96f0500aba293f796710d7d48c2d87b43cbb1a2b04dbd25251eb45f539baf8e0e99c83c5fb5abb5a2aaac2841feed5dab20f68009d12637a397a35bb230e39e9dec64e01751a3a5fabce590e90c8f9a4de6bad33aef6ea11e8980544418da995a98003b42fb17afdc77ac95ef0a49fd13f74d87eda2c621a9ff8cc0edff851921f15a1b830f1a3395e4d671062ede52f4c90f66cf70d884ae7fdca282e6fc90b55ba056937544f7776d7433ac819b5995be66aaad3f389c1b577b9315e16d20ca43e0d9f52b8f3bddbc6ff065c517c659ad777852949a8d3d6d7e2103a4a2e5a596a2278c62e1cf42298a7e51a30be7801ce4d3897f86cced9f38da51b9e99deb707f0fbed93dd86aa75e6ff6f75b2613652701c66adab76d57495856bc74abc9cb70cd4b5538f70b66417c3c1092665a4c72f9d3e0bfc5a0a26602d8363c753e17fd779f7cf353671cf53639c4d33be5dab31ad00e482135c5d84d45b5b34d1eebbdad53338da55afcfe2003dfcb75e7ff2255a42a366e9c9adb9679d85391301a6a36efb0901156d80b6c8c387308cad7af4948c6b0f5a1ab5963693694af358648bd7e3647c925816e4f094949a57db41abd7d22ae646367bffc8aa04aaa42b8580557372bd264d577466c88bec8b08313a8d0ed671293615de3af133b63cf7db3b3d0adc2d5cf94ba2cb065faa20078e44d39e8cd6e80c87e8c729c41058450f3c3495eeb280b36409c8ae33889e4600764c74afff3d7f44f49ad42c75c1cf4b532cc8d27cdc581177a8813cee49379ed1f21fbc2e4c0303cb1946b6858ccf827a5788e0e1783b4211e187168fcd409af7085589d28c74e69963777e9ac9aeaeb5ecd7405dea2333311001e310718c08e7deb1068b2b41f4c51bbb35dda0fa02b821b5fdfd91938c31d8567360ec2269a740815e843b90a23bd9d7fd710e53fc7c6aaec6cbba2974c327fe8c0d285f059839cdcd76652b5e5b267e3e2944d8def6db894d28aec100d9ef6d4ad6e91804045a81d58d5c1e1a66545f1a1e0ca1a9e96b7fb110cf779e264028d66202ccee47334a9227155ac373d13bd06a00da0cf77b27ed034dbf4fc1b1e0de5e6b3fb0ba10271eaf67f76c9668df813f2cdc53a0c904676ddb037e4b50ec5091109847d07c7570a652b33b22b1f3af9748b3591697203cb050e4aae9e549052f875a1cba124ff5afbb6bc8e82d7f21f546d43196e49b330f7d015be609d92adfd11c1fcb1b9a82b6325eb9b99dd84c9fad2998dd9d324077418f58b88625e19b81672aa0f72cb25808b7f4bab43b1ec7416bfae39e10b795f60ae306d7270abbceba84a97c4e30da2717ad481e83335efbe43adacb71a72325350d5f9923359ca936fe39387ef036f15b7a677774a75dd78fbb72ff6483ebfadcd4e32adc8fa6cb86963d75d78e0c2b840dd4b9a973cabb6758c52b98c7257f2c3fb40866d528464186e3caa60e343ac8bf176cb68b8289f1bf062d82e444fdbf6cd35ef3cb0d475d17e1af9f7591a4f1e1b93c84a28d89ebd484db59a2cc9f9d560729109dcf9ed6f72cb424f724bdd8cd7112a95a5d759796504f000275621f7591976008bf3b474b7d0a939a708ec2f6f6ba364fecaf1c6f4b93ee165f0f44d5623ad9c795d64bfb8bfd59608c7a455b71ff3daa6d6a04e28129d70d2b934bc9d641cbcbeb07dc62023928e24309dca4467e56c2d4697d6f7181bcab1bfe5b49be490193a5eb04cb188cd1fcd2641afa291ace00d697abef1fef367b81ca7e8c52beebd493804137fcf35ee8be7b9c17aeba274d9efac70200eb3ca248359f4834d346b79b2ac1ff9192f90e2c50de886532468f1a002537616d18cfbcf53aa2ae85b68d749a8df61a87030f40631825c0337812d7aef147836061af4508421721e113e7a55a773307cf6d80b82763102742f97b9daaaace7354a22844e40c9a7f52f008c59d2652a6786eb0696ccfb5dd7118a0349c8fe81482720075730d0d46e20bc85f84f7edecc0039469124a668756ea700f49306292ac3909b171242e40ba046d32c887bef4d11e86c8965c33f65663c011c03972469e6c38604565c3ad20a83693f089488b0b0372de79b815e69796a141ce84e2684bcc483e62bdd3814efb6a823ec14ce64ba28f8439be38418edcb216ff7a25d50caaf3dec85ea3efd6c5e21c587e717e4e1c16ca60e3e767b807a4b380649ccb033a1d34615e3d218967e33950fe5e70df5d4ec0176fa21a232c1464045600f57e0bee0a1d37fb4f9cc21fde5d442ebd5aef6ddaca1617d0cb55dea20cb23c5e9f979300e46617198d1721c1df308e991a62d6630da3240636dd7391b75c2c80295db3ad29d9a214d13c26e791b47097b4f804a46755c64acb8499514a597bc84663d0330669519098f4ba0ee6415c17b7a35ec78a3f9641ea1461e2c95ed80ef5d393e9e80beeca575e22fc590bb77cda39ddc7223b5b7de36f94e6b060d4db79226381224f1b4fc05e2c778cc90fdfc1ac59c383bd2ed2bff969d586204375be59cd22d002947a0c59c8baf2627c5efeefeefdbb6da52146989a4c9ac8f0f23bf9371425aaa131684bac8fb84b7d289d000d824f5c8857f08a3d7be5401d4ea75bdf183fa4c16105f8c094a63b52f35466c969a734e5b676ea6119a65f441af9fc38a379124bea1683f008630c44cf58aec3e3de6ccc495f1d3222e61791fbb1e91fcb9eb052a9bdc3520e1fad76b483399e16c54f99d58de314d5d9d837d1f8633d0de77e77a85db229f3c87d604b36c61bf7971790938a139264b9b5b5b1b9e0e742d324bfe932f2dafe081b05517da53d00b89ee85fe3f792bf8b412039efdaaf51d430823d89acce19dd9e4d94df0e8b76cc89d6713a306e75a8ef5cbb19cb5ecbe8b2fee9d72c2b315c451514934422637f03f8eaddcd6b88f464a81bcb365033637e1ac5ca7c2c8bd5e253fbf6add7b1cd3a9139c7098c7b139ab4c8f5e53e703f22ded7535a0c7b3d312669f036df18d777e64f3db80ebf0fcc115f9e484592c84a24bb7c5906b99818de93370fc69886617903f2bb37716d00d7470975e225421c8e55b14356822045887059ffaa373a41ca76d6d22856641fa3f4bf7143bb4dc19f3698acc17219089591c0663e0823fe4e43fd3b5536a604dc00e2c9c7005dae301dababd57195474ecf149043f5e6f82bf5c6a584915b359b2fae305367d95ab3b99c09df2373fcd9d432f37f16a69b7a4dc222fd1973596793f8af4292df1e196e65f43e55b60506145e7792e80b7ef3e8fd380ff59034540ae8262e0b6f6dce504800c9c494abe18254a9fd736ebefcfe355f62ddecaabecd1d592ffa00e88a5197f3811945237a76754ea9c22d6df59dd1bd30939c80a6e5c3be59af1a6cf1f3a8057201228c2a0f4f8c4601ff6e6c6a5417a6a081880a198c6f24ec4328", 0x2000, &(0x7f0000004980)={&(0x7f0000002180)={0x50, 0x0, 0x9, {0x7, 0x20, 0xfffffffb, 0x100, 0x3381, 0x1, 0x564, 0x9}}, &(0x7f0000002200)={0x18, 0xd535d03373aa48f9, 0x5, {0x3}}, &(0x7f0000002240)={0x18, 0x0, 0x31, {0x80000000}}, &(0x7f0000002280)={0x18, 0xfffffffffffffff5, 0x9, {0x80000001}}, &(0x7f00000022c0)={0x18, 0x6e, 0x4, {0x7}}, &(0x7f0000004340)={0x28, 0x0, 0x400, {{0x3, 0x80000001, 0x2, r2}}}, &(0x7f0000004380)={0x60, 0x0, 0x8, {{0x1, 0x3f, 0x8, 0x1, 0x3e32, 0x6, 0x19c, 0x20}}}, &(0x7f0000004400)={0x18, 0x0, 0xf9, {0xf82}}, &(0x7f0000004440)={0x13, 0x0, 0xffffffffffff1e2f, {')[\x00'}}, &(0x7f0000004480)={0x20, 0x0, 0x37, {0x0, 0x13}}, &(0x7f00000044c0)={0x78, 0x0, 0x2, {0xb5, 0x4, 0x0, {0x1, 0x7f, 0x1000, 0x6, 0x5, 0x8001, 0xfffffffa, 0x200, 0x401, 0x8000, 0x1, 0xee00, 0xffffffffffffffff, 0x3}}}, &(0x7f0000004540)={0x90, 0x24, 0x100, {0x1, 0x3, 0x7f, 0x0, 0x0, 0x0, {0x2, 0x8001, 0x0, 0x28000000000, 0x0, 0x1ff, 0x2, 0x2, 0xbdea, 0xa000, 0x5, 0x0, 0xee01, 0x6, 0x9}}}, &(0x7f0000004600)={0x30, 0x0, 0x5, [{0x4, 0x4c2, 0x1, 0x9, '#'}]}, &(0x7f0000004680)={0x200, 0x0, 0x9, [{{0x1, 0x0, 0xffff, 0xa93d, 0x180a, 0x80, {0x3, 0xfffffffffffffff8, 0x2, 0xfffffffffffff5fa, 0x7ff, 0x80, 0x10001, 0x3, 0xfffffffe, 0xa000, 0x8, 0xee01, 0xffffffffffffffff, 0x9, 0x98}}, {0x6, 0xf6, 0x2, 0x8, '[,'}}, {{0x1, 0x1, 0x7, 0x3, 0x9, 0x0, {0x5, 0x7f, 0x1f, 0xc90, 0x0, 0x20000000, 0x8, 0x7, 0x0, 0xa000, 0x7ff, 0xee01, r3, 0x8, 0x80}}, {0x0, 0x3, 0xa, 0x1, '/dev/fuse\x00'}}, {{0x4, 0x2, 0x95b, 0x4, 0x5, 0xff, {0x6, 0x1, 0x4, 0x400, 0xfff, 0xffffffffffffba79, 0x9e9, 0x9, 0x8000, 0xc000, 0x7fffffff, 0xee00, 0xffffffffffffffff, 0x1ff, 0x1}}, {0x0, 0xfffffffffffffff7, 0xa, 0xa8aa, '/dev/fuse\x00'}}]}, &(0x7f0000004880)={0xa0, 0x0, 0x8, {{0x5, 0x2, 0x6, 0xa0, 0xffffffff, 0x3f, {0x2, 0x5, 0x200, 0x8000, 0x3, 0x0, 0x3, 0xeb, 0x20, 0x6000, 0x9, r4, 0xffffffffffffffff, 0x2, 0x1}}, {0x0, 0x2}}}, &(0x7f0000004940)={0x20, 0x0, 0x5, {0x40, 0x0, 0x10001, 0xe27}}}) r5 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$TIOCMBIC(0xffffffffffffffff, 0x5417, &(0x7f00000000c0)=0xfffffbff) ioctl$BINDER_SET_MAX_THREADS(r5, 0x40046210, 0x0) ioctl$PIO_SCRNMAP(0xffffffffffffffff, 0x4b41, &(0x7f0000000100)="30339cc8bdc5c530") 02:35:05 executing program 2: bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x1d, 0x1, &(0x7f0000000080)=@raw=[@generic={0x0, 0x0, 0x8, 0x1ff, 0x6}], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0xa4, &(0x7f0000000100)=""/164, 0x41100, 0x12, [], 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000280)={0x5, 0x1}, 0x8, 0x10, &(0x7f00000002c0)={0x2, 0x1, 0x3ff, 0x10001}, 0x10, 0xffffffffffffffff}, 0x78) 02:35:05 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5421, 0x400000) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r1, 0x4b6b, 0x0) ioctl$KDDELIO(r0, 0x4b35, 0xfffffffffffffffb) ioctl$KDGETLED(0xffffffffffffffff, 0x4b31, &(0x7f0000000080)) 02:35:05 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x4000, 0x0) openat$cgroup_netprio_ifpriomap(r1, &(0x7f0000000080)='net_prio.ifpriomap\x00', 0x2, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) [ 2103.278180][T26319] binder: 26317:26319 ioctl 541b 0 returned -22 [ 2103.348056][T26319] binder: 26317:26319 ioctl 541b 0 returned -22 02:35:05 executing program 0: bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x1d, 0x1, &(0x7f0000000080)=@raw=[@generic], 0x0, 0x0, 0xa4, &(0x7f0000000100)=""/164, 0x41100, 0x12, [], 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000280)={0x5, 0x1}, 0x8, 0x10, &(0x7f00000002c0)={0x2, 0x1, 0x3ff, 0x10001}, 0x10, 0xffffffffffffffff}, 0x78) [ 2103.409483][T26325] binder: 26322:26325 ioctl 40046210 0 returned -22 02:35:05 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)=@ipv6_getaddr={0x2c, 0x16, 0x400, 0x70bd27, 0x25dfdbfc, {0xa, 0x1f, 0x60, 0xc8}, [@IFA_ADDRESS={0x14, 0x1, @rand_addr=' \x01\x00'}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000001}, 0x4044000) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140), 0x111}}, 0x20) write$RDMA_USER_CM_CMD_NOTIFY(r2, &(0x7f00000001c0)={0xf, 0x8}, 0x10) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) [ 2103.473891][T26325] binder: 26322:26325 ioctl 40046210 0 returned -22 02:35:05 executing program 2: bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x1d, 0x1, &(0x7f0000000080)=@raw=[@generic={0x0, 0x0, 0x8, 0x1ff, 0x6}], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0xa4, &(0x7f0000000100)=""/164, 0x41100, 0x12, [], 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000280)={0x5, 0x1}, 0x8, 0x10, &(0x7f00000002c0)={0x2, 0x1, 0x3ff, 0x10001}, 0x10, 0xffffffffffffffff}, 0x78) 02:35:05 executing program 4: getsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(0xffffffffffffffff, 0x84, 0xc, &(0x7f0000000000), &(0x7f0000000040)=0x4) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000080)={0x81, 0x0, 0x1}) ioctl$DRM_IOCTL_AGP_FREE(0xffffffffffffffff, 0x40206435, &(0x7f00000000c0)={0x0, r0}) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0xf0500, 0x0) ioctl$TIOCSTI(r1, 0x5421, 0x3) 02:35:05 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) getpid() ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) 02:35:05 executing program 3: mmap$binder(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x1, 0x11, 0xffffffffffffffff, 0x8) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) 02:35:05 executing program 0: bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x1d, 0x1, &(0x7f0000000080)=@raw=[@generic], 0x0, 0x0, 0xa4, &(0x7f0000000100)=""/164, 0x41100, 0x12, [], 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000280)={0x5, 0x1}, 0x8, 0x10, &(0x7f00000002c0)={0x2, 0x1, 0x3ff, 0x10001}, 0x10, 0xffffffffffffffff}, 0x78) [ 2103.655926][T26339] binder: 26336:26339 ioctl 541b 0 returned -22 02:35:05 executing program 2: bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) 02:35:05 executing program 1: ioctl$VT_GETMODE(0xffffffffffffffff, 0x5601, &(0x7f0000000040)) ioctl$VT_GETMODE(0xffffffffffffffff, 0x5601, &(0x7f0000000000)) r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) ioctl$KDSETMODE(0xffffffffffffffff, 0x4b3a, 0x1) syz_open_dev$tty20(0xc, 0x4, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) syz_open_dev$vim2m(&(0x7f00000000c0)='/dev/video#\x00', 0xa9, 0x2) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) [ 2103.796486][T26347] binder: 26343:26347 ioctl 40046210 0 returned -22 02:35:05 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5421, 0x9) 02:35:05 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(0xffffffffffffffff, 0x89fb, &(0x7f0000000100)={'ip6gre0\x00', &(0x7f0000000080)={'ip6gre0\x00', 0x0, 0x4, 0x81, 0x81, 0x1f, 0x76, @initdev={0xfe, 0x88, [], 0x0, 0x0}, @mcast1, 0x8000, 0x7, 0x7, 0x9}}) sendmsg$nl_route(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="df250a00"/20, @ANYRES32=r2, @ANYBLOB="8000000a080007000104000008000900400020009f3b42b7831d0ec064d18117fd3ae7f28157fe6917440214a1214e01d9af7a6e68b734a1dc29f6412aedace99a152ae5b410af054c62a1090677547a03fda76fb8be97"], 0x2c}, 0x1, 0x0, 0x0, 0x10}, 0x4000000) [ 2103.848427][T26351] binder: 26343:26351 ioctl 40046210 0 returned -22 02:35:06 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$GIO_CMAP(0xffffffffffffffff, 0x4b70, &(0x7f00000000c0)) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f0000000080)=0x7) syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) 02:35:06 executing program 2: bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) [ 2103.947887][T26358] binder: 26353:26358 ioctl 541b 0 returned -22 02:35:06 executing program 0: bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x1d, 0x1, &(0x7f0000000080)=@raw=[@generic], 0x0, 0x0, 0xa4, &(0x7f0000000100)=""/164, 0x41100, 0x12, [], 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000280)={0x5, 0x1}, 0x8, 0x10, &(0x7f00000002c0)={0x2, 0x1, 0x3ff, 0x10001}, 0x10, 0xffffffffffffffff}, 0x78) [ 2104.003295][T26358] binder: 26353:26358 ioctl c0306201 0 returned -14 02:35:06 executing program 4: openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r0, 0x4b6b, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r1, 0x4b6b, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r2, 0x4b6b, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x4) r3 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x92400, 0x0) ioctl$TIOCSTI(r3, 0x5421, 0xc27) [ 2104.070151][T26358] binder: 26353:26358 ioctl 541b 0 returned -22 [ 2104.086031][T26364] binder: 26353:26364 ioctl c0306201 0 returned -14 02:35:06 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000040), &(0x7f0000000080)=0x10, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) [ 2104.167455][T26370] binder: 26366:26370 ioctl c0306201 0 returned -14 [ 2104.200901][T26370] binder: 26366:26370 ioctl 40046210 0 returned -22 02:35:06 executing program 1: getuid() r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x404) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r1, 0x4b6b, 0x0) ioctl$FIONREAD(r1, 0x541b, &(0x7f0000000040)) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) 02:35:06 executing program 2: bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) 02:35:06 executing program 0: bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x1d, 0x1, &(0x7f0000000080)=@raw=[@generic], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x12, [], 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000280)={0x5, 0x1}, 0x8, 0x10, &(0x7f00000002c0)={0x2, 0x1, 0x3ff, 0x10001}, 0x10, 0xffffffffffffffff}, 0x78) [ 2104.268133][T26375] binder: 26366:26375 ioctl c0306201 0 returned -14 [ 2104.311438][T26375] binder: 26366:26375 ioctl 40046210 0 returned -22 02:35:06 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x145100, 0x0) ioctl$TIOCSTI(r0, 0x5421, 0x400000) 02:35:06 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r0, 0xc0405519, 0x0) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(r0, 0xc008551c, &(0x7f0000000200)=ANY=[@ANYBLOB="3dbf00000c00000009b700000005000000"]) write$RDMA_USER_CM_CMD_GET_EVENT(0xffffffffffffffff, &(0x7f00000001c0)={0xc, 0x8, 0xfa00, {&(0x7f0000000040)}}, 0x10) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x5460, 0x0) 02:35:06 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$KDDELIO(0xffffffffffffffff, 0x4b35, 0x2c1) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) 02:35:06 executing program 2: bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x1d, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x0, 0xa4, &(0x7f0000000100)=""/164, 0x41100, 0x12, [], 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000280)={0x5, 0x1}, 0x8, 0x10, &(0x7f00000002c0)={0x2, 0x1, 0x3ff, 0x10001}, 0x10, 0xffffffffffffffff}, 0x78) [ 2104.461275][T26386] binder: 26381:26386 ioctl 541b 0 returned -22 [ 2104.487763][T26386] binder: BINDER_SET_CONTEXT_MGR already set 02:35:06 executing program 0: bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x1d, 0x1, &(0x7f0000000080)=@raw=[@generic], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x12, [], 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000280)={0x5, 0x1}, 0x8, 0x10, &(0x7f00000002c0)={0x2, 0x1, 0x3ff, 0x10001}, 0x10, 0xffffffffffffffff}, 0x78) [ 2104.515761][T26386] binder: 26381:26386 ioctl 40046207 0 returned -16 [ 2104.576243][T26394] binder: 26381:26394 ioctl 541b 0 returned -22 [ 2104.587958][T26396] binder: 26393:26396 ioctl 40046210 0 returned -22 02:35:06 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5421, 0x400000) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r1, 0x4b6b, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000000)=0x1) r2 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ttyprintk\x00', 0xa2000, 0x0) ioctl$VT_RESIZE(r2, 0x5609, &(0x7f0000000080)={0x2, 0x7, 0x2}) 02:35:06 executing program 3: ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(0xffffffffffffffff, 0xc008551c, &(0x7f0000000240)={0x2, 0x24, [0x7, 0x7fff, 0xffff, 0x3, 0x8, 0x3, 0x2, 0x8, 0xff]}) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f0000000040)=0x9) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000000c0)={0x2}) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x24, 0x0, &(0x7f0000000080)=[@clear_death={0x400c630f, 0x2}, @increfs_done={0x40106308, 0x3}], 0xef, 0x0, &(0x7f0000000100)="8c47840fdde35b7c1fc93eadd47ef7eecc1704d987948fdf078e079670b5f1431fdf3ff1ee4a79e017f853402b40d3be65794e2c834577ba07243f54956bf69e12ecdb5754017ad6a698eee29194db5f2eb63362474cb092510bd9c12d1c81e5d1f449f2417280cda87c4bb470e874def209799f4070d333d9908513375fbb429ae851811248caa99c550ced74d987ab45cbe93d13ac916694ec0cb5e231910f9c18a85c1315eb2d55b87159fad77481b0b7616c884911e44ab0ff6dcaa5e5e278daf5ce55a8fbe2ec6f6bdbd93b82f99baf96cc6b6514c8380ad4e59d6e76d05d2228ee83c62623220e546b21c9f0"}) [ 2104.632578][T26399] binder: 26393:26399 ioctl 40046210 0 returned -22 02:35:06 executing program 1: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r0, 0xc0405519, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000040)={0x2020, 0x0, 0x0}, 0x2020) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000020c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000002080)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_QUERY(r0, &(0x7f0000002100)={0x13, 0x10, 0xfa00, {&(0x7f0000002400), r2}}, 0x18) r3 = getuid() write$FUSE_DIRENTPLUS(r0, &(0x7f0000002240)=ANY=[@ANYBLOB="b8000000daffffff", @ANYRES64=r1, @ANYBLOB="0200000000000000010000000000000003000000000000000300000000000000000001000000000001000000000000007f000000000000000200000000000000ee000000000000000100010000000000aeb00000000000000000010009000000060000000020000001010000", @ANYRES32=r3, @ANYRES32, @ANYBLOB="03000000000800000000000004000000000000001f000000000000000d000000ff7f00002f6465762f62696e6465722300000000ec7ceba5619443e1495cc9775862cab423f7f363de25b3555645bd13187b4240d7775a540e172835e940cb8615b1ab1d13364972c66b0b9e7a857154088c2b9ceba861580e2ce1bfe37cf2379cb605a2e2f2bebe1b6d4573717602fc52be87041aa2fcda32372ea11aa07e633eeadf8e9773d25a39ad2734810aa84539fa81c43c02dca00d3b43a7fe76abcb84d8ea9fb777964e8485de7a954ccaf16c75a447e42db567142341ce4c8801096bad024e2093e5628aa7ee794a0a8b64b1ec3e635270faa215184d9a19057267862d513e60b85b43cdc6fc54e945f42e03358f0caddfdc60432ab810ef77ab27998a87deebf4f67905ece3d2641febbd"], 0xb8) r4 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r4, 0x541b, 0x0) 02:35:06 executing program 2: bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x1d, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x0, 0xa4, &(0x7f0000000100)=""/164, 0x41100, 0x12, [], 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000280)={0x5, 0x1}, 0x8, 0x10, &(0x7f00000002c0)={0x2, 0x1, 0x3ff, 0x10001}, 0x10, 0xffffffffffffffff}, 0x78) 02:35:06 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x802) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r2, 0x4b6b, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x1c, 0x0, &(0x7f0000000200)=[@acquire={0x40046305, 0x1}, @increfs_done={0x40106308, 0x3}], 0xe7, 0x0, &(0x7f0000000280)="23d2e485ab5d58a16b91562f5e70a7bbf8328a27312294d696bcfc0c44f3f62bac27a3165974cdac4bd4384ed4cb6437728e03114353de9b7e504271fc2526fe0a5dc2417fd4bad34694703cc78956c271b3fd9c303a681afdc8161c39dd5291596cb24c4d5903779f36df11ce0230fae437ab9749f1bff9c1e8bcc6f74c209b81b53a59587a05122cb1c83bfed956ecd2f76240772e9cd00ecb64710fac7e79415ea55486f3f33a76091a8fcba4dab2bd069fb6545c3f3c9acf0c23d0fbb6d6b6b179cebcd61d8c4e23f8cceffd60bff449ab8cecca916149cd7bbc581f72cddcbde8f0883daa"}) ioctl$FIONREAD(0xffffffffffffffff, 0x541b, &(0x7f0000000040)) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) 02:35:06 executing program 0: bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x1d, 0x1, &(0x7f0000000080)=@raw=[@generic], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000280)={0x5, 0x1}, 0x8, 0x10, &(0x7f00000002c0)={0x2, 0x1, 0x3ff, 0x10001}, 0x10, 0xffffffffffffffff}, 0x78) [ 2104.815116][T26406] binder: 26402:26406 ioctl 541b 0 returned -22 02:35:06 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x408401, 0x0) ioctl$TIOCSTI(r0, 0x5421, 0x400000) sendmsg$RDMA_NLDEV_CMD_SYS_GET(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x10, 0x1406, 0x400, 0x70bd2b, 0x25dfdbff}, 0x10}, 0x1, 0x0, 0x0, 0x4004}, 0x40814) [ 2104.856559][T26409] binder: 26402:26409 ioctl 541b 0 returned -22 [ 2104.876409][T26408] binder: 26403:26408 ioctl c0306201 0 returned -14 02:35:07 executing program 2: bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x1d, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x0, 0xa4, &(0x7f0000000100)=""/164, 0x41100, 0x12, [], 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000280)={0x5, 0x1}, 0x8, 0x10, &(0x7f00000002c0)={0x2, 0x1, 0x3ff, 0x10001}, 0x10, 0xffffffffffffffff}, 0x78) 02:35:07 executing program 1: r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$DCCPDIAG_GETSOCK(r0, &(0x7f0000001600)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000015c0)={&(0x7f0000001200)={0x398, 0x13, 0x100, 0x70bd2c, 0x25dfdbfe, {0x9, 0x0, 0x1, 0x0, {0x4e24, 0x4e21, [0x8000, 0x9928, 0x1f, 0x4], [0x4, 0x0, 0x0, 0xfffeffff], 0x0, [0x4, 0x401]}, 0xfe5, 0x9}, [@INET_DIAG_REQ_BYTECODE={0x5e, 0x1, "272c67004ca16f0a60124a1484434b2948e058d15acf20fc4ad78c9ccaef015a2457571cc21a508f892fbe9321af2c027b9caea6093ddb56d61643b77cdcc2c22d1b4e3814ea392d36ca3976aa1a27475253ae7bc0e4d86302f2"}, @INET_DIAG_REQ_BYTECODE={0xa4, 0x1, "25faa9d5d645e9112187f3201bd421bf16c4564d4b24fb0f9fb70cf0bb0fce940c67197620ec28d3a16cde39c0f8a6379ec0fc2ce66912e7d1a6e2525097ce441918416c5cd3dccb8734a8b29a0fe6e63935f2bf666b6e9f27a96228a2fcff330f74dfeb67b504b222256a1d5ac2acc14057965bc315e963ef322ffd516596d5e86040fcb7957849b1760170ecba008be57b2f4d58743143c546f5e6b50c797c"}, @INET_DIAG_REQ_BYTECODE={0x8d, 0x1, "cbc71d1782fa9f17cfd77f98f1f35eda16e158bcd99aeec5ec789dd21dde8cdd6a650558d5f4e9be35e9ec48e7661912bb1c14542a768a9a308669913b6c576a2e4f53c01f59f219998facab9fc49bfaaf8e44febf2f84218a95c6bf0d2647ff453a2def8e61b7486f8c712a0c391344dce05a2bafab7f8164fe459e7f2adc30c8ace07d2470a909d6"}, @INET_DIAG_REQ_BYTECODE={0x101, 0x1, "4e4696042162f8027fe46de67a2022b31aaa3e69779e82c516720fcafd89dd18a185f539fc562c39b0b919c7c2db215dbaac5f44eb5cb4a71d3c01028f53bea905ea732801afc26ffdc6ef4dc804afdfb67da915c7744851646f13ee5ffc14e069e66e80ed3b735a6ab3a335460dea0c7c74ec92ce0d17b8d4662bd5dc8d6701bd5f166c53bc2d49df68d57a388eb6dded95fe1897ba7f64038e8f2bc9c1bcc68d36b3e8329bce6db139deb69e9dc5601b89abb1dde98766a823d8a7adef4b3d7446bba63ae9eb591673c0bc14abeb660a040fa08e134373d04bd3761f9168f567fb8f11ba8c5950b9a293e4c847cf5464d4650f18bed15aac83e09bf4"}, @INET_DIAG_REQ_BYTECODE={0xa2, 0x1, "c32335a04c6bcb03c7f91c5807377c7d603e980d1329c737c095f5e1068c7eac30b8e4cc941ab6970974d35f2301b3a77d2d1d72015b6fd0dd1d10264559ca4b1650dc18c376b249691c0673abd1d88be0063b6fbb153564b049f5eb18f19d4f50f81ac4e020a8882c30cc58e8bd356ea2299fd5834150edd8270574557b1c9b95f5f7b014b70776a0b4c7f41c056f813cd67017f0f5a0a82d119452ccc6"}, @INET_DIAG_REQ_BYTECODE={0xf, 0x1, "e5fbd976f06bc679513fd7"}]}, 0x398}, 0x1, 0x0, 0x0, 0x24000000}, 0x4000000) r1 = syz_open_dev$binderN(&(0x7f00000011c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001180)={0x4, 0x0, &(0x7f0000000140)=[@exit_looper], 0x1000, 0x0, &(0x7f0000000180)="cc86625aea1a86714e3e588f8b929925a4a1d73a24978cdd686055028286a2dbc8c48efaa9a95c071e10fd8c5343599b00fd8e36104089aa87c6891c6dd02659b69f721a6b891548a2a99561a9078981aa3ce49af73c47ac903d529d8cbb7f176c4832e14f53f28c07e63ec8c385a8a65c2d34b189edff52c26fdfe9ea30fcd8f194ab9a095639a9e3820e8f83721d2f79c36af70ca94954edb4544d89fa34dce156d1f6933a0eaae22cf637a37d42bac1031d0adec166c8472e509e2ffcf49d208a5ccaa54369c05978146ea6b4a21f9face9a31fe16e8c80fdabc463935a4fed1daea979ac455547d30a24bf51e7584411aeee075fe34d43a41ebfec5bf8cdb2a501ed029a901155d4e176191c16f7232e1ba63b337750e8a7a12243ae8a8c8882c78a907bdd49f080dc984259fefc30d6dbb62f92ea278d33c2a8a96779a30dc7689ad58bc5fbff9052b5b8597987b2c5cb53d94f0507803e609a048bf94740c6a9290d69b24aa8e2fbdaa1a65e7bf29f7f61836af470f045d01d575af87b0195da5ce50af8a797fb6960ad2733d979fed0ee4108cce574685af82e3aeab37efe494971a1f613455929f9956d27ea44f57913c5dfc310b34edaf886c310271c4cab0b8329cbf12df81b8f01826dee3f35a3aa64bf49db28e0a565ad066dfd626c72e6f8082663ba84333bd0117237af304767ba6824f07de15d9103ab45ddd249fe91c06c7fce0b6b73e41f868e9fb15f9790c01abed51ef7aa7acf4da793823d38660195908e6f27939c5150852d945a57a9e9f4158463186349655d7baf744bb1dc1b669e5e5b53cb8b74b75a030be6e4486bbb7caadf772c8250c4d6460e151fb66e60c05446d8ceeb2d9db19ee91700cdc19a461babfee47d60438226408099280adf711280edd22461b0f6f97890cceb9c6fb57f6d2118d731d481ea78eb193b7856516e8e0ac903ffb7bc94f062984085b94e865098f6b6b51485943377d7c967b76ccbf6f1169d7d2e6a6d5551fd34f9837b8e600ce205bffe5b5f83ebd0ac009d682c5d366f28d8ca36e7c1cd637f8f415d13170fd2bc3505ed538d8126dba2c812061d7418010f466606e1ef53dc532734c6fd5b09a3e11323af290e293dd329db184d3266502f726d47406be157476f21118c1becf730ac9f724a4303d0552f495d576d3d239b4db6bfc12239b93cffb3e2027913b8e76d840ca90dd3e7e3fbcdd27ec1ed459f67bcfa7429bc5ae9e6b1a9fbe7fb119ab7293a20b0a190499fe3379b879627d65f40b2fd1c37c9bbf406fe4643957c8cda5404c0e12aa276616ab410c0d6d030aa5c33af443ff28a7d5ed1adefa5cd8ff9fffc5b998ca6a93804f6684c72985c13907833b2d85a335b275c11c70f6df876a96b0230ade33ff12a138aca6d902df2d8d45e54d911b4cd83dd94b82f9e63c27eb4e50a16d5208555a26d4109672a5def32490794ebba66d9c554f76c9ec5206e82538cfbd7061f1862bf18ea0b264e0263e5ccb98dfc1d0503f9f39713579c70cfb3b351d9606ed2db95bf56bc08a3e44ea292aabd387a1fc73eb5ff41cee02b8808bfb4fa25bbcdbe4d765d323e760c366c409d9301a2d1ebca293bbd9347fb3e38ac90bdef797420d08e844c611fe4be94785a8b855e234750ffd0fc85510fb4feaef853305a52625211cf0a34e6de5feaa42a955df30c4a2b3c43279407f06a48cefaad534bd2a4a97bdad26b4197e9135c674d40f053aff54dc9d3dbdf39d0f9cddbe33aa56ea849e3eb701eee6f22fbcf1c4953f4719834a2a19e64aedc50c077905168053b12e75ebc2f551f576e167e4b9c8f6e0ba63a63f7be7cb0f122a920d0fba32631cfb76b94eacd2f8dc4d351c1f45a82ad796ea11ea90981ae854eb579ba2b6549633a691c70de8e84319c1732e01bbd82eaeb677c8cc2f6f672d0c96d4c864a803d3b57b60f8834e70c785c9c07215a82cb1a571a3f4662253544957e71bdddbb1e1e307a6a2f008e3ba91a03d72d118b013cbc85b5f900922f019848b0bacebc7bb58e226c493b11d0d737683552e43d55db65c9b677b9f3876cbe8c0d912bc58a0b1982e28e510165930429e39304f4cd8ca48d758a957bb89ab5edb1ec2427ef368c74a0321b9236ed319797d841a3b4ebdf60784b72f23003267193abbda981580b72d149c1e28b94ff6a1acfc6d7e8018c2c4c28551bb208a224f5d4936574f2acfb53d10d2825d5827b0457ca834297c6d98d60779a90f4813401e585953743dc324b9be1560cd928c62e87ae42de1c6a077f325c426a3cb3ed5366705fef2bf5cea7eab228407965b528b35f10d534a8f57b2ff6b73a997334a2273abd41e30462408e48c60a02fe237b8ec2e1b412b644d2079fd041eefaf3634600ed20c093798e58dd4f35c2ab56812ada96fa31b4d0f04c74c41a8f8b328df120a28acc3998082c83ef60c80a528daf63168fb447d61529898f3a1223c2195d0825c55c11f1ee946f530f30f441720f106b78ee0788f9f241d090e5e584c7f12ba3f6c6bae9945e29d2ddd42dbcce86b708d5be9b3207d83a2b2b5a8fadbe66a16b8064db5f978dbf3e2f0e70f064e528425bc1bc80d7320bdd21f3b165b5a9c572cc268337f77cd099965f11ca87f5571dc9dae47a96fa78321684697a2e34c3c02a3dd9995d9e89cb59e8874f7cc172169a5322b34b57dbd5d2604a61584ee42fc841c992c3abbdbb8b8b5a678f24d5b32be302ae6bc23cce14bf7cb84ee0d8261b1d2e2622608cd16d5921db0f21c9ead8873d1f3b844f4f20fe2ff8ddcbab17d252e7c4582534813c772c9353e873ecbde1e679de6a51b934f6477b0f6b6a8235c02eb20616b7c5385416fbef2ae8096182e2c6ebef279f54a879a4fb41cb8b20061073d2350411a7c84d1bd7ac2e807f5b8f71614d52b13f9b613b4efa4c4214ee407ec058daa0bf30837241c25a6ff725f150ea2c0877d8e5fb21dc880d1779e7365db2f3c442ca528b483ef64d795eac86fb826a6f009dbcd0a476459fd975d44cb5c458dd03c616ef844af50bacc1b76925c1b2ba3cd4fb0c7c241027e709474f7685588001aa55db4eb823d227c68f1a56f33a454daf0cc05b4d14ba0cf607154d4a4d1849a83d86aa3ffc23b7428524ad597fa2f60d204674428080b815cd56e409edad8fc985b457ab3ddc804b7a4863f34fdc6f1aafabcfba8da5b5cfc244270727305cbc3219c20ad24c1f94ec0400baa6e6f9b333487a42f01709caf4fb701fc83f5c6100fffaced6d7c6bcd5d601c047f91ea132fadb0cf84fb94cb9f3989de43cb27a49edefeab111dcf65bc556a74ae815b2e2f29dd049e71fcc0917dfe55a8018a8cc266d31edf485058070304ff4c35527b0d7533a6999433f19961b5aac3c4cd5ca789f2b2d4d74971107548eff83085e55c3adeaec608c109d1701b380f1ea4a44eb71614c5282a9c5c727a99036a2f55cba91f77e959e4d4ac612d2c4d4dcadc1d64851a43183e7db82ac48c27f2ecd11b7b5df02bd4df41b1e814be34afbde956fc236b5971b0c3881a23be5c27ff013e70ca6906ca4c2140d0b0eb10a67fb75163af49040d199d270afe943f5451b38ea68a2e3f8673cc212266046785352d50f589b0bdaf091071337f56e18605b91f9dcc679eda919a4992f26f4c93595cec64dc480e40c9b3332d203ef9d71a9c1c5fc5a5533469c240dcc6c5e0f2169c8dee2c7b95349a1afcf02cf0df9d5c1217022aefd78148c16f3436553066a1d75ccafff68ea199fcf8af768ac5d7be73605c699776f6163d78fc8ad699f4239e2c80570455b58b101ee012ebcf8c9cf4666c8fa6f63cb6adf227a1a6dd201f580a5f98745f8f44bd445487d41c571997d654c8df07ea7583390470425c64645bd9601aaeaaf7e045d41e034061f1ef7eb1193d25d9ca0625bae06fabbe76dd4cc619f2f79b73333dd6b004654ffba73bbd1644fae9c37d9af1fbbfd018d9e83a1e32a65c59a3bed616f6ca6033c8674984952d81bc4f0bee8eb1d25a2fee1e60fe9a519a2fa392461088d7e0264e3e4419d81db6a36b4cedf5a39fa334c59a3c283cfcfa674c732a125c7735358c354b24220d2dfc21e3d9d20efcb0f695ad5c01b3ff886c435ea6317b48a5e72a79d1750d8a74e2237d2926828dba55fd7c5d425f078aa5465bd292d3712957e51252b7f994f57652861c9e1d35baed5a196f6b497b5eef4694cda0f726eddc3fab2ccd3df622188380de1ef9ff4ba8e9b3b121d907adb6515b960881f46882e249c086a81ee0b77bf1c1b5ff56125f06a63e35d73df25e0456529835796305ddcca8f5d591ec518057dfaef3ec51a31ac7b4a032209803283125c5b687e7c305baf3b56c22d22138e570ce3bb4ff0fe1b1be45b7f076f36d0283f8a2603e822eef5cd1c90358647bc4e316c163f89695f59fb7b91111c3ccf863f8f437df07968928e2b26b2c80eb18945c8860eeba6aa98640add2cadcf542551d4155de36fc4ebce9de2b8e630ddda84923da853940776636514598c5abd6a05656b18791608988ad18046abf0f08acaf59a9622b6e719030e4653a2a107d731cbb1e1548397c2071963952e038080401d75c67448e06f7e7cd2474c3a270898d8584c513675d141d9b608e93dc9ed49283588e5ca6707650ddac6496428c00a1d8db259efc0b0c9ac57e243f14a2488a39dc56932525d6f88e49e16ba63d9c3426d808a8bca2ae097911387288ab7a3a3608e44c37518463d01addca117ec99ec17c26e0ff6062c772ddda30f992cd64584e2ea55f6ba576c4c09edba7b99ba32b36b3e43dd1b2a5fca3fae53157ea6fa8c440a8efd0a75b990eb4d04fc13f9b16e894b711b43e1b6e2f9f09d8d3c106ff9b85cc555d4d573b684b21f543ee21111400d37794813e4407f8f40299cc53f5f9f65d3bacb1c5aa126bb722392b09269edeee50b9a5c24e12515c0dea4f82096c04aaf5958de4612e95964ede397f4a8d4381ce5f8bf57232069830dba70c1b4fdab29fb4af73251615c4ffaf21b803bca0636ef9386fe5d322c72c6f2a1de783c87fb86b765616245d6ad3d2534fa127b8863e41f304eeb06274ec844c86237270e25c7dc4871116c799ce2ea3fc2eae8bd695f7d82c72b0d249bbd334b8e4e3db2d972d963a05753bde975c3af2edcb53fc7208617b08a1221f2377589f8f7cd9cebbe271f4d694b71326572da0e780974653d386138e7b3ffdc5b08f6b4005e88668dff9e61bd5130c0c5ccc63772e1da4aba23f165a93dcc6f6e85abf9519aa96c9074c4a5f55dbb5fc6682c08bc4f19cd6649f6420c69346dfc685a36a05494997d6fa439508ef469e630790d7e7a300f9b28f5c0fff919363f7276d59dfb684092495dd4b0af7b27ee131fdbda2e14b4c2851c7779fc524cdac5e8b5165d81ee50f3a2cc51ffd3334af7bd52bfcdbf1fbd8dd1c8f79049572d7e42a9c186c369d2639b039637414e56601d20ae895d84f709b6fe79fbaa42892b13754bcfb32570c58b5d8e75714d5cc750d941a82c73893c86bb829b45080efe674cf345e892248f0efc4fa1cc84cbfbb8f679815967169fbeb061f074fce909153a9dbdcce97e847562e5c45416c8f5f50e776f6e7e6dba77cc3e6161c9ed9c124b1a5c37d005118f3e6e96f7480928b75e658fdd8687bbd48fe4a4b0d1dd6d63b84dc7dd16d7db03862e5a6e3180f51ac8bfebc6afdc5f268633412c82a6f79f73c6da4086e4709cac45b2196e7521838715aa33e188a6"}) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(0xffffffffffffffff, 0x81785501, &(0x7f0000000040)=""/204) r2 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000001680)={&(0x7f0000001640)='f2fs_truncate_data_blocks_range\x00'}, 0x10) ioctl$BINDER_SET_MAX_THREADS(r1, 0x541b, 0x0) sendmsg$RDMA_NLDEV_CMD_STAT_SET(r2, &(0x7f00000017c0)={&(0x7f0000001700)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000001780)={&(0x7f0000001740)={0x18, 0x1410, 0x200, 0x70bd28, 0x35dfdc02, "", [@RDMA_NLDEV_ATTR_STAT_RES={0x8}]}, 0x18}, 0x1, 0x0, 0x0, 0x1}, 0x2) r3 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f00000016c0)={0x2}) [ 2104.945119][T26415] binder: 26410:26415 ioctl 40046210 0 returned -22 02:35:07 executing program 0: bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x1d, 0x1, &(0x7f0000000080)=@raw=[@generic], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f00000002c0)={0x2, 0x1, 0x3ff, 0x10001}, 0x10, 0xffffffffffffffff}, 0x78) [ 2105.008475][T26417] binder: 26410:26417 ioctl 40046210 0 returned -22 02:35:07 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN_UNNAMED(0x11, &(0x7f0000000040), 0x10) [ 2105.129748][T26424] binder: 26421:26424 ioctl 541b 0 returned -22 02:35:07 executing program 4: sendmsg$RDMA_NLDEV_CMD_PORT_GET(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000240)={&(0x7f0000000100)={0x20, 0x1405, 0x1, 0x70bd2b, 0x25dfdbfc, "", [{{0x8, 0x1, 0x1}, {0x8, 0x3, 0x1}}]}, 0x20}, 0x1, 0x0, 0x0, 0x40008c4}, 0x800) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000480)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x10, 0x0, @in={0x2, 0x0, @multicast2}}}, 0x90) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {&(0x7f0000000000), 0x3, r1, 0x1c, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r2, 0x5421, 0x400000) 02:35:07 executing program 2: bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x1d, 0x0, &(0x7f0000000080), &(0x7f00000000c0)='syzkaller\x00', 0x0, 0xa4, &(0x7f0000000100)=""/164, 0x41100, 0x12, [], 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000280)={0x5, 0x1}, 0x8, 0x10, &(0x7f00000002c0)={0x2, 0x1, 0x3ff, 0x10001}, 0x10, 0xffffffffffffffff}, 0x78) [ 2105.169925][T26424] binder: 26421:26424 ioctl c0306201 0 returned -14 [ 2105.225368][T26427] binder: 26421:26427 ioctl 541b 0 returned -22 [ 2105.256116][T26427] binder: 26421:26427 ioctl c0306201 0 returned -14 [ 2105.285696][T26432] binder: 26429:26432 ioctl 40046210 0 returned -22 [ 2105.315379][T26432] binder: 26429:26432 ioctl 40046210 0 returned -22 02:35:07 executing program 3: openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/qrtr-tun\x00', 0x20000) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) 02:35:07 executing program 0: bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x1d, 0x1, &(0x7f0000000080)=@raw=[@generic], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff}, 0x78) 02:35:07 executing program 1: ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x541b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000100)={0x10, 0x0, &(0x7f0000000000)=[@request_death], 0x95, 0x0, &(0x7f0000000040)="f2ec644b51140158f701ffece889637eb12645ce126d1291bffc2f0b20da48d014a0b9ad4f9641b930c9bbe85d75265ebf8eaa7c967dad329bc2a4172c72e82c0737dcc7d05f0f2911abb0409c9efb4bf47865fb65a40e239b95ae60afdb4645c4368d63f0068740d71686114ad84dc01e995ada9ee3ce0c284eefd20691b47c23ed85769f2145f35c2a1238481808bafe5af5855d"}) 02:35:07 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$vim2m_VIDIOC_QUERYBUF(0xffffffffffffffff, 0xc0585609, &(0x7f0000000040)={0x0, 0x2, 0x4, 0x20, 0x0, {0x0, 0x2710}, {0x1, 0x8, 0x1, 0x0, 0x1, 0x1, 'FdR6'}, 0x1, 0x2, @userptr=0x2, 0x3}) 02:35:07 executing program 2: bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x1d, 0x0, &(0x7f0000000080), &(0x7f00000000c0)='syzkaller\x00', 0x0, 0xa4, &(0x7f0000000100)=""/164, 0x41100, 0x12, [], 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000280)={0x5, 0x1}, 0x8, 0x10, &(0x7f00000002c0)={0x2, 0x1, 0x3ff, 0x10001}, 0x10, 0xffffffffffffffff}, 0x78) 02:35:07 executing program 4: openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(0xffffffffffffffff, 0x5421, 0x8) [ 2105.667097][T26440] binder: 26403:26440 ioctl c0306201 0 returned -14 [ 2105.757870][T26446] binder: 26442:26446 ioctl 40046210 0 returned -22 [ 2105.778953][T26446] binder: 26442:26446 ioctl 40046210 0 returned -22 02:35:07 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r0, 0xc018620c, &(0x7f0000000080)) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) 02:35:07 executing program 2: bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x1d, 0x0, &(0x7f0000000080), &(0x7f00000000c0)='syzkaller\x00', 0x0, 0xa4, &(0x7f0000000100)=""/164, 0x41100, 0x12, [], 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000280)={0x5, 0x1}, 0x8, 0x10, &(0x7f00000002c0)={0x2, 0x1, 0x3ff, 0x10001}, 0x10, 0xffffffffffffffff}, 0x78) 02:35:07 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0xca800, 0x0) ioctl$SG_SET_TIMEOUT(r0, 0x2201, &(0x7f0000000000)=0x1) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000500)={0x0, 0x18, 0xfa00, {0x4, &(0x7f00000004c0), 0x106, 0x3}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x2, 0x9}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f00000002c0)={0x14, 0x88, 0xfa00, {r3, 0x30, 0x0, @in={0x2, 0x4e24, @multicast1}}}, 0x90) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0xc, 0x0, &(0x7f00000001c0)=ANY=[], 0xa1, 0x0, &(0x7f0000000080)="1c5cad648f5b5914ceb21ea2aaba3ec87ea6d103d0b46bf0d4c6a976e94d5d14d364216b35d60b3ae8dff5495d879fb7b1cf6b376e1fac33c911aa964bf4f4abcb2498230291f65f22da947407583a9b222a2b4f345b51fd478dea18c6da0d18d580e254caa444b5e29c69f83375b9be36fcf5397d454bec55447391b98d342dd44e23b37a0adc915cdb11e9d95215a1ae3dc747e737fdffa6093156e99d225659"}) ioctl$TIOCSTI(r0, 0x5421, 0x400000) 02:35:07 executing program 0: sendmsg$RDMA_NLDEV_CMD_PORT_GET(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000240)={&(0x7f0000000100)={0x20, 0x1405, 0x1, 0x70bd2b, 0x25dfdbfc, "", [{{0x8, 0x1, 0x1}, {0x8, 0x3, 0x1}}]}, 0x20}, 0x1, 0x0, 0x0, 0x40008c4}, 0x800) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000480)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x10, 0x0, @in={0x2, 0x0, @multicast2}}}, 0x90) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {&(0x7f0000000000), 0x3, r1, 0x1c, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r2, 0x5421, 0x400000) 02:35:07 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x3) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(0xffffffffffffffff, 0x40045532, &(0x7f0000000040)=0x7) 02:35:08 executing program 5: ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046210, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) r1 = getuid() read$FUSE(0xffffffffffffffff, &(0x7f0000000980)={0x2020, 0x0, 0x0, 0x0}, 0xfffffffffffffe4a) write$FUSE_DIRENTPLUS(0xffffffffffffffff, &(0x7f0000000040)={0x2a8, 0xffffffffffffffda, 0x0, [{{0x0, 0x0, 0xffff, 0x1000, 0x2, 0x9, {0x2, 0x400, 0xbb, 0x200, 0x9e96, 0x1f, 0x3, 0x1000, 0xe03, 0x6000, 0xfd7f, r1, 0xee01, 0x9, 0x8b}}, {0x6, 0x2, 0x3, 0x7fff, '+}*'}}, {{0x3, 0x3, 0xffff, 0x7ff, 0x81, 0x7be, {0x0, 0x4, 0x19b5, 0x1, 0x414b, 0x1, 0x1, 0x7, 0xd956, 0x8000, 0x2, r2, 0xffffffffffffffff, 0x400}}, {0x4, 0x80000001, 0xd, 0x15ac, '/dev/binder#\x00'}}, {{0x4, 0x1, 0x3, 0x1000, 0x10001, 0xfffff000, {0x3, 0xfffffffffffffff8, 0x2, 0x605e, 0x4, 0x0, 0x80000000, 0x9, 0x0, 0x2000, 0x81, 0xee00, 0xee01, 0x0, 0x100}}, {0x5, 0x8001, 0xd, 0x9, '/dev/binder#\x00'}}, {{0x1, 0x3, 0x1, 0xeae, 0x20, 0x8, {0x4, 0xc8b, 0x1000, 0x3, 0x1000, 0x2, 0x5, 0x1ff, 0x3, 0x2000, 0x0, 0xee01, 0xee01, 0x1000, 0x8}}, {0x3, 0xffffffffffffff01, 0xd, 0x7, '/dev/binder#\x00'}}]}, 0x2a8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f0000000000)=0x8a37) r3 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/qrtr-tun\x00', 0x14800) write$qrtrtun(r3, &(0x7f0000000380)="7ea811c922c6429972fcb0a3eb7bf4f8cf0258dd4fd51acb981d53e6606f7b730a78a36c3423775eba99cca38ac3f845ef4f1792b7cb8cf6784c967e50d0595cf6a020d87a469ab082d67a4a5d5d444d31bea1af07334b8a770c6f97a72f263f7cdea34806804f826a3bd23fc3d331dd299c3f6846e12e85de9e049a7d49d467d292c35ad6352be61e4a29eee8e0038b28f2e290908f58bc84e733e7dd918e39eb00bc095e54a54955c4657158e7597e57e267b97d4c8a102cb942fc4e6f84a5a5aa355179e086ea919fc510762defd96157cad685ea006b", 0xd8) syz_open_dev$binderN(&(0x7f0000000300)='/dev/binder#\x00', 0x0, 0x2) [ 2106.013728][T26461] binder: 26455:26461 ioctl c018620c 20000080 returned -1 [ 2106.065061][T26461] binder: 26455:26461 ioctl c018620c 20000080 returned -1 [ 2106.077763][T26466] binder: 26460:26466 ioctl c0306201 0 returned -14 02:35:08 executing program 0: sendmsg$RDMA_NLDEV_CMD_PORT_GET(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000240)={&(0x7f0000000100)={0x20, 0x1405, 0x1, 0x70bd2b, 0x25dfdbfc, "", [{{0x8, 0x1, 0x1}, {0x8, 0x3, 0x1}}]}, 0x20}, 0x1, 0x0, 0x0, 0x40008c4}, 0x800) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000480)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x10, 0x0, @in={0x2, 0x0, @multicast2}}}, 0x90) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {&(0x7f0000000000), 0x3, r1, 0x1c, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r2, 0x5421, 0x400000) 02:35:08 executing program 2: bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x1d, 0x1, &(0x7f0000000080)=@raw=[@generic={0x0, 0x0, 0x0, 0x1ff, 0x6}], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0xa4, &(0x7f0000000100)=""/164, 0x41100, 0x12, [], 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000280)={0x5, 0x1}, 0x8, 0x10, &(0x7f00000002c0)={0x2, 0x1, 0x3ff, 0x10001}, 0x10, 0xffffffffffffffff}, 0x78) 02:35:08 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) syz_open_dev$tty20(0xc, 0x4, 0x0) 02:35:08 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x313c01, 0x0) ioctl$TIOCSTI(r0, 0x5421, 0x400000) ioctl$TIOCSSOFTCAR(r0, 0x541a, &(0x7f0000000000)=0x5) [ 2106.155089][T26470] binder: 26460:26470 ioctl c0306201 0 returned -14 02:35:08 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) 02:35:08 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000040)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_BMAP(r1, &(0x7f0000002080)={0x18, 0x0, r2, {0x4}}, 0x18) [ 2106.347962][T26482] binder: 26475:26482 ioctl 541b 0 returned -22 02:35:08 executing program 2: bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x1d, 0x1, &(0x7f0000000080)=@raw=[@generic={0x0, 0x0, 0x0, 0x0, 0x6}], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0xa4, &(0x7f0000000100)=""/164, 0x41100, 0x12, [], 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000280)={0x5, 0x1}, 0x8, 0x10, &(0x7f00000002c0)={0x2, 0x1, 0x3ff, 0x10001}, 0x10, 0xffffffffffffffff}, 0x78) 02:35:08 executing program 0: sendmsg$RDMA_NLDEV_CMD_PORT_GET(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000240)={&(0x7f0000000100)={0x20, 0x1405, 0x1, 0x70bd2b, 0x25dfdbfc, "", [{{0x8, 0x1, 0x1}, {0x8, 0x3, 0x1}}]}, 0x20}, 0x1, 0x0, 0x0, 0x40008c4}, 0x800) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000480)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x10, 0x0, @in={0x2, 0x0, @multicast2}}}, 0x90) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {&(0x7f0000000000), 0x3, r1, 0x1c, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r2, 0x5421, 0x400000) [ 2106.404348][T26482] binder: 26475:26482 ioctl 541b 0 returned -22 02:35:08 executing program 4: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r0, 0x4b6b, 0x0) ioctl$TIOCGSERIAL(r0, 0x541e, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=""/191}) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r1, 0x5421, 0x400000) r2 = syz_open_dev$tty1(0xc, 0x4, 0x3) ioctl$GIO_FONTX(r2, 0x4b6b, 0x0) ioctl$GIO_CMAP(r0, 0x4b70, &(0x7f0000000180)) ioctl$TIOCSTI(r2, 0x5412, 0x100) 02:35:08 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) setsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(r1, 0x84, 0xc, &(0x7f0000000080)=0xcb, 0x4) socketpair(0x28, 0x6, 0x6, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$RDMA_NLDEV_CMD_DELLINK(r2, &(0x7f0000000200)={&(0x7f0000000100), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x20, 0x1404, 0x802, 0x100, 0x25dfdbfc, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40090}, 0x804) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r0, 0xc018620c, &(0x7f0000000040)) [ 2106.463096][T26487] binder: 26485:26487 ioctl 40046210 0 returned -22 02:35:08 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) [ 2106.516863][T26487] binder: 26485:26487 ioctl 40046210 0 returned -22 02:35:08 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x242000, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f0000000080)=0x3) syz_init_net_socket$nl_rdma(0xffffffffffffffff, 0x3, 0x14) 02:35:08 executing program 2: bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x1d, 0x1, &(0x7f0000000080)=@raw=[@generic], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0xa4, &(0x7f0000000100)=""/164, 0x41100, 0x12, [], 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000280)={0x5, 0x1}, 0x8, 0x10, &(0x7f00000002c0)={0x2, 0x1, 0x3ff, 0x10001}, 0x10, 0xffffffffffffffff}, 0x78) 02:35:08 executing program 0: sendmsg$RDMA_NLDEV_CMD_PORT_GET(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000240)={&(0x7f0000000100)={0x20, 0x1405, 0x1, 0x70bd2b, 0x25dfdbfc, "", [{{0x8, 0x1, 0x1}, {0x8, 0x3, 0x1}}]}, 0x20}, 0x1, 0x0, 0x0, 0x40008c4}, 0x800) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000480)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x10, 0x0, @in={0x2, 0x0, @multicast2}}}, 0x90) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {&(0x7f0000000000), 0x3, r1, 0x1c, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) [ 2106.668010][T26500] binder: 26495:26500 ioctl c018620c 20000040 returned -1 [ 2106.701161][T26501] binder: 26498:26501 ioctl 541b 0 returned -22 02:35:08 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5421, 0x400000) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r0, 0x89f4, &(0x7f00000002c0)={'syztnl0\x00', &(0x7f0000000240)={'ip6gre0\x00', 0x0, 0x4, 0x3, 0x20, 0x2, 0x1e, @initdev={0xfe, 0x88, [], 0x0, 0x0}, @remote, 0x8000, 0x80, 0x7, 0x8}}) sendmsg$nl_route(r0, &(0x7f0000000380)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=@bridge_setlink={0x3c, 0x13, 0x100, 0x70bd26, 0x25dfdbfe, {0x7, 0x0, 0x0, r1, 0x10980, 0x1}, [@IFLA_PHYS_SWITCH_ID={0x19, 0x24, "18ecdf5f03d4bd8243719ef9ea925490e9754a49f3"}]}, 0x3c}, 0x1, 0x0, 0x0, 0x10}, 0x20040040) 02:35:08 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) setsockopt$inet_sctp_SCTP_AUTH_CHUNK(0xffffffffffffffff, 0x84, 0x15, &(0x7f0000000040)={0x1}, 0x1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) write$FUSE_DIRENT(0xffffffffffffffff, &(0x7f0000000080)={0x38, 0xfffffffffffffff5, 0x0, [{0x0, 0x100000001, 0xd, 0x100, '/dev/binder#\x00'}]}, 0x38) 02:35:08 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x100a}) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x987) syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) 02:35:08 executing program 2: bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x1d, 0x1, &(0x7f0000000080)=@raw=[@generic], 0x0, 0x0, 0xa4, &(0x7f0000000100)=""/164, 0x41100, 0x12, [], 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000280)={0x5, 0x1}, 0x8, 0x10, &(0x7f00000002c0)={0x2, 0x1, 0x3ff, 0x10001}, 0x10, 0xffffffffffffffff}, 0x78) [ 2106.844355][T26507] binder: 26504:26507 ioctl 40046210 0 returned -22 [ 2106.867258][T26507] binder: 26504:26507 ioctl 40046210 0 returned -22 02:35:09 executing program 0: sendmsg$RDMA_NLDEV_CMD_PORT_GET(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000240)={&(0x7f0000000100)={0x20, 0x1405, 0x1, 0x70bd2b, 0x25dfdbfc, "", [{{0x8, 0x1, 0x1}, {0x8, 0x3, 0x1}}]}, 0x20}, 0x1, 0x0, 0x0, 0x40008c4}, 0x800) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000480)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x10, 0x0, @in={0x2, 0x0, @multicast2}}}, 0x90) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {&(0x7f0000000000), 0x3, r1, 0x1c, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) 02:35:09 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) [ 2106.984784][T26515] binder: 26513:26515 ioctl 541b 0 returned -22 02:35:09 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x442f40, 0x0) ioctl$TIOCSTI(r0, 0x5421, 0x400000) [ 2107.036453][T26518] binder: 26513:26518 ioctl 541b 0 returned -22 02:35:09 executing program 2: bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x1d, 0x1, &(0x7f0000000080)=@raw=[@generic], 0x0, 0x0, 0xa4, &(0x7f0000000100)=""/164, 0x41100, 0x12, [], 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000280)={0x5, 0x1}, 0x8, 0x10, &(0x7f00000002c0)={0x2, 0x1, 0x3ff, 0x10001}, 0x10, 0xffffffffffffffff}, 0x78) 02:35:09 executing program 0: sendmsg$RDMA_NLDEV_CMD_PORT_GET(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000240)={&(0x7f0000000100)={0x20, 0x1405, 0x1, 0x70bd2b, 0x25dfdbfc, "", [{{0x8, 0x1, 0x1}, {0x8, 0x3, 0x1}}]}, 0x20}, 0x1, 0x0, 0x0, 0x40008c4}, 0x800) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000480)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x10, 0x0, @in={0x2, 0x0, @multicast2}}}, 0x90) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {&(0x7f0000000000), 0x3, 0xffffffffffffffff, 0x1c, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) 02:35:09 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) openat$vim2m(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vim2m\x00', 0x2, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCPKT(r1, 0x5420, &(0x7f0000000080)=0x1) ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, 0xffffffffffff93b4) getsockopt$inet_sctp_SCTP_NODELAY(0xffffffffffffffff, 0x84, 0x3, &(0x7f00000000c0), &(0x7f0000000100)=0x4) [ 2107.180642][T26526] binder: 26523:26526 ioctl c0306201 0 returned -14 [ 2107.192553][T26527] binder: 26524:26527 ioctl 40046210 0 returned -22 [ 2107.220277][T26528] binder: 26523:26528 ioctl c0306201 0 returned -14 02:35:09 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x622284, 0x0) read$FUSE(r0, &(0x7f0000000180)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INTERRUPT(r0, &(0x7f0000000040)={0x10, 0xfffffffffffffffe, r1}, 0x10) ioctl$TIOCSTI(r0, 0x5421, 0x400000) r2 = syz_open_dev$ptys(0xc, 0x3, 0x1) ioctl$TIOCGLCKTRMIOS(r2, 0x5456, &(0x7f0000000000)={0x1bb, 0x7, 0xffffffff, 0x3, 0xc, "5b598aece2fa80e700496b258eca718740e5a1"}) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_NOTIFY(r4, &(0x7f00000001c0)={0xf, 0x8, 0xfa00, {r5}}, 0x10) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000080)={0x14, 0x88, 0xfa00, {r5, 0x1c, 0x0, @in={0x2, 0x4e21, @multicast1}}}, 0x90) 02:35:09 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0xc02) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) 02:35:09 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) [ 2107.376266][T26534] binder: 26532:26534 ioctl 541b 0 returned -22 02:35:09 executing program 2: bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x1d, 0x1, &(0x7f0000000080)=@raw=[@generic], 0x0, 0x0, 0xa4, &(0x7f0000000100)=""/164, 0x41100, 0x12, [], 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000280)={0x5, 0x1}, 0x8, 0x10, &(0x7f00000002c0)={0x2, 0x1, 0x3ff, 0x10001}, 0x10, 0xffffffffffffffff}, 0x78) 02:35:09 executing program 0: sendmsg$RDMA_NLDEV_CMD_PORT_GET(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000240)={&(0x7f0000000100)={0x20, 0x1405, 0x1, 0x70bd2b, 0x25dfdbfc, "", [{{0x8, 0x1, 0x1}, {0x8, 0x3, 0x1}}]}, 0x20}, 0x1, 0x0, 0x0, 0x40008c4}, 0x800) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000480)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x10, 0x0, @in={0x2, 0x0, @multicast2}}}, 0x90) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {&(0x7f0000000000), 0x3, 0xffffffffffffffff, 0x1c, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) [ 2107.443737][T26538] binder: 26532:26538 ioctl 541b 0 returned -22 02:35:09 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5421, 0x400000) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x400000, 0x0) ioctl$GIO_SCRNMAP(r0, 0x4b40, &(0x7f0000000180)=""/235) [ 2107.503600][T26543] binder: 26541:26543 ioctl 40046210 0 returned -22 02:35:09 executing program 1: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x1000) syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x680000, 0x0) ioctl$BINDER_SET_MAX_THREADS(r2, 0x541b, 0x0) 02:35:09 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) 02:35:09 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) 02:35:09 executing program 0: sendmsg$RDMA_NLDEV_CMD_PORT_GET(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000240)={&(0x7f0000000100)={0x20, 0x1405, 0x1, 0x70bd2b, 0x25dfdbfc, "", [{{0x8, 0x1, 0x1}, {0x8, 0x3, 0x1}}]}, 0x20}, 0x1, 0x0, 0x0, 0x40008c4}, 0x800) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000480)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x10, 0x0, @in={0x2, 0x0, @multicast2}}}, 0x90) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {&(0x7f0000000000), 0x3, 0xffffffffffffffff, 0x1c, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) 02:35:09 executing program 2: bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x1d, 0x1, &(0x7f0000000080)=@raw=[@generic], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x12, [], 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000280)={0x5, 0x1}, 0x8, 0x10, &(0x7f00000002c0)={0x2, 0x1, 0x3ff, 0x10001}, 0x10, 0xffffffffffffffff}, 0x78) 02:35:09 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x12000, 0x0) ioctl$TIOCSTI(r0, 0x5421, 0x400000) read$FUSE(r0, &(0x7f0000000180)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) read$FUSE(r0, &(0x7f00000021c0)={0x2020, 0x0, 0x0, 0x0}, 0x2020) getgroups(0x5, &(0x7f0000000000)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xee01]) read$FUSE(r0, &(0x7f0000004200)={0x2020, 0x0, 0x0, 0x0}, 0x2020) getgroups(0x3, &(0x7f0000000040)=[0x0, 0xee01, 0xee01]) r6 = geteuid() write$FUSE_DIRENTPLUS(r0, &(0x7f0000006240)={0x6d0, 0x0, 0x0, [{{0x5, 0x3, 0xc9a6, 0x7, 0xfffff022, 0x709, {0x2, 0x5, 0x10000, 0x2, 0x72, 0x7, 0x6, 0x8001, 0x7fff, 0x1000, 0x40, 0x0, r1, 0x5, 0x81}}, {0x6, 0xa533, 0x12, 0xffff, '/proc/capi/capi20\x00'}}, {{0x4, 0x0, 0x3f, 0x3e, 0x5, 0x1, {0x0, 0xffffffff80000000, 0x2, 0x9, 0x1, 0xffff, 0x10001, 0x40, 0x8, 0x1000, 0x2, r2, 0xee00, 0x3, 0x80000000}}, {0x6, 0x7ff, 0x12, 0x215, '/proc/capi/capi20\x00'}}, {{0x3, 0x0, 0x4, 0xffffffffffff8001, 0x7fffffff, 0x40, {0x2, 0x8, 0x5, 0x20, 0x7fffffff, 0x4, 0x4, 0x3, 0x6, 0x4000, 0x3, 0x0, r3, 0x3ff, 0xfffffff8}}, {0x5, 0x401, 0x12, 0x6, '/proc/capi/capi20\x00'}}, {{0x6, 0x3, 0x8, 0xf69, 0xfff, 0x80000001, {0x3, 0x100000000, 0xffffffff, 0x100, 0xffffffffffffff9d, 0x7, 0x2, 0x38e5, 0xfffffffc, 0x1000, 0xfffffffe, r4, r5, 0x9, 0x7}}, {0x6, 0x9, 0x12, 0x1, '/proc/capi/capi20\x00'}}, {{0x2, 0x2, 0x9, 0xfa00, 0x2fe80000, 0x0, {0x5, 0x2, 0x16, 0x8, 0x8af4, 0x2, 0x4, 0xefda, 0x4, 0xa000, 0x9, 0xee01, 0xee01, 0x6, 0x4}}, {0x6, 0x0, 0x12, 0x7, '/proc/capi/capi20\x00'}}, {{0x6, 0x0, 0xfffffffffffff252, 0x7ff, 0x20, 0x5, {0x3, 0xfff, 0x1f, 0x100000001, 0x0, 0x3, 0x15, 0xd38d, 0x3, 0x8000, 0x6, 0x0, 0xee01, 0x1, 0x3ff}}, {0x4, 0x7, 0x12, 0x8000, '/proc/capi/capi20\x00'}}, {{0x6, 0x3, 0x3, 0xffffffff, 0x1, 0x5600, {0x2, 0x1, 0x81, 0x1, 0x20, 0x8c, 0x8000, 0x401, 0x1, 0x4000, 0x7fffffff, 0xee01, 0xee00, 0x20, 0x2}}, {0x2, 0x1, 0x12, 0x1, '/proc/capi/capi20\x00'}}, {{0x6, 0x1, 0x6, 0xfffffffffffffffe, 0x5eb, 0x4, {0x1, 0x5, 0x5b3, 0x7fff, 0x3ff, 0x8, 0x0, 0x1ff, 0x8000, 0xa000, 0x6, r6, 0xee00, 0x7, 0x8001}}, {0x1, 0x800, 0x12, 0x9d, '/proc/capi/capi20\x00'}}, {{0x5, 0x3, 0x80000000, 0x7, 0x7f, 0x80000000, {0x6, 0x80000000, 0x6, 0x0, 0x1, 0x0, 0x3, 0x3, 0x6, 0x4000, 0x0, 0xffffffffffffffff, 0x0, 0x2, 0x4}}, {0x6, 0x4, 0x4, 0x4, 'w,\'^'}}, {{0x7, 0x2, 0x758, 0x8, 0xc, 0x5, {0x6, 0x0, 0x8, 0xffff, 0x6, 0x200000000, 0x1000, 0x20, 0x5, 0x6000, 0x1, 0xee00, 0xffffffffffffffff, 0x3f, 0x1}}, {0x2, 0x0, 0x1, 0x8, 'Z'}}]}, 0x6d0) [ 2107.771165][T26557] binder: 26553:26557 ioctl c0306201 0 returned -14 [ 2107.804291][T26557] binder: 26553:26557 ioctl c0306201 0 returned -14 [ 2107.839561][T26560] binder: 26556:26560 ioctl 40046210 0 returned -22 [ 2107.864940][T26557] binder: 26553:26557 ioctl c0306201 0 returned -14 [ 2107.889957][T26563] binder: 26553:26563 ioctl c0306201 0 returned -14 02:35:10 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$PIO_SCRNMAP(0xffffffffffffffff, 0x4b41, &(0x7f0000000040)="f11e06ec3084b4b1b747654ea57eb9ab5e") ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) 02:35:10 executing program 0: sendmsg$RDMA_NLDEV_CMD_PORT_GET(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000240)={&(0x7f0000000100)={0x20, 0x1405, 0x1, 0x70bd2b, 0x25dfdbfc, "", [{{0x8, 0x1, 0x1}, {0x8, 0x3, 0x1}}]}, 0x20}, 0x1, 0x0, 0x0, 0x40008c4}, 0x800) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {&(0x7f0000000000), 0x3, r1, 0x1c, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) 02:35:10 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) 02:35:10 executing program 2: bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x1d, 0x1, &(0x7f0000000080)=@raw=[@generic], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x12, [], 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000280)={0x5, 0x1}, 0x8, 0x10, &(0x7f00000002c0)={0x2, 0x1, 0x3ff, 0x10001}, 0x10, 0xffffffffffffffff}, 0x78) 02:35:10 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) r1 = socket$phonet_pipe(0x23, 0x5, 0x2) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r2, 0x89f4, &(0x7f0000002180)={'sit0\x00', &(0x7f0000002100)={'ip6_vti0\x00', 0x0, 0x29, 0x3, 0x1, 0x7, 0x14, @initdev={0xfe, 0x88, [], 0x0, 0x0}, @rand_addr=' \x01\x00', 0x700, 0x7800, 0x4, 0x101}}) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f00000022c0)=0x7fffffff) accept$phonet_pipe(r1, 0x0, 0x0) connect$phonet_pipe(r1, &(0x7f0000000040)={0x23, 0x7, 0x1, 0x6}, 0x10) read$FUSE(0xffffffffffffffff, &(0x7f0000000080)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_BMAP(r0, &(0x7f00000020c0)={0x18, 0x0, r3, {0x8}}, 0x18) sendmsg$RDMA_NLDEV_CMD_DELLINK(0xffffffffffffffff, &(0x7f0000002280)={&(0x7f00000021c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000002240)={&(0x7f0000002200)={0x30, 0x1404, 0x8, 0x70bd26, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x30}, 0x1, 0x0, 0x0, 0x4004080}, 0x4000) 02:35:10 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5421, 0x400000) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r2, 0xc0405519, 0x0) read$FUSE(r0, &(0x7f0000000180)={0x2020, 0x0, 0x0}, 0x2020) r4 = getpgid(0xffffffffffffffff) write$FUSE_LK(r2, &(0x7f0000000080)={0x28, 0x0, r3, {{0x7, 0x401, 0x2, r4}}}, 0x28) ioctl$GIO_FONTX(r1, 0x4b6b, 0x0) r5 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r5, 0x4b6b, 0x0) ioctl$GIO_CMAP(r5, 0x4b70, &(0x7f00000000c0)) [ 2108.155562][T26579] binder: 26573:26579 ioctl c0306201 0 returned -14 [ 2108.184252][T26582] binder: 26575:26582 ioctl 541b 0 returned -22 [ 2108.194325][T26579] binder: 26573:26579 ioctl 40046210 0 returned -22 02:35:10 executing program 0: sendmsg$RDMA_NLDEV_CMD_PORT_GET(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000240)={&(0x7f0000000100)={0x20, 0x1405, 0x1, 0x70bd2b, 0x25dfdbfc, "", [{{0x8, 0x1, 0x1}, {0x8, 0x3, 0x1}}]}, 0x20}, 0x1, 0x0, 0x0, 0x40008c4}, 0x800) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {&(0x7f0000000000), 0x3, r0, 0x1c, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) 02:35:10 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x400100, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f0000000280)={0x5, 0x10, 0xfa00, {&(0x7f0000000080), 0xffffffffffffffff, 0x2}}, 0x18) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x5460, 0x0) accept4(r0, &(0x7f00000002c0)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @initdev}}}, &(0x7f0000000340)=0x80, 0x800) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r2, 0x4b6b, 0x0) ioctl$TIOCSPTLCK(r2, 0x40045431, &(0x7f0000000380)=0x1) 02:35:10 executing program 2: bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x1d, 0x1, &(0x7f0000000080)=@raw=[@generic], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000280)={0x5, 0x1}, 0x8, 0x10, &(0x7f00000002c0)={0x2, 0x1, 0x3ff, 0x10001}, 0x10, 0xffffffffffffffff}, 0x78) [ 2108.231521][T26582] binder: 26575:26582 ioctl 541b 0 returned -22 [ 2108.237873][T26579] binder: 26573:26579 ioctl c0306201 0 returned -14 [ 2108.268930][T26586] binder: 26573:26586 ioctl 40046210 0 returned -22 02:35:10 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) getsockopt$inet_sctp_SCTP_AUTO_ASCONF(0xffffffffffffffff, 0x84, 0x1e, &(0x7f0000000040), &(0x7f0000000080)=0x4) r1 = accept(0xffffffffffffffff, &(0x7f00000000c0)=@pppoe={0x18, 0x0, {0x0, @link_local}}, &(0x7f0000000140)=0x80) getsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(r1, 0x84, 0xc, &(0x7f0000000180), &(0x7f00000001c0)=0x4) 02:35:10 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5421, 0x400000) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r1, 0x4b6b, 0x0) ioctl$VT_RESIZE(r1, 0x5609, &(0x7f0000000000)={0x7, 0x400, 0x8c}) 02:35:10 executing program 5: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) syz_open_dev$sndctrl(&(0x7f00000000c0)='/dev/snd/controlC#\x00', 0xffffffff, 0x400) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100)='/dev/hwrng\x00', 0x0, 0x0) syz_open_dev$sndctrl(&(0x7f0000000180)='/dev/snd/controlC#\x00', 0x8, 0x800) openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/capi/capi20\x00', 0x200c00, 0x0) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r2, 0xc0405519, 0x0) r3 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000200)='/proc/capi/capi20\x00', 0x240000, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r3, 0xc0405519, 0x0) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) ioctl$FUSE_DEV_IOC_CLONE(r0, 0x8004e500, &(0x7f0000000080)=r4) r5 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_SET_MAX_THREADS(r5, 0x40046210, 0x0) 02:35:10 executing program 0: sendmsg$RDMA_NLDEV_CMD_PORT_GET(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000240)={&(0x7f0000000100)={0x20, 0x1405, 0x1, 0x70bd2b, 0x25dfdbfc, "", [{{0x8, 0x1, 0x1}, {0x8, 0x3, 0x1}}]}, 0x20}, 0x1, 0x0, 0x0, 0x40008c4}, 0x800) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {&(0x7f0000000000), 0x3, r0, 0x1c, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) 02:35:10 executing program 2: bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x1d, 0x1, &(0x7f0000000080)=@raw=[@generic], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f00000002c0)={0x2, 0x1, 0x3ff, 0x10001}, 0x10, 0xffffffffffffffff}, 0x78) 02:35:10 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)={0x3}) [ 2108.517789][T26599] binder: 26597:26599 ioctl 541b 0 returned -22 [ 2108.543557][T26599] binder: 26597:26599 ioctl 541b 0 returned -22 02:35:10 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) [ 2108.658518][T26607] binder: 26602:26607 ioctl 40046210 0 returned -22 02:35:10 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5421, 0x400000) socket$inet6_udplite(0xa, 0x2, 0x88) [ 2108.717680][T26612] binder: 26602:26612 ioctl 40046210 0 returned -22 02:35:10 executing program 2: bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x1d, 0x1, &(0x7f0000000080)=@raw=[@generic], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff}, 0x78) 02:35:10 executing program 0: sendmsg$RDMA_NLDEV_CMD_PORT_GET(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000240)={&(0x7f0000000100)={0x20, 0x1405, 0x1, 0x70bd2b, 0x25dfdbfc, "", [{{0x8, 0x1, 0x1}, {0x8, 0x3, 0x1}}]}, 0x20}, 0x1, 0x0, 0x0, 0x40008c4}, 0x800) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {&(0x7f0000000000), 0x3, r0, 0x1c, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) 02:35:10 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_NOTIFY(r1, &(0x7f00000001c0)={0xf, 0x8, 0xfa00, {r2}}, 0x10) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_MIGRATE_ID(0xffffffffffffffff, &(0x7f00000000c0)={0x12, 0x10, 0xfa00, {&(0x7f0000000040), r2, r3}}, 0x18) r4 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0xa, 0x4e23, 0x0, @remote, 0x1}, {0xa, 0x4e24, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x80}, r2, 0x6}}, 0x48) ioctl$BINDER_SET_MAX_THREADS(r4, 0x40046210, 0x0) 02:35:10 executing program 3: ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x5460, 0x0) [ 2108.831940][T26617] binder: 26614:26617 ioctl 541b 0 returned -22 02:35:11 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x5010c2, 0x0) setrlimit(0x3, &(0x7f0000000040)={0x1, 0x9}) ioctl$VT_RESIZEX(r1, 0x560a, &(0x7f00000000c0)={0x3, 0xfa93, 0x4, 0x2, 0x3f, 0xecb4}) 02:35:11 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5421, 0x400000) 02:35:11 executing program 2: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5421, 0x400000) socket$inet6_udplite(0xa, 0x2, 0x88) 02:35:11 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {&(0x7f0000000000), 0x3, r1, 0x1c, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) [ 2109.054666][T26628] binder: 26624:26628 ioctl 40046210 0 returned -22 02:35:11 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) [ 2109.106674][T26633] binder: 26627:26633 ioctl 541b 0 returned -22 [ 2109.123356][T26634] binder: 26624:26634 ioctl 40046210 0 returned -22 [ 2109.163663][T26633] binder: 26627:26633 ioctl 541b 0 returned -22 02:35:11 executing program 2: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5421, 0x400000) socket$inet6_udplite(0xa, 0x2, 0x88) 02:35:11 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = accept(0xffffffffffffffff, &(0x7f0000000840)=@can, &(0x7f00000008c0)=0x80) r3 = accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000900), &(0x7f0000002980)=0x10, 0x80000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001580)={0x18, 0x2, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000ffff000000080000000000005bf1c56c8caa265c0dd968e986e5a8585f4922f8012b6924975ea07bd364bd71e34e41a504739c050c0585d8336d3e1ca5d7ddc4340e8e58faf56fb80d39a624d7b8b3891a2441eca66989c9ca0b8aba"], &(0x7f0000000100)='GPL\x00', 0x8, 0x1000, &(0x7f0000000500)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r4, 0x4b6b, 0x0) ioctl$TIOCMBIC(r4, 0x5417, &(0x7f0000000180)=0x1) r5 = socket$phonet_pipe(0x23, 0x5, 0x2) sendmsg$nl_route(r2, &(0x7f00000002c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)=@getneightbl={0x14, 0x42, 0x200, 0x70bd27, 0x25dfdbfe, {}, ["", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x800}, 0x48800) accept$phonet_pipe(r5, 0x0, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) ioctl$sock_bt_hidp_HIDPCONNADD(r2, 0x400448c8, &(0x7f0000002a80)={r3, r5, 0xffff, 0xb0, &(0x7f00000029c0)="898dde8d59c03b624bd80d60d355759ee1235e70754d82af65cf5776db3d840d787e8a5413b8da8772fb2d934096326a00f1f843292c393d7d9b839528fc2320a60b8b08a9ca18002fd6f332d5eb177db178de52d35834d87395afc7e9cfd71c0aa21c5b8693ef629937332ec8ab49ec89da346baeb8e5950797632488caef20891301496dbbbfc9da508ff43a044cfebd609a38d75b141f8d72736c9a16793e5596cd16a3fb094ae838e7da2f38da3a", 0x9, 0x9, 0xef44, 0x7f, 0x2, 0x3, 0x200, 'syz0\x00'}) r6 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/capi/capi20\x00', 0x200000, 0x0) mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x0) setsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r6, 0x84, 0x8, &(0x7f0000000140), 0x4) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x0, 0x2}) 02:35:11 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {&(0x7f0000000000), 0x3, r1, 0x1c, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) 02:35:11 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) getpgrp(0x0) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r0, 0x81785501, &(0x7f0000000180)=""/239) ioctl$TIOCSTI(r0, 0x5421, 0x7) ioctl$KDSKBLED(r0, 0x4b65, 0x581d481b) 02:35:11 executing program 1: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) syz_open_dev$binderN(0xfffffffffffffffe, 0x0, 0x800) r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r1, 0x4b6b, 0x0) ioctl$VT_GETMODE(r1, 0x5601, &(0x7f0000000080)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x40, 0x0) ioctl$BINDER_SET_MAX_THREADS(r2, 0x541b, 0x0) 02:35:11 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x100}) socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$phonet_pipe(0x23, 0x5, 0x2) accept$phonet_pipe(r1, 0x0, 0x0) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r2, 0xc0405519, 0x0) getsockopt$bt_sco_SCO_CONNINFO(r2, 0x11, 0x2, &(0x7f00000001c0)=""/4096, &(0x7f0000000100)=0x1000) recvmmsg(r1, &(0x7f0000000140)=[{{&(0x7f0000000080)=@can, 0x80, &(0x7f0000000100)}, 0xa}], 0x1, 0x40010043, &(0x7f0000000180)={0x0, 0x989680}) 02:35:11 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {&(0x7f0000000000), 0x3, r1, 0x1c, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) 02:35:11 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x5010c2, 0x0) setrlimit(0x3, &(0x7f0000000040)={0x1, 0x9}) ioctl$VT_RESIZEX(r1, 0x560a, &(0x7f00000000c0)={0x3, 0xfa93, 0x4, 0x2, 0x3f, 0xecb4}) [ 2109.453916][T26650] binder: 26645:26650 ioctl 40046210 0 returned -22 [ 2109.494410][T26650] binder: 26645:26650 ioctl c0306201 0 returned -14 [ 2109.512126][T26652] binder: 26648:26652 ioctl c0306201 0 returned -14 [ 2109.542697][T26658] binder: 26648:26658 ioctl c0306201 0 returned -14 [ 2109.558225][T26650] binder: 26645:26650 ioctl 40046210 0 returned -22 [ 2109.568000][T26660] binder: 26653:26660 ioctl 541b 0 returned -22 [ 2109.576329][T26661] binder: 26645:26661 ioctl c0306201 0 returned -14 02:35:11 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5421, 0x400000) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r1, 0x4b6b, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r2, 0x4b6b, 0x0) ioctl$KDGKBENT(r2, 0x4b46, &(0x7f0000000040)={0xb9, 0x4, 0x400}) ioctl$KDGKBLED(r1, 0x4b64, &(0x7f0000000000)) 02:35:11 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = getpgrp(0x0) syz_open_procfs$namespace(r3, &(0x7f0000000000)='ns/ipc\x00') sendmsg$nl_route(r2, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, &(0x7f0000000580)={&(0x7f0000000500)=@dellinkprop={0x54, 0x6d, 0x100, 0x70bd2d, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x200, 0x8080}, [@IFLA_NET_NS_PID={0x8, 0x13, r3}, @IFLA_MAP={0x24, 0xe, {0xfffffffffffffa04, 0xfffffffffffffffa, 0x9, 0x5, 0x7f, 0xfa}}, @IFLA_CARRIER_CHANGES={0x8, 0x23, 0xffffffff}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000000}, 0x811) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f0000000040)=0x19) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) 02:35:11 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) 02:35:11 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {&(0x7f0000000000), 0x3, r1, 0x1c, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) 02:35:11 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x5010c2, 0x0) setrlimit(0x3, &(0x7f0000000040)={0x1, 0x9}) ioctl$VT_RESIZEX(r1, 0x560a, &(0x7f00000000c0)={0x3, 0xfa93, 0x4, 0x2, 0x3f, 0xecb4}) 02:35:11 executing program 3: setsockopt$inet_sctp_SCTP_INITMSG(0xffffffffffffffff, 0x84, 0x2, &(0x7f0000000040)={0x7, 0x4, 0xe1, 0x7f}, 0x8) accept$phonet_pipe(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=0x10) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, 0x1f) [ 2109.844589][T26677] binder: 26670:26677 ioctl 40046210 0 returned -22 [ 2109.855754][T26675] binder: 26668:26675 ioctl c0306201 0 returned -14 [ 2109.880449][T26680] binder: 26672:26680 ioctl 541b 0 returned -22 02:35:12 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) r1 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)={0x2}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0), 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@bridge_dellink={0x28, 0x11, 0x10, 0x70bd26, 0x25dfdbff, {0x7, 0x0, 0x0, 0x0, 0x8900, 0x1400}, [@IFLA_LINK_NETNSID={0x8}]}, 0x28}}, 0x4000000) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) [ 2109.906860][T26675] binder: 26668:26675 ioctl 541b 0 returned -22 02:35:12 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {&(0x7f0000000000), 0x3, r1, 0x1c, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) 02:35:12 executing program 3: ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x5460, 0x0) 02:35:12 executing program 4: write$RDMA_USER_CM_CMD_INIT_QP_ATTR(0xffffffffffffffff, &(0x7f00000000c0)={0xb, 0x10, 0xfa00, {&(0x7f0000000000), 0xffffffffffffffff, 0x8}}, 0x18) r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5421, 0x400000) [ 2109.977689][T26683] binder: 26668:26683 ioctl c0306201 0 returned -14 02:35:12 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x5010c2, 0x0) setrlimit(0x3, &(0x7f0000000040)={0x1, 0x9}) ioctl$VT_RESIZEX(r1, 0x560a, &(0x7f00000000c0)={0x3, 0xfa93, 0x4, 0x2, 0x3f, 0xecb4}) [ 2110.023562][T26683] binder: 26668:26683 ioctl 541b 0 returned -22 [ 2110.077643][T26685] binder: 26684:26685 ioctl 40046210 0 returned -22 [ 2110.118166][T26690] binder: 26684:26690 ioctl 40046210 0 returned -22 02:35:12 executing program 1: ioctl$SNDRV_CTL_IOCTL_CARD_INFO(0xffffffffffffffff, 0x81785501, &(0x7f0000000180)=""/143) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)={0x1}) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000080)='/proc/capi/capi20\x00', 0xc0800, 0x0) write$RDMA_USER_CM_CMD_JOIN_MCAST(r1, &(0x7f0000000240)={0x16, 0x98, 0xfa00, {&(0x7f0000000100)={0xffffffffffffffff}, 0x3, 0xffffffffffffffff, 0x30, 0x1, @in={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0xa0) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r2, &(0x7f0000000300)={0x11, 0x10, 0xfa00, {&(0x7f00000000c0), r3}}, 0x18) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) ioctl$SCSI_IOCTL_SYNC(r1, 0x4) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(r2, 0xc0045540, &(0x7f0000000380)) ioctl$SCSI_IOCTL_SYNC(r1, 0x4) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r4, 0x4b6b, 0x0) ioctl$TIOCGPGRP(r4, 0x540f, &(0x7f0000000340)) 02:35:12 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {&(0x7f0000000000), 0x3, r1, 0x1c, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) 02:35:12 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x2001, 0x0) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f0000000080)) 02:35:12 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) ioctl$DRM_IOCTL_AGP_FREE(r1, 0x40206435, &(0x7f0000000040)) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) 02:35:12 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) mmap$binder(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0xe146) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x864880, 0x0) r1 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$KDSKBLED(r1, 0x4b65, 0x8) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x547480, 0x0) ioctl$TIOCSTI(r1, 0x5421, 0x2) r3 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1001, 0x1}) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r2, 0x40045542, &(0x7f00000000c0)=0xa48) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x208e40, 0x0) [ 2110.227612][T26695] binder: 26691:26695 ioctl 541b 0 returned -22 02:35:12 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x5010c2, 0x0) setrlimit(0x3, &(0x7f0000000040)={0x1, 0x9}) [ 2110.307738][T26698] binder: 26697:26698 ioctl 541b 0 returned -22 [ 2110.365256][T26698] binder: 26697:26698 ioctl 541b 0 returned -22 [ 2110.387037][T26705] binder: 26699:26705 ioctl 40046210 0 returned -22 02:35:12 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {&(0x7f0000000000), 0x3, r1, 0x1c, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) [ 2110.430181][T26708] binder: 26702:26708 ioctl c0306201 0 returned -14 [ 2110.439366][T26705] binder: 26699:26705 ioctl 40046210 0 returned -22 02:35:12 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001600)={0xa4, 0x0, &(0x7f00000014c0)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x18, &(0x7f0000001180)={@flat=@weak_handle={0x77682a85, 0x1100, 0x1}, @fda={0x66646185, 0x9, 0x1, 0x14}, @ptr={0x70742a85, 0x1, &(0x7f0000000180)=""/4096, 0x1000, 0x0, 0x6}}, &(0x7f0000001200)={0x0, 0x18, 0x38}}}, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001400)={@ptr={0x70742a85, 0x1, &(0x7f0000001240)=""/254, 0xfe, 0x0, 0x39}, @ptr={0x70742a85, 0x1, &(0x7f0000001340)=""/168, 0xa8}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000001480)={0x0, 0x28, 0x50}}}, @exit_looper, @decrefs={0x40046307, 0x1}, @request_death={0x400c630e, 0x2}], 0x4c, 0x0, &(0x7f0000001580)="2f78493095709f001cd538fec2acf461aa7a2e6fecc246b65163bcc49c58b954199f5ecd40084a4ea0977611adba5d5ccac5a212b12a6749a5c386dc11b2e45d486d8508f3ccbce9a8be907c"}) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) sendmsg$RDMA_NLDEV_CMD_PORT_GET(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x40, 0x1405, 0x200, 0x70bd2d, 0x25dfdbfb, "", [{{0x8, 0x1, 0x2}, {0x8, 0x3, 0x4}}, {{0x8, 0x1, 0x2}, {0x8, 0x3, 0x1}}, {{0x8, 0x1, 0x2}, {0x8, 0x3, 0x4}}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000}, 0x40) 02:35:12 executing program 3: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) [ 2110.509173][T26708] binder: 26702:26708 ioctl c0306201 0 returned -14 [ 2110.526829][T26713] binder: 26710:26713 ioctl 541b 0 returned -22 02:35:12 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10001) r1 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$KDGETLED(r2, 0x4b31, &(0x7f0000000080)) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) 02:35:12 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSTI(r1, 0x5421, 0x400000) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r2, 0x4b6b, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r3, 0x4b6b, 0x0) ioctl$TIOCSSOFTCAR(r3, 0x541a, &(0x7f0000000000)=0x2) ioctl$TIOCSTI(r0, 0x5412, 0x6) ioctl$TIOCSTI(r2, 0x5412, 0xa5e7) 02:35:12 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) setrlimit(0x3, &(0x7f0000000040)={0x1, 0x9}) [ 2110.667920][T26722] binder: 26717:26722 ioctl 541b 0 returned -22 [ 2110.698931][T26723] binder: 26719:26723 ioctl c0306201 0 returned -14 02:35:12 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, 0x0, 0x0) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {&(0x7f0000000000), 0x3, 0xffffffffffffffff, 0x1c, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) [ 2110.733629][T26725] binder: 26719:26725 ioctl c0306201 0 returned -14 [ 2110.744462][T26726] binder: 26717:26726 ioctl 541b 0 returned -22 [ 2110.744656][T26724] binder: 26721:26724 ioctl 40046210 0 returned -22 02:35:12 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) r1 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x1001) syz_open_dev$binderN(&(0x7f00000001c0)='/dev/binder#\x00', 0x0, 0x2) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x101240, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) r3 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000180)={0x73622a85, 0x10b}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f00000000c0)={0x2}) r4 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ttyprintk\x00', 0x2a0b05, 0x0) r5 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r5, 0x4b6b, 0x0) ioctl$TIOCGSERIAL(r5, 0x541e, 0x0) r6 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, 0x0) ioctl$BINDER_THREAD_EXIT(r6, 0x40046208, 0x0) ioctl$PIO_FONTRESET(r4, 0x4b6d, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x541b, 0x0) [ 2110.840765][T26731] binder: 26728:26731 ioctl 541b 0 returned -22 02:35:12 executing program 3: prctl$PR_MCE_KILL(0x21, 0x0, 0x1) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0xded1e137e2bae41a) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f0000000000)=0x7) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) 02:35:12 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x1901, 0x3}) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) 02:35:13 executing program 2: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) setrlimit(0x3, &(0x7f0000000040)={0x1, 0x9}) 02:35:13 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(0xffffffffffffffff, 0x40045431, &(0x7f0000000040)=0x1) ioctl$FUSE_DEV_IOC_CLONE(0xffffffffffffffff, 0x8004e500, &(0x7f0000000000)=r0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r1, 0x4b6b, 0x0) r2 = syz_open_dev$sndctrl(&(0x7f0000000a80)='/dev/snd/controlC#\x00', 0x4f3, 0x0) read$FUSE(r2, 0x0, 0x0) ioctl$TIOCSTI(r1, 0x5421, 0x9) 02:35:13 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, 0x0, 0x0) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {&(0x7f0000000000), 0x3, 0xffffffffffffffff, 0x1c, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) [ 2111.017733][T26740] binder: 26736:26740 ioctl c0306201 0 returned -14 [ 2111.039164][T26742] binder: 26739:26742 ioctl c0306201 0 returned -14 [ 2111.069669][T26741] binder: 26738:26741 ioctl c0306201 0 returned -14 [ 2111.072719][T26744] binder: 26736:26744 ioctl c0306201 0 returned -14 [ 2111.097980][T26745] binder: 26739:26745 ioctl 40046210 0 returned -22 [ 2111.117017][T26741] binder: 26738:26741 ioctl c0306201 0 returned -14 [ 2111.147504][T26745] binder: 26739:26745 ioctl c0306201 0 returned -14 [ 2111.178554][T26741] binder: 26738:26741 ioctl c0306201 0 returned -14 [ 2111.190702][T26745] binder: 26739:26745 ioctl 40046210 0 returned -22 02:35:13 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000080)={0x2020, 0x0, 0x0}, 0x2020) getgroups(0x8, &(0x7f00000020c0)=[0xee00, 0xffffffffffffffff, 0xee00, 0xee00, 0x0, 0xee00, 0xee01, 0x0]) write$FUSE_ENTRY(r1, &(0x7f0000002100)={0x90, 0xfffffffffffffff5, r2, {0x2, 0x1, 0x3, 0x1, 0x40, 0x7ff, {0x5, 0xd09, 0x8, 0x3, 0x3f, 0xa8c, 0x1, 0x1f, 0xff, 0x8000, 0x9, 0x0, r3, 0xfffffffa, 0x9}}}, 0x90) 02:35:13 executing program 2: setrlimit(0x3, &(0x7f0000000040)={0x1, 0x9}) [ 2111.221073][T26741] binder: 26738:26741 ioctl 541b 0 returned -22 02:35:13 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, 0x0, 0x0) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {&(0x7f0000000000), 0x3, 0xffffffffffffffff, 0x1c, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) 02:35:13 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x800) syz_open_dev$sg(&(0x7f0000000080)='/dev/sg#\x00', 0xffff, 0x1172c1) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046210, 0x0) [ 2111.280758][T26753] binder: 26738:26753 ioctl c0306201 0 returned -14 02:35:13 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5421, 0x400000) clock_gettime(0x0, &(0x7f0000001f00)={0x0, 0x0}) recvmmsg(r0, &(0x7f0000001e00)=[{{&(0x7f0000000000)=@hci, 0x80, &(0x7f0000000440)=[{&(0x7f0000000180)=""/242, 0xf2}, {&(0x7f0000000080)=""/56, 0x38}, {&(0x7f0000000280)=""/147, 0x93}, {&(0x7f0000002040)=""/235, 0xeb}, {&(0x7f00000000c0)=""/88, 0x58}], 0x5, &(0x7f00000004c0)=""/31, 0x1f}, 0xfffffffa}, {{0x0, 0x0, &(0x7f0000001780)=[{&(0x7f0000000500)=""/4096, 0x1000}, {&(0x7f0000001500)=""/244, 0xf4}, {&(0x7f0000001600)=""/231, 0xe7}, {&(0x7f0000001700)=""/74, 0x4a}], 0x4}, 0x4}, {{&(0x7f00000017c0)=@rc, 0x80, &(0x7f0000002000)=[{&(0x7f0000001f80)=""/82, 0x52}, {&(0x7f00000018c0)=""/78, 0x4e}, {&(0x7f0000001940)=""/234, 0xea}, {&(0x7f0000001840)=""/119, 0x77}], 0x4}}, {{0x0, 0xffffffffffffff5c, &(0x7f0000001d40)=[{&(0x7f0000001a80)=""/99, 0x63}, {&(0x7f0000001b00)=""/240, 0xf0}, {&(0x7f0000001c00)=""/108, 0x6c}, {&(0x7f0000001c80)=""/14, 0xe}, {&(0x7f0000001cc0)=""/6, 0x6}, {&(0x7f0000001d00)=""/40, 0x28}], 0x6, &(0x7f0000001dc0)=""/42, 0x2a}, 0x1}], 0x4, 0x0, &(0x7f0000001f40)={r1, r2+60000000}) sendmsg$RDMA_NLDEV_CMD_RES_MR_GET(r0, &(0x7f0000002180)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000002140)={&(0x7f0000001a40)={0x28, 0x140d, 0x800, 0x70bd26, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_PORT_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x24000804}, 0x20000800) accept(r0, &(0x7f0000000340)=@sco, &(0x7f00000003c0)=0x80) [ 2111.349057][T26741] binder: 26738:26741 ioctl 541b 0 returned -22 02:35:13 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x0, 0x1}) 02:35:13 executing program 2: setrlimit(0x0, &(0x7f0000000040)={0x1, 0x9}) 02:35:13 executing program 3: syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) setsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0xb, &(0x7f0000000040)=0xe4c5, 0x4) r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r0, 0xc0405519, 0x0) ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f00000000c0)={@fixed={[], 0x10}, 0x9}) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(0xffffffffffffffff, 0x40045542, &(0x7f0000000080)=0x58) 02:35:13 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {&(0x7f0000000000), 0x3, r1, 0x1c, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) 02:35:13 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_NOTIFY(r1, &(0x7f00000001c0)={0xf, 0x8, 0xfa00, {r2}}, 0x10) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, &(0x7f0000000080)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000040)=0x1, r2, 0x0, 0x2, 0x4}}, 0x20) r3 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r3, 0x40046210, 0x0) 02:35:13 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5421, 0x400000) socket$inet6_sctp(0xa, 0x1, 0x84) [ 2111.662819][T26775] binder: 26772:26775 ioctl 541b 0 returned -22 [ 2111.702150][T26775] binder: 26772:26775 ioctl 541b 0 returned -22 02:35:13 executing program 2: setrlimit(0x0, &(0x7f0000000040)={0x1, 0x9}) [ 2111.725341][T26779] binder: 26774:26779 ioctl 40046210 0 returned -22 02:35:13 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) ioctl$DRM_IOCTL_AGP_FREE(r1, 0x40206435, &(0x7f0000000040)) socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) [ 2111.782314][T26785] binder: 26774:26785 ioctl 40046210 0 returned -22 02:35:13 executing program 1: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180)='/dev/hwrng\x00', 0x200, 0x0) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r0, 0x800448d2, &(0x7f0000000300)={0x2, &(0x7f00000001c0)=[{@none}, {@none}]}) sendmsg$L2TP_CMD_NOOP(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="f415001b", @ANYRES16=0x0, @ANYBLOB="00012bbd7000fedbdf250000000008001800e00000020c001000000100000000000008000a00000000000500130009000000080011000000000006001a004e23000014001f00fe8000000000000000000000000000bb06001b0000020000"], 0x64}, 0x1, 0x0, 0x0, 0x800}, 0x1) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x541b, 0x0) 02:35:13 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {&(0x7f0000000000), 0x3, 0xffffffffffffffff, 0x1c, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) 02:35:13 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x40400, 0x0) mmap$qrtrtun(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x200000a, 0x10, r1, 0xd6) ioctl$TIOCSTI(r0, 0x5421, 0x400000) 02:35:13 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x800) r1 = syz_open_dev$ptys(0xc, 0x3, 0x1) ioctl$FIONREAD(r1, 0x541b, &(0x7f0000000000)) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) 02:35:14 executing program 2: setrlimit(0x0, &(0x7f0000000040)={0x1, 0x9}) [ 2111.983045][T26794] binder: 26791:26794 ioctl 541b 0 returned -22 02:35:14 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x40800, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1, 0x11, r1, 0x80000001) r2 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0xfaaa, 0x442440) r4 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r4, 0xc0405519, 0x0) ioctl$SG_SET_TIMEOUT(r4, 0x2201, &(0x7f0000000140)) ioctl$DRM_IOCTL_AGP_ALLOC(r1, 0xc0206434, &(0x7f00000000c0)={0x1000, 0x0, 0x10001}) ioctl$DRM_IOCTL_AGP_FREE(r3, 0x40206435, &(0x7f0000000100)={0x0, r5}) 02:35:14 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {&(0x7f0000000000), 0x3, 0xffffffffffffffff, 0x1c, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) [ 2112.044064][T26800] binder: 26796:26800 ioctl 40046210 0 returned -22 [ 2112.045707][T26801] binder: 26791:26801 ioctl 541b 0 returned -22 02:35:14 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) r1 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$DRM_IOCTL_AGP_FREE(r0, 0x40206435, &(0x7f0000001180)) ioctl$TIOCSTI(r1, 0x5421, 0x3ffffc) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r2, 0xc0405519, 0x0) setsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r2, 0x84, 0x8, &(0x7f0000000080)=0x8, 0x4) ioctl$PIO_SCRNMAP(r2, 0x4b41, &(0x7f00000000c0)="2d6856b583bc980e7dcb92dd7ae98e6d7e9235c4b0c2560c8e627be4b1f62c2491d3a49ff008c7f64219561b97013eba39207fe1434ddef13b6c02a5243dadd6fe312bb8917832262b9f312c969d3f3f1d76ab3540e097f7c296b06fcd4d32373debf788d0fc5dca55f196fd") ioctl$TIOCGSERIAL(r0, 0x541e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=""/4096}) 02:35:14 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x1000, 0x1}) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) connect$phonet_pipe(0xffffffffffffffff, &(0x7f0000000040)={0x23, 0x3f, 0x2, 0xfa}, 0x10) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_NOTIFY(r3, &(0x7f00000001c0)={0xf, 0x8, 0xfa00, {r4}}, 0x10) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e22, 0x2, @private1, 0x8}, {0xa, 0x4e21, 0x3, @ipv4={[], [], @empty}, 0x80000000}, r4, 0x10001}}, 0x48) 02:35:14 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$KDDELIO(0xffffffffffffffff, 0x4b35, 0x2) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) [ 2112.215884][T26808] binder: 26806:26808 ioctl c0306201 0 returned -14 02:35:14 executing program 2: setrlimit(0x3, 0x0) 02:35:14 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {&(0x7f0000000000), 0x3, 0xffffffffffffffff, 0x1c, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) [ 2112.284328][T26813] binder: 26806:26813 ioctl c0306201 0 returned -14 [ 2112.344872][T26817] binder: 26812:26817 ioctl 40046210 0 returned -22 [ 2112.356335][T26816] binder: 26811:26816 ioctl 541b 0 returned -22 02:35:14 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) write$FUSE_DIRENT(r1, &(0x7f0000000080)={0x150, 0x0, 0x0, [{0x2, 0x9, 0xd, 0x101, '/dev/binder#\x00'}, {0x6, 0x9, 0xd, 0x1, '/dev/binder#\x00'}, {0x1, 0x3}, {0x5, 0x0, 0xd, 0x100, '/dev/binder#\x00'}, {0x1, 0x8, 0x1, 0x4d5, ','}, {0x1, 0x9, 0xd, 0x70cd, '/dev/binder#\x00'}, {0x0, 0x8, 0xd, 0xc9, '/dev/binder#\x00'}, {0x0, 0x0, 0xd, 0x5, '/dev/binder#\x00'}, {0x1, 0x9, 0x0, 0x4}]}, 0x150) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) [ 2112.397428][T26820] binder: 26812:26820 ioctl 40046210 0 returned -22 [ 2112.410268][T26816] binder: 26811:26816 ioctl 541b 0 returned -22 02:35:14 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x20042, 0x0) ioctl$TIOCSTI(r0, 0x5421, 0x400000) 02:35:14 executing program 2: setrlimit(0x3, 0x0) 02:35:14 executing program 1: recvmsg$can_j1939(0xffffffffffffffff, &(0x7f0000001540)={&(0x7f0000000040)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff}}, 0x80, &(0x7f0000001440)=[{&(0x7f00000000c0)=""/22, 0x16}, {&(0x7f0000000100)=""/11, 0xb}, {&(0x7f0000000140)=""/25, 0x19}, {&(0x7f0000000180)=""/151, 0x97}, {&(0x7f0000000240)=""/4096, 0x1000}, {&(0x7f0000001240)=""/236, 0xec}, {&(0x7f0000001340)=""/248, 0xf8}], 0x7, &(0x7f00000014c0)=""/68, 0x44}, 0x20) r1 = syz_genetlink_get_family_id$gtp(&(0x7f00000015c0)='gtp\x00') sendmsg$GTP_CMD_GETPDP(r0, &(0x7f0000001680)={&(0x7f0000001580)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000001640)={&(0x7f0000001600)={0x34, r1, 0x10, 0x70bd26, 0x25dfdbfe, {}, [@GTPA_LINK={0x8}, @GTPA_MS_ADDRESS={0x8, 0x5, @remote}, @GTPA_PEER_ADDRESS={0x8, 0x4, @broadcast}, @GTPA_LINK={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x44000}, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r2, 0x541b, 0x0) 02:35:14 executing program 5: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r0, 0xc0405519, 0x0) sendmsg$L2TP_CMD_NOOP(r0, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYBLOB="34000000ca9f146cb096a2e99bed67d60a5954fdc589c05015b9f81dd73d14b073a43e753ca097ccd65d0030e335f2895d87bc4cbb4c819d7811d0a34d716f5010c4b8a6aa6b574e754cdb9f32eec51269d4d434a4ade7914ac8f5c713ee575770ee7eb18b20", @ANYRES16=0x0, @ANYBLOB="000227bd7000fddbdf25000000000500140007000000060001000700000006001c00ffff00000500060002000000"], 0x34}, 0x1, 0x0, 0x0, 0x10}, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000340)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000001c0), 0xffffffffffffffff, 0x0, 0x1, 0x4}}, 0x20) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r2, 0xc0405519, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046210, 0x0) 02:35:14 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {&(0x7f0000000000), 0x3, r1, 0x1c, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) 02:35:14 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) 02:35:14 executing program 4: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_GET_EVENT(r0, &(0x7f0000000040)={0xc, 0x8, 0xfa00, {&(0x7f0000000180)}}, 0x10) ioctl$TIOCSTI(r0, 0x5421, 0x400000) 02:35:14 executing program 2: setrlimit(0x3, 0x0) [ 2112.718890][T26839] binder: 26834:26839 ioctl 541b 0 returned -22 [ 2112.745200][T26840] binder: 26835:26840 ioctl 40046210 0 returned -22 [ 2112.754461][T26842] binder: 26834:26842 ioctl 541b 0 returned -22 02:35:14 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {&(0x7f0000000000), 0x3, r1, 0x1c, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) 02:35:14 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r0, 0xc018620c, &(0x7f0000000080)) syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000140)={0x3}) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r2, 0xc018620c, &(0x7f0000000100)={0x2}) 02:35:14 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETPRL(0xffffffffffffffff, 0x89f4, &(0x7f0000000200)={'ip6gre0\x00', &(0x7f0000000180)={'ip6tnl0\x00', 0x0, 0x4, 0x9, 0x0, 0xfffffff8, 0x70, @mcast2, @private2={0xfc, 0x2, [], 0x1}, 0x7, 0x10, 0x4, 0xc8}}) accept(0xffffffffffffffff, &(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000540)=0x80) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000580)='/dev/hwrng\x00', 0x44082, 0x0) r3 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000640)='/proc/capi/capi20\x00', 0x60000, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r0, 0x89f4, &(0x7f0000000100)={'syztnl2\x00', &(0x7f0000000080)={'syztnl1\x00', r1, 0x29, 0x8, 0xff, 0x2, 0x20, @mcast1, @ipv4={[], [], @loopback}, 0x1, 0x0, 0x5, 0x8}}) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000002c0)=@bpf_tracing={0x1a, 0x7, &(0x7f0000000140)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfff, 0x0, 0x0, 0x0, 0x13}, [@generic={0x1, 0x8, 0xe, 0x6, 0x81}, @call={0x85, 0x0, 0x0, 0x51}, @exit, @call={0x85, 0x0, 0x0, 0x99}]}, &(0x7f0000000040)='syzkaller\x00', 0x5, 0xd1, &(0x7f00000003c0)=""/209, 0x40f00, 0x13, [], r4, 0x17, r2, 0x8, &(0x7f00000005c0)={0x3, 0x5}, 0x8, 0x10, &(0x7f0000000600)={0x5, 0x2, 0x6, 0x240000}, 0x10, 0x9ca8, r3}, 0x78) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) 02:35:15 executing program 2: setrlimit(0x3, &(0x7f0000000040)={0x0, 0x9}) 02:35:15 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5421, 0x400000) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0xf) 02:35:15 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x1, 0x40000) ioctl$DRM_IOCTL_AGP_BIND(r0, 0x40106436, &(0x7f0000000080)={0x0, 0x3d32}) r1 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_SET_MAX_THREADS(r1, 0x5460, 0x0) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r2, 0xc0405519, 0x0) 02:35:15 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {&(0x7f0000000000), 0x3, r1, 0x1c, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) [ 2113.045963][T26856] binder: 26854:26856 ioctl 89f4 20000100 returned -22 [ 2113.055830][T26859] binder: 26855:26859 ioctl c018620c 20000080 returned -1 [ 2113.087759][T26856] binder: 26854:26856 ioctl 40046210 0 returned -22 [ 2113.089023][T26859] binder: 26855:26859 ioctl c0306201 0 returned -14 [ 2113.139606][T26856] binder: 26854:26856 ioctl 89f4 20000100 returned -22 [ 2113.152536][T26859] binder: 26855:26859 ioctl 541b 0 returned -22 02:35:15 executing program 2: setrlimit(0x3, &(0x7f0000000040)) [ 2113.191733][T26859] binder: 26855:26859 ioctl c0306201 0 returned -14 02:35:15 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5421, 0x400000) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r0, 0xc4c85513, &(0x7f0000000180)={{0x0, 0x3, 0x4, 0x9, 'syz1\x00', 0x10000}, 0x1, [0x7f, 0xfffffffffffffffb, 0xc, 0x3, 0x4, 0x1, 0x6, 0x7ff, 0x7fff, 0x9, 0x5, 0xd38, 0x0, 0x3, 0xfffffffffffffffb, 0x20, 0x0, 0x7ff, 0x7, 0xca3, 0x5, 0x0, 0xfff, 0x2, 0x100000000, 0x8001, 0x3f, 0x1f, 0x7f, 0x2, 0x80000000, 0xffff, 0x7, 0x5, 0x6, 0x4, 0xffffffff, 0xadfe, 0x0, 0x7f, 0x7, 0xfffffffffffffffa, 0x1f, 0x8, 0x8000, 0xffffffffffffffff, 0xcce, 0x8, 0x4, 0x5, 0x811, 0x9, 0x4, 0x1, 0x10000, 0x856, 0x80000001, 0x8001, 0x7502, 0x2, 0xb92, 0x0, 0x80, 0x25510667, 0x0, 0x1, 0x101, 0x5, 0x5, 0x400, 0x5, 0x3ff, 0xe53, 0x800, 0xffffffff, 0x33, 0xff, 0x6, 0x7f, 0x3, 0x5, 0x8000, 0x5, 0xff, 0x40, 0x101, 0x0, 0x82a, 0x6, 0x1ff, 0x4, 0x81, 0x28, 0x10001, 0x4, 0x0, 0xfdf, 0x172d, 0x7fffffff, 0x6, 0x8, 0x6, 0xbff1, 0x0, 0x7ff, 0x1, 0x40, 0x8, 0x7f, 0x3, 0x6, 0x8, 0x100000001, 0xa, 0x7, 0x36, 0x0, 0x1, 0x80000000, 0x6, 0x4, 0x3f, 0x8001, 0x0, 0x9, 0x7fff, 0x5, 0x876]}) sendmsg$RDMA_NLDEV_CMD_STAT_DEL(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x18, 0x1412, 0x800, 0x70bd27, 0x25dfdbfc, "", [@RDMA_NLDEV_ATTR_STAT_COUNTER_ID={0x8, 0x4f, 0x1}]}, 0x18}, 0x1, 0x0, 0x0, 0x4000004}, 0x24000845) [ 2113.235187][T26859] binder: 26855:26859 ioctl c018620c 20000100 returned -1 02:35:15 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) ioctl$DRM_IOCTL_AGP_BIND(r1, 0x40106436, &(0x7f0000000040)={0x0, 0x7}) mmap$binder(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x7ff) 02:35:15 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) [ 2113.278854][T26859] binder: 26855:26859 ioctl c018620c 20000080 returned -1 [ 2113.301111][T26870] binder: 26855:26870 ioctl c0306201 0 returned -14 02:35:15 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {&(0x7f0000000000), 0x3, r1, 0x1c, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) [ 2113.333625][T26866] binder: 26855:26866 ioctl c0306201 0 returned -14 [ 2113.341023][T26859] binder: 26855:26859 ioctl 541b 0 returned -22 [ 2113.349062][T26870] binder: 26855:26870 ioctl c018620c 20000100 returned -1 02:35:15 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x1, 0x40000) ioctl$DRM_IOCTL_AGP_BIND(r0, 0x40106436, &(0x7f0000000080)={0x0, 0x3d32}) r1 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_SET_MAX_THREADS(r1, 0x5460, 0x0) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r2, 0xc0405519, 0x0) 02:35:15 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x3, 0x80) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r1, 0xc4c85512, &(0x7f0000000080)={{0x4, 0x5, 0x1, 0x0, 'syz1\x00', 0x10000}, 0x1, [0x3, 0x0, 0x52, 0x1000, 0xfffffffffffffdb7, 0x4, 0x56, 0x36d2, 0x6, 0x40, 0xfff, 0x1, 0x1f, 0x48bf65ed, 0x209, 0x0, 0x5, 0x10001, 0x4cdd2b86, 0x7, 0x8, 0x7fff, 0x81, 0x81, 0x4, 0x3, 0xffffffff, 0x3ff, 0x0, 0x0, 0x8, 0x2, 0xef0, 0x3, 0x1000, 0x100, 0x8, 0x0, 0x7, 0x7ff, 0x6, 0x7, 0x1, 0x3, 0x8, 0x16daf560, 0x40, 0x7f, 0x0, 0x7, 0x7, 0x8, 0xfffffffffffff2dd, 0x37e, 0x1, 0x10001, 0x400, 0x2, 0xdf, 0x0, 0x6, 0x5, 0x3, 0x7, 0x6, 0x5, 0x1, 0x2, 0x7, 0x2, 0x0, 0x0, 0x8, 0x80000000, 0x7, 0x100, 0x1, 0x8, 0x6, 0x9, 0xf6, 0x1000, 0x7, 0x8001, 0x3, 0x8feb, 0x9, 0xeb, 0x8, 0xff, 0xd2, 0x0, 0x9, 0x0, 0x1, 0xff, 0x9, 0x5, 0x20000000, 0xfffffffffffffe01, 0xfffffffffffff800, 0x401, 0x9, 0x9, 0x9, 0x8, 0x40, 0x2, 0x0, 0x3, 0x7, 0x1, 0x4, 0x3, 0x80, 0x7, 0x100000000, 0x7fffffff, 0x2, 0x1b1b8811, 0xff, 0x7, 0xee4, 0x0, 0x7, 0xffffffffffffff81, 0xffffffffffffff01, 0x1]}) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r1, 0x40045542, &(0x7f0000000ac0)) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000580)='/proc/capi/capi20\x00', 0x210000, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r2, 0xc4c85512, &(0x7f00000005c0)={{0xa, 0x0, 0xd435, 0x1, '\x00', 0x701}, 0x1, [0x7, 0x9, 0xb, 0x8, 0xe2e, 0x7, 0xffff, 0x8, 0x21c, 0x7, 0x4, 0x5, 0x6, 0x4, 0xac, 0x800, 0x9, 0x7f, 0xff, 0x5f27, 0x1ff, 0xf3f, 0xfffffffffffffffa, 0x2, 0xffffffff7fffffff, 0x100000001, 0x951, 0x29, 0x2, 0x1, 0x800, 0x3, 0x0, 0x100000000, 0x8001, 0x3, 0x100, 0x2, 0x7fffffff, 0x8, 0x5, 0x3, 0x1, 0x2, 0xfffffffffffffff9, 0x4d96, 0x7, 0x5, 0x800, 0x80000000, 0x7, 0x100, 0x165, 0x3, 0x0, 0x80, 0x2, 0x200, 0x87e0, 0x19, 0x7, 0x3f, 0xaf9d, 0xc, 0x800, 0x20, 0xac8, 0x40, 0x3, 0x7, 0x800, 0x9, 0x8, 0x20002000000, 0x4a, 0x1ff, 0x5, 0x2, 0x7, 0x40000000000, 0x8, 0x9a, 0x0, 0xa21, 0x7fffffff, 0x7fffffff, 0x4, 0x4, 0x8000, 0x58, 0x800, 0x6, 0x2, 0x8, 0x9998, 0x3, 0x4, 0x9, 0x80, 0x0, 0x8, 0x7, 0x40000000000000, 0x2, 0x6, 0x1, 0x5, 0x400, 0xffff, 0x7fffffff, 0xfffffffffffff801, 0x80000000, 0x7fff, 0x1000, 0xffffffffffffffe0, 0x1, 0x80000000, 0x8000, 0x81, 0x7fff, 0x9, 0x9, 0x0, 0x2, 0x0, 0x4, 0x0, 0x1]}) setsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(r2, 0x84, 0xc, &(0x7f0000000b00)=0x1000, 0x4) 02:35:15 executing program 3: ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x5460, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f0000000140)=0xffffbeb6) ioctl$sock_ipv6_tunnel_SIOCGETPRL(0xffffffffffffffff, 0x89f4, &(0x7f0000005b80)={'ip6tnl0\x00', &(0x7f0000005b00)={'ip6gre0\x00', 0x0, 0x2f, 0x3, 0x9, 0x7f, 0x0, @mcast1, @private1, 0x40, 0x80, 0x7, 0x1400000}}) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000005c40)='/dev/hwrng\x00', 0xa0000, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000005c80)=@bpf_ext={0x1c, 0x4, &(0x7f0000000000)=@raw=[@alu={0x7, 0x1, 0xc, 0x7, 0x6, 0x2, 0x1}, @alu={0x4, 0x0, 0x5, 0x6, 0xa, 0x2, 0x8}, @call={0x85, 0x0, 0x0, 0x62}, @call={0x85, 0x0, 0x0, 0x4c}], &(0x7f0000000040)='syzkaller\x00', 0x7, 0xa5, &(0x7f0000000080)=""/165, 0x40f00, 0x16, [], r1, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000005bc0)={0x8, 0x2}, 0x8, 0x10, &(0x7f0000005c00)={0x5, 0x7, 0x7, 0x20}, 0x10, 0x18b53, r2}, 0x78) r3 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r3, 0xc0405519, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r2, 0x89fb, &(0x7f0000002b00)={'syztnl2\x00', &(0x7f0000002a80)={'syztnl1\x00', r1, 0x2f, 0x9, 0xff, 0x80000001, 0x10, @loopback, @loopback, 0x20, 0x7, 0x8001, 0xf45}}) r5 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000002b40)='/proc/capi/capi20\x00', 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000002b80)={0x16, 0x3f, 0x9, 0x5, 0x1000, r3, 0x401, [], r4, r5, 0x2, 0x3, 0x3}, 0x40) [ 2113.494991][T26882] binder: 26877:26882 ioctl 40046210 0 returned -22 02:35:15 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {&(0x7f0000000000), 0x3, r1, 0x1c, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) 02:35:15 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x301000, 0x0) ioctl$TIOCSTI(r0, 0x5421, 0x400000) 02:35:15 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) [ 2113.642163][T26888] binder: 26887:26888 ioctl 541b 0 returned -22 [ 2113.687121][T26888] binder: 26887:26888 ioctl 541b 0 returned -22 [ 2113.693135][T26892] binder: 26889:26892 ioctl c0306201 0 returned -14 02:35:15 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x1, 0x40000) ioctl$DRM_IOCTL_AGP_BIND(r0, 0x40106436, &(0x7f0000000080)={0x0, 0x3d32}) r1 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_SET_MAX_THREADS(r1, 0x5460, 0x0) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r2, 0xc0405519, 0x0) 02:35:15 executing program 1: ioctl$KDSKBLED(0xffffffffffffffff, 0x4b65, 0x7) read$FUSE(0xffffffffffffffff, &(0x7f0000000040)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_BMAP(0xffffffffffffffff, &(0x7f0000002080)={0x18, 0x0, r0, {0x2}}, 0x18) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x541b, 0x0) [ 2113.760772][T26897] binder: 26889:26897 ioctl c0306201 0 returned -14 [ 2113.811654][T26900] binder: 26896:26900 ioctl 40046210 0 returned -22 02:35:15 executing program 4: sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000580)={0x5c, 0x0, 0x20, 0x70bd2b, 0x25dfdbfe, {}, [@GTPA_LINK={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x2}, @GTPA_PEER_ADDRESS={0x8, 0x4, @multicast2}, @GTPA_FLOW={0x6, 0x6, 0x2}, @GTPA_I_TEI={0x8, 0x8, 0x2}, @GTPA_I_TEI={0x8, 0x8, 0x2}, @GTPA_I_TEI={0x8, 0x8, 0x2}, @GTPA_FLOW={0x6}, @GTPA_O_TEI={0x8}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4004040}, 0x8080) r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5421, 0x400000) ioctl$GIO_CMAP(0xffffffffffffffff, 0x4b70, &(0x7f0000000000)) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000080)={0x3, 0x21, 0x9, 0xfffbfff7, 0x101, r0, 0x3f, [], 0x0, r0, 0x1, 0x5, 0x1}, 0x40) ioctl$GIO_FONTX(r1, 0x4b6b, 0x0) ioctl$GIO_FONTX(r1, 0x4b6b, &(0x7f0000000040)={0x1ce, 0x8, &(0x7f0000000180)}) [ 2113.860693][T26900] binder: 26896:26900 ioctl c0306201 0 returned -14 02:35:15 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [@GTPA_FLOW={0x6}]}, 0x1c}}, 0x10) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000180)='/proc/capi/capi20\x00', 0x254000, 0x0) r3 = syz_genetlink_get_family_id$gtp(&(0x7f0000000200)='gtp\x00') sendmsg$GTP_CMD_NEWPDP(r2, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40304d20}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x34, r3, 0x400, 0x70bd25, 0x25dfdbfc, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @private=0xa010102}, @GTPA_NET_NS_FD={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x4}, @GTPA_VERSION={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x4850}, 0x0) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x20000, 0x0) mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1, 0x11, r4, 0x8) ioctl$BINDER_SET_MAX_THREADS(r1, 0x5460, 0x0) 02:35:15 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {&(0x7f0000000000), 0x3, r1, 0x1c, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) [ 2113.906540][T26900] binder: 26896:26900 ioctl 40046210 0 returned -22 [ 2113.914515][T26904] binder: 26896:26904 ioctl c0306201 0 returned -14 [ 2113.990435][T26907] binder: 26903:26907 ioctl 541b 0 returned -22 02:35:16 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) r3 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, 0x0) r4 = syz_open_dev$binderN(&(0x7f0000000500)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, 0x0) syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x800) r5 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, 0x0) r6 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r6, 0xc0405519, 0x0) sendmsg$RDMA_NLDEV_CMD_PORT_GET(r6, &(0x7f0000000480)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000001c0)={&(0x7f00000002c0)={0x60, 0x1405, 0x800, 0x70bd26, 0x25dfdbfd, "", [{{0x8, 0x1, 0x1}, {0x8}}, {{0x8, 0x1, 0x1}, {0x8}}, {{0x8, 0x1, 0x1}, {0x8}}, {{0x8, 0x1, 0x1}, {0x8, 0x3, 0x3}}, {{0x8, 0x1, 0x1}, {0x8, 0x3, 0x2}}]}, 0x60}, 0x1, 0x0, 0x0, 0x840}, 0x20040014) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000440)={0x74, 0x0, &(0x7f0000000100)=[@decrefs={0x40046307, 0x1}, @exit_looper, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/35, 0x23, 0x0, 0x36}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}}, @release, @decrefs={0x40046307, 0x2}, @free_buffer], 0xe4, 0x0, &(0x7f0000000340)="192edaf8621943df81acc8221c73261958e5f8ae85aa447823557a30e6683fb7f101dc128832e2cac0d345d10b74ddae1aeab72f3a0b2bc47880b99b81afb1eae43481ab1453f61f27a53d23aee8264f0864b8a511acda89e97d96874adebda0fea7c668502a1b338e5a4baeb421f214d1d3a67e5e396a00b066627b2e496ac10f604074fdfa175876f46b8095672bc46c98fc6a66d043b398630f89aaee27538ea0e60425a68c0bf77df4eeaa03b17a5d98782b3d47a177cff183e49d47b5f2e6fafc9debf5c7d261ccbdd727a28322da1a27798d8ce0f807c940f846c1cf12697736fe"}) r7 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000080)='/proc/capi/capi20\x00', 0x68002, 0x0) ioctl$BINDER_SET_MAX_THREADS(r7, 0x40046210, 0x0) ioctl$SCSI_IOCTL_GET_PCI(r7, 0x5387, &(0x7f00000004c0)) [ 2114.031712][T26913] binder: 26903:26913 ioctl 541b 0 returned -22 02:35:16 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x1, 0x40000) ioctl$DRM_IOCTL_AGP_BIND(r0, 0x40106436, &(0x7f0000000080)={0x0, 0x3d32}) r1 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_SET_MAX_THREADS(r1, 0x5460, 0x0) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r2, 0xc0405519, 0x0) 02:35:16 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) r1 = syz_init_net_socket$nl_rdma(0xffffffffffffffff, 0x3, 0x14) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000012c0)={0x50, 0x0, &(0x7f0000001200)=[@register_looper, @transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001140)={@ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/109, 0x6d, 0x2, 0xc}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/4096, 0x1000, 0x2}, @fd={0x66642a85, 0x0, r1}}, &(0x7f00000011c0)={0x0, 0x28, 0x50}}}, @release={0x40046306, 0x3}], 0x21, 0x0, &(0x7f0000001280)="f806fc964ef83248583bd20824a7cb75baf6028a96c00aaf0c3b171c700071d91d"}) ioctl$KDGETLED(0xffffffffffffffff, 0x4b31, &(0x7f0000000040)) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000080)={0x3}) 02:35:16 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040), 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, 0x0, 0x0) 02:35:16 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) mmap$binder(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x7) 02:35:16 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5421, 0x400000) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) r2 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) r3 = socket$can_j1939(0x1d, 0x2, 0x7) r4 = mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x6) r5 = socket$nl_sock_diag(0x10, 0x3, 0x4) r6 = bpf$BPF_RAW_TRACEPOINT_OPEN_UNNAMED(0x11, &(0x7f0000000400)={0x0, r0}, 0x10) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x104, 0x0, &(0x7f0000000500)=[@enter_looper, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000040)={@flat=@weak_handle={0x77682a85, 0x110a, 0x1}, @fda={0x66646185, 0x2, 0x0, 0x36}, @fd={0x66642a85, 0x0, r3}}, &(0x7f00000000c0)={0x0, 0x18, 0x38}}}, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000240)={@ptr={0x70742a85, 0x1, &(0x7f0000000100)=""/16, 0x10, 0x2, 0x2f}, @ptr={0x70742a85, 0x1, &(0x7f0000000180)=""/171, 0xab, 0x2, 0x5}, @fda={0x66646185, 0x7, 0x2, 0x6}}, &(0x7f00000002c0)={0x0, 0x28, 0x50}}}, @increfs_done={0x40106308, 0x2}, @free_buffer={0x40086303, r4}, @acquire={0x40046305, 0x5}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000440)={@fd={0x66642a85, 0x0, r5}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/211, 0xd3, 0x1, 0x2f}, @fd={0x66642a85, 0x0, r6}}, &(0x7f00000004c0)={0x0, 0x18, 0x40}}}, @exit_looper], 0x16, 0x0, &(0x7f0000000640)="eddee3baa5721b83e5ed4e7d98bda0b7e1c84dda1776"}) ioctl$GIO_FONTX(r1, 0x4b6b, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000700)={&(0x7f00000006c0)='sched_switch\x00'}, 0x10) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000000)=0x2) [ 2114.238843][T26921] binder: 26917:26921 ioctl c0306201 0 returned -14 [ 2114.269598][T26921] binder: 26917:26921 ioctl c0306201 0 returned -14 [ 2114.319778][T26921] binder: 26917:26921 ioctl c0306201 0 returned -14 [ 2114.345998][T26929] binder: 26923:26929 ioctl 541b 0 returned -22 02:35:16 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x1, 0x40000) ioctl$DRM_IOCTL_AGP_BIND(r0, 0x40106436, &(0x7f0000000080)={0x0, 0x3d32}) r1 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_SET_MAX_THREADS(r1, 0x5460, 0x0) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) [ 2114.364206][T26921] binder: 26917:26921 ioctl c0306201 0 returned -14 [ 2114.387289][T26930] binder: 26927:26930 ioctl c0306201 0 returned -14 [ 2114.404794][T26929] binder: 26923:26929 ioctl 541b 0 returned -22 02:35:16 executing program 3: ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(0xffffffffffffffff, 0xc008551c, &(0x7f0000000040)={0x687, 0x4, [0x1]}) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x5460, 0x0) 02:35:16 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040), 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, 0x0, 0x0) [ 2114.416105][T26921] binder: 26917:26921 ioctl c0306201 0 returned -14 [ 2114.467390][T26932] binder: 26917:26932 ioctl c0306201 0 returned -14 [ 2114.479709][T26933] binder: 26927:26933 ioctl c0306201 0 returned -14 [ 2114.493101][T26932] binder: 26917:26932 ioctl c0306201 0 returned -14 [ 2114.500188][T26921] binder: 26917:26921 ioctl c0306201 0 returned -14 [ 2114.502249][T26934] binder: 26917:26934 ioctl c0306201 0 returned -14 02:35:16 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f0000000080)={0x2}) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(0xffffffffffffffff, 0xc0405519, &(0x7f00000000c0)={0x4, 0x5, 0x401, 0x2, 'syz1\x00', 0x7ff}) 02:35:16 executing program 4: openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) r0 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ttyprintk\x00', 0x400400, 0x0) ioctl$TIOCSTI(r0, 0x5421, 0x3ffffe) [ 2114.626455][T26941] binder: 26938:26941 ioctl c0306201 0 returned -14 02:35:16 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x1, 0x40000) ioctl$DRM_IOCTL_AGP_BIND(r0, 0x40106436, &(0x7f0000000080)={0x0, 0x3d32}) r1 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_SET_MAX_THREADS(r1, 0x5460, 0x0) 02:35:16 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) [ 2114.676456][T26941] binder: 26938:26941 ioctl c0306201 0 returned -14 02:35:16 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040), 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, 0x0, 0x0) [ 2114.754638][T26941] binder: 26938:26941 ioctl c0306201 0 returned -14 [ 2114.765851][T26944] binder: 26938:26944 ioctl c0306201 0 returned -14 [ 2114.785525][T26946] binder: 26943:26946 ioctl c0306201 0 returned -14 02:35:16 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) [ 2114.825959][T26946] binder: 26943:26946 ioctl c018620c 20000080 returned -1 [ 2114.872480][T26946] binder: 26943:26946 ioctl 541b 0 returned -22 [ 2114.884334][T26955] binder: 26949:26955 ioctl 40046210 0 returned -22 02:35:17 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000380)='/proc/capi/capi20\x00', 0x80c0, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x7, 0x6, &(0x7f0000000440)=@raw=[@alu={0x7, 0x1, 0x3, 0x5, 0xb, 0x4, 0xffffffffffffffff}, @btf_id={0x18, 0x1, 0x3, 0x0, 0x1}, @exit, @func={0x85, 0x0, 0x1, 0x0, 0x2}, @exit], &(0x7f0000000480)='syzkaller\x00', 0x7, 0x0, 0x0, 0x41000, 0x4, [], 0x0, 0x24, r0, 0x8, &(0x7f00000004c0)={0x2, 0x4}, 0x8, 0x10, &(0x7f0000000500)={0x0, 0xc, 0x81, 0x5}, 0x10, 0x0, r0}, 0x78) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0xd, 0x9, &(0x7f0000000240)=@raw=[@func={0x85, 0x0, 0x1, 0x0, 0x1}, @func={0x85, 0x0, 0x1, 0x0, 0x4}, @jmp={0x5, 0x1, 0x5, 0x0, 0x5, 0x8, 0x8}, @generic={0x1d, 0x1, 0x3, 0x64, 0x14}, @jmp={0x5, 0x0, 0xb, 0x9, 0x6, 0x80, 0x7}, @ldst={0x0, 0x2, 0x0, 0x3, 0x5, 0x18, 0xfffffffffffffff0}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffffa}, @generic={0x40, 0x9, 0x5, 0x5, 0x7}, @call={0x85, 0x0, 0x0, 0x4f}], &(0x7f00000002c0)='GPL\x00', 0x3, 0x49, &(0x7f0000000300)=""/73, 0x41100, 0x18, [], 0x0, 0x25, r1, 0x8, &(0x7f00000003c0)={0x4, 0x2}, 0x8, 0x10, &(0x7f0000000400)={0x1, 0xd, 0x3, 0x3f}, 0x10, 0x0, r2}, 0x78) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r0, 0xc0405519, 0x0) write$RDMA_USER_CM_CMD_MIGRATE_ID(r0, &(0x7f0000000040)={0x12, 0x10}, 0x18) r3 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r3, 0x5421, 0x400000) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x1, &(0x7f00000000c0)={0xffffffffffffffff}, 0x13f, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r4, &(0x7f0000000180)={0x14, 0x88, 0xfa00, {r5, 0x10, 0x0, @in6={0xa, 0x4e23, 0x4, @local, 0x8}}}, 0x90) [ 2114.934316][T26946] binder: 26943:26946 ioctl c0306201 0 returned -14 [ 2114.945764][T26959] binder: 26943:26959 ioctl c018620c 20000080 returned -1 02:35:17 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {0x0, 0x3, r1, 0x1c, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) 02:35:17 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x1, 0x40000) ioctl$DRM_IOCTL_AGP_BIND(r0, 0x40106436, &(0x7f0000000080)={0x0, 0x3d32}) syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x800) [ 2114.995724][T26946] binder: 26943:26946 ioctl 541b 0 returned -22 02:35:17 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, &(0x7f0000000040)={0x3}) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000080)={0x78, 0x0, 0x0, {0x100000001, 0x80000001, 0x0, {0x1, 0x1, 0x100000001, 0x7, 0x4, 0xffffffffffffff81, 0x401, 0x5, 0xffffffff, 0xc000, 0xfffff70e, 0xffffffffffffffff, 0xee01, 0x4, 0x2}}}, 0x78) 02:35:17 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0x8, 0x0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vga_arbiter\x00', 0x200840, 0x0) write$vga_arbiter(r1, &(0x7f00000000c0)=@other={'decodes', ' ', 'mem'}, 0xc) 02:35:17 executing program 1: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x300, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/hwrng\x00', 0x2040, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_MAX_THREADS(r2, 0x541b, 0x0) 02:35:17 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x1, 0x40000) ioctl$DRM_IOCTL_AGP_BIND(r0, 0x40106436, &(0x7f0000000080)={0x0, 0x3d32}) 02:35:17 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {0x0, 0x0, r1, 0x1c, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) [ 2115.225174][T26972] binder: 26966:26972 ioctl 40046210 0 returned -22 02:35:17 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r0, 0x89f4, &(0x7f0000000080)={'ip6gre0\x00', &(0x7f0000000000)={'ip6gre0\x00', 0x0, 0x4, 0x2, 0x5, 0x7fffffff, 0x1, @ipv4={[], [], @loopback}, @remote, 0x10, 0x10, 0xfffffffc, 0x3}}) ioctl$TIOCSTI(r0, 0x5421, 0x400000) [ 2115.289125][T26975] binder: 26966:26975 ioctl 40046210 0 returned -22 [ 2115.317032][T26977] binder: 26974:26977 ioctl c0306201 0 returned -14 [ 2115.335350][T26977] binder: 26974:26977 ioctl c0306201 0 returned -14 02:35:17 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1, 0x11, r1, 0x8) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) [ 2115.366930][T26977] binder: 26974:26977 ioctl c0306201 0 returned -14 [ 2115.403953][T26977] binder: 26974:26977 ioctl 541b 0 returned -22 02:35:17 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f0000000040)={0x3}) [ 2115.446941][T26985] binder: 26974:26985 ioctl c0306201 0 returned -14 02:35:17 executing program 4: ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(0xffffffffffffffff, 0xc008551c, &(0x7f0000000040)={0x687, 0x4, [0x1]}) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x5460, 0x0) 02:35:17 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040), 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {0x0, 0x0, 0xffffffffffffffff, 0x1c, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) [ 2115.497527][T26977] binder: 26974:26977 ioctl c0306201 0 returned -14 [ 2115.504950][T26985] binder: 26974:26985 ioctl c0306201 0 returned -14 [ 2115.524029][T26988] binder: 26974:26988 ioctl 541b 0 returned -22 02:35:17 executing program 2: ioctl$DRM_IOCTL_AGP_BIND(0xffffffffffffffff, 0x40106436, &(0x7f0000000080)={0x0, 0x3d32}) [ 2115.578909][T26990] binder: 26987:26990 ioctl c0306201 0 returned -14 [ 2115.617292][T26990] binder: 26987:26990 ioctl 40046210 0 returned -22 02:35:17 executing program 1: ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x541b, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r1 = mmap$binder(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x1, 0x11, 0xffffffffffffffff, 0x1ac0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x80, 0x0, &(0x7f00000000c0)=[@acquire_done, @increfs={0x40046304, 0x1}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000000)={@fda={0x66646185, 0x0, 0x0, 0x19}, @flat=@binder={0x73622a85, 0x1101, 0x1}, @fda={0x66646185, 0x7, 0x2, 0x18}}, &(0x7f0000000080)={0x0, 0x20, 0x38}}}, @free_buffer={0x40086303, r1}, @increfs={0x40046304, 0x2}, @enter_looper, @increfs], 0x78, 0x0, &(0x7f0000000140)="bf64b6536ca65a62bd9e34184ad306cc4db74ebce96c8401de3249b08561c7c522954ee79ca030825517051ea96d2e95bb2701db21cf0ff1dda2f219a209a1bde3c7b952bd80477df30ab6907ac009eafc738261293493bbf1b734c34619dfde7b6c64e2049b167bb8ae2cf246ec081d4e7b18f0f9aef0cc"}) [ 2115.642161][T26993] binder: 26989:26993 ioctl c0306201 0 returned -14 [ 2115.670809][T26995] binder: 26991:26995 ioctl c0306201 0 returned -14 [ 2115.680154][T26996] binder: 26987:26996 ioctl c0306201 0 returned -14 [ 2115.696585][T26999] binder: 26989:26999 ioctl c018620c 20000040 returned -1 [ 2115.712038][T26995] binder: 26991:26995 ioctl c0306201 0 returned -14 [ 2115.725472][T27000] binder: 26987:27000 ioctl 40046210 0 returned -22 [ 2115.748095][T26993] binder: 26989:26993 ioctl c0306201 0 returned -14 [ 2115.756746][T26999] binder: 26989:26999 ioctl c018620c 20000040 returned -1 02:35:17 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040), 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {0x0, 0x0, 0xffffffffffffffff, 0x1c, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) 02:35:17 executing program 2: ioctl$DRM_IOCTL_AGP_BIND(0xffffffffffffffff, 0x40106436, &(0x7f0000000080)={0x0, 0x3d32}) 02:35:17 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {0x0, 0x0, r1, 0x1c, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) 02:35:17 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r0, 0x4b6b, 0x0) r1 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, 0xffffffffffffffff, 0x5) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0xd4, 0x0, &(0x7f00000002c0)=[@reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x18, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000040)={@flat=@binder={0x73622a85, 0x1001, 0x1}, @fda={0x66646185, 0x5, 0x0, 0x21}, @fd={0x66642a85, 0x0, r0}}, &(0x7f00000000c0)={0x0, 0x18, 0x38}}, 0x40}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000200)={@fda={0x66646185, 0x5}, @fda={0x66646185, 0x3, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/211, 0xd3, 0x2, 0x6}}, &(0x7f0000000280)={0x0, 0x20, 0x40}}, 0x40}, @free_buffer={0x40086303, r1}, @increfs_done={0x40106308, 0x2}, @dead_binder_done, @increfs={0x40046304, 0x2}, @increfs={0x40046304, 0x1}], 0x63, 0x0, &(0x7f00000003c0)="30bce0062f269cb2d37b9e82b9c427ff723b0c2b8ac9bb4b010a5fd19466503b01d5643df545322f6f57e34108c748617bfcaf7af83f6cb5b6aefee17b940ef5c846459b5eebb163c9521295692f3fd91fefa636ceb2e08e5430140c946f4d7d3380ad"}) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046210, 0x0) [ 2115.834299][T27004] binder: 27001:27004 ioctl c0306201 0 returned -14 02:35:17 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x100a, 0x3}) [ 2115.900791][T27005] binder: 27001:27005 ioctl c0306201 0 returned -14 02:35:18 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) mmap$binder(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x2d0) ioctl$GIO_FONTX(0xffffffffffffffff, 0x4b6b, &(0x7f0000000100)={0xf9, 0x7, &(0x7f0000001940)}) syz_open_dev$binderN(&(0x7f0000001240)='/dev/binder#\x00', 0x0, 0x1402) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x20a01, 0x0) socket$nl_sock_diag(0x10, 0x3, 0x4) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r2, 0x4b6b, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000001800)={0x94, 0x0, &(0x7f0000001680)=[@reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000001180)={@fda={0x66646185, 0x7, 0x2, 0x7}, @ptr={0x70742a85, 0x0, &(0x7f0000000140)=""/2, 0x2, 0x1, 0x35}, @ptr={0x70742a85, 0x1, &(0x7f0000000180)=""/4096, 0x1000, 0x1, 0x2e}}, &(0x7f0000001200)={0x0, 0x20, 0x48}}}, @enter_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x68, 0x18, &(0x7f0000001400)={@flat=@weak_binder={0x77622a85, 0x0, 0x3}, @ptr={0x70742a85, 0x0, &(0x7f0000001300)=""/118, 0x76, 0x2, 0x9}, @ptr={0x70742a85, 0x0, &(0x7f0000001380)=""/66, 0x42, 0x2, 0x3c}}, &(0x7f0000001480)={0x0, 0x18, 0x40}}}, @release={0x40046306, 0x2}], 0x10, 0x0, &(0x7f0000000080)="38e58f8dce44e2e4683b68fec5b6c022"}) ioctl$KDSKBLED(r2, 0x4b65, 0x7f) getsockopt$bt_sco_SCO_OPTIONS(0xffffffffffffffff, 0x11, 0x1, &(0x7f0000001840)=""/224, &(0x7f00000000c0)=0xe0) 02:35:18 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040), 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {0x0, 0x0, 0xffffffffffffffff, 0x1c, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) 02:35:18 executing program 2: ioctl$DRM_IOCTL_AGP_BIND(0xffffffffffffffff, 0x40106436, &(0x7f0000000080)={0x0, 0x3d32}) 02:35:18 executing program 4: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) r3 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, 0x0) r4 = syz_open_dev$binderN(&(0x7f0000000500)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, 0x0) syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x800) r5 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, 0x0) r6 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r6, 0xc0405519, 0x0) sendmsg$RDMA_NLDEV_CMD_PORT_GET(r6, &(0x7f0000000480)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000001c0)={&(0x7f00000002c0)={0x60, 0x1405, 0x800, 0x70bd26, 0x25dfdbfd, "", [{{0x8, 0x1, 0x1}, {0x8}}, {{0x8, 0x1, 0x1}, {0x8}}, {{0x8, 0x1, 0x1}, {0x8}}, {{0x8, 0x1, 0x1}, {0x8, 0x3, 0x3}}, {{0x8, 0x1, 0x1}, {0x8, 0x3, 0x2}}]}, 0x60}, 0x1, 0x0, 0x0, 0x840}, 0x20040014) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000440)={0x74, 0x0, &(0x7f0000000100)=[@decrefs={0x40046307, 0x1}, @exit_looper, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/35, 0x23, 0x0, 0x36}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}}, @release, @decrefs={0x40046307, 0x2}, @free_buffer], 0xe4, 0x0, &(0x7f0000000340)="192edaf8621943df81acc8221c73261958e5f8ae85aa447823557a30e6683fb7f101dc128832e2cac0d345d10b74ddae1aeab72f3a0b2bc47880b99b81afb1eae43481ab1453f61f27a53d23aee8264f0864b8a511acda89e97d96874adebda0fea7c668502a1b338e5a4baeb421f214d1d3a67e5e396a00b066627b2e496ac10f604074fdfa175876f46b8095672bc46c98fc6a66d043b398630f89aaee27538ea0e60425a68c0bf77df4eeaa03b17a5d98782b3d47a177cff183e49d47b5f2e6fafc9debf5c7d261ccbdd727a28322da1a27798d8ce0f807c940f846c1cf12697736fe"}) r7 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000080)='/proc/capi/capi20\x00', 0x68002, 0x0) ioctl$BINDER_SET_MAX_THREADS(r7, 0x40046210, 0x0) ioctl$SCSI_IOCTL_GET_PCI(r7, 0x5387, &(0x7f00000004c0)) 02:35:18 executing program 5: r0 = syz_init_net_socket$nl_rdma(0xffffffffffffffff, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_GET(r0, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000480)={&(0x7f0000000400)={0x50, 0x1401, 0x200, 0x70bd2c, 0x25dfdbfd, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}]}, 0x50}, 0x1, 0x0, 0x0, 0x8080}, 0x50) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x2) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046210, 0x0) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, &(0x7f0000000300)={0x1}) r2 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000200)={0x50, 0x0, &(0x7f0000000080)=[@decrefs={0x40046307, 0x3}, @increfs_done={0x40106308, 0x1}, @increfs_done={0x40106308, 0x2}, @increfs_done={0x40106308, 0x3}, @dead_binder_done], 0xf9, 0x0, &(0x7f0000000100)="78401af963a87505497f8b7d1e4b36cd318384f659e3f7021825e6fb8ba6ed0c4604b9dc9c327a80c25d511e91e8cac1bc1599279ce9c15940d5541be3487c2cc233393a5471701f63160adb2188336bc2a9ac26a1dad32419c2068e1323c44859e8b9881a8b6a4d31ef94489bfab7e68b9874b6825343a3c0f4f0efcf21ccf9df230898e16c5643db5774af46a9ed9568f39eac3801f4ba92fd842ae690a382a189324d9feaa678ff8c9270d02797f48c9a7ef531de0389641b73524add61f27b927e58286d3b9ea803927bacc25edb5ca2bc7e5b569e304b23f320a2d8f1b5b765e6d50e765d6b051c23e94bad1d70962d8717506563ec13"}) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, &(0x7f00000002c0)={0x2, 0x200, 0x5c}) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000280)='/proc/capi/capi20\x00', 0x200, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_LOCK(0xffffffffffffffff, 0x40405514, &(0x7f0000000240)={0x2, 0x4, 0x8000, 0x1, '\x00', 0x2}) 02:35:18 executing program 3: ioctl$KDGKBLED(0xffffffffffffffff, 0x4b64, &(0x7f0000000040)) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x1800) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) [ 2116.222116][T27022] binder: 27019:27022 ioctl 541b 0 returned -22 [ 2116.292728][T27028] binder: 27023:27028 ioctl c0306201 0 returned -14 [ 2116.305724][T27022] binder: 27019:27022 ioctl 541b 0 returned -22 [ 2116.324001][T27028] binder: 27023:27028 ioctl c0306201 0 returned -14 02:35:18 executing program 2: r0 = syz_open_dev$dri(0x0, 0x1, 0x40000) ioctl$DRM_IOCTL_AGP_BIND(r0, 0x40106436, &(0x7f0000000080)={0x0, 0x3d32}) [ 2116.341965][T27032] binder: 27025:27032 ioctl 40046210 0 returned -22 [ 2116.372164][T27028] binder: 27023:27028 ioctl c0306201 0 returned -14 02:35:18 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x4002, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000280)={0xffffffffffffffff}, 0x2, 0x9}}, 0x20) r4 = syz_open_dev$binderN(&(0x7f0000000340)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_SET_MAX_THREADS(r4, 0x40046205, &(0x7f0000000380)=0x1) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r2, &(0x7f0000000300)={0x5, 0x10, 0xfa00, {&(0x7f0000000080), r3, 0x1}}, 0x18) write$RDMA_USER_CM_CMD_JOIN_MCAST(r2, &(0x7f00000005c0)={0x16, 0x98, 0xfa00, {&(0x7f00000003c0), 0x4, r3, 0x1c, 0x1, @in6={0xa, 0x4e24, 0x54, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x3}}}, 0xa0) ioctl$BINDER_THREAD_EXIT(r4, 0x40046208, 0x0) r5 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r5, 0xc0405519, 0x0) write$RDMA_USER_CM_CMD_INIT_QP_ATTR(r5, &(0x7f0000000580)={0xb, 0x10, 0xfa00, {&(0x7f00000004c0), r3, 0x89d}}, 0x18) 02:35:18 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {0x0, 0x0, r1, 0x0, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) [ 2116.408372][T27028] binder: 27023:27028 ioctl c0306201 0 returned -14 [ 2116.410289][T27035] binder: 27025:27035 ioctl 40046210 0 returned -22 [ 2116.446046][T27028] binder: 27023:27028 ioctl c0306201 0 returned -14 02:35:18 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) sendmsg$RDMA_NLDEV_CMD_STAT_SET(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x30, 0x1410, 0x20, 0x70bd27, 0x25dfdbfd, "", [@RDMA_NLDEV_ATTR_STAT_MODE={0x8, 0x4a, 0x1}, @RDMA_NLDEV_ATTR_STAT_RES={0x8}, @RDMA_NLDEV_ATTR_RES_LQPN={0x8, 0x15, 0x2}, @RDMA_NLDEV_ATTR_STAT_MODE={0x8, 0x4a, 0x1}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000008}, 0x4000000) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) 02:35:18 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000080)='/proc/capi/capi20\x00', 0x101000, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x1108, 0x2}) syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) 02:35:18 executing program 4: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) r3 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, 0x0) r4 = syz_open_dev$binderN(&(0x7f0000000500)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, 0x0) syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x800) r5 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, 0x0) r6 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r6, 0xc0405519, 0x0) sendmsg$RDMA_NLDEV_CMD_PORT_GET(r6, &(0x7f0000000480)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000001c0)={&(0x7f00000002c0)={0x60, 0x1405, 0x800, 0x70bd26, 0x25dfdbfd, "", [{{0x8, 0x1, 0x1}, {0x8}}, {{0x8, 0x1, 0x1}, {0x8}}, {{0x8, 0x1, 0x1}, {0x8}}, {{0x8, 0x1, 0x1}, {0x8, 0x3, 0x3}}, {{0x8, 0x1, 0x1}, {0x8, 0x3, 0x2}}]}, 0x60}, 0x1, 0x0, 0x0, 0x840}, 0x20040014) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000440)={0x74, 0x0, &(0x7f0000000100)=[@decrefs={0x40046307, 0x1}, @exit_looper, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/35, 0x23, 0x0, 0x36}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}}, @release, @decrefs={0x40046307, 0x2}, @free_buffer], 0xe4, 0x0, &(0x7f0000000340)="192edaf8621943df81acc8221c73261958e5f8ae85aa447823557a30e6683fb7f101dc128832e2cac0d345d10b74ddae1aeab72f3a0b2bc47880b99b81afb1eae43481ab1453f61f27a53d23aee8264f0864b8a511acda89e97d96874adebda0fea7c668502a1b338e5a4baeb421f214d1d3a67e5e396a00b066627b2e496ac10f604074fdfa175876f46b8095672bc46c98fc6a66d043b398630f89aaee27538ea0e60425a68c0bf77df4eeaa03b17a5d98782b3d47a177cff183e49d47b5f2e6fafc9debf5c7d261ccbdd727a28322da1a27798d8ce0f807c940f846c1cf12697736fe"}) r7 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000080)='/proc/capi/capi20\x00', 0x68002, 0x0) ioctl$BINDER_SET_MAX_THREADS(r7, 0x40046210, 0x0) ioctl$SCSI_IOCTL_GET_PCI(r7, 0x5387, &(0x7f00000004c0)) [ 2116.587625][T27040] binder: 27038:27040 ioctl 541b 0 returned -22 02:35:18 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {0x0, 0x0, r1, 0x0, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) [ 2116.631233][T27040] binder: 27038:27040 ioctl c0306201 0 returned -14 [ 2116.671782][T27040] binder: BINDER_SET_CONTEXT_MGR already set 02:35:18 executing program 2: r0 = syz_open_dev$dri(0x0, 0x1, 0x40000) ioctl$DRM_IOCTL_AGP_BIND(r0, 0x40106436, &(0x7f0000000080)={0x0, 0x3d32}) [ 2116.711571][T27040] binder: 27038:27040 ioctl 40046207 0 returned -16 [ 2116.734684][T27050] binder: 27044:27050 ioctl c0306201 0 returned -14 02:35:18 executing program 3: ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x5460, 0x0) [ 2116.757151][T27040] binder: 27038:27040 ioctl 541b 0 returned -22 [ 2116.761538][T27054] binder: 27038:27054 ioctl c0306201 0 returned -14 [ 2116.778576][T27052] binder: 27047:27052 ioctl c0306201 0 returned -14 [ 2116.803276][T27050] binder: 27044:27050 ioctl 40046210 0 returned -22 [ 2116.806801][T27051] binder: BINDER_SET_CONTEXT_MGR already set [ 2116.816228][T27051] binder: 27038:27051 ioctl 40046207 0 returned -16 [ 2116.842518][T27058] binder: 27047:27058 ioctl c0306201 0 returned -14 [ 2116.856986][T27059] binder: 27044:27059 ioctl c0306201 0 returned -14 02:35:19 executing program 1: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) r1 = syz_open_dev$sndctrl(&(0x7f0000000000)='/dev/snd/controlC#\x00', 0x9c, 0x218800) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(r1, 0xc008551c, &(0x7f0000000180)={0x6, 0x1c, [0x8000, 0x1000, 0x9, 0x6, 0x80, 0x8001, 0x3]}) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r0, 0xc0405519, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f00000000c0)={'ip6tnl0\x00', &(0x7f0000000040)={'sit0\x00', 0x0, 0x2b, 0x81, 0x6, 0xfffffffb, 0x10, @private0, @dev={0xfe, 0x80, [], 0x29}, 0x20, 0x0, 0xd8, 0x1}}) r2 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_SET_MAX_THREADS(r2, 0x541b, 0x0) [ 2116.894057][T27052] binder: 27047:27052 ioctl c0306201 0 returned -14 [ 2116.913521][T27059] binder: 27044:27059 ioctl 40046210 0 returned -22 [ 2116.923951][T27052] binder: 27047:27052 ioctl c0306201 0 returned -14 02:35:19 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {0x0, 0x0, r1, 0x0, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) [ 2116.966574][T27052] binder: 27047:27052 ioctl c0306201 0 returned -14 02:35:19 executing program 2: r0 = syz_open_dev$dri(0x0, 0x1, 0x40000) ioctl$DRM_IOCTL_AGP_BIND(r0, 0x40106436, &(0x7f0000000080)={0x0, 0x3d32}) 02:35:19 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_TLV_READ(0xffffffffffffffff, 0xc008551a, &(0x7f0000000080)={0x7, 0x4, [0x8]}) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) 02:35:19 executing program 3: socketpair(0x3, 0x2, 0x9, &(0x7f0000000040)={0xffffffffffffffff}) getsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(0xffffffffffffffff, 0x84, 0xc, &(0x7f0000000180), &(0x7f00000001c0)=0x4) sendmsg$RDMA_NLDEV_CMD_PORT_GET(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="30000000051420002bbd7000fcd9df250800010001000000080003000200000008000100020000000800030002000000"], 0x30}, 0x1, 0x0, 0x0, 0xc040001}, 0x0) socketpair(0x2b, 0x1, 0x6, &(0x7f0000000000)) ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x5460, 0x0) 02:35:19 executing program 4: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) r3 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, 0x0) r4 = syz_open_dev$binderN(&(0x7f0000000500)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, 0x0) syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x800) r5 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, 0x0) r6 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r6, 0xc0405519, 0x0) sendmsg$RDMA_NLDEV_CMD_PORT_GET(r6, &(0x7f0000000480)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000001c0)={&(0x7f00000002c0)={0x60, 0x1405, 0x800, 0x70bd26, 0x25dfdbfd, "", [{{0x8, 0x1, 0x1}, {0x8}}, {{0x8, 0x1, 0x1}, {0x8}}, {{0x8, 0x1, 0x1}, {0x8}}, {{0x8, 0x1, 0x1}, {0x8, 0x3, 0x3}}, {{0x8, 0x1, 0x1}, {0x8, 0x3, 0x2}}]}, 0x60}, 0x1, 0x0, 0x0, 0x840}, 0x20040014) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000440)={0x74, 0x0, &(0x7f0000000100)=[@decrefs={0x40046307, 0x1}, @exit_looper, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/35, 0x23, 0x0, 0x36}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}}, @release, @decrefs={0x40046307, 0x2}, @free_buffer], 0xe4, 0x0, &(0x7f0000000340)="192edaf8621943df81acc8221c73261958e5f8ae85aa447823557a30e6683fb7f101dc128832e2cac0d345d10b74ddae1aeab72f3a0b2bc47880b99b81afb1eae43481ab1453f61f27a53d23aee8264f0864b8a511acda89e97d96874adebda0fea7c668502a1b338e5a4baeb421f214d1d3a67e5e396a00b066627b2e496ac10f604074fdfa175876f46b8095672bc46c98fc6a66d043b398630f89aaee27538ea0e60425a68c0bf77df4eeaa03b17a5d98782b3d47a177cff183e49d47b5f2e6fafc9debf5c7d261ccbdd727a28322da1a27798d8ce0f807c940f846c1cf12697736fe"}) r7 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000080)='/proc/capi/capi20\x00', 0x68002, 0x0) ioctl$BINDER_SET_MAX_THREADS(r7, 0x40046210, 0x0) ioctl$SCSI_IOCTL_GET_PCI(r7, 0x5387, &(0x7f00000004c0)) [ 2117.153821][T27068] binder: 27065:27068 ioctl 541b 0 returned -22 [ 2117.175997][T27073] binder: 27065:27073 ioctl 541b 0 returned -22 [ 2117.222401][T27076] binder: 27070:27076 ioctl 40046210 0 returned -22 [ 2117.263564][T27077] binder: 27075:27077 ioctl c0306201 0 returned -14 02:35:19 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {0x0, 0x0, r1, 0x1c, 0x0, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) [ 2117.272242][T27078] binder: 27070:27078 ioctl 40046210 0 returned -22 02:35:19 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x40000) ioctl$DRM_IOCTL_AGP_BIND(r0, 0x40106436, &(0x7f0000000080)={0x0, 0x3d32}) [ 2117.298132][T27077] binder: 27075:27077 ioctl c0306201 0 returned -14 02:35:19 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) ioctl$SG_SET_TIMEOUT(r1, 0x2201, &(0x7f0000000040)=0x4) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) 02:35:19 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(0xffffffffffffffff, 0xc4c85512, &(0x7f0000000040)={{0x0, 0x5, 0x7, 0x4, '\x00', 0xffffff80}, 0x1, [0x5, 0x2, 0x1, 0x9, 0x9, 0x400, 0xffffffff, 0xa3b, 0x9, 0x5, 0x558f, 0x4, 0x6, 0x5, 0xfffffffffffffff7, 0x10000, 0x1, 0x1, 0x86c2, 0x6, 0x400, 0x5, 0x7f, 0x1, 0x1, 0x1, 0x400, 0x7, 0x5221, 0x1, 0x3ff, 0x2, 0x1000, 0x0, 0x9, 0xb5ea, 0xfffffffffffffe01, 0x4, 0x3, 0x700, 0xae, 0x9, 0x6, 0x7, 0x9, 0x92ca, 0x0, 0x357, 0x9, 0x3, 0x40, 0x6, 0x4, 0x8, 0x4, 0x68e91ec2, 0x7, 0xfffffffffffffffd, 0x6, 0x200, 0x6, 0x82c, 0x5, 0x3, 0x40, 0x0, 0x41, 0x2, 0x5, 0x8001, 0x5, 0x0, 0xe14, 0x1, 0x6, 0x8001, 0x8001, 0x9, 0x800, 0x8, 0x800, 0x8000800, 0x2, 0x8, 0x200, 0x9, 0xffffffffffffb8bd, 0x8, 0x100, 0xffff, 0xce8b, 0x7, 0x80000001, 0x8, 0x4, 0x5, 0x6, 0x0, 0xffffffff, 0x2, 0x8, 0x7fff, 0x140000000, 0x10001, 0x9, 0x6, 0xfffffffeffffffff, 0x10000, 0x1, 0x3ff, 0x9, 0xfffffffffffffffe, 0x5, 0x280000, 0x2, 0x0, 0x100000000, 0x6, 0x6, 0x3, 0x8, 0xffffffffffff7fff, 0x5, 0x70a, 0x8000, 0x8c, 0x5, 0x6]}) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) 02:35:19 executing program 3: write$cgroup_netprio_ifpriomap(0xffffffffffffffff, &(0x7f0000000040)={'team_slave_1', 0x32, 0x38}, 0xf) r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x1802) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) [ 2117.346223][T27077] binder: 27075:27077 ioctl c0306201 0 returned -14 [ 2117.383877][T27077] binder: 27075:27077 ioctl c0306201 0 returned -14 [ 2117.427753][T27077] binder: 27075:27077 ioctl c0306201 0 returned -14 02:35:19 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_AGP_BIND(r0, 0x40106436, &(0x7f0000000080)={0x0, 0x3d32}) 02:35:19 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {0x0, 0x0, r1, 0x1c, 0x0, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) [ 2117.515949][T27086] binder: 27084:27086 ioctl 541b 0 returned -22 02:35:19 executing program 4: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) r3 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, 0x0) r4 = syz_open_dev$binderN(&(0x7f0000000500)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, 0x0) syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x800) r5 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, 0x0) r6 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r6, 0xc0405519, 0x0) sendmsg$RDMA_NLDEV_CMD_PORT_GET(r6, &(0x7f0000000480)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000001c0)={&(0x7f00000002c0)={0x60, 0x1405, 0x800, 0x70bd26, 0x25dfdbfd, "", [{{0x8, 0x1, 0x1}, {0x8}}, {{0x8, 0x1, 0x1}, {0x8}}, {{0x8, 0x1, 0x1}, {0x8}}, {{0x8, 0x1, 0x1}, {0x8, 0x3, 0x3}}, {{0x8, 0x1, 0x1}, {0x8, 0x3, 0x2}}]}, 0x60}, 0x1, 0x0, 0x0, 0x840}, 0x20040014) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000440)={0x74, 0x0, &(0x7f0000000100)=[@decrefs={0x40046307, 0x1}, @exit_looper, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/35, 0x23, 0x0, 0x36}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}}, @release, @decrefs={0x40046307, 0x2}, @free_buffer], 0xe4, 0x0, &(0x7f0000000340)="192edaf8621943df81acc8221c73261958e5f8ae85aa447823557a30e6683fb7f101dc128832e2cac0d345d10b74ddae1aeab72f3a0b2bc47880b99b81afb1eae43481ab1453f61f27a53d23aee8264f0864b8a511acda89e97d96874adebda0fea7c668502a1b338e5a4baeb421f214d1d3a67e5e396a00b066627b2e496ac10f604074fdfa175876f46b8095672bc46c98fc6a66d043b398630f89aaee27538ea0e60425a68c0bf77df4eeaa03b17a5d98782b3d47a177cff183e49d47b5f2e6fafc9debf5c7d261ccbdd727a28322da1a27798d8ce0f807c940f846c1cf12697736fe"}) r7 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000080)='/proc/capi/capi20\x00', 0x68002, 0x0) ioctl$BINDER_SET_MAX_THREADS(r7, 0x40046210, 0x0) [ 2117.575941][T27090] binder: 27087:27090 ioctl 40046210 0 returned -22 [ 2117.579044][T27089] binder: 27084:27089 ioctl 541b 0 returned -22 [ 2117.637546][T27094] binder: 27087:27094 ioctl 40046210 0 returned -22 02:35:19 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {0x0, 0x0, r1, 0x1c, 0x0, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) 02:35:19 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f0000000040)=0x7) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) 02:35:19 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) 02:35:19 executing program 2: syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_AGP_BIND(0xffffffffffffffff, 0x40106436, &(0x7f0000000080)={0x0, 0x3d32}) [ 2117.770263][T27101] binder: 27098:27101 ioctl c0306201 0 returned -14 [ 2117.797155][T27101] binder: 27098:27101 ioctl c0306201 0 returned -14 02:35:19 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {0x0, 0x0, r1, 0x1c, 0x0, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) [ 2117.827835][T27101] binder: 27098:27101 ioctl c0306201 0 returned -14 [ 2117.857533][T27101] binder: 27098:27101 ioctl c0306201 0 returned -14 [ 2117.892926][T27101] binder: 27098:27101 ioctl c0306201 0 returned -14 [ 2117.916784][T27108] binder: 27103:27108 ioctl c0306201 0 returned -14 02:35:20 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {0x0, 0x0, r1, 0x1c, 0x0, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) [ 2117.943535][T27108] binder: 27103:27108 ioctl 541b 0 returned -22 [ 2117.992846][T27113] binder: 27103:27113 ioctl c0306201 0 returned -14 02:35:20 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {0x0, 0x0, r1, 0x1c, 0x1, @in6={0xa, 0x0, 0xffff, @empty, 0x8}}}, 0xa0) 02:35:20 executing program 4: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) r3 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, 0x0) r4 = syz_open_dev$binderN(&(0x7f0000000500)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, 0x0) syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x800) r5 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, 0x0) r6 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r6, 0xc0405519, 0x0) sendmsg$RDMA_NLDEV_CMD_PORT_GET(r6, &(0x7f0000000480)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000001c0)={&(0x7f00000002c0)={0x60, 0x1405, 0x800, 0x70bd26, 0x25dfdbfd, "", [{{0x8, 0x1, 0x1}, {0x8}}, {{0x8, 0x1, 0x1}, {0x8}}, {{0x8, 0x1, 0x1}, {0x8}}, {{0x8, 0x1, 0x1}, {0x8, 0x3, 0x3}}, {{0x8, 0x1, 0x1}, {0x8, 0x3, 0x2}}]}, 0x60}, 0x1, 0x0, 0x0, 0x840}, 0x20040014) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000440)={0x74, 0x0, &(0x7f0000000100)=[@decrefs={0x40046307, 0x1}, @exit_looper, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/35, 0x23, 0x0, 0x36}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}}, @release, @decrefs={0x40046307, 0x2}, @free_buffer], 0xe4, 0x0, &(0x7f0000000340)="192edaf8621943df81acc8221c73261958e5f8ae85aa447823557a30e6683fb7f101dc128832e2cac0d345d10b74ddae1aeab72f3a0b2bc47880b99b81afb1eae43481ab1453f61f27a53d23aee8264f0864b8a511acda89e97d96874adebda0fea7c668502a1b338e5a4baeb421f214d1d3a67e5e396a00b066627b2e496ac10f604074fdfa175876f46b8095672bc46c98fc6a66d043b398630f89aaee27538ea0e60425a68c0bf77df4eeaa03b17a5d98782b3d47a177cff183e49d47b5f2e6fafc9debf5c7d261ccbdd727a28322da1a27798d8ce0f807c940f846c1cf12697736fe"}) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000080)='/proc/capi/capi20\x00', 0x68002, 0x0) 02:35:20 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000040)={0x78, 0x0, 0x0, {0x8, 0xa7, 0x0, {0x6, 0x7f, 0x401, 0x6, 0x0, 0x8, 0x7fff, 0x0, 0x1, 0x2000, 0x7, 0x0, 0xffffffffffffffff, 0x16af, 0xffffffc3}}}, 0x78) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) [ 2118.049147][T27115] binder: 27103:27115 ioctl 541b 0 returned -22 02:35:20 executing program 2: syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_AGP_BIND(0xffffffffffffffff, 0x40106436, &(0x7f0000000080)={0x0, 0x3d32}) 02:35:20 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0xc04) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000240)={0x2}) ioctl$GIO_CMAP(0xffffffffffffffff, 0x4b70, &(0x7f0000000280)) write$RDMA_USER_CM_CMD_GET_EVENT(r1, &(0x7f0000000200)={0xc, 0x8, 0xfa00, {&(0x7f0000000080)}}, 0x10) 02:35:20 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {0x0, 0x0, r1, 0x1c, 0x0, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) [ 2118.233573][T27123] binder: 27119:27123 ioctl 40046210 0 returned -22 [ 2118.249069][T27125] binder: 27120:27125 ioctl c0306201 0 returned -14 [ 2118.261866][T27126] binder: 27122:27126 ioctl 541b 0 returned -22 02:35:20 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {0x0, 0x0, r1, 0x1c, 0x1, @in6={0xa, 0x0, 0x0, @empty, 0x8}}}, 0xa0) [ 2118.290041][T27125] binder: 27120:27125 ioctl c0306201 0 returned -14 [ 2118.292286][T27127] binder: 27119:27127 ioctl 40046210 0 returned -22 [ 2118.314780][T27125] binder: 27120:27125 ioctl c0306201 0 returned -14 02:35:20 executing program 2: syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_AGP_BIND(0xffffffffffffffff, 0x40106436, &(0x7f0000000080)={0x0, 0x3d32}) [ 2118.339609][T27125] binder: 27120:27125 ioctl c0306201 0 returned -14 [ 2118.371769][T27125] binder: 27120:27125 ioctl c0306201 0 returned -14 02:35:20 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x802) r2 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f0000000040)=0xc) 02:35:20 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {0x0, 0x0, r1, 0x1c, 0x1, @in6={0xa, 0x0, 0x0, @empty}}}, 0xa0) 02:35:20 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {0x0, 0x0, 0xffffffffffffffff, 0x1c, 0x0, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) 02:35:20 executing program 4: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) r3 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, 0x0) r4 = syz_open_dev$binderN(&(0x7f0000000500)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, 0x0) syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x800) r5 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, 0x0) r6 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r6, 0xc0405519, 0x0) sendmsg$RDMA_NLDEV_CMD_PORT_GET(r6, &(0x7f0000000480)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000001c0)={&(0x7f00000002c0)={0x60, 0x1405, 0x800, 0x70bd26, 0x25dfdbfd, "", [{{0x8, 0x1, 0x1}, {0x8}}, {{0x8, 0x1, 0x1}, {0x8}}, {{0x8, 0x1, 0x1}, {0x8}}, {{0x8, 0x1, 0x1}, {0x8, 0x3, 0x3}}, {{0x8, 0x1, 0x1}, {0x8, 0x3, 0x2}}]}, 0x60}, 0x1, 0x0, 0x0, 0x840}, 0x20040014) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000440)={0x74, 0x0, &(0x7f0000000100)=[@decrefs={0x40046307, 0x1}, @exit_looper, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/35, 0x23, 0x0, 0x36}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}}, @release, @decrefs={0x40046307, 0x2}, @free_buffer], 0xe4, 0x0, &(0x7f0000000340)="192edaf8621943df81acc8221c73261958e5f8ae85aa447823557a30e6683fb7f101dc128832e2cac0d345d10b74ddae1aeab72f3a0b2bc47880b99b81afb1eae43481ab1453f61f27a53d23aee8264f0864b8a511acda89e97d96874adebda0fea7c668502a1b338e5a4baeb421f214d1d3a67e5e396a00b066627b2e496ac10f604074fdfa175876f46b8095672bc46c98fc6a66d043b398630f89aaee27538ea0e60425a68c0bf77df4eeaa03b17a5d98782b3d47a177cff183e49d47b5f2e6fafc9debf5c7d261ccbdd727a28322da1a27798d8ce0f807c940f846c1cf12697736fe"}) 02:35:20 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_AGP_BIND(r0, 0x40106436, 0x0) [ 2118.581945][T27138] binder: 27135:27138 ioctl 40046210 0 returned -22 [ 2118.635054][T27138] binder: 27135:27138 ioctl 40046210 0 returned -22 [ 2118.666538][T27144] binder: 27139:27144 ioctl c0306201 0 returned -14 02:35:20 executing program 0: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) r3 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, 0x0) r4 = syz_open_dev$binderN(&(0x7f0000000500)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, 0x0) syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x800) r5 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, 0x0) r6 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r6, 0xc0405519, 0x0) sendmsg$RDMA_NLDEV_CMD_PORT_GET(r6, &(0x7f0000000480)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000001c0)={&(0x7f00000002c0)={0x60, 0x1405, 0x800, 0x70bd26, 0x25dfdbfd, "", [{{0x8, 0x1, 0x1}, {0x8}}, {{0x8, 0x1, 0x1}, {0x8}}, {{0x8, 0x1, 0x1}, {0x8}}, {{0x8, 0x1, 0x1}, {0x8, 0x3, 0x3}}, {{0x8, 0x1, 0x1}, {0x8, 0x3, 0x2}}]}, 0x60}, 0x1, 0x0, 0x0, 0x840}, 0x20040014) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000440)={0x74, 0x0, &(0x7f0000000100)=[@decrefs={0x40046307, 0x1}, @exit_looper, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/35, 0x23, 0x0, 0x36}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}}, @release, @decrefs={0x40046307, 0x2}, @free_buffer], 0xe4, 0x0, &(0x7f0000000340)="192edaf8621943df81acc8221c73261958e5f8ae85aa447823557a30e6683fb7f101dc128832e2cac0d345d10b74ddae1aeab72f3a0b2bc47880b99b81afb1eae43481ab1453f61f27a53d23aee8264f0864b8a511acda89e97d96874adebda0fea7c668502a1b338e5a4baeb421f214d1d3a67e5e396a00b066627b2e496ac10f604074fdfa175876f46b8095672bc46c98fc6a66d043b398630f89aaee27538ea0e60425a68c0bf77df4eeaa03b17a5d98782b3d47a177cff183e49d47b5f2e6fafc9debf5c7d261ccbdd727a28322da1a27798d8ce0f807c940f846c1cf12697736fe"}) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000080)='/proc/capi/capi20\x00', 0x68002, 0x0) 02:35:20 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {0x0, 0x0, 0xffffffffffffffff, 0x1c, 0x0, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) [ 2118.698710][T27144] binder: 27139:27144 ioctl c0306201 0 returned -14 02:35:20 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000001080)={0x10, 0x0, &(0x7f0000000040)=[@exit_looper, @increfs={0x40046304, 0x1}, @exit_looper], 0x1000, 0x0, &(0x7f0000000080)="6b2410f7b05333f1e2f413e9fce2871f79323aceff62e44a062988cadd927f52642014e4f08f6d47597fc3a4c525eae282032517ee6a7fbb1e0ac5b328af8ae871868aad03c3e658755c77875039b8111f38540bbeef03b91167efe1f4335413f34ab3e644d9b23a1e5873c2f17f792411a3273e686b5232d888563f3d3b3b8db9f88e910063fe8f14a8a47ad59e7062f28e51178d800f7aaddf8fb0459eb762bc12c1dc2d5994a4b2908b33fffabdd914fad83bbad44cf797e062c416f7219646c250f7830a3d8b74880b8c7442b36e11828174e3f72d739dcfd457b2f91dbc013e0f808f692294049a5b2d2504665c616f2c267f240d68bc1ba80cf0a280616d0d1134a1a1511f0e690d94f333903e4eb6738738ab2dc07f0cea69c7915ec5c789764acf1b7c4c3b7ebbb5f322d2f07af1cb23f93abccc99e895ddde0cb4d200c3d4f06301b483d58d179f944d865a5187fec027907ad47235ef676afd749fcb3ea4541eb38470847f79c6b7748cdc4bfb167b3905690daceeb6deba2807c86ad60407d7ad96b2c723e5a8e34498b559c93d13ce811c0b5eb48a47576bf6de9168aaf3caaaf52877db9394dcc93d342c5f30967304e4667a3b0cd96645f23c00da3ba54f3643141dd2d40511d6561b7e0fda9c0dc97694cbb0282339989e16220f6d6283f40ceb51543763f2b21d0c5ff9c013783f43b94c730e2b900f040e23f3db15c8b4b28bdbdf62c0cfea27f400e4b97236f3c49cf7eb08e7fa0c52536316c999bde916b5170a1948d0044c7a0be22494dd79c2a9a006429833d7d70a1a22599cea15d446af797c8ee6fb4eafb9b1d3c341a56d587d4f4ec6f8e3e8f17f617eae145a815cc8851feb4af21dedd2050da3b602fd8b9a0d49565836c6f1fd5fe0060ba64cc38c6f927b04a40b89cb90eef2715768b5bd8dd60d576e2d0a3be47740d7b5da9167d53bda810f7d1517e57369e3ce64078f66bc88c831dd317edf457570263e02beedfefd58df6a03e02718a311a1691c9c741112404c6310140da1daff0b588a3d702afec1aafb90a57326fae2936ebacbe0057d01a915da1e21d5ee6c0ce3f54ad7a70e254ee91809fb2f96e915ac4a6c3ea479b7f0816db751db3c7d737e392503777c2aae7a64d5e48aad91ea5cb384eb61cc41edc14db81a62b3fdff0ec643fc34679d9a34387a4648d9c0f77d916257856c30665dbcbdcbe6756492c57cc18ae442f9892237a7f3e8b659411b0168b2eee67ca8b8e5774950dcbf334f380a55c23c782b2640e3c882d940c773e6ab224d7188b8760b4d9f8052f425db3e42d42c6b5bddc97e913aa49ed051894cc7573da6d8f6ae4954bb39911c673fe886092c74fc550d282d945b7f7ada33eaf075ccb82660a8d5dae42ef051a754313f811cf556d902bcd95121705c1c16b73fc7b8816ab8898cf95067f1a4d8bbe6965e75e2473fdd41394fb849f251735d3156b10d53188beaf245a17ecd2d29c91d4143b54f0e0c007d91ede805f3084ae94d26b114c9c59c7342470da19ed6ae07bb4f547e5ff92146782edaf240b95a3a5227c577a1a9572c565c118d73835970c5185457575b5da1763e1d69292fbc67c972df4e4cdc854d708ca5a070f7330c82fabeebc823c3c79cdd2d5681dcef3f4ceef614503541633c656cee140e225f27b0346dd76830bd2162c2f7617e588e919a254f43cf48e010e9b9f852ad51d1e6428798f5e4814e615ff09319f3d9f5d05f85aac3460a880d9a6625c79dbf5a83f0d05d31e97365c9d6a048b95c11be168f736384e43da05092f82536ad7e8c7aa13991e7cda0716dba4ac008df4b4d53e73e1324705b207fc4286f3154324b2f5409edbd1c6b110be8b220364ac53d2e538302b31e200d1e6cedf45e7d45bb144ce75c0f5a6b109a3d29a01058a18f0d3850fd933918421c679be7d6360332e1604d1460b9b3535bed452739beef97143ed045d8c513af7cb2bb91e86254bfdf469d8ec8b0b269d71e1e90fd237b1f6e4e3cacac16dbde2a4fdb2d65471feb73b48c914989b087ac1526646ca67179e494e19bca9325fba496c754bcdd40e372d394ae717b763cc8c642fb13541604c0cdbf3051db5bca9f3e1e23e252fd2fb80dd7b0d10429d30ae7da2e98ad49e1a8f57889d43d3713e61bcbc623f89fe5ea81ea512c02767845ee634aaf8275d5ca217a2f4030225cabfed7b2fff165547ac7e493214d9df07cfe3e03a31c45a717e87a6a9592f75040fb395a74678a475923aa5d046ff7712f8ec8090a15bc0c7395b69fe59c53bb778ce2015cf6ee0004ef7f90dad57368fa655aec5a34675ae3eeb365a04bacf8f4daba735002db30daca8dde51d842a59c65b8ae99324ca2e5905b66536524f5b1e5bfbc66ab2b376ec2cd9ba6ce5c540c05421ce6bf817212392c2d3ba0b507e3bda399e7c517369239eb39f728349b39c1fff18479450a565222e08bf6c8e7c96e67b2f2476098fe7fb9885314a2f7a7cc949f00d2914a1daf2228e61267663877d6ef3dbb0c7192dc624ff105fb5875a8132c447c87318010d02e2075e28661ffe7b5f801545c1851ba7013c17f83bc9c92f0a6d8e636b3ff72a7d92cd6ab8ae32405a16276c897e845ac5309f8c027e144f3b78625a0d7cd862e424210480427b4ffb789a237aeac279e6d860dc076c24ceae1a74341e74302a40136f5f22c23d58b408c7f96afeddc71810c5cb7e1a7fbf0be164009835ecd40fc72e661118a59162cdfed60eecdec6bc0bf76bf32da86cf14073a386fbfbf61d5bf1079bba7ec1952eaf162d2604d8ce7eff411f429e4dc58d75d2b75627ec4fe0ad7b14df553e753d8392450f3e0eb913e60a005e7fe64d66d66cee73a2c669f2ef2cc4782f9f9e720bd05ffa9416bb1979a137c5edc4396ae35f10674772de316019fee3dfdcf0a845ff90514bf42aa97b1ab4da4fafb0a0e05152ad8820b4b6f8b1ec1dabf7543a3079f438bb043ab03ffe0926511bdb3eb441ebe10721ae98a1cdedcf2a767ec576b1022c21eb330b8bb5637677263812d5e6c5929dc67ce8fe2b9bf4d754cdc46fbbd09ccd624f29e2772f16b2678a78534977e2a577104785c9db31b026f58485e9a2d2ebcd2b0f4e415efda94642ce9ec61f6a56dd207137bed4c14dce2c603083f28ef4f9a3648270ade1593474eba45d55186c5edd794e7e9ebae9d35df330737f60340d09d41af741706a3ed1aa07b1fb5ab593451b5331185c4a3641002a4d490b4d6d234fb83ffd18a9fe0b96992d03e2bd77c0c669e7ed11ff8c309ade5c72af1ad6e5518b23b61ee2e81494f8fb54c27f54a38737e7a19b456ed426aa70395e361d520ee6633eb567ac048d5ee254e65b397561369375869554f78bf5dd7fb2060631fe5e39287ef1eece37388ec21f3f13f28133f1c551f1d6a64d68977be1399ef284e139f55523e1b25c37daebd7b73b050c84ab2551671c8db1e4ecb7fc4d7ab7afc39847ef70fb9f67de93567b45cfe15c13de83da4d94cedce219b0d1d43da5815d4f1b098ffbd890945ef822b9350d12c3b542db4a1d4d4ce50f4c22df747f9344cc990e69f5b4c203d8b95c3433d4283a2c0ff711ccfcc080069eca1161af3c77566ec0b94b86c4a3b14935015ab9144753fa6bea3f1caabcc64318cb8be6c007793a7b6fc509a66d95b29a8b6ac792dc9ff30b4d5825a8274dfa92d1286889913846218182d5ba8398e3ec14a000413bbaeb6e55062e006daedcf90d1652ef027e69534acecfdadb0634b724d437a2084d1cf84bf2971436d8d00e0359bd6d9be8cc0501a277969ecb34f401ee45eb46dd47915c881bf2c62c13a6dbf1fb44fa9dd1867d324b3203d0cdbf1dec13696da1576255ffb10618e0bf786678cb7d017744faf085b794c3b7ac4ea84126a3bce943e26e5db0484c74fbb594f86eff89e2cbf542d49590865cf1f1a9ffbc056d2ffe49256f7a4aaba6ab95296f4322699929b93d549b9b969f60e5a731d2e6fb4c17ac8ed5abb748a6304e3ea4cf4b94f53543a05f2ab0f801deaf679905353ea634145ecdc83a29dcf5e6a7953ed28a1e106d3a2ef22d5a2298b0261633cbcaa9948057d2830007dc94314947ffc88128d3855c509cb72d71918a60dddcbcc6ef8058df8b599e375da55f9e1a35b2c5be6bffe06087900f9b9b4f52b6e0e5554d840173d5d92206d8197b1163ed2c5e8582bf4d51056ae52b126ee0416321e8602466eb64ce411f8392d3b55fea6192861059511436f994daffee8c68fa0f6ec6d936d1a6d3103c3fa8d5ed9ad607dda23e67d420a9f813384ca2f099f4e3aaaf442311c0967a8d3e594f6c51af7f9da51f7f34c4c758ddf221e1550abb66f0ed63674dfc217da5477145234cc320260655a7a86776401640c8e9834bb782f0d7c08f60ed9c0fc04434be23e73c49f1c7a4ae1a038fcc02e3393a2a7bcd68fe9a15222a36ff8223f8fcba11c552ab12297a5ddbdea736b14111959c025c471c7b94bdc4790b597d608a5d06579de435f16af02dd931b723e9f830ba55ad1252c8b9b9580618beddfa2e6c77cb40722d9b6f159459806cbafab42e2b11b528e749e3e7c56b516319b2141f85333075a041c36f25ab4fa947444ab7b7fd01e2aebf8e6c4be8286dc264e8f34849d695e82adbeae9493d71eb6133bac423862cd525439aefe023701426ef28a4ebeeef817c35b1656d029a5b4afd772b7fcb0d20f507757ee5dae0498d7a885a2077ccee45e863fcf590f5354196199649e0701969f8c3f568afb2b502066dd1e23b4175ccdd1353f68e125cc235deaddfec9979e010da0d944e2b62ae7862996d9e270218434276b5d2861194ee93fbf4bc4df739d609337795efdcf18f504a5b4de13c51bf351cef2a035b5c1fe1f60b8cdc8a7a15b9cde6035b9429c09fd5e93837306325f3d85a3362d176ba4482bb870b2bb22bc6e8175988494f2c0d661ada3641bacf404862227ed4bb3c84fd51f0076530aa92fa7f3976f6fc93d8d1fdbfc7a11aaf6edcd37837f96db44bba292f2bd37c2c4fb0c26b3449f4ec452eb15fe4a267d490fbf55b089b3695cf7a181dc75fa5d3111623ae222dee1eb2c705d15d93414e6899a5df6fcb397c06f1542fe683b78cba0ac015cd24ee2773b46c41ce2257d1cce4af50c2fb01b4f707d6d5d5f0b9ffeee3fa610b50b601a2304d5f7a3e896f45aed4fd2c2d849fdd6d54c49f14658f814ea83377dd82da01e0bf24d2545cd17e60a9c7ac30a5eb029c01de4ec90cd12022a8eefa47901a33d922557ea43f183fcd4da2163edd53eb1b935226c14585503ac7dc675bce20dc19e5669934961ff7958f5e1ad95ae4b81fc251e6b1d66893b943bbafef5f0832dc8b363608d020c87c2c366d60ef2d5e3e8f0002906ac40774e582563227da2c06fa9b5cb74281c099412f262f0e230766e3da372e965faa0c4d5874baaf562b02ba8dce09131508bc55dcf56668a5d6afd8f8801d21bd9a40c213a1c4a43cb450c7ea18016f9276033831f13e6898fba74a8926e365e2c1bd081f74f9da3a69e2e6c65752266b555bf684cc564e2d3d120b5a806f45fede3b79b536a9a81cfa0de511a2d50cd97c86df9d78b963ac604bc13f4e4c4d10d6e7006c8cbe3703ccf4d743440b96103516b0cb4bbc8d7eb813b5cbcf6eb51925d41b7914c4b73ffd58b9ba544f04880c160d5dfdfc4a521cc0c6236dc30a9f437f3b7f3b0c68ab3f036db38e38711b7572e34716fbff40fe4e6957c0a01"}) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) [ 2118.752328][T27144] binder: 27139:27144 ioctl c0306201 0 returned -14 [ 2118.786253][T27144] binder: 27139:27144 ioctl c0306201 0 returned -14 [ 2118.818062][T27144] binder: 27139:27144 ioctl c0306201 0 returned -14 [ 2118.848827][T27150] binder: 27148:27150 ioctl c0306201 0 returned -14 [ 2118.879018][T27150] binder: 27148:27150 ioctl c0306201 0 returned -14 [ 2118.905992][T27153] binder: 27151:27153 ioctl c0306201 0 returned -14 [ 2118.907671][T27150] binder: 27148:27150 ioctl c0306201 0 returned -14 [ 2118.949056][T27150] binder: 27148:27150 ioctl c0306201 0 returned -14 [ 2118.975234][T27150] binder: 27148:27150 ioctl c0306201 0 returned -14 [ 2118.988554][T27154] binder: 27151:27154 ioctl 40046210 0 returned -22 [ 2119.078139][T27155] binder: 27122:27155 ioctl 541b 0 returned -22 02:35:21 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {0x0, 0x0, 0xffffffffffffffff, 0x1c, 0x0, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) 02:35:21 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_AGP_BIND(r0, 0x40106436, 0x0) 02:35:21 executing program 4: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) r3 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, 0x0) r4 = syz_open_dev$binderN(&(0x7f0000000500)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, 0x0) syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x800) r5 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, 0x0) r6 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r6, 0xc0405519, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000440)={0x74, 0x0, &(0x7f0000000100)=[@decrefs={0x40046307, 0x1}, @exit_looper, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/35, 0x23, 0x0, 0x36}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}}, @release, @decrefs={0x40046307, 0x2}, @free_buffer], 0xe4, 0x0, &(0x7f0000000340)="192edaf8621943df81acc8221c73261958e5f8ae85aa447823557a30e6683fb7f101dc128832e2cac0d345d10b74ddae1aeab72f3a0b2bc47880b99b81afb1eae43481ab1453f61f27a53d23aee8264f0864b8a511acda89e97d96874adebda0fea7c668502a1b338e5a4baeb421f214d1d3a67e5e396a00b066627b2e496ac10f604074fdfa175876f46b8095672bc46c98fc6a66d043b398630f89aaee27538ea0e60425a68c0bf77df4eeaa03b17a5d98782b3d47a177cff183e49d47b5f2e6fafc9debf5c7d261ccbdd727a28322da1a27798d8ce0f807c940f846c1cf12697736fe"}) 02:35:21 executing program 0: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) r3 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, 0x0) r4 = syz_open_dev$binderN(&(0x7f0000000500)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, 0x0) syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x800) r5 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, 0x0) r6 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r6, 0xc0405519, 0x0) sendmsg$RDMA_NLDEV_CMD_PORT_GET(r6, &(0x7f0000000480)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000001c0)={&(0x7f00000002c0)={0x60, 0x1405, 0x800, 0x70bd26, 0x25dfdbfd, "", [{{0x8, 0x1, 0x1}, {0x8}}, {{0x8, 0x1, 0x1}, {0x8}}, {{0x8, 0x1, 0x1}, {0x8}}, {{0x8, 0x1, 0x1}, {0x8, 0x3, 0x3}}, {{0x8, 0x1, 0x1}, {0x8, 0x3, 0x2}}]}, 0x60}, 0x1, 0x0, 0x0, 0x840}, 0x20040014) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000440)={0x74, 0x0, &(0x7f0000000100)=[@decrefs={0x40046307, 0x1}, @exit_looper, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/35, 0x23, 0x0, 0x36}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}}, @release, @decrefs={0x40046307, 0x2}, @free_buffer], 0xe4, 0x0, &(0x7f0000000340)="192edaf8621943df81acc8221c73261958e5f8ae85aa447823557a30e6683fb7f101dc128832e2cac0d345d10b74ddae1aeab72f3a0b2bc47880b99b81afb1eae43481ab1453f61f27a53d23aee8264f0864b8a511acda89e97d96874adebda0fea7c668502a1b338e5a4baeb421f214d1d3a67e5e396a00b066627b2e496ac10f604074fdfa175876f46b8095672bc46c98fc6a66d043b398630f89aaee27538ea0e60425a68c0bf77df4eeaa03b17a5d98782b3d47a177cff183e49d47b5f2e6fafc9debf5c7d261ccbdd727a28322da1a27798d8ce0f807c940f846c1cf12697736fe"}) 02:35:21 executing program 1: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) [ 2119.203233][T27164] binder: 27162:27164 ioctl c0306201 0 returned -14 [ 2119.222940][T27167] binder: 27160:27167 ioctl c0306201 0 returned -14 [ 2119.231870][T27164] binder: 27162:27164 ioctl c0306201 0 returned -14 02:35:21 executing program 3: write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {0x0, 0x0, r0, 0x1c, 0x0, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) 02:35:21 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_AGP_BIND(r0, 0x40106436, 0x0) [ 2119.267219][T27167] binder: 27160:27167 ioctl c0306201 0 returned -14 [ 2119.274686][T27164] binder: 27162:27164 ioctl c0306201 0 returned -14 [ 2119.308760][T27169] binder: 27168:27169 ioctl c0306201 0 returned -14 [ 2119.311669][T27164] binder: 27162:27164 ioctl c0306201 0 returned -14 [ 2119.326406][T27167] binder: 27160:27167 ioctl c0306201 0 returned -14 [ 2119.341067][T27169] binder: 27168:27169 ioctl 541b 0 returned -22 [ 2119.351734][T27164] binder: 27162:27164 ioctl c0306201 0 returned -14 [ 2119.364059][T27167] binder: 27160:27167 ioctl c0306201 0 returned -14 [ 2119.399763][T27173] binder: 27168:27173 ioctl c0306201 0 returned -14 [ 2119.403074][T27167] binder: 27160:27167 ioctl c0306201 0 returned -14 02:35:21 executing program 4: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) r3 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, 0x0) r4 = syz_open_dev$binderN(&(0x7f0000000500)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, 0x0) syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x800) r5 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, 0x0) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000440)={0x74, 0x0, &(0x7f0000000100)=[@decrefs={0x40046307, 0x1}, @exit_looper, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/35, 0x23, 0x0, 0x36}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}}, @release, @decrefs={0x40046307, 0x2}, @free_buffer], 0xe4, 0x0, &(0x7f0000000340)="192edaf8621943df81acc8221c73261958e5f8ae85aa447823557a30e6683fb7f101dc128832e2cac0d345d10b74ddae1aeab72f3a0b2bc47880b99b81afb1eae43481ab1453f61f27a53d23aee8264f0864b8a511acda89e97d96874adebda0fea7c668502a1b338e5a4baeb421f214d1d3a67e5e396a00b066627b2e496ac10f604074fdfa175876f46b8095672bc46c98fc6a66d043b398630f89aaee27538ea0e60425a68c0bf77df4eeaa03b17a5d98782b3d47a177cff183e49d47b5f2e6fafc9debf5c7d261ccbdd727a28322da1a27798d8ce0f807c940f846c1cf12697736fe"}) 02:35:21 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_AGP_BIND(r0, 0x40106436, &(0x7f0000000080)) [ 2119.433413][T27169] binder: 27168:27169 ioctl 541b 0 returned -22 02:35:21 executing program 3: write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {0x0, 0x0, r0, 0x1c, 0x0, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) 02:35:21 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) r2 = syz_open_dev$sndctrl(&(0x7f0000000100)='/dev/snd/controlC#\x00', 0x1bf80, 0x189800) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(r2, 0xc008551c, &(0x7f0000000180)={0x1000, 0x4, [0x7]}) write$FUSE_ENTRY(r1, &(0x7f0000000040)={0x90, 0x0, 0x0, {0x4, 0x0, 0xfffffffffffffffa, 0x306, 0x4, 0xffff, {0x2, 0x10000, 0x9, 0x0, 0x9, 0x7, 0x1ff, 0x7, 0x80000001, 0x2000, 0x4, 0xffffffffffffffff, 0x0, 0x4}}}, 0x90) [ 2119.547981][T27177] binder: 27175:27177 ioctl c0306201 0 returned -14 [ 2119.555513][T27177] binder: 27175:27177 ioctl c0306201 0 returned -14 [ 2119.572568][T27177] binder: 27175:27177 ioctl c0306201 0 returned -14 [ 2119.596037][T27177] binder: 27175:27177 ioctl c0306201 0 returned -14 [ 2119.636221][T27177] binder: 27175:27177 ioctl c0306201 0 returned -14 [ 2119.647775][T27182] binder: 27180:27182 ioctl 541b 0 returned -22 [ 2119.685666][T27182] binder: 27180:27182 ioctl 541b 0 returned -22 [ 2119.726685][T27154] binder: 27151:27154 ioctl c0306201 0 returned -14 [ 2119.746012][T27154] binder: 27151:27154 ioctl 40046210 0 returned -22 02:35:21 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000080)='/proc/capi/capi20\x00', 0x200000, 0x0) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r2, 0xc018620c, &(0x7f00000000c0)={0x2}) 02:35:21 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_AGP_BIND(r0, 0x40106436, 0x0) 02:35:21 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_AGP_BIND(r0, 0x40106436, &(0x7f0000000080)) 02:35:21 executing program 3: write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {0x0, 0x0, r0, 0x1c, 0x0, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) 02:35:21 executing program 4: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) r3 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, 0x0) r4 = syz_open_dev$binderN(&(0x7f0000000500)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, 0x0) syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x800) r5 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000440)={0x74, 0x0, &(0x7f0000000100)=[@decrefs={0x40046307, 0x1}, @exit_looper, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/35, 0x23, 0x0, 0x36}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}}, @release, @decrefs={0x40046307, 0x2}, @free_buffer], 0xe4, 0x0, &(0x7f0000000340)="192edaf8621943df81acc8221c73261958e5f8ae85aa447823557a30e6683fb7f101dc128832e2cac0d345d10b74ddae1aeab72f3a0b2bc47880b99b81afb1eae43481ab1453f61f27a53d23aee8264f0864b8a511acda89e97d96874adebda0fea7c668502a1b338e5a4baeb421f214d1d3a67e5e396a00b066627b2e496ac10f604074fdfa175876f46b8095672bc46c98fc6a66d043b398630f89aaee27538ea0e60425a68c0bf77df4eeaa03b17a5d98782b3d47a177cff183e49d47b5f2e6fafc9debf5c7d261ccbdd727a28322da1a27798d8ce0f807c940f846c1cf12697736fe"}) 02:35:21 executing program 1: openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qrtr-tun\x00', 0x1c1000) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/qrtr-tun\x00', 0x100) [ 2119.885056][T27192] binder: 27189:27192 ioctl c0306201 0 returned -14 [ 2119.910700][T27192] binder: 27189:27192 ioctl c0306201 0 returned -14 [ 2119.929931][T27192] binder: 27189:27192 ioctl c0306201 0 returned -14 [ 2119.931250][T27194] binder: 27191:27194 ioctl 541b 0 returned -22 [ 2119.938256][T27198] binder: 27193:27198 ioctl 40046210 0 returned -22 [ 2119.955625][T27192] binder: 27189:27192 ioctl c0306201 0 returned -14 [ 2119.972586][T27198] binder: 27193:27198 ioctl c0306201 0 returned -14 02:35:22 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {0x0, 0x0, r1, 0x1c, 0x0, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) 02:35:22 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_AGP_BIND(r0, 0x40106436, 0x0) [ 2119.982533][T27192] binder: 27189:27192 ioctl c0306201 0 returned -14 [ 2120.000205][T27198] binder: 27193:27198 ioctl 40046210 0 returned -22 [ 2120.014211][T27200] binder: 27193:27200 ioctl c0306201 0 returned -14 02:35:22 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_AGP_BIND(r0, 0x40106436, &(0x7f0000000080)) 02:35:22 executing program 4: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) r3 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, 0x0) r4 = syz_open_dev$binderN(&(0x7f0000000500)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, 0x0) syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x800) r5 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000440)={0x74, 0x0, &(0x7f0000000100)=[@decrefs={0x40046307, 0x1}, @exit_looper, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/35, 0x23, 0x0, 0x36}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}}, @release, @decrefs={0x40046307, 0x2}, @free_buffer], 0xe4, 0x0, &(0x7f0000000340)="192edaf8621943df81acc8221c73261958e5f8ae85aa447823557a30e6683fb7f101dc128832e2cac0d345d10b74ddae1aeab72f3a0b2bc47880b99b81afb1eae43481ab1453f61f27a53d23aee8264f0864b8a511acda89e97d96874adebda0fea7c668502a1b338e5a4baeb421f214d1d3a67e5e396a00b066627b2e496ac10f604074fdfa175876f46b8095672bc46c98fc6a66d043b398630f89aaee27538ea0e60425a68c0bf77df4eeaa03b17a5d98782b3d47a177cff183e49d47b5f2e6fafc9debf5c7d261ccbdd727a28322da1a27798d8ce0f807c940f846c1cf12697736fe"}) 02:35:22 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) r2 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000002080)='/dev/ttyprintk\x00', 0x8000, 0x0) ioctl$TIOCSLCKTRMIOS(r2, 0x5457, &(0x7f00000020c0)) read$FUSE(r1, &(0x7f0000000040)={0x2020}, 0x2020) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r3, 0x4b6b, 0x0) ioctl$FIONREAD(r3, 0x541b, &(0x7f0000002100)) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) 02:35:22 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f0000000040)=0x7ff) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_NOTIFY(r3, &(0x7f00000001c0)={0xf, 0x8, 0xfa00, {r4}}, 0x10) write$RDMA_USER_CM_CMD_NOTIFY(0xffffffffffffffff, &(0x7f0000000080)={0xf, 0x8, 0xfa00, {r4, 0xf}}, 0x10) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) 02:35:22 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_AGP_BIND(r0, 0x40106436, 0x0) 02:35:22 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {0x0, 0x0, r1, 0x1c, 0x0, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) 02:35:22 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_AGP_BIND(r0, 0x40106436, &(0x7f0000000080)) [ 2120.254622][T27211] binder: 27208:27211 ioctl c0306201 0 returned -14 [ 2120.264960][T27213] binder: 27210:27213 ioctl c0306201 0 returned -14 [ 2120.320980][T27211] binder: 27208:27211 ioctl c0306201 0 returned -14 [ 2120.321286][T27213] binder: 27210:27213 ioctl 40046210 0 returned -22 [ 2120.330094][T27212] binder: 27209:27212 ioctl 541b 0 returned -22 [ 2120.351460][T27211] binder: 27208:27211 ioctl c0306201 0 returned -14 [ 2120.375738][T27211] binder: 27208:27211 ioctl c0306201 0 returned -14 [ 2120.408881][T27213] binder: 27210:27213 ioctl c0306201 0 returned -14 02:35:22 executing program 0: ioctl$DRM_IOCTL_AGP_BIND(0xffffffffffffffff, 0x40106436, 0x0) 02:35:22 executing program 2: syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) 02:35:22 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {0x0, 0x0, r1, 0x1c, 0x0, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) 02:35:22 executing program 4: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) r3 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, 0x0) r4 = syz_open_dev$binderN(&(0x7f0000000500)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, 0x0) syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x74, 0x0, &(0x7f0000000100)=[@decrefs={0x40046307, 0x1}, @exit_looper, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/35, 0x23, 0x0, 0x36}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}}, @release, @decrefs={0x40046307, 0x2}, @free_buffer], 0xe4, 0x0, &(0x7f0000000340)="192edaf8621943df81acc8221c73261958e5f8ae85aa447823557a30e6683fb7f101dc128832e2cac0d345d10b74ddae1aeab72f3a0b2bc47880b99b81afb1eae43481ab1453f61f27a53d23aee8264f0864b8a511acda89e97d96874adebda0fea7c668502a1b338e5a4baeb421f214d1d3a67e5e396a00b066627b2e496ac10f604074fdfa175876f46b8095672bc46c98fc6a66d043b398630f89aaee27538ea0e60425a68c0bf77df4eeaa03b17a5d98782b3d47a177cff183e49d47b5f2e6fafc9debf5c7d261ccbdd727a28322da1a27798d8ce0f807c940f846c1cf12697736fe"}) 02:35:22 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x402) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) 02:35:22 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) r2 = getpgrp(0x0) syz_open_procfs$namespace(r2, &(0x7f0000000000)='ns/ipc\x00') ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r1, 0xc1105511, &(0x7f0000000080)={{0x7, 0x2, 0x6d8f, 0x20, 'syz0\x00', 0x8}, 0x0, 0x40, 0x2, r2, 0x1, 0xff000000, 'syz1\x00', &(0x7f0000000040)=['/dev/binder#\x00'], 0xd, [], [0xc3, 0x1, 0x6, 0x3]}) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) 02:35:22 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {0x0, 0x0, r1, 0x1c, 0x0, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) 02:35:22 executing program 0: ioctl$DRM_IOCTL_AGP_BIND(0xffffffffffffffff, 0x40106436, 0x0) [ 2120.689671][T27233] binder: 27228:27233 ioctl c0306201 0 returned -14 [ 2120.721827][T27233] binder: 27228:27233 ioctl c0306201 0 returned -14 [ 2120.724425][T27236] binder: 27232:27236 ioctl 541b 0 returned -22 [ 2120.748311][T27237] binder: 27235:27237 ioctl 40046210 0 returned -22 [ 2120.761694][T27238] binder: 27232:27238 ioctl 541b 0 returned -22 [ 2120.774553][T27240] binder: 27235:27240 ioctl 40046210 0 returned -22 [ 2120.787528][T27233] binder: 27228:27233 ioctl c0306201 0 returned -14 02:35:22 executing program 2: syz_open_dev$dri(0x0, 0x0, 0x0) 02:35:22 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r1, 0x5609, &(0x7f0000000040)={0x5516, 0x3f, 0x7}) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) [ 2120.840786][T27233] binder: 27228:27233 ioctl c0306201 0 returned -14 02:35:22 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN_UNNAMED(0x11, &(0x7f0000000040), 0x10) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x800) 02:35:23 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {0x0, 0x0, r1, 0x1c, 0x0, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) 02:35:23 executing program 0: ioctl$DRM_IOCTL_AGP_BIND(0xffffffffffffffff, 0x40106436, 0x0) 02:35:23 executing program 4: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) r3 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, 0x0) r4 = syz_open_dev$binderN(&(0x7f0000000500)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, 0x0) syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x74, 0x0, &(0x7f0000000100)=[@decrefs={0x40046307, 0x1}, @exit_looper, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/35, 0x23, 0x0, 0x36}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}}, @release, @decrefs={0x40046307, 0x2}, @free_buffer], 0xe4, 0x0, &(0x7f0000000340)="192edaf8621943df81acc8221c73261958e5f8ae85aa447823557a30e6683fb7f101dc128832e2cac0d345d10b74ddae1aeab72f3a0b2bc47880b99b81afb1eae43481ab1453f61f27a53d23aee8264f0864b8a511acda89e97d96874adebda0fea7c668502a1b338e5a4baeb421f214d1d3a67e5e396a00b066627b2e496ac10f604074fdfa175876f46b8095672bc46c98fc6a66d043b398630f89aaee27538ea0e60425a68c0bf77df4eeaa03b17a5d98782b3d47a177cff183e49d47b5f2e6fafc9debf5c7d261ccbdd727a28322da1a27798d8ce0f807c940f846c1cf12697736fe"}) 02:35:23 executing program 2: syz_open_dev$dri(0x0, 0x0, 0x0) 02:35:23 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)={0x2}) 02:35:23 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {0x0, 0x0, r1, 0x1c, 0x0, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) 02:35:23 executing program 0: r0 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_AGP_BIND(r0, 0x40106436, 0x0) 02:35:23 executing program 4: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) r3 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, 0x0) r4 = syz_open_dev$binderN(&(0x7f0000000500)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, 0x0) syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x74, 0x0, &(0x7f0000000100)=[@decrefs={0x40046307, 0x1}, @exit_looper, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/35, 0x23, 0x0, 0x36}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}}, @release, @decrefs={0x40046307, 0x2}, @free_buffer], 0xe4, 0x0, &(0x7f0000000340)="192edaf8621943df81acc8221c73261958e5f8ae85aa447823557a30e6683fb7f101dc128832e2cac0d345d10b74ddae1aeab72f3a0b2bc47880b99b81afb1eae43481ab1453f61f27a53d23aee8264f0864b8a511acda89e97d96874adebda0fea7c668502a1b338e5a4baeb421f214d1d3a67e5e396a00b066627b2e496ac10f604074fdfa175876f46b8095672bc46c98fc6a66d043b398630f89aaee27538ea0e60425a68c0bf77df4eeaa03b17a5d98782b3d47a177cff183e49d47b5f2e6fafc9debf5c7d261ccbdd727a28322da1a27798d8ce0f807c940f846c1cf12697736fe"}) 02:35:23 executing program 2: syz_open_dev$dri(0x0, 0x0, 0x0) [ 2121.026900][T27252] binder: 27249:27252 ioctl 40046210 0 returned -22 [ 2121.049842][T27254] binder: 27249:27254 ioctl 40046210 0 returned -22 [ 2121.090830][T27257] binder: 27248:27257 ioctl 541b 0 returned -22 [ 2121.184408][T27260] binder: 27256:27260 ioctl c0306201 0 returned -14 [ 2121.186940][T27260] binder: 27256:27260 ioctl c0306201 0 returned -14 [ 2121.209359][T27260] binder: 27256:27260 ioctl c0306201 0 returned -14 [ 2121.217540][T27260] binder: 27256:27260 ioctl c0306201 0 returned -14 [ 2121.356179][T27267] binder: 27263:27267 ioctl 40046210 0 returned -22 02:35:23 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, 0x0, 0x0) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {0x0, 0x0, 0xffffffffffffffff, 0x1c, 0x0, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) [ 2121.438879][T27274] binder: 27268:27274 ioctl c0306201 0 returned -14 02:35:23 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = socket$phonet_pipe(0x23, 0x5, 0x2) accept$phonet_pipe(r1, 0x0, 0x0) ioctl$sock_bt_hidp_HIDPCONNADD(0xffffffffffffffff, 0x400448c8, &(0x7f0000001040)={r1, 0xffffffffffffffff, 0x401, 0x1000, &(0x7f0000000040)="05b3a5af7a542286c246e12c1a5e48de67bc5f2756c0109e3d8aa4b15cc6aa730db2ecd483cbe365d92a1e9c1c02093bafdc367a16c0f99832cfd876e27dce03ac41f55ff185ae4359c45adbd6aaa475be96b06ac324bf132937319db913fdcd8a28b20d0b611e7edc3959611d3e49cdb40be7772b2a1aa1052f1c6a734b6a7e8fe8daf77cdf93754964e1beb7e17cdb38706f6eaf811d6d2e1a74a2c0fa452c9214ca414587825e1217db5ee6daa5776b91787cad5a57ba17f1300875d5ac48797bfed05c26e4418628de79bf91ababbfea1bf0b0b121961166658cf057dd7c278d6b53d573057e068247b8a960ea22d1883391bbf44977c1cdbcd6a829e646d15b31b725763f64fcb027bd7da7f92ad03faf26c5f8610ed9881013379cb6ec5dee712e6392c36e49c0a46dba8c4a3102b70ef2f7e685ef54113ee961bcf99ef587acb2e4fb97502f05b6657171ef2adcc5439eafe1ed87aaee258c74dc503cd67f5ee66f622e21ac7e994d079d5a1c7411e296417642d3919849dee539b40641099927161d574508ae3972a03cdad3bf9f0e8a1be5ffdb6fe61b690489391c418593e32aed759a8ba6dc5669d7fe703d4e49a12b14d064429eb5151822d41a89f970e86268807cb8308950f4ca2020d28fa74a57c774a1bbd8cfadd2fd43550ad83767361d7d256da1b0f83019683450a0872747b117b1b170152daa6bdf580ed94f3500e0e7f25e3c2e51111dd7798464d8c9b57d849fe668bbe293d94e089ecbd24743385d480de0eb8353683f39b76a4b1ea7c6463d015cbe64b69ce02e19129a2eedef3e77ecb60a4e78b0ae7981ce060acbc5de425219d21fefd727f5dd8175bef2d168afcd8b1a40ebbcbbb8f935a6b4a77f006cac5030f613b11168ce61e6666125dc1bfdb03566e1ee7463e27784afe80fb68914e1251cf06e408615b4ff000fca2959a0cac2f114a9fef8b3f2f05708e9009ed2bc43956966a58898ef5b55034992ad9e9c00d35461f0892670719b137c0a85abd59bfc9b5e49af09ac872329eb3cbe069c96878f4ed87bc67947e6e8538bac3fe24371f37545fb491be1cdaeca0f2ac88ccffc0750e24ae98756fc90589bfee48f44a426be6550f4823534ef99be0ac7c4e17b733e850ef3b9bb82f865cf6faf726ddcda30e467c722be2191ad454dc0481467c4a1bfb1b74da3552337670044a88cb3785ef780d5b2852c800b2adbf37ad650c6e901f7348da73ab654e04138de9f51dda2a818a76a640a466bee4a2c51beea825ee31420dd53dd4de714302d3c999622db8c69ea8e2968ab7f5fe68ecb46968edf991c4c5853aee2fd51d448c65736ce65e5d47712d85fb9360bad1c6b094b33c4821a9a7b859dcb451d2346e87ae60c08683192bf9887b96bc11334e4473b397532084e1837a20929c6aca521069b10c96b1901595d71d35dee16521b38ac48f2e5824993bc0de17e2f52c97ea2e71edc6a6b445a6fb96511d4532f6ddf386f46df38df9ccc8cfb643b7ae39772b378b7948fe62a21f29f768a3d105f6b9df5426535084e4906d2a95ef6bdd575bed2a3f9ce8b0683a4360b29c53c72f99ed14fd87be4ad7b3aa904aa1043af5c692915f29fc306d4ea73139dee222361f2ba1cdb6083f2880bd08da8efa7ebb57587638dfd26ba0b41cd8b5e00e6388a1147d1540e38f098f52d8ac1b2ff61ea366db5d4779dc11645804aac1f5f620643f28a1dde0a1dc780dfbaa2b8fe4d621dfc442c517b80e1e7c3a8611bd37b4e5bd4816b4aa8166f80976ff4d6f4590137aa79fc47bd4d19476d3383677767121b440fc11e0bf1b1655bd4fbc0d396b1a213ee7a7e72a5e8c057732bcdeeca51f7490f6590dcb5f683356f978029ca697a97b8f6e8e466bff678382241177a1f020251325a092e1109462a23c91f53d05f133b3eae50ea1bf8d0e2d327828dd27d0eb5eee355e20213fcd10a0d5480171f5c369fccfe19e26bd4680f72d4252ad0a8ae23e6597f88cd4f42834c618f003c239f84a28342141ab815da6837bb537a174714444aca0f2f78348ba3a873ec02703f512ac0bd1c18005765b52cd6b2b0206fad080445fbcc99618ce4fdfeb4e3e59ba3c4496e280eebcd05cf09bd38e57be0584d2ecf5e2ecfd7d88e576c12713761eb56d8d17f1b00f75583a13bef8f174396489f10fcfc44be07cb2dcf9de18029e43931e4516a9c6782182cdde1e466960815faf843b406749672b668b05e00b140f850743cafeef782cb657006a2f0c9c045011c09c91f3ee4c8631d1530cb6e6b34b4669fe467354176e558001951f9bd88420df7fc7700349ca52575f1597920323ec59b6725d025397a33b986663b6e7e69cba6decf10e2f20a47d9a3873d3e0a107b712844d97f93abcc2df57f88d48df1cc48e6c3170b973ead7a261e1115a04acd6e453aa2fac816a211bd5248ba36d73cf8c61dab68a9648940dbc6120f700fd92f6ee0364fae085ff16e00c0fb26b7d17af89b94bdacbbbf32c04808dd7e073a102cba2ed8bec6e27e5a428b6f234671c6ada5c2a955e58b715d44ebba340ab6567c47f0de672d3312906b9d08ee57f86530253f1f80668ffbde2893e78496dce0065c678f6aed05c484e06cfce80fc0f5d41ee3ce762566a8b01cec117d931a6476fda2a65c2f753859408d8d772665ccfbb963f6150c96fa1308cb77302d2acd4e70a3ce2266f71cbf00bf09fde73449d1d7bc504e03e4ae513e5c2453e528c11e16f252fa6c2a49dcf4ba9747382184b85368a39ee67c2b4030bd3724770dc519c9973e8e25112b88db0cf56b834de16a1644af4f492dc16ef3f115b84fbaa7cc2e2c1e3ccf8e59e88ae9f869ef98a67fb16382b03d089b140e85637f68cbeb320e75fdf4670e394a075d4c28481769896046d18132b2e5ee9994b630e1638ac7050a77d62b973c92cdf2f4bf790583efded3d5db66e217f72c0f61515d7f0651fd2a0f283d9e7477be81e01653f40aafde35f5e7d60076fbe6cbc2d5ba8edbf5cb746670b215f5bff4b335b18e8f17a835046dd32bcd57b98224c6be5c77d068623b7b22f2ee7b61a911e1722970dfd3c30715848b16561d7040b75a7124e437c95a88b6bf09879e1affa22570eef2e15dfbbab517815b144b60ee4baed806ebed94de88f7e7967c39ee4579326f093c19fd33e4b49a028402fc3f33301fb5063b3b7e2a8302b328a962707e84f69876dd111f2884a932e125c9f409e461c0eb5930f72e7d6bfe1b9de212554cb1b2af4a190d3ca2e234585b1dfe97f5b75ca42b5b0ee8234370373654ca8d6cd929a8726db4db5f6b7302a4dd620498a97463262d82dd3b575017b828361923d878a1e5bad6cae8705ebc7f9cffe8506421c5ddb6f4bcca545bb98755ef0947813b80b775c94cfc23723aabaee73f67e40c5e99136c9b073d5dc3568b131eb7c2a7f5a881bce1b2edcca4f59195774e09773c3b53710289509b36896d29c71a66f9031b98d1ad1c67baa38a2b7d3540d465ef830457e92b50db9ba2d8d715b17ad4c04ee3a9ea1ff2fa9e48b11f73a4ffbe7adfe7209adcd15903430bf9276879f08cc38c8a810e3154f285cdb555a74515ae682f0b8c53cd86269cbd102d2b69191453fccfdeaba8ab2fd8d5078a6211ca7b4688a8324ecd6a0f64508881e4d62273e9daaa5715e5b163294b0d194714a658d490aa8469b954feec9d46529c3f2825c7a9dec0e5d76c5e9c1ca79fe40f0b8617e3af3ed822ba661accc448ffbaee820caf37266fb043f54d3d86d06cd149408b2e4cf5e338b5402ca06e6145ead4ea326eefd27d1f3489d2b8dc719dbd13a51fb7aafa8026648a25d6a8e96c59b85571303a4803004c82014b42e455f55cc477810883c21127ae57c0dc0bc4577c9af4f1d882b682095dbf6897338c81e336fcca069cd89a53a4af292348e483d38181f46bacb132eeca43fb666b4b4cb1bae64b42498b95cf6ff127f32544992672a922e4230eaee2d1878b09bf06325507a83185c6c54225e51d1e4e39f96c4de3797a6d5ccd50526c0ca383b9a099dd5daf67052e5ac90d5bc699c99110e08a8469f4b92e2d9c9b7ac7e1a62bb45d2a8156bed85b2be3f20a41af71f35096be55a0242052200c7a16831864baff5c5f19dd1b975b69dfe7794918cbf3aa9679bbad4009ac60573b5a1d8fa4060ab94efb18b44b2a2ace37edb108d1ff49155ff960f681926bdee3e42725bef94e8d1e960b65ed059d5fbad4d8f05589669176133a41ce04a7354bd35d3fff44f0d1b615ad608de0c0144660e9d2864ef533768bb7b9acb889a53e483645a072525bbf0ed4f2f7f5fc4d6877376dc281d2454fcc52b7f95eb146395a9a6f5c33faa989aa77010c0f73e94984a95ea0ba39daf2a4eb511ca4b8c0e06e963d92f239b7e62cca9914492d2653967805cbeb339126a0ea39e8135fafbc93297bef70d7258ef3b375810cfbb3c23738d80fd194ce717e7e259d8404d612cadf4939d3041a1205dd48566e208b1cde660c99499021cf48f48873ad401b4310c45732130751ee4e4c58c47366b55528f764e2414532df16a4f6753102962dd30959a7b60e549c77dc0f345ab42645fdb1eb6dbdb43c0f2b46438b5cb5e05407125ec1c25bafd202428736b13d5c767873cba0442fc4bce8849d320bfff49e1919c544240c09d8954262b32ddfee30631fde2f0dcb0ab1313f0f3bfaf549cf6ac37a5118772e0ac74e5b3abb70d8f5901a777a218b76447d9c4f83c3927d4709ed40922c3b1d11ef6ef2eef53f0c649097ba8677760d3968203646c67b1bf19791df701638e54b0dec2d8274a82f1eadba1ca1330afe98381698988fbbde854ac341971504e9d51aaf03ec62c629bc30e92e83323f51fe8b7f4aa523be72f82882eac53ae36e7f7eaff9b6ce764e7709aa8ee942f392d558430686f20f012f1d099e8f969e70b435d57d52a015f4a16f827a4cf84ccda93c9bfc6255672e3cc81615a56d1a1355ed46dd9ef53c9d599e20de516b58d56a80424b33960979b7930718d2abfe7ebfd49cd0c85cd936e15021eac58d3a6b02388cc4f41f0cc2d35789ddd77d9aeaa1bc962d14d85aaf1da75b1804b7a9ed4244081c5fe1f1bcac52d01abc6bf3418cf1dd292f43d7d8de30db748e885fb1a8c8a81baa789b7e559bd6382cd8d3361c0d5a182b4213e49328055460425c87b29ec5e58b34bbe28ab81d17509bdd93a90f3923a80c7804622ea863fbd1f0f78ec16ccca8a422a797526e7c21bcea267ec8259494d34a1209712e4ed6f9cb090f6ab8980c167d32e1a08599ffc068828588cdc41382a6d23968f5186f246410ee325b7201567728bf80b8bc4d50125ed28784f26a83e1830da3d4af5f368fe95b4a75ba8adf117fae1ef552f158bc4623b7d806bf994c5ea1aff8e95918dede9564cb1201caf3070aeba9c9a0d3e1d6e2df48c11ea94551c08543f69b8bbaa915e700218ac9b8aeb72f051dda5f667bef84cb3ece9d3e67341f1e705fec2faf29108f10342e3875f1f7f520999a913847eb2a5c488a66cbe274790545f7e384675c1c9613218ce24f56a3576cd771664e00f9ffa1fc0cb072a4309838dc122110455ebde63a8ac00d506f3b8f36ee01e6fcb35ac2e8b187382f0df4f397ca238e9fff6b5a10ee3baa9a509e640ede1716fb973b0cb5459be09bbd27cc09bf00ba9c206553ce602b1cfda98d2e740e3a2a9e3647d5c8803359a9ae3bef8da210ea52d12a1629f5d9ac908d9ae942", 0x4, 0xff, 0x7, 0x7, 0xff, 0x1, 0x101, 'syz1\x00'}) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) 02:35:23 executing program 0: r0 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_AGP_BIND(r0, 0x40106436, 0x0) [ 2121.481575][T27274] binder: 27268:27274 ioctl c0306201 0 returned -14 02:35:23 executing program 2: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) r3 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, 0x0) r4 = syz_open_dev$binderN(&(0x7f0000000500)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, 0x0) syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x74, 0x0, &(0x7f0000000100)=[@decrefs={0x40046307, 0x1}, @exit_looper, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/35, 0x23, 0x0, 0x36}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}}, @release, @decrefs={0x40046307, 0x2}, @free_buffer], 0xe4, 0x0, &(0x7f0000000340)="192edaf8621943df81acc8221c73261958e5f8ae85aa447823557a30e6683fb7f101dc128832e2cac0d345d10b74ddae1aeab72f3a0b2bc47880b99b81afb1eae43481ab1453f61f27a53d23aee8264f0864b8a511acda89e97d96874adebda0fea7c668502a1b338e5a4baeb421f214d1d3a67e5e396a00b066627b2e496ac10f604074fdfa175876f46b8095672bc46c98fc6a66d043b398630f89aaee27538ea0e60425a68c0bf77df4eeaa03b17a5d98782b3d47a177cff183e49d47b5f2e6fafc9debf5c7d261ccbdd727a28322da1a27798d8ce0f807c940f846c1cf12697736fe"}) [ 2121.535235][T27274] binder: 27268:27274 ioctl c0306201 0 returned -14 [ 2121.576880][T27274] binder: 27268:27274 ioctl c0306201 0 returned -14 [ 2121.599669][T27267] binder: 27263:27267 ioctl 40046210 0 returned -22 02:35:23 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, 0x0, 0x0) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {0x0, 0x0, 0xffffffffffffffff, 0x1c, 0x0, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) [ 2121.647386][T27281] binder: 27278:27281 ioctl 541b 0 returned -22 [ 2121.663569][T27282] binder: 27280:27282 ioctl c0306201 0 returned -14 02:35:23 executing program 0: r0 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_AGP_BIND(r0, 0x40106436, 0x0) 02:35:23 executing program 4: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) r3 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, 0x0) r4 = syz_open_dev$binderN(&(0x7f0000000500)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, 0x0) r5 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000440)={0x74, 0x0, &(0x7f0000000100)=[@decrefs={0x40046307, 0x1}, @exit_looper, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/35, 0x23, 0x0, 0x36}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}}, @release, @decrefs={0x40046307, 0x2}, @free_buffer], 0xe4, 0x0, &(0x7f0000000340)="192edaf8621943df81acc8221c73261958e5f8ae85aa447823557a30e6683fb7f101dc128832e2cac0d345d10b74ddae1aeab72f3a0b2bc47880b99b81afb1eae43481ab1453f61f27a53d23aee8264f0864b8a511acda89e97d96874adebda0fea7c668502a1b338e5a4baeb421f214d1d3a67e5e396a00b066627b2e496ac10f604074fdfa175876f46b8095672bc46c98fc6a66d043b398630f89aaee27538ea0e60425a68c0bf77df4eeaa03b17a5d98782b3d47a177cff183e49d47b5f2e6fafc9debf5c7d261ccbdd727a28322da1a27798d8ce0f807c940f846c1cf12697736fe"}) 02:35:23 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x200001, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) [ 2121.705438][T27282] binder: 27280:27282 ioctl c0306201 0 returned -14 [ 2121.720574][T27283] binder: 27278:27283 ioctl 541b 0 returned -22 [ 2121.767540][T27282] binder: 27280:27282 ioctl c0306201 0 returned -14 [ 2121.797642][T27282] binder: 27280:27282 ioctl c0306201 0 returned -14 02:35:23 executing program 1: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r0, 0x4b6b, 0x0) ioctl$TIOCSSOFTCAR(r0, 0x541a, &(0x7f00000000c0)=0x80000000) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0xc02) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000080)={0x1}) ioctl$BINDER_SET_MAX_THREADS(r1, 0x541b, 0x0) 02:35:23 executing program 2: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) r3 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, 0x0) r4 = syz_open_dev$binderN(&(0x7f0000000500)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, 0x0) syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x74, 0x0, &(0x7f0000000100)=[@decrefs={0x40046307, 0x1}, @exit_looper, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/35, 0x23, 0x0, 0x36}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}}, @release, @decrefs={0x40046307, 0x2}, @free_buffer], 0xe4, 0x0, &(0x7f0000000340)="192edaf8621943df81acc8221c73261958e5f8ae85aa447823557a30e6683fb7f101dc128832e2cac0d345d10b74ddae1aeab72f3a0b2bc47880b99b81afb1eae43481ab1453f61f27a53d23aee8264f0864b8a511acda89e97d96874adebda0fea7c668502a1b338e5a4baeb421f214d1d3a67e5e396a00b066627b2e496ac10f604074fdfa175876f46b8095672bc46c98fc6a66d043b398630f89aaee27538ea0e60425a68c0bf77df4eeaa03b17a5d98782b3d47a177cff183e49d47b5f2e6fafc9debf5c7d261ccbdd727a28322da1a27798d8ce0f807c940f846c1cf12697736fe"}) [ 2121.855706][T27292] binder: 27288:27292 ioctl c0306201 0 returned -14 [ 2121.884079][T27292] binder: 27288:27292 ioctl c0306201 0 returned -14 [ 2121.895329][T27293] binder: 27290:27293 ioctl 40046210 0 returned -22 02:35:24 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, 0x0, 0x0) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {0x0, 0x0, 0xffffffffffffffff, 0x1c, 0x0, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) 02:35:24 executing program 0: syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_AGP_BIND(0xffffffffffffffff, 0x40106436, 0x0) [ 2121.950307][T27292] binder: 27288:27292 ioctl c0306201 0 returned -14 [ 2121.950449][T27294] binder: 27290:27294 ioctl 40046210 0 returned -22 [ 2121.990729][T27296] binder: 27288:27296 ioctl c0306201 0 returned -14 [ 2122.013918][T27297] binder: 27295:27297 ioctl 541b 0 returned -22 02:35:24 executing program 4: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) r3 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, 0x0) syz_open_dev$binderN(&(0x7f0000000500)='/dev/binder#\x00', 0x0, 0x802) r4 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x74, 0x0, &(0x7f0000000100)=[@decrefs={0x40046307, 0x1}, @exit_looper, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/35, 0x23, 0x0, 0x36}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}}, @release, @decrefs={0x40046307, 0x2}, @free_buffer], 0xe4, 0x0, &(0x7f0000000340)="192edaf8621943df81acc8221c73261958e5f8ae85aa447823557a30e6683fb7f101dc128832e2cac0d345d10b74ddae1aeab72f3a0b2bc47880b99b81afb1eae43481ab1453f61f27a53d23aee8264f0864b8a511acda89e97d96874adebda0fea7c668502a1b338e5a4baeb421f214d1d3a67e5e396a00b066627b2e496ac10f604074fdfa175876f46b8095672bc46c98fc6a66d043b398630f89aaee27538ea0e60425a68c0bf77df4eeaa03b17a5d98782b3d47a177cff183e49d47b5f2e6fafc9debf5c7d261ccbdd727a28322da1a27798d8ce0f807c940f846c1cf12697736fe"}) 02:35:24 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x2) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) r3 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x806) r4 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, 0x0) ioctl$BINDER_SET_MAX_THREADS(r3, 0x40046210, 0x0) [ 2122.070678][T27301] binder: 27295:27301 ioctl 541b 0 returned -22 [ 2122.093757][T27304] binder: 27300:27304 ioctl c0306201 0 returned -14 02:35:24 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {0x0, 0x0, 0xffffffffffffffff, 0x1c, 0x0, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) 02:35:24 executing program 0: syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_AGP_BIND(0xffffffffffffffff, 0x40106436, 0x0) [ 2122.146180][T27304] binder: 27300:27304 ioctl c0306201 0 returned -14 02:35:24 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r1, 0x4b6b, 0x0) ioctl$GIO_SCRNMAP(r1, 0x4b40, &(0x7f0000000040)=""/112) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) [ 2122.196763][T27304] binder: 27300:27304 ioctl c0306201 0 returned -14 [ 2122.234392][T27307] binder: 27305:27307 ioctl c0306201 0 returned -14 [ 2122.245280][T27304] binder: 27300:27304 ioctl c0306201 0 returned -14 [ 2122.261671][T27308] binder: 27306:27308 ioctl c0306201 0 returned -14 [ 2122.263965][T27307] binder: 27305:27307 ioctl c0306201 0 returned -14 [ 2122.301016][T27308] binder: 27306:27308 ioctl c0306201 0 returned -14 [ 2122.328230][T27316] binder: 27305:27316 ioctl c0306201 0 returned -14 [ 2122.337155][T27308] binder: 27306:27308 ioctl c0306201 0 returned -14 02:35:24 executing program 0: syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_AGP_BIND(0xffffffffffffffff, 0x40106436, 0x0) 02:35:24 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x200001, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) 02:35:24 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {0x0, 0x0, 0xffffffffffffffff, 0x1c, 0x0, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) [ 2122.384400][T27317] binder: 27312:27317 ioctl 541b 0 returned -22 [ 2122.395637][T27308] binder: 27306:27308 ioctl c0306201 0 returned -14 02:35:24 executing program 4: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) r3 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, 0x0) r4 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x74, 0x0, &(0x7f0000000100)=[@decrefs={0x40046307, 0x1}, @exit_looper, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/35, 0x23, 0x0, 0x36}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}}, @release, @decrefs={0x40046307, 0x2}, @free_buffer], 0xe4, 0x0, &(0x7f0000000340)="192edaf8621943df81acc8221c73261958e5f8ae85aa447823557a30e6683fb7f101dc128832e2cac0d345d10b74ddae1aeab72f3a0b2bc47880b99b81afb1eae43481ab1453f61f27a53d23aee8264f0864b8a511acda89e97d96874adebda0fea7c668502a1b338e5a4baeb421f214d1d3a67e5e396a00b066627b2e496ac10f604074fdfa175876f46b8095672bc46c98fc6a66d043b398630f89aaee27538ea0e60425a68c0bf77df4eeaa03b17a5d98782b3d47a177cff183e49d47b5f2e6fafc9debf5c7d261ccbdd727a28322da1a27798d8ce0f807c940f846c1cf12697736fe"}) [ 2122.442121][T27308] binder: 27306:27308 ioctl 40046210 0 returned -22 [ 2122.461433][T27318] binder: 27312:27318 ioctl 541b 0 returned -22 [ 2122.504546][T27321] binder: 27306:27321 ioctl c0306201 0 returned -14 [ 2122.522843][T27323] binder: 27319:27323 ioctl 40046210 0 returned -22 [ 2122.546096][T27308] binder: 27306:27308 ioctl c0306201 0 returned -14 [ 2122.555741][T27321] binder: 27306:27321 ioctl c0306201 0 returned -14 [ 2122.579747][T27326] binder: 27306:27326 ioctl c0306201 0 returned -14 02:35:24 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x402200, 0x0) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) 02:35:24 executing program 0: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) r3 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, 0x0) r4 = syz_open_dev$binderN(&(0x7f0000000500)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, 0x0) syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x74, 0x0, &(0x7f0000000100)=[@decrefs={0x40046307, 0x1}, @exit_looper, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/35, 0x23, 0x0, 0x36}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}}, @release, @decrefs={0x40046307, 0x2}, @free_buffer], 0xe4, 0x0, &(0x7f0000000340)="192edaf8621943df81acc8221c73261958e5f8ae85aa447823557a30e6683fb7f101dc128832e2cac0d345d10b74ddae1aeab72f3a0b2bc47880b99b81afb1eae43481ab1453f61f27a53d23aee8264f0864b8a511acda89e97d96874adebda0fea7c668502a1b338e5a4baeb421f214d1d3a67e5e396a00b066627b2e496ac10f604074fdfa175876f46b8095672bc46c98fc6a66d043b398630f89aaee27538ea0e60425a68c0bf77df4eeaa03b17a5d98782b3d47a177cff183e49d47b5f2e6fafc9debf5c7d261ccbdd727a28322da1a27798d8ce0f807c940f846c1cf12697736fe"}) 02:35:24 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) r2 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000002080)='/dev/ttyprintk\x00', 0x8000, 0x0) ioctl$TIOCSLCKTRMIOS(r2, 0x5457, &(0x7f00000020c0)) read$FUSE(r1, &(0x7f0000000040)={0x2020}, 0x2020) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r3, 0x4b6b, 0x0) ioctl$FIONREAD(r3, 0x541b, &(0x7f0000002100)) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) 02:35:24 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {0x0, 0x0, 0xffffffffffffffff, 0x1c, 0x0, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) [ 2122.648042][T27329] binder: 27327:27329 ioctl c0306201 0 returned -14 [ 2122.679896][T27329] binder: 27327:27329 ioctl c0306201 0 returned -14 02:35:24 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) r3 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_MAX_THREADS(r2, 0x40046210, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)) r4 = getpgrp(0x0) syz_open_procfs$namespace(r4, &(0x7f0000000000)='ns/ipc\x00') syz_open_procfs$namespace(r4, &(0x7f0000000080)='ns/user\x00') read$FUSE(0xffffffffffffffff, &(0x7f0000000980)={0x2020, 0x0, 0x0}, 0x2020) r6 = geteuid() write$FUSE_DIRENTPLUS(0xffffffffffffffff, &(0x7f0000000140)={0xb0, 0x0, r5, [{{0x4, 0x3, 0xce, 0x1, 0x2cd1c5ee, 0x261, {0x1, 0x7, 0xffffffff, 0x9, 0x2, 0x7, 0x1, 0xffffffff, 0x6, 0xa000, 0x7, r6, 0x0, 0x6, 0x40}}, {0x3, 0x1, 0x5, 0x5, '-^-\x85}'}}]}, 0xb0) [ 2122.750261][T27329] binder: 27327:27329 ioctl c0306201 0 returned -14 [ 2122.800469][T27335] binder: 27332:27335 ioctl 541b 0 returned -22 [ 2122.801027][T27338] binder: 27331:27338 ioctl 541b 0 returned -22 [ 2122.815180][T27337] binder: 27334:27337 ioctl c0306201 0 returned -14 02:35:24 executing program 4: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) r3 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x74, 0x0, &(0x7f0000000100)=[@decrefs={0x40046307, 0x1}, @exit_looper, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/35, 0x23, 0x0, 0x36}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}}, @release, @decrefs={0x40046307, 0x2}, @free_buffer], 0xe4, 0x0, &(0x7f0000000340)="192edaf8621943df81acc8221c73261958e5f8ae85aa447823557a30e6683fb7f101dc128832e2cac0d345d10b74ddae1aeab72f3a0b2bc47880b99b81afb1eae43481ab1453f61f27a53d23aee8264f0864b8a511acda89e97d96874adebda0fea7c668502a1b338e5a4baeb421f214d1d3a67e5e396a00b066627b2e496ac10f604074fdfa175876f46b8095672bc46c98fc6a66d043b398630f89aaee27538ea0e60425a68c0bf77df4eeaa03b17a5d98782b3d47a177cff183e49d47b5f2e6fafc9debf5c7d261ccbdd727a28322da1a27798d8ce0f807c940f846c1cf12697736fe"}) [ 2122.871843][T27337] binder: 27334:27337 ioctl c0306201 0 returned -14 [ 2122.910402][T27342] binder: 27339:27342 ioctl c0306201 0 returned -14 02:35:25 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {0x0, 0x0, r1, 0x1c, 0x0, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) 02:35:25 executing program 1: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x48002, 0x0) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f0000000540)={0x11, 0x10, 0xfa00, {&(0x7f0000000500)}}, 0x18) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x202002, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000480)={0xc0, 0x0, &(0x7f00000002c0)=[@transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x60, 0x18, &(0x7f00000000c0)={@ptr={0x70742a85, 0x1, &(0x7f0000000080)=""/22, 0x16, 0x0, 0x1e}, @fda={0x66646185, 0x2, 0x0, 0x3}, @flat=@binder={0x73622a85, 0x0, 0x3}}, &(0x7f00000004c0)={0x0, 0x28, 0x48}}, 0x400}, @clear_death={0x400c630f, 0x1}, @decrefs={0x40046307, 0x3}, @clear_death={0x400c630f, 0x3}, @reply_sg={0x40486312, {0x3, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000200)={@fda={0x66646185, 0x8, 0x1, 0x39}, @flat=@weak_handle={0x77682a85, 0x0, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000180)=""/121, 0x79, 0x2, 0x15}}, &(0x7f0000000280)={0x0, 0x20, 0x38}}, 0x1000}], 0xf5, 0x0, &(0x7f0000000380)="00ed4160e440129d92797bd420a5561df1b64a03d18d1dcea2d57d39d0e2cb790346a44331ce3f60409deb9d2b19852c4405649d93917229b7bf51cf935a3aabc4b1088592e8c888e2329bb62a5bc0421041812b7d3ac38d9f2b19a6e2e5f733d2638692529c1a39155ad548b8da92a5513351ff19a938732333e0ab57c8e9c941d191061b3b61954131aa23f54fabd34f5f8c7ebab6accdf7c60227a85ccc0ed5e3760bef038ceccb494be9b504d4c792e36d96a0bdcb65c7540febd951b7698f8ce7a2088aa5f30adacec75cd2b2ed3cbfcb9c8bd46503432897d13d6c9bf72fc936d0438b64f49199d25b246ea4b03fa5f53902"}) ioctl$BINDER_SET_MAX_THREADS(r1, 0x541b, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000600)={0x0, 0x18, 0xfa00, {0x1, &(0x7f00000005c0)={0xffffffffffffffff}, 0x106, 0x1}}, 0x20) write$RDMA_USER_CM_CMD_MIGRATE_ID(r0, &(0x7f0000000640)={0x12, 0x10, 0xfa00, {&(0x7f0000000580), r3, r2}}, 0x18) 02:35:25 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) r2 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000002080)='/dev/ttyprintk\x00', 0x8000, 0x0) ioctl$TIOCSLCKTRMIOS(r2, 0x5457, &(0x7f00000020c0)) read$FUSE(r1, &(0x7f0000000040)={0x2020}, 0x2020) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r3, 0x4b6b, 0x0) ioctl$FIONREAD(r3, 0x541b, &(0x7f0000002100)) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) [ 2122.920460][T27337] binder: 27334:27337 ioctl c0306201 0 returned -14 [ 2122.969990][T27342] binder: 27339:27342 ioctl c0306201 0 returned -14 [ 2122.981223][T27342] binder: 27339:27342 ioctl c0306201 0 returned -14 [ 2123.006614][T27346] binder: 27343:27346 ioctl c0306201 0 returned -14 [ 2123.012960][T27337] binder: 27334:27337 ioctl c0306201 0 returned -14 [ 2123.023821][T27342] binder: 27339:27342 ioctl 40046210 0 returned -22 [ 2123.034289][T27346] binder: 27343:27346 ioctl c0306201 0 returned -14 02:35:25 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {0x0, 0x0, r1, 0x1c, 0x0, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) [ 2123.072855][T27345] binder: 27339:27345 ioctl c0306201 0 returned -14 [ 2123.080664][T27351] binder: 27339:27351 ioctl 40046210 0 returned -22 02:35:25 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {0x0, 0x0, 0xffffffffffffffff, 0x1c, 0x0, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) [ 2123.118319][T27352] binder: 27349:27352 ioctl 541b 0 returned -22 [ 2123.154870][T27352] binder: 27349:27352 ioctl 541b 0 returned -22 [ 2123.157077][T27353] binder: 27350:27353 ioctl 541b 0 returned -22 02:35:25 executing program 4: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) r3 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x74, 0x0, &(0x7f0000000100)=[@decrefs={0x40046307, 0x1}, @exit_looper, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/35, 0x23, 0x0, 0x36}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}}, @release, @decrefs={0x40046307, 0x2}, @free_buffer], 0xe4, 0x0, &(0x7f0000000340)="192edaf8621943df81acc8221c73261958e5f8ae85aa447823557a30e6683fb7f101dc128832e2cac0d345d10b74ddae1aeab72f3a0b2bc47880b99b81afb1eae43481ab1453f61f27a53d23aee8264f0864b8a511acda89e97d96874adebda0fea7c668502a1b338e5a4baeb421f214d1d3a67e5e396a00b066627b2e496ac10f604074fdfa175876f46b8095672bc46c98fc6a66d043b398630f89aaee27538ea0e60425a68c0bf77df4eeaa03b17a5d98782b3d47a177cff183e49d47b5f2e6fafc9debf5c7d261ccbdd727a28322da1a27798d8ce0f807c940f846c1cf12697736fe"}) 02:35:25 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$TIOCGLCKTRMIOS(0xffffffffffffffff, 0x5456, &(0x7f0000000040)={0x8, 0x401, 0xffff8fb0, 0x0, 0x17, "0125db2581cdae2d99d3da8994052cb377341c"}) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000011c0)='/proc/capi/capi20\x00', 0x0, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x4) ioctl$GIO_FONTX(r2, 0x4b6b, 0x0) ioctl$VT_RESIZE(r2, 0x5609, &(0x7f0000001180)={0x40, 0x8, 0x7fff}) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) ioctl$GIO_CMAP(0xffffffffffffffff, 0x4b70, &(0x7f0000001200)) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r1, 0x81785501, &(0x7f0000000080)=""/4096) ioctl$KDSETMODE(r2, 0x4b3a, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="0b6300000e3cd7197d5f92c2c41f212ce79be7eaadd19a3fd1521192bf82e360a5b77b432f4fb1f10c62af17f4013c4595d747b3a1975334d9b945ca5cef8f02d971da2bc6d41997204f4911ca338a2f93a1cc9e29d9740d988b677094087c6e6988ec2b47ef5b8dfd92ac6e373dd0d34454000000000000"], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000001240)='/dev/hwrng\x00', 0x202000, 0x0) ioctl$KDGETLED(r3, 0x4b31, &(0x7f0000001080)) 02:35:25 executing program 1: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x48002, 0x0) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f0000000540)={0x11, 0x10, 0xfa00, {&(0x7f0000000500)}}, 0x18) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x202002, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000480)={0xc0, 0x0, &(0x7f00000002c0)=[@transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x60, 0x18, &(0x7f00000000c0)={@ptr={0x70742a85, 0x1, &(0x7f0000000080)=""/22, 0x16, 0x0, 0x1e}, @fda={0x66646185, 0x2, 0x0, 0x3}, @flat=@binder={0x73622a85, 0x0, 0x3}}, &(0x7f00000004c0)={0x0, 0x28, 0x48}}, 0x400}, @clear_death={0x400c630f, 0x1}, @decrefs={0x40046307, 0x3}, @clear_death={0x400c630f, 0x3}, @reply_sg={0x40486312, {0x3, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000200)={@fda={0x66646185, 0x8, 0x1, 0x39}, @flat=@weak_handle={0x77682a85, 0x0, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000180)=""/121, 0x79, 0x2, 0x15}}, &(0x7f0000000280)={0x0, 0x20, 0x38}}, 0x1000}], 0xf5, 0x0, &(0x7f0000000380)="00ed4160e440129d92797bd420a5561df1b64a03d18d1dcea2d57d39d0e2cb790346a44331ce3f60409deb9d2b19852c4405649d93917229b7bf51cf935a3aabc4b1088592e8c888e2329bb62a5bc0421041812b7d3ac38d9f2b19a6e2e5f733d2638692529c1a39155ad548b8da92a5513351ff19a938732333e0ab57c8e9c941d191061b3b61954131aa23f54fabd34f5f8c7ebab6accdf7c60227a85ccc0ed5e3760bef038ceccb494be9b504d4c792e36d96a0bdcb65c7540febd951b7698f8ce7a2088aa5f30adacec75cd2b2ed3cbfcb9c8bd46503432897d13d6c9bf72fc936d0438b64f49199d25b246ea4b03fa5f53902"}) ioctl$BINDER_SET_MAX_THREADS(r1, 0x541b, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000600)={0x0, 0x18, 0xfa00, {0x1, &(0x7f00000005c0)={0xffffffffffffffff}, 0x106, 0x1}}, 0x20) write$RDMA_USER_CM_CMD_MIGRATE_ID(r0, &(0x7f0000000640)={0x12, 0x10, 0xfa00, {&(0x7f0000000580), r3, r2}}, 0x18) 02:35:25 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) r2 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000002080)='/dev/ttyprintk\x00', 0x8000, 0x0) ioctl$TIOCSLCKTRMIOS(r2, 0x5457, &(0x7f00000020c0)) read$FUSE(r1, &(0x7f0000000040)={0x2020}, 0x2020) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r3, 0x4b6b, 0x0) ioctl$FIONREAD(r3, 0x541b, &(0x7f0000002100)) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) 02:35:25 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {0x0, 0x0, r1, 0x1c, 0x0, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) 02:35:25 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {0x0, 0x0, 0xffffffffffffffff, 0x1c, 0x0, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) [ 2123.355181][T27362] binder: 27359:27362 ioctl c0306201 0 returned -14 [ 2123.376118][T27364] binder: 27360:27364 ioctl 541b 0 returned -22 [ 2123.422647][T27362] binder: 27359:27362 ioctl c0306201 0 returned -14 [ 2123.432178][T27366] binder: 27363:27366 ioctl 541b 0 returned -22 02:35:25 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) r2 = syz_open_dev$sndctrl(&(0x7f0000000100)='/dev/snd/controlC#\x00', 0x1bf80, 0x189800) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(r2, 0xc008551c, &(0x7f0000000180)={0x1000, 0x4, [0x7]}) write$FUSE_ENTRY(r1, &(0x7f0000000040)={0x90, 0x0, 0x0, {0x4, 0x0, 0xfffffffffffffffa, 0x306, 0x4, 0xffff, {0x2, 0x10000, 0x9, 0x0, 0x9, 0x7, 0x1ff, 0x7, 0x80000001, 0x2000, 0x4, 0xffffffffffffffff, 0x0, 0x4}}}, 0x90) 02:35:25 executing program 4: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x74, 0x0, &(0x7f0000000100)=[@decrefs={0x40046307, 0x1}, @exit_looper, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/35, 0x23, 0x0, 0x36}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}}, @release, @decrefs={0x40046307, 0x2}, @free_buffer], 0xe4, 0x0, &(0x7f0000000340)="192edaf8621943df81acc8221c73261958e5f8ae85aa447823557a30e6683fb7f101dc128832e2cac0d345d10b74ddae1aeab72f3a0b2bc47880b99b81afb1eae43481ab1453f61f27a53d23aee8264f0864b8a511acda89e97d96874adebda0fea7c668502a1b338e5a4baeb421f214d1d3a67e5e396a00b066627b2e496ac10f604074fdfa175876f46b8095672bc46c98fc6a66d043b398630f89aaee27538ea0e60425a68c0bf77df4eeaa03b17a5d98782b3d47a177cff183e49d47b5f2e6fafc9debf5c7d261ccbdd727a28322da1a27798d8ce0f807c940f846c1cf12697736fe"}) [ 2123.487956][T27365] binder: 27361:27365 ioctl 40046210 0 returned -22 [ 2123.516530][T27365] binder: 27361:27365 ioctl c0306201 20001140 returned -11 02:35:25 executing program 2: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r0, 0xc0405519, 0x0) r1 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000002080)='/dev/ttyprintk\x00', 0x8000, 0x0) ioctl$TIOCSLCKTRMIOS(r1, 0x5457, &(0x7f00000020c0)) read$FUSE(r0, &(0x7f0000000040)={0x2020}, 0x2020) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r2, 0x4b6b, 0x0) ioctl$FIONREAD(r2, 0x541b, &(0x7f0000002100)) 02:35:25 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x802) r2 = syz_open_dev$binderN(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f0000000040)=0xc) [ 2123.573862][T27370] binder: 27361:27370 ioctl 40046210 0 returned -22 02:35:25 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {0x0, 0x0, r1, 0x1c, 0x0, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) [ 2123.641471][T27377] binder: 27376:27377 ioctl 541b 0 returned -22 02:35:25 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) r2 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000380)={0xb4, 0x0, &(0x7f0000000200)=[@decrefs={0x40046307, 0x2}, @acquire, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x18, &(0x7f00000000c0)={@fda={0x66646185, 0x1, 0x0, 0x3}, @flat=@weak_handle={0x77682a85, 0x1101, 0x3}, @flat=@binder={0x73622a85, 0x100}}, &(0x7f0000000040)={0x0, 0x20, 0x38}}}, @reply_sg={0x40486312, {0x1, 0x0, 0x0, 0x0, 0x22, 0x0, 0x0, 0x58, 0x18, &(0x7f00000003c0)={@fda={0x66646185, 0xa, 0x0, 0x20}, @fda={0x66646185, 0x8, 0x1, 0x7}, @fd={0x66642a85, 0x0, r1}}, &(0x7f00000001c0)={0x0, 0x20, 0x40}}, 0x1000}, @free_buffer, @acquire={0x40046305, 0x2}], 0x85, 0x0, &(0x7f00000002c0)="0cdb8b509f17d72893367334273da56dd40aa597b2967144334e94d109c00798696e03c2f9bf36f2764bbd5f3d2abee8fe43c25db63dd47ae22e7d6e804f36d0f3adfa4ec53d08faeced5f7a620f4dd074a12f7dd0151f563031bb16dd4229c13ef44a52edf916c16421f9dc5d36e3606a2378ca10bfb041e6d34b887aa79eed2868b59f44"}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) [ 2123.689408][T27381] binder: 27378:27381 ioctl c0306201 0 returned -14 02:35:25 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) r2 = syz_open_dev$sndctrl(&(0x7f0000000100)='/dev/snd/controlC#\x00', 0x1bf80, 0x189800) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(r2, 0xc008551c, &(0x7f0000000180)={0x1000, 0x4, [0x7]}) write$FUSE_ENTRY(r1, &(0x7f0000000040)={0x90, 0x0, 0x0, {0x4, 0x0, 0xfffffffffffffffa, 0x306, 0x4, 0xffff, {0x2, 0x10000, 0x9, 0x0, 0x9, 0x7, 0x1ff, 0x7, 0x80000001, 0x2000, 0x4, 0xffffffffffffffff, 0x0, 0x4}}}, 0x90) [ 2123.772700][T27384] binder: 27379:27384 ioctl 40046210 0 returned -22 02:35:25 executing program 2: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r0, 0xc0405519, 0x0) r1 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000002080)='/dev/ttyprintk\x00', 0x8000, 0x0) ioctl$TIOCSLCKTRMIOS(r1, 0x5457, &(0x7f00000020c0)) read$FUSE(r0, &(0x7f0000000040)={0x2020}, 0x2020) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$FIONREAD(r2, 0x541b, &(0x7f0000002100)) 02:35:25 executing program 4: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x74, 0x0, &(0x7f0000000100)=[@decrefs={0x40046307, 0x1}, @exit_looper, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/35, 0x23, 0x0, 0x36}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}}, @release, @decrefs={0x40046307, 0x2}, @free_buffer], 0xe4, 0x0, &(0x7f0000000340)="192edaf8621943df81acc8221c73261958e5f8ae85aa447823557a30e6683fb7f101dc128832e2cac0d345d10b74ddae1aeab72f3a0b2bc47880b99b81afb1eae43481ab1453f61f27a53d23aee8264f0864b8a511acda89e97d96874adebda0fea7c668502a1b338e5a4baeb421f214d1d3a67e5e396a00b066627b2e496ac10f604074fdfa175876f46b8095672bc46c98fc6a66d043b398630f89aaee27538ea0e60425a68c0bf77df4eeaa03b17a5d98782b3d47a177cff183e49d47b5f2e6fafc9debf5c7d261ccbdd727a28322da1a27798d8ce0f807c940f846c1cf12697736fe"}) 02:35:25 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$TIOCGLCKTRMIOS(0xffffffffffffffff, 0x5456, &(0x7f0000000040)={0x8, 0x401, 0xffff8fb0, 0x0, 0x17, "0125db2581cdae2d99d3da8994052cb377341c"}) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000011c0)='/proc/capi/capi20\x00', 0x0, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x4) ioctl$GIO_FONTX(r2, 0x4b6b, 0x0) ioctl$VT_RESIZE(r2, 0x5609, &(0x7f0000001180)={0x40, 0x8, 0x7fff}) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) ioctl$GIO_CMAP(0xffffffffffffffff, 0x4b70, &(0x7f0000001200)) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r1, 0x81785501, &(0x7f0000000080)=""/4096) ioctl$KDSETMODE(r2, 0x4b3a, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="0b6300000e3cd7197d5f92c2c41f212ce79be7eaadd19a3fd1521192bf82e360a5b77b432f4fb1f10c62af17f4013c4595d747b3a1975334d9b945ca5cef8f02d971da2bc6d41997204f4911ca338a2f93a1cc9e29d9740d988b677094087c6e6988ec2b47ef5b8dfd92ac6e373dd0d34454000000000000"], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000001240)='/dev/hwrng\x00', 0x202000, 0x0) ioctl$KDGETLED(r3, 0x4b31, &(0x7f0000001080)) 02:35:26 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {0x0, 0x0, r1, 0x1c, 0x0, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) [ 2123.873563][T27388] binder: 27386:27388 ioctl c0306201 0 returned -14 [ 2123.905471][T27388] binder: 27386:27388 ioctl 40046210 0 returned -22 [ 2123.951439][T27393] binder: 27392:27393 ioctl c0306201 0 returned -14 [ 2123.991426][T27394] binder: 27390:27394 ioctl 541b 0 returned -22 02:35:26 executing program 4: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x74, 0x0, &(0x7f0000000100)=[@decrefs={0x40046307, 0x1}, @exit_looper, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/35, 0x23, 0x0, 0x36}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}}, @release, @decrefs={0x40046307, 0x2}, @free_buffer], 0xe4, 0x0, &(0x7f0000000340)="192edaf8621943df81acc8221c73261958e5f8ae85aa447823557a30e6683fb7f101dc128832e2cac0d345d10b74ddae1aeab72f3a0b2bc47880b99b81afb1eae43481ab1453f61f27a53d23aee8264f0864b8a511acda89e97d96874adebda0fea7c668502a1b338e5a4baeb421f214d1d3a67e5e396a00b066627b2e496ac10f604074fdfa175876f46b8095672bc46c98fc6a66d043b398630f89aaee27538ea0e60425a68c0bf77df4eeaa03b17a5d98782b3d47a177cff183e49d47b5f2e6fafc9debf5c7d261ccbdd727a28322da1a27798d8ce0f807c940f846c1cf12697736fe"}) [ 2124.001196][T27388] binder: 27386:27388 ioctl c0306201 0 returned -14 [ 2124.010956][T27397] binder: 27386:27397 ioctl 40046210 0 returned -22 02:35:26 executing program 2: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r0, 0xc0405519, 0x0) r1 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000002080)='/dev/ttyprintk\x00', 0x8000, 0x0) ioctl$TIOCSLCKTRMIOS(r1, 0x5457, &(0x7f00000020c0)) read$FUSE(r0, &(0x7f0000000040)={0x2020}, 0x2020) ioctl$FIONREAD(0xffffffffffffffff, 0x541b, &(0x7f0000002100)) 02:35:26 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x480040, 0x0) write$qrtrtun(r2, &(0x7f0000000300)="03f0accdb1045ccedb236a49fcf881edb0fce2f2732b3d01cdffaccc62c5c8995230dc143073b306057a1094109e6db473580eb2f8e6878edcc5ee0975d6f4d2c427adb1cfb16dfaab56555e87c5ce5b6ad1a556b864e73fed747eede9c4e1b53e3e78f207f210ae762abbc444cdaeb15796d942b5ae3071f88acb5708e3da1919330ec9d6bf701ea4b8091ae7c49c6c597242aec6aba697a33fdc4a439172629539790458de365f31f3c93a3661901bd1c5fd43a1535885d2ae3efb292acd55273902361f4f09f40120643ac17158276cf5a43f6ba95bf4378b3bfeaf01d3f31963b3a494d21ad76f12ce178b4d9ceadc79aa215ba1f4bbf471cb376e8b5c20096ef8b1fc7a8541623fba7c1875100bb62e2ecf01e2bedb038352810a5fe16a336c49746f3f6e662cd6f8c0e0ead3a027a6522b08a834d22a92ca94cb30cf049c8734f04925f8e393a05aac0ae87d7e4c9b5b7414b1235abdce874cf1d5e9363a41a57f7feac25cad3cb27350", 0xffffff04) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x110a, 0x2}) 02:35:26 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) r2 = syz_open_dev$sndctrl(&(0x7f0000000100)='/dev/snd/controlC#\x00', 0x1bf80, 0x189800) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(r2, 0xc008551c, &(0x7f0000000180)={0x1000, 0x4, [0x7]}) write$FUSE_ENTRY(r1, &(0x7f0000000040)={0x90, 0x0, 0x0, {0x4, 0x0, 0xfffffffffffffffa, 0x306, 0x4, 0xffff, {0x2, 0x10000, 0x9, 0x0, 0x9, 0x7, 0x1ff, 0x7, 0x80000001, 0x2000, 0x4, 0xffffffffffffffff, 0x0, 0x4}}}, 0x90) [ 2124.102875][T27399] binder: 27395:27399 ioctl 40046210 0 returned -22 [ 2124.134644][T27399] binder: 27395:27399 ioctl c0306201 20001140 returned -11 02:35:26 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {0x0, 0x0, r1, 0x1c, 0x0, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) 02:35:26 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$TIOCGLCKTRMIOS(0xffffffffffffffff, 0x5456, &(0x7f0000000040)={0x8, 0x401, 0xffff8fb0, 0x0, 0x17, "0125db2581cdae2d99d3da8994052cb377341c"}) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000011c0)='/proc/capi/capi20\x00', 0x0, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x4) ioctl$GIO_FONTX(r2, 0x4b6b, 0x0) ioctl$VT_RESIZE(r2, 0x5609, &(0x7f0000001180)={0x40, 0x8, 0x7fff}) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) ioctl$GIO_CMAP(0xffffffffffffffff, 0x4b70, &(0x7f0000001200)) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r1, 0x81785501, &(0x7f0000000080)=""/4096) ioctl$KDSETMODE(r2, 0x4b3a, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="0b6300000e3cd7197d5f92c2c41f212ce79be7eaadd19a3fd1521192bf82e360a5b77b432f4fb1f10c62af17f4013c4595d747b3a1975334d9b945ca5cef8f02d971da2bc6d41997204f4911ca338a2f93a1cc9e29d9740d988b677094087c6e6988ec2b47ef5b8dfd92ac6e373dd0d34454000000000000"], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000001240)='/dev/hwrng\x00', 0x202000, 0x0) ioctl$KDGETLED(r3, 0x4b31, &(0x7f0000001080)) 02:35:26 executing program 4: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x74, 0x0, &(0x7f0000000100)=[@decrefs={0x40046307, 0x1}, @exit_looper, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/35, 0x23, 0x0, 0x36}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}}, @release, @decrefs={0x40046307, 0x2}, @free_buffer], 0xe4, 0x0, &(0x7f0000000340)="192edaf8621943df81acc8221c73261958e5f8ae85aa447823557a30e6683fb7f101dc128832e2cac0d345d10b74ddae1aeab72f3a0b2bc47880b99b81afb1eae43481ab1453f61f27a53d23aee8264f0864b8a511acda89e97d96874adebda0fea7c668502a1b338e5a4baeb421f214d1d3a67e5e396a00b066627b2e496ac10f604074fdfa175876f46b8095672bc46c98fc6a66d043b398630f89aaee27538ea0e60425a68c0bf77df4eeaa03b17a5d98782b3d47a177cff183e49d47b5f2e6fafc9debf5c7d261ccbdd727a28322da1a27798d8ce0f807c940f846c1cf12697736fe"}) [ 2124.252993][T27406] binder: 27405:27406 ioctl 40046210 0 returned -22 [ 2124.288269][T27406] binder: 27405:27406 ioctl c0306201 0 returned -14 [ 2124.288553][T27408] binder: 27404:27408 ioctl 541b 0 returned -22 02:35:26 executing program 2: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r0, 0xc0405519, 0x0) r1 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000002080)='/dev/ttyprintk\x00', 0x8000, 0x0) ioctl$TIOCSLCKTRMIOS(r1, 0x5457, &(0x7f00000020c0)) read$FUSE(r0, &(0x7f0000000040)={0x2020}, 0x2020) ioctl$FIONREAD(0xffffffffffffffff, 0x541b, &(0x7f0000002100)) [ 2124.322225][T27406] binder: BINDER_SET_CONTEXT_MGR already set [ 2124.351841][T27406] binder: 27405:27406 ioctl 4018620d 20000080 returned -16 [ 2124.404942][T27406] binder: 27405:27406 ioctl 40046210 0 returned -22 [ 2124.424013][T27415] binder: 27405:27415 ioctl c0306201 0 returned -14 [ 2124.444056][T27413] binder: 27409:27413 ioctl 40046210 0 returned -22 02:35:26 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) r2 = syz_open_dev$sndctrl(&(0x7f0000000100)='/dev/snd/controlC#\x00', 0x1bf80, 0x189800) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(r2, 0xc008551c, &(0x7f0000000180)={0x1000, 0x4, [0x7]}) [ 2124.462454][T27413] binder: 27409:27413 ioctl c0306201 20001140 returned -11 02:35:26 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040), 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, 0x0, 0x0) 02:35:26 executing program 4: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x74, 0x0, &(0x7f0000000100)=[@decrefs={0x40046307, 0x1}, @exit_looper, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/35, 0x23, 0x0, 0x36}, @fd, @fd}, &(0x7f0000000280)={0x0, 0x28, 0x40}}}, @release, @decrefs={0x40046307, 0x2}, @free_buffer], 0xe4, 0x0, &(0x7f0000000340)="192edaf8621943df81acc8221c73261958e5f8ae85aa447823557a30e6683fb7f101dc128832e2cac0d345d10b74ddae1aeab72f3a0b2bc47880b99b81afb1eae43481ab1453f61f27a53d23aee8264f0864b8a511acda89e97d96874adebda0fea7c668502a1b338e5a4baeb421f214d1d3a67e5e396a00b066627b2e496ac10f604074fdfa175876f46b8095672bc46c98fc6a66d043b398630f89aaee27538ea0e60425a68c0bf77df4eeaa03b17a5d98782b3d47a177cff183e49d47b5f2e6fafc9debf5c7d261ccbdd727a28322da1a27798d8ce0f807c940f846c1cf12697736fe"}) 02:35:26 executing program 5: ioctl$PIO_SCRNMAP(0xffffffffffffffff, 0x4b41, &(0x7f0000000040)="db6723a514e3e751ddf3b54beb669b2cb34df5bd82ba3174d2c2918a6def44a259fa78d576bc2209eaa4d7e80b75a6616cf77c0d2804011edc82892113ebc579c725a941caa9d410b9d767662b082c2ac7feffa0fa5743f6b2101bd93c08541e8c9e7965b4a842dcaf4f") clock_gettime(0x0, &(0x7f00000000c0)={0x0, 0x0}) nanosleep(&(0x7f0000000100)={r0, r1+60000000}, &(0x7f0000000140)) r2 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) clock_gettime(0x1, &(0x7f0000000180)) r3 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r3, 0xc0405519, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_INFO(r3, 0xc10c5541, &(0x7f00000001c0)={0x0, 0x2}) ioctl$BINDER_SET_MAX_THREADS(r2, 0x40046210, 0x0) 02:35:26 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$TIOCGLCKTRMIOS(0xffffffffffffffff, 0x5456, &(0x7f0000000040)={0x8, 0x401, 0xffff8fb0, 0x0, 0x17, "0125db2581cdae2d99d3da8994052cb377341c"}) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000011c0)='/proc/capi/capi20\x00', 0x0, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x4) ioctl$GIO_FONTX(r2, 0x4b6b, 0x0) ioctl$VT_RESIZE(r2, 0x5609, &(0x7f0000001180)={0x40, 0x8, 0x7fff}) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) ioctl$GIO_CMAP(0xffffffffffffffff, 0x4b70, &(0x7f0000001200)) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r1, 0x81785501, &(0x7f0000000080)=""/4096) ioctl$KDSETMODE(r2, 0x4b3a, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="0b6300000e3cd7197d5f92c2c41f212ce79be7eaadd19a3fd1521192bf82e360a5b77b432f4fb1f10c62af17f4013c4595d747b3a1975334d9b945ca5cef8f02d971da2bc6d41997204f4911ca338a2f93a1cc9e29d9740d988b677094087c6e6988ec2b47ef5b8dfd92ac6e373dd0d34454000000000000"], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000001240)='/dev/hwrng\x00', 0x202000, 0x0) ioctl$KDGETLED(r3, 0x4b31, &(0x7f0000001080)) [ 2124.647602][T27427] binder: 27420:27427 ioctl 541b 0 returned -22 02:35:26 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040), 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, 0x0, 0x0) 02:35:26 executing program 2: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r0, 0xc0405519, 0x0) r1 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000002080)='/dev/ttyprintk\x00', 0x8000, 0x0) ioctl$TIOCSLCKTRMIOS(r1, 0x5457, &(0x7f00000020c0)) read$FUSE(r0, &(0x7f0000000040)={0x2020}, 0x2020) ioctl$FIONREAD(0xffffffffffffffff, 0x541b, &(0x7f0000002100)) 02:35:26 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(0xffffffffffffffff, 0xc008551c, &(0x7f0000000180)={0x1000, 0x4, [0x7]}) 02:35:26 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x74, 0x0, &(0x7f0000000100)=[@decrefs={0x40046307, 0x1}, @exit_looper, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/35, 0x23, 0x0, 0x36}, @fd, @fd}, &(0x7f0000000280)={0x0, 0x28, 0x40}}}, @release, @decrefs={0x40046307, 0x2}, @free_buffer], 0xe4, 0x0, &(0x7f0000000340)="192edaf8621943df81acc8221c73261958e5f8ae85aa447823557a30e6683fb7f101dc128832e2cac0d345d10b74ddae1aeab72f3a0b2bc47880b99b81afb1eae43481ab1453f61f27a53d23aee8264f0864b8a511acda89e97d96874adebda0fea7c668502a1b338e5a4baeb421f214d1d3a67e5e396a00b066627b2e496ac10f604074fdfa175876f46b8095672bc46c98fc6a66d043b398630f89aaee27538ea0e60425a68c0bf77df4eeaa03b17a5d98782b3d47a177cff183e49d47b5f2e6fafc9debf5c7d261ccbdd727a28322da1a27798d8ce0f807c940f846c1cf12697736fe"}) [ 2124.816347][T27432] binder: 27429:27432 ioctl 40046210 0 returned -22 [ 2124.826290][T27433] binder: 27428:27433 ioctl 40046210 0 returned -22 [ 2124.858817][T27432] binder: 27429:27432 ioctl c0306201 20001140 returned -11 02:35:27 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040), 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, 0x0, 0x0) [ 2124.920490][T27438] binder: 27436:27438 ioctl 541b 0 returned -22 02:35:27 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$TIOCGLCKTRMIOS(0xffffffffffffffff, 0x5456, &(0x7f0000000040)={0x8, 0x401, 0xffff8fb0, 0x0, 0x17, "0125db2581cdae2d99d3da8994052cb377341c"}) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000011c0)='/proc/capi/capi20\x00', 0x0, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x4) ioctl$GIO_FONTX(r2, 0x4b6b, 0x0) ioctl$VT_RESIZE(r2, 0x5609, &(0x7f0000001180)={0x40, 0x8, 0x7fff}) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) ioctl$GIO_CMAP(0xffffffffffffffff, 0x4b70, &(0x7f0000001200)) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r1, 0x81785501, &(0x7f0000000080)=""/4096) ioctl$KDSETMODE(r2, 0x4b3a, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="0b6300000e3cd7197d5f92c2c41f212ce79be7eaadd19a3fd1521192bf82e360a5b77b432f4fb1f10c62af17f4013c4595d747b3a1975334d9b945ca5cef8f02d971da2bc6d41997204f4911ca338a2f93a1cc9e29d9740d988b677094087c6e6988ec2b47ef5b8dfd92ac6e373dd0d34454000000000000"], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) openat$hwrng(0xffffffffffffff9c, &(0x7f0000001240)='/dev/hwrng\x00', 0x202000, 0x0) 02:35:27 executing program 2: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r0, 0xc0405519, 0x0) r1 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000002080)='/dev/ttyprintk\x00', 0x8000, 0x0) ioctl$TIOCSLCKTRMIOS(r1, 0x5457, &(0x7f00000020c0)) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$FIONREAD(r2, 0x541b, &(0x7f0000002100)) 02:35:27 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(0xffffffffffffffff, 0xc008551c, &(0x7f0000000180)={0x1000, 0x4, [0x7]}) 02:35:27 executing program 4: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x74, 0x0, &(0x7f0000000100)=[@decrefs={0x40046307, 0x1}, @exit_looper, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/35, 0x23, 0x0, 0x36}, @fd, @fd}, &(0x7f0000000280)={0x0, 0x28, 0x40}}}, @release, @decrefs={0x40046307, 0x2}, @free_buffer], 0xe4, 0x0, &(0x7f0000000340)="192edaf8621943df81acc8221c73261958e5f8ae85aa447823557a30e6683fb7f101dc128832e2cac0d345d10b74ddae1aeab72f3a0b2bc47880b99b81afb1eae43481ab1453f61f27a53d23aee8264f0864b8a511acda89e97d96874adebda0fea7c668502a1b338e5a4baeb421f214d1d3a67e5e396a00b066627b2e496ac10f604074fdfa175876f46b8095672bc46c98fc6a66d043b398630f89aaee27538ea0e60425a68c0bf77df4eeaa03b17a5d98782b3d47a177cff183e49d47b5f2e6fafc9debf5c7d261ccbdd727a28322da1a27798d8ce0f807c940f846c1cf12697736fe"}) 02:35:27 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040), 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {0x0, 0x0, 0xffffffffffffffff, 0x1c, 0x0, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) [ 2125.144947][T27447] binder: 27444:27447 ioctl 40046210 0 returned -22 [ 2125.163973][T27451] binder: 27449:27451 ioctl 541b 0 returned -22 [ 2125.172513][T27447] binder: 27444:27447 ioctl c0306201 20001140 returned -11 02:35:27 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) 02:35:27 executing program 2: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r0, 0xc0405519, 0x0) openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000002080)='/dev/ttyprintk\x00', 0x8000, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$FIONREAD(r1, 0x541b, &(0x7f0000002100)) 02:35:27 executing program 4: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x74, 0x0, &(0x7f0000000100)=[@decrefs={0x40046307, 0x1}, @exit_looper, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/35, 0x23, 0x0, 0x36}, @fd, @fd}, &(0x7f0000000280)={0x0, 0x28, 0x40}}}, @release, @decrefs={0x40046307, 0x2}, @free_buffer], 0xe4, 0x0, &(0x7f0000000340)="192edaf8621943df81acc8221c73261958e5f8ae85aa447823557a30e6683fb7f101dc128832e2cac0d345d10b74ddae1aeab72f3a0b2bc47880b99b81afb1eae43481ab1453f61f27a53d23aee8264f0864b8a511acda89e97d96874adebda0fea7c668502a1b338e5a4baeb421f214d1d3a67e5e396a00b066627b2e496ac10f604074fdfa175876f46b8095672bc46c98fc6a66d043b398630f89aaee27538ea0e60425a68c0bf77df4eeaa03b17a5d98782b3d47a177cff183e49d47b5f2e6fafc9debf5c7d261ccbdd727a28322da1a27798d8ce0f807c940f846c1cf12697736fe"}) 02:35:27 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(0xffffffffffffffff, 0xc008551c, &(0x7f0000000180)={0x1000, 0x4, [0x7]}) 02:35:27 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$TIOCGLCKTRMIOS(0xffffffffffffffff, 0x5456, &(0x7f0000000040)={0x8, 0x401, 0xffff8fb0, 0x0, 0x17, "0125db2581cdae2d99d3da8994052cb377341c"}) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000011c0)='/proc/capi/capi20\x00', 0x0, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x4) ioctl$GIO_FONTX(r2, 0x4b6b, 0x0) ioctl$VT_RESIZE(r2, 0x5609, &(0x7f0000001180)={0x40, 0x8, 0x7fff}) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) ioctl$GIO_CMAP(0xffffffffffffffff, 0x4b70, &(0x7f0000001200)) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r1, 0x81785501, &(0x7f0000000080)=""/4096) ioctl$KDSETMODE(r2, 0x4b3a, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="0b6300000e3cd7197d5f92c2c41f212ce79be7eaadd19a3fd1521192bf82e360a5b77b432f4fb1f10c62af17f4013c4595d747b3a1975334d9b945ca5cef8f02d971da2bc6d41997204f4911ca338a2f93a1cc9e29d9740d988b677094087c6e6988ec2b47ef5b8dfd92ac6e373dd0d34454000000000000"], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) 02:35:27 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040), 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {0x0, 0x0, 0xffffffffffffffff, 0x1c, 0x0, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) [ 2125.606414][T27458] binder: 27428:27458 ioctl 40046210 0 returned -22 [ 2125.721675][T27469] binder: 27462:27469 ioctl 541b 0 returned -22 02:35:27 executing program 4: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x74, 0x0, &(0x7f0000000100)=[@decrefs={0x40046307, 0x1}, @exit_looper, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/35, 0x23, 0x0, 0x36}, @fd, @fd}, &(0x7f0000000280)={0x0, 0x28, 0x40}}}, @release, @decrefs={0x40046307, 0x2}, @free_buffer], 0xe4, 0x0, &(0x7f0000000340)="192edaf8621943df81acc8221c73261958e5f8ae85aa447823557a30e6683fb7f101dc128832e2cac0d345d10b74ddae1aeab72f3a0b2bc47880b99b81afb1eae43481ab1453f61f27a53d23aee8264f0864b8a511acda89e97d96874adebda0fea7c668502a1b338e5a4baeb421f214d1d3a67e5e396a00b066627b2e496ac10f604074fdfa175876f46b8095672bc46c98fc6a66d043b398630f89aaee27538ea0e60425a68c0bf77df4eeaa03b17a5d98782b3d47a177cff183e49d47b5f2e6fafc9debf5c7d261ccbdd727a28322da1a27798d8ce0f807c940f846c1cf12697736fe"}) 02:35:27 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) r1 = syz_open_dev$sndctrl(&(0x7f0000000100)='/dev/snd/controlC#\x00', 0x1bf80, 0x189800) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(r1, 0xc008551c, &(0x7f0000000180)={0x1000, 0x4, [0x7]}) 02:35:27 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040), 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {0x0, 0x0, 0xffffffffffffffff, 0x1c, 0x0, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) [ 2125.764175][T27470] binder: 27466:27470 ioctl 40046210 0 returned -22 [ 2125.776444][T27468] binder: 27461:27468 ioctl 40046210 0 returned -22 02:35:27 executing program 2: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r0, 0xc0405519, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$FIONREAD(r1, 0x541b, &(0x7f0000002100)) 02:35:27 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r1, 0x4b6b, 0x0) ioctl$VT_GETMODE(r1, 0x5601, &(0x7f0000000040)) [ 2125.816595][T27468] binder: 27461:27468 ioctl c0306201 20001140 returned -11 02:35:28 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$TIOCGLCKTRMIOS(0xffffffffffffffff, 0x5456, &(0x7f0000000040)={0x8, 0x401, 0xffff8fb0, 0x0, 0x17, "0125db2581cdae2d99d3da8994052cb377341c"}) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000011c0)='/proc/capi/capi20\x00', 0x0, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x4) ioctl$GIO_FONTX(r2, 0x4b6b, 0x0) ioctl$VT_RESIZE(r2, 0x5609, &(0x7f0000001180)={0x40, 0x8, 0x7fff}) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) ioctl$GIO_CMAP(0xffffffffffffffff, 0x4b70, &(0x7f0000001200)) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r1, 0x81785501, &(0x7f0000000080)=""/4096) ioctl$KDSETMODE(r2, 0x4b3a, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="0b6300000e3cd7197d5f92c2c41f212ce79be7eaadd19a3fd1521192bf82e360a5b77b432f4fb1f10c62af17f4013c4595d747b3a1975334d9b945ca5cef8f02d971da2bc6d41997204f4911ca338a2f93a1cc9e29d9740d988b677094087c6e6988ec2b47ef5b8dfd92ac6e373dd0d34454000000000000"], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) [ 2125.913810][T27476] binder: 27472:27476 ioctl 541b 0 returned -22 02:35:28 executing program 4: syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x74, 0x0, &(0x7f0000000100)=[@decrefs={0x40046307, 0x1}, @exit_looper, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/35, 0x23, 0x0, 0x36}, @fd, @fd}, &(0x7f0000000280)={0x0, 0x28, 0x40}}}, @release, @decrefs={0x40046307, 0x2}, @free_buffer], 0xe4, 0x0, &(0x7f0000000340)="192edaf8621943df81acc8221c73261958e5f8ae85aa447823557a30e6683fb7f101dc128832e2cac0d345d10b74ddae1aeab72f3a0b2bc47880b99b81afb1eae43481ab1453f61f27a53d23aee8264f0864b8a511acda89e97d96874adebda0fea7c668502a1b338e5a4baeb421f214d1d3a67e5e396a00b066627b2e496ac10f604074fdfa175876f46b8095672bc46c98fc6a66d043b398630f89aaee27538ea0e60425a68c0bf77df4eeaa03b17a5d98782b3d47a177cff183e49d47b5f2e6fafc9debf5c7d261ccbdd727a28322da1a27798d8ce0f807c940f846c1cf12697736fe"}) 02:35:28 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {0x0, 0x0, r1, 0x0, 0x0, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) [ 2125.988050][T27480] binder: 27478:27480 ioctl 40046210 0 returned -22 02:35:28 executing program 2: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$FIONREAD(r0, 0x541b, &(0x7f0000002100)) 02:35:28 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) r1 = syz_open_dev$sndctrl(&(0x7f0000000100)='/dev/snd/controlC#\x00', 0x1bf80, 0x189800) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(r1, 0xc008551c, &(0x7f0000000180)={0x1000, 0x4, [0x7]}) [ 2126.036210][T27480] binder: 27478:27480 ioctl 40046210 0 returned -22 02:35:28 executing program 4: syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x74, 0x0, &(0x7f0000000100)=[@decrefs={0x40046307, 0x1}, @exit_looper, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/35, 0x23, 0x0, 0x36}, @fd, @fd}, &(0x7f0000000280)={0x0, 0x28, 0x40}}}, @release, @decrefs={0x40046307, 0x2}, @free_buffer], 0xe4, 0x0, &(0x7f0000000340)="192edaf8621943df81acc8221c73261958e5f8ae85aa447823557a30e6683fb7f101dc128832e2cac0d345d10b74ddae1aeab72f3a0b2bc47880b99b81afb1eae43481ab1453f61f27a53d23aee8264f0864b8a511acda89e97d96874adebda0fea7c668502a1b338e5a4baeb421f214d1d3a67e5e396a00b066627b2e496ac10f604074fdfa175876f46b8095672bc46c98fc6a66d043b398630f89aaee27538ea0e60425a68c0bf77df4eeaa03b17a5d98782b3d47a177cff183e49d47b5f2e6fafc9debf5c7d261ccbdd727a28322da1a27798d8ce0f807c940f846c1cf12697736fe"}) 02:35:28 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$TIOCGLCKTRMIOS(0xffffffffffffffff, 0x5456, &(0x7f0000000040)={0x8, 0x401, 0xffff8fb0, 0x0, 0x17, "0125db2581cdae2d99d3da8994052cb377341c"}) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000011c0)='/proc/capi/capi20\x00', 0x0, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x4) ioctl$GIO_FONTX(r2, 0x4b6b, 0x0) ioctl$VT_RESIZE(r2, 0x5609, &(0x7f0000001180)={0x40, 0x8, 0x7fff}) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) ioctl$GIO_CMAP(0xffffffffffffffff, 0x4b70, &(0x7f0000001200)) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r1, 0x81785501, &(0x7f0000000080)=""/4096) ioctl$KDSETMODE(r2, 0x4b3a, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="0b6300000e3cd7197d5f92c2c41f212ce79be7eaadd19a3fd1521192bf82e360a5b77b432f4fb1f10c62af17f4013c4595d747b3a1975334d9b945ca5cef8f02d971da2bc6d41997204f4911ca338a2f93a1cc9e29d9740d988b677094087c6e6988ec2b47ef5b8dfd92ac6e373dd0d34454000000000000"], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) 02:35:28 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {0x0, 0x0, r1, 0x0, 0x0, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) [ 2126.220556][T27492] binder: 27490:27492 ioctl 541b 0 returned -22 02:35:28 executing program 2: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$FIONREAD(r0, 0x541b, &(0x7f0000002100)) 02:35:28 executing program 1: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$sndctrl(&(0x7f0000000100)='/dev/snd/controlC#\x00', 0x1bf80, 0x189800) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(r0, 0xc008551c, &(0x7f0000000180)={0x1000, 0x4, [0x7]}) 02:35:28 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) getgroups(0x1, &(0x7f00000023c0)=[0xee01]) r2 = getuid() r3 = getuid() read$FUSE(0xffffffffffffffff, &(0x7f0000002600)={0x2020, 0x0, 0x0, 0x0}, 0x2020) r5 = getuid() syz_fuse_handle_req(0xffffffffffffffff, &(0x7f00000000c0)="50d89673295267c93d65029425dc293f9ca37e3e6cd8a791122130f0f5505e65d7ea03171545c3c93d953a3b3e549d22260b18e6954da096bd62edf98b9e7e9dc89080baae1c81012eaf0e07119e23db6c9790e20312dff45a8de40ad2f592475c4888baf563337d3e591772cb5a4dd844c57fba968078a743bfe9fa01dbac5133fe735740c4e927676bf2b9a6f7ce21d1ce7f8e3e8d5e4447b4f842360d7ff65db8cf036e1fced9736bfabdce98833a214ac3d44fafc0dae441a141a161ac02116cd37d4d5562ad02defbbdbdc099db1b8b79c483dff1ce607667a1ec541ea7bf2ee16a7087d55bba7f7a1b5b25018a4abfe4be6a245d157688f7f53b6af2582826ba3adc0f43dfd8a438e35ed4d44343144a5c1f8cb5fce2180f1b9c622ee2aa83799ded3a64c606147c42818540d3c66983f79b8b15ac9cce4b940526daf6be42bc989fb3c47eeb1de2a30145707b041b4a54a1f8c2fe7407dcbcc5ae6e37f02ddd0e5e7ccd866cb695ce053a399728281d6d7a00dd1fae2d437e322abac045b69014016d74422b954a07a93f469d15fd5a7b5030012746a24cb332b4ef735c0b6350df87242a6ab1994c8c1f30809aa4ae7a53fbd51c9a05210694280dde5aa5f711e00cc1152a963e6a0414ef59c05d650f23360b76cbc24abfd82a56e800ed4b3dd511365e8e84bc31df6b2f90ad8f1a8976a249280e4aa5cab56985a583fa8fb1e049172ac040252468fc5678ff151e3a0db2ca99ab75e2c529ed9cf968645f3068a6b4f04fbbd1b5161a5d70335a35b27a84c41c30a3af2229a93a675398894a0f5616e649a28f80084ab28fb8b847cb70ec71b674b7d680830a87c1539b8e74a708c20064769b0199efed0bda6e6b4ae7060ee0a89ca68b1f63a010822c4033b23dc91bb5e96882d3d04ce0cc5d9d2561a10432a4198ed6a528dd0f2d96b80997d1322fd755aa5e52558f5c0aeded6662be7c7eb74fbb6b421e668dc8225ea4dd87781475b277ec61e20151a4d95f8e9158b304d513903f46b166225833b4a6d40c5e73e1be7cf0b6a64c28b67f7c8acb34567e1287c7f23f5f628c497c9289a8447cbd940908746338a3a7f046cfde61a123fb6c6182c68615fe67e5d2936b90705fcd78a7329f86c3c8b884e229e20f59741567b65dbd0a34c11d9f14c5a63a4fe07f9caabf0a472a3384263856f46e6d6b8c6f4198caeafba2dbb672f224dab4cc4a5bac9a3555584ecad59ef8ad015d04a41873923864c8d1988e540b59844bcd14f524df28116036667a0523dcbfc8ea66e9017d6ea8adc70a2388f63cd82520ef4f87bc8f1b16a3e22a78ea590159cfa636b3116f0cc18d8089e8fc4ce33045e8354d1ec1a67cb58fb6e68fd8a4bba72641b830aa171ba3460834ee61fb069bde99201a397f8d4e7c20b3ae04d7d533a4152e71aea5a619a8331acf5b11ef5ec130abd353126fdffc30f8f7e6857e6016c2b50f9d9d7017fe4ce857afeb22b74e92aacc87db766fbec44be2b6a29be62b8fc2660bcaddacc9a6cf1ffef446b7039924e83d2839c56facba9d3b498378efc941747474cdd0b67eb5e9373d86982bcd946600c64173a1f1d5ad00d6a54d78bf3e72c423f251b72f35ce6153b54e5460ea29a852c23804f3c40786de4868fdb8a44708d14bc78afe04503332d5af3309788185b85b3d7fc26a5466294adc94a72607409aa3d8f67eb9ed9261c35a341dd2b4ab5ffacc68eff532e352f110ed85dcd93d24468c38bbf61a42166ed65c0faa3a037b63fc6fa4a55a4f02ff393ff727f7c0625c9c7c12d8bc46d509050af9bf8dc404350224952080311a8d6e1610ec17167179fda81f8f9dd56dfd93d6c93aa2707f9ec2bbd8ac76e9079e268c6122ea12384299c8f279f1b6c3000fc8e90bb31db1160563482259eb324ac5ca8a6016279c8ac60fec3e43467fc5410cf8d2b6d8ad1774c1fd4d944ad86182048d4f5bed16c5a9597485413e703672c51ff2ddf988ecaad5995818debac8cab50bbda833dd14dfd719b86b41d5bec804a777af8f3304cfeec254f8bfa09d621e75a1436c815b36f4f2b48e2e1bf6943741415b5d98e86eae947666eeef666873a7af0b187431925bbcfb4eb72e1f0606126504ea9d5bac073ddfd2d90b00d5bf5d8d18e3b1426e1ff89ae2337522ef88c7b4b713d7053ec7f4fd32bea0a5af3cbd0b2f998592b68c0c926d63615f76a3642eadbe922708b38eaf6742901424d48ff9e5b98c22e5caf0c60d71f0a37dbfad7c5c69a086beb97ca17dc88cf7a424f75bba59c4cbbe387d187e6bda900bf6755eb328977b87f607e325c9c5e0db04c1086f5348c416c1a955fc7f6c8faf14af59d7366386846ea5563ce3da5762028885fda8d635b551a4b9560c2572cc63daf3fad06da2848c91b7f3b4c54dae91451ceb235c04bb4da3ac8c364639c92fb3dca20aadf5fd28c9a0b465d3686e5375b3067f4fe9a09de363d7baa33dbac85dd0575edaad358620c4812c00961dbeaa596ed63565e5ab0b8e1204afbb33de38df13d13eefc2308a4c010c7d52b696afcef451b6affbbd80e18f9381fad9cc0f72b78e9452faa5823f75bf55724cfc7f3e6cd2041f5fc4aaa9f17db06671347fcafd601d88928a704a16107129e375e7a43dbec63d02d19239e852d191019ee4841fbf8ec6ef5459fd4999f848a71ce28d7425a19524a686a4b992c659b7a43e6479eef10b80ee6e203f041e931c1137996c0f78fc4e77e7970dffe3e91f4c0e3ba3aebedb98fd73fea48857ea3c57c4f11b965b33b270cbd5fe73790659a663fbf5983bd1c6b99b38f66497c83d567f0ec9b8d0564e72ad0bdf259c462e8d4553ac8f6bf9be39f6fb4192836df3c58505043472ba854f3e8c0556ebc89ac53559e8a2da0553a800034eb3a211d9a97f7b4b942d75e4b5e5187b1d021189f7d80b2b8c3a245d9033e6d07ffae96d807b1a8b2bbf26aeb7a0d0f6a3df5b785f6284280a2db1269da37d83fd7d8626cfc298adafa38ba78b24537d8b3260b2aa299fb714c30504f7cfc4f788f781cebfaa131ea5514453fce6c661abf86fec0c4b904b064caa49b355ede749a7eb2d469e241e0511d7d670b47c912fa79b53c98d93030d9537b6ca19646099f6880e17a7c89467797d141516f2697f1963e1b2b5781ab312e229b954f09ec454550a1bafd34f3d5d51936f0e98b763f447ddedaf56442d3f54c5f4c8e9eeb97cff48b61343fb82c4204b63f24c0867054fd1cdb980d671d7f64617063241cba3995ae0e1207d45a79653f7548c3a94ec6b418c852185f9892a9dad559a7e4f857064ffabdf8a7b76dac241f40ba173bdb4b2cb51d27866d8f5acce7b21fdf73afc1923b8d05a5e6f135c312cb68132b8b1645fafd669ec9e65bc31d7265ffadde9f761791ef16dc4bfc284d95e587982d04ddd3161a2b2f74ce9d53b5b86b61e456b6b4ab7625025ac6ff35c476b98b0191fac109c843b8da46146bbcb8c03598a103b6dcb51ca4a9808480401b6322bf826f29bc788232e69d16d125f8b61c8c17fc33f2a9dbb493789b05e0d82651d0bfa498028c14149dd40018f4e9dd6f6105814871c65bd298dccac8bd6e8d1a39c4b56f2b6f2ba5e5c1ebf6197d55f5241a796bfd51731a4896711ec04a6bad2fd40bddcd6b9b8176d4fee2f4bf0d15d2ac1c19b4eda5550d89c4ab935c01b95b4feaa53586ef5753414b83d359d24e1b07938d05607eb205d44eb5b8178e9bfd5c14e7da1733563c3bc5c357a6a2444925be3dafb6a9661821aa24a5343620c67e1cf6ca5aa2b922250f66ba9de5262f051c8f7bd8d62d9a5038aa632ff651297a4cdf072c28f014c491370df44e91ed6e8e245be4b28c6352f86993957bf640b353ada24e015d04e8fd80cfb89aeb3f9b7d106b96cda688165b834740b84d1b5cdcb538b31ea6692eade9d45562a504a52996d9e2dd3181f4ef47d217e44714ad9e6a78b29fbf4df58e611eb6fdf59b1b3f31f861d6b37727234b1ca17efc333f45d0ed9892a14ce43bc018bc8fa10dd19ef902b141609aadd5e86e7aee4193a177117df7b19aa15cd6533a7ee3d1ade6a11ed4eda3316c0980705459da374b37e33b8a7c8dee266744b1d9c4c1b8219b6a36ffae61acbb6ba10e86f0f568f851fe00560f4f4c1fe30703cc9a2c9d371678daff7202106546444010c1c9b0615bba39b7023655785747faba4293a622bba5d9e4ad031a35e7d75c9f212fc9b823597b8aeabea8d826707adf93335a95b6dae58cb92a4d592d2683664740c7f00d6e933a86c64275257a014ba2a2aca3c201783b6db5797d586462509dd074370f76336f2d9bb777a6609c00a25d7cf828547b1f9557393fd285ce7c81d9bd780a34fbaa8aa4bd409e084943d2ce0b043f73487ac95d2619d7ea1c984f1e5060b269918526c5ef349ac6dad23bda5f5714f9e8e7d9da5a777c2583b1c7891d965345cc7df093990347ff99fdaa5efe41c493d08cfd86c6749786150c4571f19c2d7927a28b2fd881ba5ea5bd9416d805146ba2fe0b644cd5d49e9a5fde5387dd11bbae51eec95561a0ca17a9f31fe4c804d8cfaa25b43c39c71cf01238de80f247a38fe127f34f55fbbb3f03317568ff666109323450c6ca825b25af05b409c8b2bd95303f724c726883d1114b7d7fcd1c9cea6c00b45092bdcfdd214203cc16f0a108a4546dda3e1e8f7266af3fbde2c533c21811a9ff1a700004217c989e204bc5f6c910f25c223d534587176d0948e52aa09278212cd3ac214f8a0c1fd957d0e4abfb897fb644b7c1ce720af423058a594374526857d423e2a8f2b682fefce57f629b7799285ff5dd344abfbd2438d5854e3e54b40ab026930c4b6ca6823d979571691faed3baa057aed19bf67fc32b268be8f3ebca865792cd20abe5aa898c25e9aabfa615a9ac37d90943aff16e7e30909c0510355ee2111e61742a5b1cbb30533c2813daa38e88f6b4e3f0f02c6c8e932e52d4aeab070a422008aa6dcaed76c718718070b9d19617cfdba2eb10418dad17324fe782b6a8a4a2eb0bdecb875653fc92662ca7daa88a1fc4e83687ccca95b5b77e93c2056b2e938668f7e13c40bebcc6ba82259aeadf9764c73e550b3152bfe36e5b8948c0c99cc7df6d16b788553758ba96424dad6cf23ca8c3ab69591019b0f2ed1ea92a226c527f2b328bbdb8710019dffe44cfe34b40238b2751508f07f2b0d90ad5c459b6146d253e7dc13fc8d3020498b87fe6ef1977aac1a0d0003ac635b8bba4ccffedfffc57323cbcaba2aed320654d2264f90b0b3cbf73750dc3751a2d81cf3ff99092614654b44abe912f9e237d4e8c1ec8b0727c1fa08bcd50c2fe887229a3853c26d59d2d9584311e5e3b565909bcc7d646d0bf82268074c27cce5655586bf5f61353700cdbffdf8bd097a1885cce5297b2dfc3e39456f079b0de9ff3c4cabac2fe55ea8e2b4cbbbda8f6c49f7d447e6008ff686e424572e31d9d851470b099e55b6e8fe102a06182323fd0b40d29e2150a47ac79b3a1f455eba95d44122adebef608bfb45c71fd74778b30fb9e1b80c19c1051f0665dd5ca2b0f244ffe48f15fe3de53d6ed4829a00a4ed3066e2b4b61132db61a591e53a7fa0fe5a0ca0809e2fef2cf8ba65ccb99aa7c8a708d634f0ae21301e18b80210e1af6b74457e6152b8bfa08123ed600855c9d7a136ef37aa95dc69a1be9f27903553a4e5a105ad77b6f42a003b521f4dcffa6b938c9d88521229698b844216d250a18b1adfbc6dd63cbe15a3bb8102b34789268028d2175399614b1fe3d7c8be4ac05e683a97b3fd6c21dec7f13f783288d8b722e8cbb7f9ec3ee72470cbe6b0e8257a1cb99bf64770a76ba45d5195df4638e5756aa98806588468ed16eafb7a3d219c2976cb1dccd10e91333d007ae86bc085127fc9c4a93973c807c8ee227a4e30b4d4666ccbf173a93f19e31151aac84bd34cf3adde0561712235f0840081d0e55c82bc727b8134080447d92ae45bc628052235e26fa468bc2ae28e4c6667c9c978b339aafdf917a0d458d9f33f13117eae4fc044b31654f17215972cdee033625a85fe7b8a99f16730507ed19bb5c1569d306d9f739f0e31a0450d3c55cbb12b8625e05c9b6751d89d8d564ffd41c082a8dfed060cfd87ef8a0cdb0c5d3a04e9624373276c2179adc796638ec0dbb72cf83351fb833f0593e3d9d0ad148561715fdabd211f79674511c17db4ddcb939e8b0ab785195ab47c9f8d0d659ebdab2c9d3afc2909ea3b8f8535ac14e3b984b73a22f65cf498face4cca78ad0815f655c0c15f2b75f38f981babbc94aafd0aba79aca8ad52cc80692f243e3b408383a19c1b57fc4b33bc4a6f335ff79d23a4cef19d555a94cc26aecf9f82f96f42155bfd4644e3cd5f04f4b76faaad23ade07cd83295f1b617ba1dc0dabeb750e2c404c3ae33505ab154392ee1ea1ac6de842193c067b3329ccbcdc9d5e1640c1a56bfb1a9d0ed3da38e3b295baadaf6f07379d28efc144c498981f6b545595fdef12bf7ed5e4f58c4bd2771adfa3b14b204dc8b9832aad201fee34f85358b1ff62e5c129a38fe7339332f941e2bf0fbe47fcd05ec77457331a3d0d0950394862d6d1fb86bc6255c5519c91f5a0e0f18e546d2acc60c147da24b87af690c75d22d79e22075b9a95961b9d8953e0af1df91edad77a98c1725623276bd8c76a244922284d733489ff4c374eb0d8c75d41a87bb681706c5e003a3b82538861e5a72da4541f76868722766dab7e10d9ffce1db039a6e7d0f098c07d2cdfc805ecc2872de95503e9f61e329c0fa37a4ec0f61192d9750b65b1256bc22776f1f65ea9b96c3e1a35032e33466a4cf14a300c6bfd3435be2e68c4092a65fb91eb7a81042bfb9ec2d0b38f90d64ea5ddad0a9856d715ca07ab8321165adb62f3c09d9d81c48155e618914bd43c4692e33cd57d141e04ccc8c7f39ab9d826bd474a25a81bcac0f05f2e54813acc40a415e27e500d646b016ffa672d223e344a3d6fa666b491ccfa81520ee7835f750121e12f8cd50895a721571713ce85ef59cb265eb1e7641024d8834caac918ca743373b40536ed830ad8f8fb961faa93f13791af11391c5b359a31330ceca3f333d5ae49a0113f6927f63edc45d0a223426825abaa711d830c45bcda885fc1ba0ed78b81408c9322c5842f9ecf12d6392ef1f75df2c92e5bac9b3a8b3a646120792aace17020e3f64b57ff8abc7af5a14746e969c7008d42e41a127c95a9f969a1628c865cbbe233c921fc2fdee10c881ab389887fa673175204eae088cc3bae7e5102723a0b7a069a91ec83d465a0f913204153263ec97a0fe755d6d764e2cbd942f1f7c50722f26e193eefa955d364600f7a38144dec772a7035df6cb97e00bb651d0367b1e4df85a4148cac17933da9f98549e17c37fe56c0c4e70e4761b8e89bbde56e702f50e083a007a3ddd355d78d93bd0c781dcf7e91955b516b713735f6e882a0af9d8976020af28ae7115c6e2a666596c2e8dd9b2f41c961ebec4fbc9648c4b9938fe85a86de8e4cde72e925e7aef5b599aecb7048b8a98e1b4a24fa07c944af9b34e4ed2d07888b74afe383f18c82989dc53815c1de76bd32d8a12f6810e927e4b0c6e9dbeb13056617264969786948d3d9cb98dd0be23e118d1c3b94f24a8e91395c9c6d7aac05e48e53156047612be367b820df950ac71acfedfa6d504dbf13630f282e4019dff1daee5db4cd730bf102b1c53edcce807f9489320d0a029eeb53b67ec60366f5c784e1048bf2ba952c334ac5ae455050e85e3620e6def25dff8104b72eb46fa0d67e1f0032b155f129412fb00ed83142701e876bba0be3ca60e31f2f7908b28d8f9fcb7495ad5f47427c881ad800e285da5c128e4f49f34aaf68900ef2465587f7db361ad2f50abc1db3b4c0edd3794755a8f71ca99ba43c931cb9a469445eb928af4b6c8bb6ea8dbbf67a8f1e5014752f67d3c9223b2ca3d7f6ed3e44ae14575f561b194503cb5a3567cd0ca6a67362c720260dd4eab8e5ec06af4fb86bcaf5144aac0e22f2e513bcfce5f7c6e8b5006714f77db251b7820fe9b300106a5185cccc1734e3c7274e4c6657293a9ae5b3d95b7c40da3b2a3eee24dbd3b16ebbbf8d07bf3ccb9589b91202b5cb69b69c232165f33216fe2cb60f32dddca23219c5f1e171566239f521276980ec0d059bd483924761f22a866d142bbf48fefe718715d48e86d5f21021a6d80d9f6548656c0b905b20819915012c22022c2f54bcfa2918061c03992b6f829dcf60c3d944acf9b0b3d1c8b8538adb7e943860f577472aab7074a066a81c4a629b5b39b4a5ba3a5fd532450e578a1b457c8c8a10dafb868bd5fe3f97c1ff8cb5921c701e0000439f02b16209bd5eda2dc243db24f351e5b0561dacda904294a776f80851f9d64f3944b3d77792704891da02ff5f7429a05a98e90a44fa554747ff84de9717845e6dfb8f55ccff0c0f035023144d905bdaffa4d5b943840e18b9bda8efa3accd3ca943443f06142ae26e9f133605cc70b1847b6379781a002db763ad71bcf93485efdbdeb6aff918943681af3c26e58daf61f00c3f7536776fd5e0fe25bd7ef11baf168b90e8810b856d56d392cc4e2cf0eca4d7134c3e314476e7a0718fb5a5585f48eceaf5e72ae08754fe25337a2b1b08b0f6932eb98ccc0b2ea310a237e765a2173a709421090f69821453ec422549f5d47adfa455a9f69350449d7c96b557a91a254822d261582cb48452d59607db79b9e5b67cb5db028efea017447c58faecccffb95107336f4e4bd04c571b12858a95c06ab1f55e76c320f86313d4a3818423cb2426e8c25c34764422f2ee76ea7977308311173463cc1ff6d987b0678c010d79c072396004b7f96614baa8b117e8a766471419c117d856660beb063395a9023db530fa29e9e0b77407c332b600ad24bfa5ddfe458efb5fcc3a11eabee91bb2ca4759a414ac3bb9a25cd16d0c08caebd2111a91930e4b28b09a2eff7f92e42ebbc530023d74124389d29b55b786c9b5ab26e0271e84617361f3b1080dcd627aa311298bdda87b441da192295dbbe438ed2c90b5d7e10cf8f75cc9585dc5a5166603e4a571cbf8cf8fa95a76cfdd6db52dbe7392550f278d885da7829fb88f5b729e19f79149a6b76f959e9ba7047b517d56516d51a60a998594e20145725acceadeb24c10a3e35fab094e1f5b3f57825362e6267577ee40f65232f32215ed3ae94a407fe162260ffb2bccd9a617d21eaa4460b4ce177bb001c80e80e7fa5c9c7eedd9946262f1eb55c58004b68e3e920c82af864171e965961b2f578123fc2c8a7ca4d9fd58df1e6419ca7db5be8df17c1ddb57bcde69e4a945f9aea9a54c1f1ae835458401ad6e6eb656afa0f40e57a833ef402fe4d7cfc536dbcfeba752986c4b1008cb551610bf88d93ea77fbd7eaa2857a0fba3996969cb209344fcc27fc9c5bd9c4b3537e09bc3aae6494a6a7c29a23225f9f8b3a9411f5effcf2f164aa013a59e72ec5415a2bbd7d29d986975fe914796c3ac7859d801dd75f1491bb5d201875a6cbb381efd71e7175b3b46d59c8f245c32b3f427ed27a0036704497cca8635578ea22c62a3dbf83aceabcfc2f156002b827050d6273fa815d482e4d1c7fb5ba4141c635bfc58d3111672902cf730d3380b3583ea4e699a23964aa209b6337b71e285f82d9888f996420aab3cbf9b83d94db968d5f7fbda21f9b6bc07c1fe474b6c74d7d00953eebac6825cb2563f01f66d5c58036a49cc8a4559f64c1cd93e093a10ac5bd7986981d088dc123e3a495597b6a4d24ad1639817c33287b603cc6c4d376d3bc64b382c9c1fe8a480e46750aa866df87abab31a893d69264169a47faa1c3c3d7bdc65068688d4c161904ab422e46fb60953b3e59000131c97182d254f3ee085fb6a3b2b31e57208e272c75f3b79a42f7bb6ca34dcf041ace98134a6283b8383c1379e6fe0d4b9672b4e189a56a62fb4c05b5e87e35e0732610b5da1753937b07bb5db4f1a5fe462381968ad4a1eb5e8e0ee5a1893714f7afbb97cf3dbee853ee39c78e552fdcd056cac59e0f9c0d6ee8fcb8c2bac2f358487001b753b73c95401b4d57049cbd5665c22a30552e834d99807e4d6a5132edb903fd374595f37adc8fa5e830883fbf2decc6f7f8b13863266f6fffab5dca5568ed31436ae76d518ec154f2946a5b4be95916b894ab72c0671cff9d1d1e83f038cb629eb5247e4ccbec16a540e9795015a20a9d45481dc017447ac40bde911311c8199060938f51f3ee2825b555d7ebd34eeb918d8d8a85a512bfd702804553bde901f1294735a3fe316ad137f476c7b5f2bb73e9edbe4c4a320375d8ef71f698ac0ec9b86aacbc260982dfc205cd3f5d3b8a2114ded830fb2493bdc983605c663bf73d558723da35ac7f5b543da46dc0a2015bfb7d0167256839feff9ac6a978ba1f3d88316238aca78065ac76bf226ea872b9df59c59f093b9daaa032e9d9d51a7d6c721b64421226b28fb494540260c7367dea9ed398607631df4ddba8da2364a3e420573411ecb608d31f5510964f212bc61f0175ccd04c64738d002ad76acecdcc80e1287256a507ab0642e9a85328ebc8737aa5b5f168b4bbfbe04d3a1da8839e3e500dda399edd97cd989fb5f7b55e730bcbe0b4ff0a27aaa2e97d534b1015b064036047ea59948899000a8e62035e0b998f26bd4faa6312650d86dbdd4f39b514adb1960a11836bdd663c880f9c5850f8ff660d526248dce0c33797b0df0ddf1503e638e79ed646db20a3ee8393b0eaf5f0ca1a96a250cd2a59577206d4ed64deb3b63d7a9f4f380b4a30395d5a43c5a8eb2daf3d628fff9a8deae6332382890c73d4cc5b66ef8f509e790d5a6ca5520e5d79f251f8c73cc6c88c03bef796743cd3f1c2d22804870e29acfea5e802b2812dc51c0da478c39513ae580650d97f7d5c96b5e81da368104a56909a95ff23fb032ec1f3d4f372fd392fa2ac505f315d67f582449650e5433aa07a26e4a07b5076b3344aa89d88f498ed08a328f9c85a791c6f7553fcbc14fd3467ac62c9a95bd6c4c863eaf7b1a61cf04359c4a1133018dbf2a96650a4fbde5d9c7de8ed7ffd316dc9db84d68e496f794d50292cb9e388515afb7a88fd31b7ae0ae59c709a6ca0898c4aa676d8c6217460d78584da322a93c94b007387c1a1200c64c147d6529d00006f7e1428287c41c9e66b24fc3054a853b9c042510468cc4721be449767e5a3d0f1ee24b912b0fae04851a9fbd93138af9fd0531c796a364da6bf5291f13d3a172b0c260421d4d225b8c4268be4e46672c38d09253955361c017809b9d842fca0f186c8439bfa242cab1801713e5f4641e7a663a806523b9069e3ce4acf310056f876759dc1eb15c3dfcac9c1d284889feb537bbdde052e3c29cfee19cacf45edbbd9c78abd3ed59f367a2f498a83491a6e6a96fdf490c4446c458d158ed6cecc5a5e214b8449187b4501862ccf0b0ca667b81ba326e9247102af9c3884c33c506423252ae7ae0b", 0x2000, &(0x7f0000004dc0)={&(0x7f00000020c0)={0x50, 0xfffffffffffffff5, 0x100000000, {0x7, 0x20, 0x6, 0x104001, 0xdb0, 0xb5, 0x7, 0xd86}}, &(0x7f0000002140)={0x18, 0xffffffffffffffda, 0x1, {0x6}}, &(0x7f0000002180)={0x18, 0x0, 0x3}, &(0x7f00000021c0)={0x18, 0x0, 0x6, {0x6}}, &(0x7f0000002200)={0x18, 0x0, 0x40df, {0x5e9b}}, &(0x7f0000002240)={0x28, 0xfffffffffffffffe, 0x3ff, {{0x3, 0xa456, 0x2, 0xffffffffffffffff}}}, &(0x7f0000002280)={0x60, 0x0, 0x6, {{0x3d, 0x7f, 0x7663, 0xfffffffffffffff9, 0x100000000, 0xffffffff, 0x20, 0x6ad}}}, &(0x7f0000002300)={0x18, 0x0, 0x12e8, {0x1}}, &(0x7f0000002340)={0x13, 0x0, 0x7fffffff, {'\'\\\x00'}}, &(0x7f0000002380)={0x20, 0x0, 0x1f, {0x0, 0x3}}, &(0x7f0000002400)={0x78, 0x0, 0x3a0, {0x8, 0x80, 0x0, {0x0, 0x1, 0x4000000000000, 0x7, 0xaf4, 0x10001, 0xe93, 0xdec8, 0x0, 0xc000, 0xaae, 0xee00, r1, 0x0, 0x87}}}, &(0x7f0000002480)={0x90, 0x0, 0x10001, {0x4, 0x1, 0x3, 0x6c66, 0x7f, 0x4, {0x2, 0x2, 0x7, 0x7ff, 0x200, 0x6, 0x5, 0x2, 0xffff, 0x6000, 0x1c0000, r2, 0xee01, 0x1e, 0x7ff}}}, &(0x7f0000002540)={0xa0, 0x0, 0x7e, [{0x2, 0x400, 0x2, 0x3, '\']'}, {0x1, 0x1, 0xd, 0xff, '/dev/binder#\x00'}, {0x0, 0xffffffffffffff00, 0xd, 0x8001, '/dev/binder#\x00'}, {0x1, 0xa6f, 0x3, 0x0, '(-:'}]}, &(0x7f0000004640)={0x658, 0x0, 0xfff, [{{0x1, 0x3, 0x9, 0x7fffffff, 0x14c6b6e8, 0x10000, {0x5, 0x1, 0x5, 0x401, 0x8000, 0x4a0000000000000, 0x3, 0x5b08, 0x200, 0x4000, 0xfffffc00, 0xffffffffffffffff, 0x0, 0x2939, 0x3}}, {0x3, 0x2, 0x5, 0x0, '%/^-$'}}, {{0x0, 0x0, 0x33f, 0x5, 0x7fff, 0x8, {0x0, 0xef, 0xa7, 0x7, 0x8, 0xfffffffffffffffd, 0x80000001, 0x6a3, 0xffffffff, 0x1000, 0xb5, 0xee00, 0xee01, 0xffff0000, 0x4}}, {0x4, 0x400, 0xd, 0xf800, '/dev/binder#\x00'}}, {{0x4, 0x1, 0x6, 0x9, 0x6, 0x2, {0x4, 0xffff, 0x6, 0xfffffffffffffff9, 0x4, 0x1, 0x2, 0x6, 0x8, 0x8000, 0x8, 0xee00, 0xffffffffffffffff, 0x3, 0x5}}, {0x0, 0x7fffffff, 0x0, 0x8}}, {{0x0, 0x1, 0xecc, 0xfffffffffffff800, 0x7, 0x4, {0x5, 0xff, 0x2, 0x32f6, 0x80, 0xcf, 0xfffffffe, 0x768d, 0x4, 0xc000, 0x1, 0xffffffffffffffff, 0xee01, 0xfffff800, 0xfea}}, {0x2873, 0x0, 0xd, 0x9a, '/dev/binder#\x00'}}, {{0x1, 0x2, 0x10001, 0x1000, 0x6, 0x4, {0x6, 0x9, 0xf644, 0x6, 0x3, 0xffffffff00000001, 0x5d8c131d, 0x4, 0x1ff, 0xa000, 0x9, r3, 0xee01, 0xff, 0x401}}, {0x6, 0x0, 0x6, 0x1ff, '&\'-^]%'}}, {{0x5, 0x0, 0x6, 0x3, 0x1, 0x1, {0x6, 0x7, 0x4, 0x4, 0x2, 0xfffffffffffffffd, 0x800, 0x3, 0xfffffff8, 0x2000, 0x6, 0x0, 0xffffffffffffffff, 0xff}}, {0x0, 0x3, 0x1, 0x1f, '{'}}, {{0x0, 0x1, 0x7, 0x6, 0x0, 0x7, {0x6, 0x1, 0x5, 0x2, 0x7f, 0x3, 0x9, 0x7067, 0x5, 0xa000, 0x6, r4, 0x0, 0x6, 0x1000}}, {0x3, 0x2, 0xd, 0x7, '/dev/binder#\x00'}}, {{0x0, 0x1, 0x2, 0x2, 0x6, 0x5246, {0x6, 0x6e34, 0x8, 0x49d, 0x101, 0x0, 0x1000, 0x30, 0x5, 0x8000, 0x6c0f, r5, 0xee00, 0x300, 0x82}}, {0x0, 0x6}}, {{0x2, 0x0, 0x80000000, 0x93c, 0x7, 0xe9df, {0x5, 0x1ef, 0xffffffffffff8f40, 0x3317, 0x5, 0x9, 0xffffffff, 0x8, 0x1, 0x2000, 0x6, 0xee01, 0xee01, 0x7, 0x1}}, {0x4, 0x8, 0x5, 0x7, '}$:\'+'}}, {{0x5, 0x3, 0x9, 0x4, 0x6, 0x4, {0x0, 0x6, 0x4, 0x41, 0x0, 0xffffffff, 0xfffffffc, 0xc942, 0x6, 0x0, 0x2, 0x0, 0xee01, 0x48, 0x20}}, {0x1, 0x40, 0x4, 0x9, '%./%'}}]}, &(0x7f0000004cc0)={0xa0, 0x0, 0x0, {{0x1, 0x1, 0x8, 0x4539, 0x6, 0xb904, {0x4, 0x3, 0x8, 0x2, 0x3, 0x4, 0x4, 0x633f089b, 0x7, 0x6000, 0x81, 0xffffffffffffffff, 0xee01, 0x0, 0x632e}}, {0x0, 0x2}}}, &(0x7f0000004d80)={0x20, 0x0, 0x3, {0x7fff, 0x4, 0x7, 0xcdb}}}) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0xff) r6 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r6, 0x40046205, &(0x7f0000000080)) 02:35:28 executing program 4: syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x74, 0x0, &(0x7f0000000100)=[@decrefs={0x40046307, 0x1}, @exit_looper, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/35, 0x23, 0x0, 0x36}, @fd, @fd}, &(0x7f0000000280)={0x0, 0x28, 0x40}}}, @release, @decrefs={0x40046307, 0x2}, @free_buffer], 0xe4, 0x0, &(0x7f0000000340)="192edaf8621943df81acc8221c73261958e5f8ae85aa447823557a30e6683fb7f101dc128832e2cac0d345d10b74ddae1aeab72f3a0b2bc47880b99b81afb1eae43481ab1453f61f27a53d23aee8264f0864b8a511acda89e97d96874adebda0fea7c668502a1b338e5a4baeb421f214d1d3a67e5e396a00b066627b2e496ac10f604074fdfa175876f46b8095672bc46c98fc6a66d043b398630f89aaee27538ea0e60425a68c0bf77df4eeaa03b17a5d98782b3d47a177cff183e49d47b5f2e6fafc9debf5c7d261ccbdd727a28322da1a27798d8ce0f807c940f846c1cf12697736fe"}) 02:35:28 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$TIOCGLCKTRMIOS(0xffffffffffffffff, 0x5456, &(0x7f0000000040)={0x8, 0x401, 0xffff8fb0, 0x0, 0x17, "0125db2581cdae2d99d3da8994052cb377341c"}) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000011c0)='/proc/capi/capi20\x00', 0x0, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x4) ioctl$GIO_FONTX(r2, 0x4b6b, 0x0) ioctl$VT_RESIZE(r2, 0x5609, &(0x7f0000001180)={0x40, 0x8, 0x7fff}) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) ioctl$GIO_CMAP(0xffffffffffffffff, 0x4b70, &(0x7f0000001200)) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r1, 0x81785501, &(0x7f0000000080)=""/4096) ioctl$KDSETMODE(r2, 0x4b3a, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="0b6300000e3cd7197d5f92c2c41f212ce79be7eaadd19a3fd1521192bf82e360a5b77b432f4fb1f10c62af17f4013c4595d747b3a1975334d9b945ca5cef8f02d971da2bc6d41997204f4911ca338a2f93a1cc9e29d9740d988b677094087c6e6988ec2b47ef5b8dfd92ac6e373dd0d34454000000000000"], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) 02:35:28 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {0x0, 0x0, r1, 0x0, 0x0, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) 02:35:28 executing program 1: r0 = syz_open_dev$sndctrl(&(0x7f0000000100)='/dev/snd/controlC#\x00', 0x1bf80, 0x189800) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(r0, 0xc008551c, &(0x7f0000000180)={0x1000, 0x4, [0x7]}) [ 2126.492430][T27506] binder: 27503:27506 ioctl 40046210 0 returned -22 [ 2126.527404][T27506] binder: 27503:27506 ioctl 40046210 0 returned -22 02:35:28 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 02:35:28 executing program 2: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$FIONREAD(r0, 0x541b, &(0x7f0000002100)) 02:35:28 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000100)='/proc/capi/capi20\x00', 0x161101, 0x0) ioctl$BINDER_SET_MAX_THREADS(r2, 0x40046205, &(0x7f0000000140)=0x6) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046210, 0x0) r3 = syz_open_dev$binderN(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x190a, 0x3}) r4 = syz_open_dev$binderN(&(0x7f0000000180)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x5) [ 2126.733571][T27520] binder: 27515:27520 ioctl c0306201 0 returned -14 02:35:28 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {0x0, 0x0, r1, 0x1c, 0x0, @in6={0xa, 0x0, 0xffff, @empty, 0x8}}}, 0xa0) 02:35:28 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$TIOCGLCKTRMIOS(0xffffffffffffffff, 0x5456, &(0x7f0000000040)={0x8, 0x401, 0xffff8fb0, 0x0, 0x17, "0125db2581cdae2d99d3da8994052cb377341c"}) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000011c0)='/proc/capi/capi20\x00', 0x0, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x4) ioctl$GIO_FONTX(r2, 0x4b6b, 0x0) ioctl$VT_RESIZE(r2, 0x5609, &(0x7f0000001180)={0x40, 0x8, 0x7fff}) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) ioctl$GIO_CMAP(0xffffffffffffffff, 0x4b70, &(0x7f0000001200)) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r1, 0x81785501, &(0x7f0000000080)=""/4096) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="0b6300000e3cd7197d5f92c2c41f212ce79be7eaadd19a3fd1521192bf82e360a5b77b432f4fb1f10c62af17f4013c4595d747b3a1975334d9b945ca5cef8f02d971da2bc6d41997204f4911ca338a2f93a1cc9e29d9740d988b677094087c6e6988ec2b47ef5b8dfd92ac6e373dd0d34454000000000000"], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) 02:35:28 executing program 1: r0 = syz_open_dev$sndctrl(0x0, 0x1bf80, 0x189800) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(r0, 0xc008551c, &(0x7f0000000180)={0x1000, 0x4, [0x7]}) 02:35:28 executing program 2: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$FIONREAD(r0, 0x541b, &(0x7f0000002100)) 02:35:28 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 2126.821107][T27523] binder: 27522:27523 ioctl c0306201 0 returned -14 [ 2126.883434][T27523] binder: 27522:27523 ioctl c0306201 0 returned -14 [ 2126.914263][T27523] binder: 27522:27523 ioctl 40046210 0 returned -22 [ 2126.977039][T27523] binder: 27522:27523 ioctl c0306201 0 returned -14 [ 2127.001056][T27532] binder: 27522:27532 ioctl c0306201 0 returned -14 02:35:29 executing program 2: syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$FIONREAD(0xffffffffffffffff, 0x541b, &(0x7f0000002100)) 02:35:29 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {0x0, 0x0, r1, 0x1c, 0x0, @in6={0xa, 0x0, 0x0, @empty, 0x8}}}, 0xa0) [ 2127.030794][T27536] binder: 27522:27536 ioctl 40046210 0 returned -22 [ 2127.037823][T27537] binder: 27530:27537 ioctl c0306201 0 returned -14 [ 2127.066137][T27533] binder: 27528:27533 ioctl 40046210 0 returned -22 02:35:29 executing program 1: r0 = syz_open_dev$sndctrl(0x0, 0x1bf80, 0x189800) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(r0, 0xc008551c, &(0x7f0000000180)={0x1000, 0x4, [0x7]}) 02:35:29 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 02:35:29 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r1, 0x4b6b, 0x0) ioctl$PIO_SCRNMAP(r1, 0x4b41, &(0x7f0000000040)="0c90ee9294b38bdcea576acdf59ef1fb65ef06c834029dc55c923581a8302f3712b7af85ec86e66039d5d84c2891640d1b8af7ab91b633a1c7e1085ef6d2d771fb76e04d5a99668303b630d60a40d84d499f20cb1598121b94e3caca7b6ff9bcba1f88690326d7bd1d7be4897397bd67") ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) 02:35:29 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$TIOCGLCKTRMIOS(0xffffffffffffffff, 0x5456, &(0x7f0000000040)={0x8, 0x401, 0xffff8fb0, 0x0, 0x17, "0125db2581cdae2d99d3da8994052cb377341c"}) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000011c0)='/proc/capi/capi20\x00', 0x0, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x4) ioctl$GIO_FONTX(r2, 0x4b6b, 0x0) ioctl$VT_RESIZE(r2, 0x5609, &(0x7f0000001180)={0x40, 0x8, 0x7fff}) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) ioctl$GIO_CMAP(0xffffffffffffffff, 0x4b70, &(0x7f0000001200)) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r1, 0x81785501, &(0x7f0000000080)=""/4096) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="0b6300000e3cd7197d5f92c2c41f212ce79be7eaadd19a3fd1521192bf82e360a5b77b432f4fb1f10c62af17f4013c4595d747b3a1975334d9b945ca5cef8f02d971da2bc6d41997204f4911ca338a2f93a1cc9e29d9740d988b677094087c6e6988ec2b47ef5b8dfd92ac6e373dd0d34454000000000000"], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) 02:35:29 executing program 2: syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$FIONREAD(0xffffffffffffffff, 0x541b, &(0x7f0000002100)) [ 2127.267016][T27546] binder: 27545:27546 ioctl c0306201 0 returned -14 02:35:29 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {0x0, 0x0, r1, 0x1c, 0x0, @in6={0xa, 0x0, 0x0, @empty}}}, 0xa0) 02:35:29 executing program 1: r0 = syz_open_dev$sndctrl(0x0, 0x1bf80, 0x189800) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(r0, 0xc008551c, &(0x7f0000000180)={0x1000, 0x4, [0x7]}) 02:35:29 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0xe4, 0x0, &(0x7f0000000340)="192edaf8621943df81acc8221c73261958e5f8ae85aa447823557a30e6683fb7f101dc128832e2cac0d345d10b74ddae1aeab72f3a0b2bc47880b99b81afb1eae43481ab1453f61f27a53d23aee8264f0864b8a511acda89e97d96874adebda0fea7c668502a1b338e5a4baeb421f214d1d3a67e5e396a00b066627b2e496ac10f604074fdfa175876f46b8095672bc46c98fc6a66d043b398630f89aaee27538ea0e60425a68c0bf77df4eeaa03b17a5d98782b3d47a177cff183e49d47b5f2e6fafc9debf5c7d261ccbdd727a28322da1a27798d8ce0f807c940f846c1cf12697736fe"}) [ 2127.356396][T27550] binder: 27547:27550 ioctl 40046210 0 returned -22 [ 2127.412630][T27552] binder: 27548:27552 ioctl 40046210 0 returned -22 [ 2127.434872][T27555] binder: 27547:27555 ioctl 40046210 0 returned -22 02:35:29 executing program 2: syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$FIONREAD(0xffffffffffffffff, 0x541b, &(0x7f0000002100)) [ 2127.463955][T27552] binder: 27548:27552 ioctl c0306201 20001140 returned -11 02:35:29 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 02:35:29 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) 02:35:29 executing program 1: r0 = syz_open_dev$sndctrl(&(0x7f0000000100)='/dev/snd/controlC#\x00', 0x0, 0x189800) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(r0, 0xc008551c, &(0x7f0000000180)={0x1000, 0x4, [0x7]}) 02:35:29 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$TIOCGLCKTRMIOS(0xffffffffffffffff, 0x5456, &(0x7f0000000040)={0x8, 0x401, 0xffff8fb0, 0x0, 0x17, "0125db2581cdae2d99d3da8994052cb377341c"}) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000011c0)='/proc/capi/capi20\x00', 0x0, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x4) ioctl$GIO_FONTX(r2, 0x4b6b, 0x0) ioctl$VT_RESIZE(r2, 0x5609, &(0x7f0000001180)={0x40, 0x8, 0x7fff}) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) ioctl$GIO_CMAP(0xffffffffffffffff, 0x4b70, &(0x7f0000001200)) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="0b6300000e3cd7197d5f92c2c41f212ce79be7eaadd19a3fd1521192bf82e360a5b77b432f4fb1f10c62af17f4013c4595d747b3a1975334d9b945ca5cef8f02d971da2bc6d41997204f4911ca338a2f93a1cc9e29d9740d988b677094087c6e6988ec2b47ef5b8dfd92ac6e373dd0d34454000000000000"], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) 02:35:29 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0xe4, 0x0, &(0x7f0000000340)="192edaf8621943df81acc8221c73261958e5f8ae85aa447823557a30e6683fb7f101dc128832e2cac0d345d10b74ddae1aeab72f3a0b2bc47880b99b81afb1eae43481ab1453f61f27a53d23aee8264f0864b8a511acda89e97d96874adebda0fea7c668502a1b338e5a4baeb421f214d1d3a67e5e396a00b066627b2e496ac10f604074fdfa175876f46b8095672bc46c98fc6a66d043b398630f89aaee27538ea0e60425a68c0bf77df4eeaa03b17a5d98782b3d47a177cff183e49d47b5f2e6fafc9debf5c7d261ccbdd727a28322da1a27798d8ce0f807c940f846c1cf12697736fe"}) 02:35:29 executing program 2: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$FIONREAD(r0, 0x541b, 0x0) [ 2127.671744][T27566] binder: 27563:27566 ioctl c0306201 0 returned -14 [ 2127.704733][T27569] binder: 27565:27569 ioctl 40046210 0 returned -22 [ 2127.779261][T27572] binder: 27568:27572 ioctl 40046210 0 returned -22 02:35:29 executing program 1: r0 = syz_open_dev$sndctrl(&(0x7f0000000100)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(r0, 0xc008551c, &(0x7f0000000180)={0x1000, 0x4, [0x7]}) 02:35:29 executing program 3: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r0, 0xc0405519, 0x0) r1 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000002080)='/dev/ttyprintk\x00', 0x8000, 0x0) ioctl$TIOCSLCKTRMIOS(r1, 0x5457, &(0x7f00000020c0)) read$FUSE(r0, &(0x7f0000000040)={0x2020}, 0x2020) ioctl$FIONREAD(0xffffffffffffffff, 0x541b, &(0x7f0000002100)) 02:35:29 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r1, 0x4b6b, 0x0) ioctl$VT_GETMODE(r1, 0x5601, &(0x7f0000000040)) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) [ 2127.825245][T27572] binder: 27568:27572 ioctl c0306201 20001140 returned -11 02:35:30 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0xe4, 0x0, &(0x7f0000000340)="192edaf8621943df81acc8221c73261958e5f8ae85aa447823557a30e6683fb7f101dc128832e2cac0d345d10b74ddae1aeab72f3a0b2bc47880b99b81afb1eae43481ab1453f61f27a53d23aee8264f0864b8a511acda89e97d96874adebda0fea7c668502a1b338e5a4baeb421f214d1d3a67e5e396a00b066627b2e496ac10f604074fdfa175876f46b8095672bc46c98fc6a66d043b398630f89aaee27538ea0e60425a68c0bf77df4eeaa03b17a5d98782b3d47a177cff183e49d47b5f2e6fafc9debf5c7d261ccbdd727a28322da1a27798d8ce0f807c940f846c1cf12697736fe"}) 02:35:30 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$TIOCGLCKTRMIOS(0xffffffffffffffff, 0x5456, &(0x7f0000000040)={0x8, 0x401, 0xffff8fb0, 0x0, 0x17, "0125db2581cdae2d99d3da8994052cb377341c"}) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000011c0)='/proc/capi/capi20\x00', 0x0, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x4) ioctl$GIO_FONTX(r2, 0x4b6b, 0x0) ioctl$VT_RESIZE(r2, 0x5609, &(0x7f0000001180)={0x40, 0x8, 0x7fff}) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="0b6300000e3cd7197d5f92c2c41f212ce79be7eaadd19a3fd1521192bf82e360a5b77b432f4fb1f10c62af17f4013c4595d747b3a1975334d9b945ca5cef8f02d971da2bc6d41997204f4911ca338a2f93a1cc9e29d9740d988b677094087c6e6988ec2b47ef5b8dfd92ac6e373dd0d34454000000000000"], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) 02:35:30 executing program 2: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r0, 0xc0405519, 0x0) r1 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000002080)='/dev/ttyprintk\x00', 0x8000, 0x0) ioctl$TIOCSLCKTRMIOS(r1, 0x5457, &(0x7f00000020c0)) read$FUSE(r0, &(0x7f0000000040)={0x2020}, 0x2020) ioctl$FIONREAD(0xffffffffffffffff, 0x541b, &(0x7f0000002100)) [ 2128.037418][T27582] binder: 27579:27582 ioctl 40046210 0 returned -22 02:35:30 executing program 1: syz_open_dev$sndctrl(&(0x7f0000000100)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(0xffffffffffffffff, 0xc008551c, &(0x7f0000000180)={0x1000, 0x4, [0x7]}) 02:35:30 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x480040, 0x0) write$qrtrtun(r2, &(0x7f0000000300)="03f0accdb1045ccedb236a49fcf881edb0fce2f2732b3d01cdffaccc62c5c8995230dc143073b306057a1094109e6db473580eb2f8e6878edcc5ee0975d6f4d2c427adb1cfb16dfaab56555e87c5ce5b6ad1a556b864e73fed747eede9c4e1b53e3e78f207f210ae762abbc444cdaeb15796d942b5ae3071f88acb5708e3da1919330ec9d6bf701ea4b8091ae7c49c6c597242aec6aba697a33fdc4a439172629539790458de365f31f3c93a3661901bd1c5fd43a1535885d2ae3efb292acd55273902361f4f09f40120643ac17158276cf5a43f6ba95bf4378b3bfeaf01d3f31963b3a494d21ad76f12ce178b4d9ceadc79aa215ba1f4bbf471cb376e8b5c20096ef8b1fc7a8541623fba7c1875100bb62e2ecf01e2bedb038352810a5fe16a336c49746f3f6e662cd6f8c0e0ead3a027a6522b08a834d22a92ca94cb30cf049c8734f04925f8e393a05aac0ae87d7e4c9b5b7414b1235abdce874cf1d5e9363a41a57f7feac25cad3cb27350", 0xffffff04) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x110a, 0x2}) [ 2128.087908][T27587] binder: 27579:27587 ioctl 40046210 0 returned -22 02:35:30 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x68, 0x0, &(0x7f0000000100)=[@decrefs={0x40046307, 0x1}, @exit_looper, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/35, 0x23, 0x0, 0x36}, @fd, @fd}, &(0x7f0000000280)={0x0, 0x28, 0x40}}}, @release, @decrefs={0x40046307, 0x2}], 0xe4, 0x0, &(0x7f0000000340)="192edaf8621943df81acc8221c73261958e5f8ae85aa447823557a30e6683fb7f101dc128832e2cac0d345d10b74ddae1aeab72f3a0b2bc47880b99b81afb1eae43481ab1453f61f27a53d23aee8264f0864b8a511acda89e97d96874adebda0fea7c668502a1b338e5a4baeb421f214d1d3a67e5e396a00b066627b2e496ac10f604074fdfa175876f46b8095672bc46c98fc6a66d043b398630f89aaee27538ea0e60425a68c0bf77df4eeaa03b17a5d98782b3d47a177cff183e49d47b5f2e6fafc9debf5c7d261ccbdd727a28322da1a27798d8ce0f807c940f846c1cf12697736fe"}) 02:35:30 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$TIOCGLCKTRMIOS(0xffffffffffffffff, 0x5456, &(0x7f0000000040)={0x8, 0x401, 0xffff8fb0, 0x0, 0x17, "0125db2581cdae2d99d3da8994052cb377341c"}) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000011c0)='/proc/capi/capi20\x00', 0x0, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x4) ioctl$GIO_FONTX(r2, 0x4b6b, 0x0) ioctl$VT_RESIZE(r2, 0x5609, &(0x7f0000001180)={0x40, 0x8, 0x7fff}) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) ioctl$GIO_CMAP(0xffffffffffffffff, 0x4b70, &(0x7f0000001200)) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r1, 0x81785501, &(0x7f0000000080)=""/4096) ioctl$KDSETMODE(r2, 0x4b3a, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="0b6300000e3cd7197d5f92c2c41f212ce79be7eaadd19a3fd1521192bf82e360a5b77b432f4fb1f10c62af17f4013c4595d747b3a1975334d9b945ca5cef8f02d971da2bc6d41997204f4911ca338a2f93a1cc9e29d9740d988b677094087c6e6988ec2b47ef5b8dfd92ac6e373dd0d34454000000000000"], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000001240)='/dev/hwrng\x00', 0x202000, 0x0) ioctl$KDGETLED(r3, 0x4b31, &(0x7f0000001080)) [ 2128.144252][T27589] binder: 27584:27589 ioctl 40046210 0 returned -22 [ 2128.180912][T27589] binder: 27584:27589 ioctl c0306201 20001140 returned -11 02:35:30 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x4) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x45a100, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000040)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INTERRUPT(r1, &(0x7f0000002080)={0x10, 0x0, r2}, 0x10) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) 02:35:30 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$TIOCGLCKTRMIOS(0xffffffffffffffff, 0x5456, &(0x7f0000000040)={0x8, 0x401, 0xffff8fb0, 0x0, 0x17, "0125db2581cdae2d99d3da8994052cb377341c"}) openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000011c0)='/proc/capi/capi20\x00', 0x0, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x4) ioctl$GIO_FONTX(r1, 0x4b6b, 0x0) ioctl$VT_RESIZE(r1, 0x5609, &(0x7f0000001180)={0x40, 0x8, 0x7fff}) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="0b6300000e3cd7197d5f92c2c41f212ce79be7eaadd19a3fd1521192bf82e360a5b77b432f4fb1f10c62af17f4013c4595d747b3a1975334d9b945ca5cef8f02d971da2bc6d41997204f4911ca338a2f93a1cc9e29d9740d988b677094087c6e6988ec2b47ef5b8dfd92ac6e373dd0d34454000000000000"], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) 02:35:30 executing program 1: syz_open_dev$sndctrl(&(0x7f0000000100)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(0xffffffffffffffff, 0xc008551c, &(0x7f0000000180)={0x1000, 0x4, [0x7]}) [ 2128.310133][T27596] binder: 27592:27596 ioctl 40046210 0 returned -22 [ 2128.350476][T27596] binder: 27592:27596 ioctl c0306201 0 returned -14 [ 2128.378326][T27598] binder: 27594:27598 ioctl 40046210 0 returned -22 [ 2128.384074][T27599] binder: 27597:27599 ioctl 40046210 0 returned -22 02:35:30 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x60, 0x0, &(0x7f0000000100)=[@decrefs={0x40046307, 0x1}, @exit_looper, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/35, 0x23, 0x0, 0x36}, @fd, @fd}, &(0x7f0000000280)={0x0, 0x28, 0x40}}}, @release], 0xe4, 0x0, &(0x7f0000000340)="192edaf8621943df81acc8221c73261958e5f8ae85aa447823557a30e6683fb7f101dc128832e2cac0d345d10b74ddae1aeab72f3a0b2bc47880b99b81afb1eae43481ab1453f61f27a53d23aee8264f0864b8a511acda89e97d96874adebda0fea7c668502a1b338e5a4baeb421f214d1d3a67e5e396a00b066627b2e496ac10f604074fdfa175876f46b8095672bc46c98fc6a66d043b398630f89aaee27538ea0e60425a68c0bf77df4eeaa03b17a5d98782b3d47a177cff183e49d47b5f2e6fafc9debf5c7d261ccbdd727a28322da1a27798d8ce0f807c940f846c1cf12697736fe"}) [ 2128.397740][T27596] binder: BINDER_SET_CONTEXT_MGR already set [ 2128.416356][T27598] binder: 27594:27598 ioctl c0306201 20001140 returned -11 [ 2128.441105][T27596] binder: 27592:27596 ioctl 4018620d 20000080 returned -16 [ 2128.482230][T27604] binder: 27600:27604 ioctl 40046210 0 returned -22 02:35:30 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000040)={0x78, 0x0, 0x0, {0x8, 0xa7, 0x0, {0x6, 0x7f, 0x401, 0x6, 0x0, 0x8, 0x7fff, 0x0, 0x1, 0x2000, 0x7, 0x0, 0xffffffffffffffff, 0x16af, 0xffffffc3}}}, 0x78) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) 02:35:30 executing program 2: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) r3 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, 0x0) r4 = syz_open_dev$binderN(&(0x7f0000000500)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, 0x0) syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x800) r5 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, 0x0) r6 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r6, 0xc0405519, 0x0) sendmsg$RDMA_NLDEV_CMD_PORT_GET(r6, &(0x7f0000000480)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000001c0)={&(0x7f00000002c0)={0x60, 0x1405, 0x800, 0x70bd26, 0x25dfdbfd, "", [{{0x8, 0x1, 0x1}, {0x8}}, {{0x8, 0x1, 0x1}, {0x8}}, {{0x8, 0x1, 0x1}, {0x8}}, {{0x8, 0x1, 0x1}, {0x8, 0x3, 0x3}}, {{0x8, 0x1, 0x1}, {0x8, 0x3, 0x2}}]}, 0x60}, 0x1, 0x0, 0x0, 0x840}, 0x20040014) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000440)={0x74, 0x0, &(0x7f0000000100)=[@decrefs={0x40046307, 0x1}, @exit_looper, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/35, 0x23, 0x0, 0x36}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000280)={0x0, 0x28, 0x40}}}, @release, @decrefs={0x40046307, 0x2}, @free_buffer], 0xe4, 0x0, &(0x7f0000000340)="192edaf8621943df81acc8221c73261958e5f8ae85aa447823557a30e6683fb7f101dc128832e2cac0d345d10b74ddae1aeab72f3a0b2bc47880b99b81afb1eae43481ab1453f61f27a53d23aee8264f0864b8a511acda89e97d96874adebda0fea7c668502a1b338e5a4baeb421f214d1d3a67e5e396a00b066627b2e496ac10f604074fdfa175876f46b8095672bc46c98fc6a66d043b398630f89aaee27538ea0e60425a68c0bf77df4eeaa03b17a5d98782b3d47a177cff183e49d47b5f2e6fafc9debf5c7d261ccbdd727a28322da1a27798d8ce0f807c940f846c1cf12697736fe"}) r7 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000080)='/proc/capi/capi20\x00', 0x68002, 0x0) ioctl$BINDER_SET_MAX_THREADS(r7, 0x40046210, 0x0) [ 2128.526576][T27604] binder: 27600:27604 ioctl c0306201 20001140 returned -11 02:35:30 executing program 1: syz_open_dev$sndctrl(&(0x7f0000000100)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(0xffffffffffffffff, 0xc008551c, &(0x7f0000000180)={0x1000, 0x4, [0x7]}) 02:35:30 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x480040, 0x0) write$qrtrtun(r2, &(0x7f0000000300)="03f0accdb1045ccedb236a49fcf881edb0fce2f2732b3d01cdffaccc62c5c8995230dc143073b306057a1094109e6db473580eb2f8e6878edcc5ee0975d6f4d2c427adb1cfb16dfaab56555e87c5ce5b6ad1a556b864e73fed747eede9c4e1b53e3e78f207f210ae762abbc444cdaeb15796d942b5ae3071f88acb5708e3da1919330ec9d6bf701ea4b8091ae7c49c6c597242aec6aba697a33fdc4a439172629539790458de365f31f3c93a3661901bd1c5fd43a1535885d2ae3efb292acd55273902361f4f09f40120643ac17158276cf5a43f6ba95bf4378b3bfeaf01d3f31963b3a494d21ad76f12ce178b4d9ceadc79aa215ba1f4bbf471cb376e8b5c20096ef8b1fc7a8541623fba7c1875100bb62e2ecf01e2bedb038352810a5fe16a336c49746f3f6e662cd6f8c0e0ead3a027a6522b08a834d22a92ca94cb30cf049c8734f04925f8e393a05aac0ae87d7e4c9b5b7414b1235abdce874cf1d5e9363a41a57f7feac25cad3cb27350", 0xffffff04) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x110a, 0x2}) 02:35:30 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$TIOCGLCKTRMIOS(0xffffffffffffffff, 0x5456, &(0x7f0000000040)={0x8, 0x401, 0xffff8fb0, 0x0, 0x17, "0125db2581cdae2d99d3da8994052cb377341c"}) openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000011c0)='/proc/capi/capi20\x00', 0x0, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x4) ioctl$GIO_FONTX(r1, 0x4b6b, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="0b6300000e3cd7197d5f92c2c41f212ce79be7eaadd19a3fd1521192bf82e360a5b77b432f4fb1f10c62af17f4013c4595d747b3a1975334d9b945ca5cef8f02d971da2bc6d41997204f4911ca338a2f93a1cc9e29d9740d988b677094087c6e6988ec2b47ef5b8dfd92ac6e373dd0d34454000000000000"], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) 02:35:30 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x58, 0x0, &(0x7f0000000100)=[@decrefs={0x40046307, 0x1}, @exit_looper, @transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000200)={@ptr={0x70742a85, 0x0, &(0x7f00000000c0)=""/35, 0x23, 0x0, 0x36}, @fd, @fd}, &(0x7f0000000280)={0x0, 0x28, 0x40}}}], 0xe4, 0x0, &(0x7f0000000340)="192edaf8621943df81acc8221c73261958e5f8ae85aa447823557a30e6683fb7f101dc128832e2cac0d345d10b74ddae1aeab72f3a0b2bc47880b99b81afb1eae43481ab1453f61f27a53d23aee8264f0864b8a511acda89e97d96874adebda0fea7c668502a1b338e5a4baeb421f214d1d3a67e5e396a00b066627b2e496ac10f604074fdfa175876f46b8095672bc46c98fc6a66d043b398630f89aaee27538ea0e60425a68c0bf77df4eeaa03b17a5d98782b3d47a177cff183e49d47b5f2e6fafc9debf5c7d261ccbdd727a28322da1a27798d8ce0f807c940f846c1cf12697736fe"}) [ 2128.673954][T27609] binder: 27608:27609 ioctl 40046210 0 returned -22 [ 2128.731392][T27614] binder: 27612:27614 ioctl 40046210 0 returned -22 [ 2128.742949][T27616] binder: 27610:27616 ioctl c0306201 0 returned -14 02:35:30 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {0x0, 0x0, r1, 0x1c, 0x0, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) [ 2128.775350][T27616] binder: 27610:27616 ioctl c0306201 0 returned -14 [ 2128.777229][T27614] binder: 27612:27614 ioctl c0306201 0 returned -14 02:35:30 executing program 1: r0 = syz_open_dev$sndctrl(&(0x7f0000000100)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(r0, 0xc008551c, 0x0) [ 2128.850885][T27616] binder: 27610:27616 ioctl c0306201 0 returned -14 [ 2128.859308][T27620] binder: BINDER_SET_CONTEXT_MGR already set [ 2128.865927][T27619] binder: 27615:27619 ioctl 40046210 0 returned -22 [ 2128.882278][T27620] binder: 27612:27620 ioctl 4018620d 20000080 returned -16 [ 2128.901470][T27616] binder: 27610:27616 ioctl c0306201 0 returned -14 02:35:31 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xc, 0x0, &(0x7f0000000100)=[@decrefs={0x40046307, 0x1}, @exit_looper], 0xe4, 0x0, &(0x7f0000000340)="192edaf8621943df81acc8221c73261958e5f8ae85aa447823557a30e6683fb7f101dc128832e2cac0d345d10b74ddae1aeab72f3a0b2bc47880b99b81afb1eae43481ab1453f61f27a53d23aee8264f0864b8a511acda89e97d96874adebda0fea7c668502a1b338e5a4baeb421f214d1d3a67e5e396a00b066627b2e496ac10f604074fdfa175876f46b8095672bc46c98fc6a66d043b398630f89aaee27538ea0e60425a68c0bf77df4eeaa03b17a5d98782b3d47a177cff183e49d47b5f2e6fafc9debf5c7d261ccbdd727a28322da1a27798d8ce0f807c940f846c1cf12697736fe"}) [ 2128.951995][T27621] binder: 27610:27621 ioctl c0306201 0 returned -14 02:35:31 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$TIOCGLCKTRMIOS(0xffffffffffffffff, 0x5456, &(0x7f0000000040)={0x8, 0x401, 0xffff8fb0, 0x0, 0x17, "0125db2581cdae2d99d3da8994052cb377341c"}) openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000011c0)='/proc/capi/capi20\x00', 0x0, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x4) ioctl$GIO_FONTX(r1, 0x4b6b, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="0b6300000e3cd7197d5f92c2c41f212ce79be7eaadd19a3fd1521192bf82e360a5b77b432f4fb1f10c62af17f4013c4595d747b3a1975334d9b945ca5cef8f02d971da2bc6d41997204f4911ca338a2f93a1cc9e29d9740d988b677094087c6e6988ec2b47ef5b8dfd92ac6e373dd0d34454000000000000"], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) 02:35:31 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x480040, 0x0) write$qrtrtun(r2, &(0x7f0000000300)="03f0accdb1045ccedb236a49fcf881edb0fce2f2732b3d01cdffaccc62c5c8995230dc143073b306057a1094109e6db473580eb2f8e6878edcc5ee0975d6f4d2c427adb1cfb16dfaab56555e87c5ce5b6ad1a556b864e73fed747eede9c4e1b53e3e78f207f210ae762abbc444cdaeb15796d942b5ae3071f88acb5708e3da1919330ec9d6bf701ea4b8091ae7c49c6c597242aec6aba697a33fdc4a439172629539790458de365f31f3c93a3661901bd1c5fd43a1535885d2ae3efb292acd55273902361f4f09f40120643ac17158276cf5a43f6ba95bf4378b3bfeaf01d3f31963b3a494d21ad76f12ce178b4d9ceadc79aa215ba1f4bbf471cb376e8b5c20096ef8b1fc7a8541623fba7c1875100bb62e2ecf01e2bedb038352810a5fe16a336c49746f3f6e662cd6f8c0e0ead3a027a6522b08a834d22a92ca94cb30cf049c8734f04925f8e393a05aac0ae87d7e4c9b5b7414b1235abdce874cf1d5e9363a41a57f7feac25cad3cb27350", 0xffffff04) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x110a, 0x2}) 02:35:31 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$DRM_IOCTL_AGP_BIND(r0, 0x40106436, &(0x7f0000000080)={0x0, 0x3d32}) 02:35:31 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x40000) ioctl$DRM_IOCTL_AGP_BIND(r0, 0x40106436, &(0x7f0000000080)={0x0, 0x3d32}) 02:35:31 executing program 1: socketpair(0x3, 0x2, 0x9, &(0x7f0000000040)={0xffffffffffffffff}) getsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(0xffffffffffffffff, 0x84, 0xc, &(0x7f0000000180), &(0x7f00000001c0)=0x4) sendmsg$RDMA_NLDEV_CMD_PORT_GET(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="30000000051420002bbd7000fcd9df250800010001000000080003000200000008000100020000000800030002000000"], 0x30}, 0x1, 0x0, 0x0, 0xc040001}, 0x0) socketpair(0x2b, 0x1, 0x6, &(0x7f0000000000)) ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x5460, 0x0) 02:35:31 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000100)=[@decrefs={0x40046307, 0x1}], 0xe4, 0x0, &(0x7f0000000340)="192edaf8621943df81acc8221c73261958e5f8ae85aa447823557a30e6683fb7f101dc128832e2cac0d345d10b74ddae1aeab72f3a0b2bc47880b99b81afb1eae43481ab1453f61f27a53d23aee8264f0864b8a511acda89e97d96874adebda0fea7c668502a1b338e5a4baeb421f214d1d3a67e5e396a00b066627b2e496ac10f604074fdfa175876f46b8095672bc46c98fc6a66d043b398630f89aaee27538ea0e60425a68c0bf77df4eeaa03b17a5d98782b3d47a177cff183e49d47b5f2e6fafc9debf5c7d261ccbdd727a28322da1a27798d8ce0f807c940f846c1cf12697736fe"}) [ 2129.177639][T27633] binder: 27628:27633 ioctl 40046210 0 returned -22 [ 2129.198467][T27635] binder: 27630:27635 ioctl 40046210 0 returned -22 [ 2129.253263][T27635] binder: 27630:27635 ioctl c0306201 0 returned -14 02:35:31 executing program 2: socketpair(0x3, 0x2, 0x9, &(0x7f0000000040)={0xffffffffffffffff}) getsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(0xffffffffffffffff, 0x84, 0xc, &(0x7f0000000180), &(0x7f00000001c0)=0x4) sendmsg$RDMA_NLDEV_CMD_PORT_GET(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="30000000051420002bbd7000fcd9df250800010001000000080003000200000008000100020000000800030002000000"], 0x30}, 0x1, 0x0, 0x0, 0xc040001}, 0x0) socketpair(0x2b, 0x1, 0x6, &(0x7f0000000000)) ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x5460, 0x0) 02:35:31 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r0, 0x4b6b, 0x0) r1 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, 0xffffffffffffffff, 0x5) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0xd4, 0x0, &(0x7f00000002c0)=[@reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x18, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000040)={@flat=@binder={0x73622a85, 0x1001, 0x1}, @fda={0x66646185, 0x5, 0x0, 0x21}, @fd={0x66642a85, 0x0, r0}}, &(0x7f00000000c0)={0x0, 0x18, 0x38}}, 0x40}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000200)={@fda={0x66646185, 0x5}, @fda={0x66646185, 0x3, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/211, 0xd3, 0x2, 0x6}}, &(0x7f0000000280)={0x0, 0x20, 0x40}}, 0x40}, @free_buffer={0x40086303, r1}, @increfs_done={0x40106308, 0x2}, @dead_binder_done, @increfs={0x40046304, 0x2}, @increfs={0x40046304, 0x1}], 0x63, 0x0, &(0x7f00000003c0)="30bce0062f269cb2d37b9e82b9c427ff723b0c2b8ac9bb4b010a5fd19466503b01d5643df545322f6f57e34108c748617bfcaf7af83f6cb5b6aefee17b940ef5c846459b5eebb163c9521295692f3fd91fefa636ceb2e08e5430140c946f4d7d3380ad"}) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046210, 0x0) 02:35:31 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$TIOCGLCKTRMIOS(0xffffffffffffffff, 0x5456, &(0x7f0000000040)={0x8, 0x401, 0xffff8fb0, 0x0, 0x17, "0125db2581cdae2d99d3da8994052cb377341c"}) openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000011c0)='/proc/capi/capi20\x00', 0x0, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x4) ioctl$GIO_FONTX(r1, 0x4b6b, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="0b6300000e3cd7197d5f92c2c41f212ce79be7eaadd19a3fd1521192bf82e360a5b77b432f4fb1f10c62af17f4013c4595d747b3a1975334d9b945ca5cef8f02d971da2bc6d41997204f4911ca338a2f93a1cc9e29d9740d988b677094087c6e6988ec2b47ef5b8dfd92ac6e373dd0d34454000000000000"], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) [ 2129.306447][T27635] binder: BINDER_SET_CONTEXT_MGR already set [ 2129.345239][T27635] binder: 27630:27635 ioctl 4018620d 20000080 returned -16 02:35:31 executing program 1: socketpair(0x3, 0x2, 0x9, &(0x7f0000000040)={0xffffffffffffffff}) getsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(0xffffffffffffffff, 0x84, 0xc, &(0x7f0000000180), &(0x7f00000001c0)=0x4) sendmsg$RDMA_NLDEV_CMD_PORT_GET(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="30000000051420002bbd7000fcd9df250800010001000000080003000200000008000100020000000800030002000000"], 0x30}, 0x1, 0x0, 0x0, 0xc040001}, 0x0) socketpair(0x2b, 0x1, 0x6, &(0x7f0000000000)) ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x5460, 0x0) 02:35:31 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000100)=[@decrefs={0x40046307, 0x1}], 0xe4, 0x0, &(0x7f0000000340)="192edaf8621943df81acc8221c73261958e5f8ae85aa447823557a30e6683fb7f101dc128832e2cac0d345d10b74ddae1aeab72f3a0b2bc47880b99b81afb1eae43481ab1453f61f27a53d23aee8264f0864b8a511acda89e97d96874adebda0fea7c668502a1b338e5a4baeb421f214d1d3a67e5e396a00b066627b2e496ac10f604074fdfa175876f46b8095672bc46c98fc6a66d043b398630f89aaee27538ea0e60425a68c0bf77df4eeaa03b17a5d98782b3d47a177cff183e49d47b5f2e6fafc9debf5c7d261ccbdd727a28322da1a27798d8ce0f807c940f846c1cf12697736fe"}) 02:35:31 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x480040, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x110a, 0x2}) 02:35:31 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x1, 0x40000) ioctl$DRM_IOCTL_AGP_BIND(r0, 0x40106436, &(0x7f0000000080)={0x0, 0x3d32}) r1 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_SET_MAX_THREADS(r1, 0x5460, 0x0) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) 02:35:31 executing program 2: socketpair(0x3, 0x2, 0x9, &(0x7f0000000040)={0xffffffffffffffff}) getsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(0xffffffffffffffff, 0x84, 0xc, &(0x7f0000000180), &(0x7f00000001c0)=0x4) sendmsg$RDMA_NLDEV_CMD_PORT_GET(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="30000000051420002bbd7000fcd9df250800010001000000080003000200000008000100020000000800030002000000"], 0x30}, 0x1, 0x0, 0x0, 0xc040001}, 0x0) socketpair(0x2b, 0x1, 0x6, &(0x7f0000000000)) ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x5460, 0x0) 02:35:31 executing program 1: socketpair(0x3, 0x2, 0x9, &(0x7f0000000040)={0xffffffffffffffff}) getsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(0xffffffffffffffff, 0x84, 0xc, &(0x7f0000000180), &(0x7f00000001c0)=0x4) sendmsg$RDMA_NLDEV_CMD_PORT_GET(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="30000000051420002bbd7000fcd9df250800010001000000080003000200000008000100020000000800030002000000"], 0x30}, 0x1, 0x0, 0x0, 0xc040001}, 0x0) socketpair(0x2b, 0x1, 0x6, &(0x7f0000000000)) ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x5460, 0x0) [ 2129.572403][T27652] binder: 27648:27652 ioctl 40046210 0 returned -22 [ 2129.605276][T27656] binder: 27654:27656 ioctl 40046210 0 returned -22 02:35:31 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000100)=[@decrefs={0x40046307, 0x1}], 0xe4, 0x0, &(0x7f0000000340)="192edaf8621943df81acc8221c73261958e5f8ae85aa447823557a30e6683fb7f101dc128832e2cac0d345d10b74ddae1aeab72f3a0b2bc47880b99b81afb1eae43481ab1453f61f27a53d23aee8264f0864b8a511acda89e97d96874adebda0fea7c668502a1b338e5a4baeb421f214d1d3a67e5e396a00b066627b2e496ac10f604074fdfa175876f46b8095672bc46c98fc6a66d043b398630f89aaee27538ea0e60425a68c0bf77df4eeaa03b17a5d98782b3d47a177cff183e49d47b5f2e6fafc9debf5c7d261ccbdd727a28322da1a27798d8ce0f807c940f846c1cf12697736fe"}) 02:35:31 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$TIOCGLCKTRMIOS(0xffffffffffffffff, 0x5456, &(0x7f0000000040)={0x8, 0x401, 0xffff8fb0, 0x0, 0x17, "0125db2581cdae2d99d3da8994052cb377341c"}) openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000011c0)='/proc/capi/capi20\x00', 0x0, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x4) ioctl$VT_RESIZE(r1, 0x5609, &(0x7f0000001180)={0x40, 0x8, 0x7fff}) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="0b6300000e3cd7197d5f92c2c41f212ce79be7eaadd19a3fd1521192bf82e360a5b77b432f4fb1f10c62af17f4013c4595d747b3a1975334d9b945ca5cef8f02d971da2bc6d41997204f4911ca338a2f93a1cc9e29d9740d988b677094087c6e6988ec2b47ef5b8dfd92ac6e373dd0d34454000000000000"], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) [ 2129.669368][T27656] binder: 27654:27656 ioctl c0306201 0 returned -14 [ 2129.683829][T27656] binder: BINDER_SET_CONTEXT_MGR already set [ 2129.735661][T27656] binder: 27654:27656 ioctl 4018620d 20000080 returned -16 02:35:31 executing program 2: socketpair(0x3, 0x2, 0x9, &(0x7f0000000040)={0xffffffffffffffff}) getsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(0xffffffffffffffff, 0x84, 0xc, &(0x7f0000000180), &(0x7f00000001c0)=0x4) sendmsg$RDMA_NLDEV_CMD_PORT_GET(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="30000000051420002bbd7000fcd9df250800010001000000080003000200000008000100020000000800030002000000"], 0x30}, 0x1, 0x0, 0x0, 0xc040001}, 0x0) socketpair(0x2b, 0x1, 0x6, &(0x7f0000000000)) ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x5460, 0x0) 02:35:31 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x1, 0x40000) ioctl$DRM_IOCTL_AGP_BIND(r0, 0x40106436, &(0x7f0000000080)={0x0, 0x3d32}) r1 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_SET_MAX_THREADS(r1, 0x5460, 0x0) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) [ 2129.854458][T27667] binder: 27664:27667 ioctl 40046210 0 returned -22 02:35:31 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x110a, 0x2}) 02:35:31 executing program 1: socketpair(0x3, 0x2, 0x9, &(0x7f0000000040)={0xffffffffffffffff}) getsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(0xffffffffffffffff, 0x84, 0xc, &(0x7f0000000180), &(0x7f00000001c0)=0x4) sendmsg$RDMA_NLDEV_CMD_PORT_GET(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="30000000051420002bbd7000fcd9df250800010001000000080003000200000008000100020000000800030002000000"], 0x30}, 0x1, 0x0, 0x0, 0xc040001}, 0x0) socketpair(0x2b, 0x1, 0x6, &(0x7f0000000000)) [ 2129.894837][T27667] binder: 27664:27667 ioctl c0306201 20001140 returned -11 02:35:32 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000100)=[@exit_looper], 0xe4, 0x0, &(0x7f0000000340)="192edaf8621943df81acc8221c73261958e5f8ae85aa447823557a30e6683fb7f101dc128832e2cac0d345d10b74ddae1aeab72f3a0b2bc47880b99b81afb1eae43481ab1453f61f27a53d23aee8264f0864b8a511acda89e97d96874adebda0fea7c668502a1b338e5a4baeb421f214d1d3a67e5e396a00b066627b2e496ac10f604074fdfa175876f46b8095672bc46c98fc6a66d043b398630f89aaee27538ea0e60425a68c0bf77df4eeaa03b17a5d98782b3d47a177cff183e49d47b5f2e6fafc9debf5c7d261ccbdd727a28322da1a27798d8ce0f807c940f846c1cf12697736fe"}) 02:35:32 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$TIOCGLCKTRMIOS(0xffffffffffffffff, 0x5456, &(0x7f0000000040)={0x8, 0x401, 0xffff8fb0, 0x0, 0x17, "0125db2581cdae2d99d3da8994052cb377341c"}) openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000011c0)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, &(0x7f0000001180)={0x40, 0x8, 0x7fff}) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="0b6300000e3cd7197d5f92c2c41f212ce79be7eaadd19a3fd1521192bf82e360a5b77b432f4fb1f10c62af17f4013c4595d747b3a1975334d9b945ca5cef8f02d971da2bc6d41997204f4911ca338a2f93a1cc9e29d9740d988b677094087c6e6988ec2b47ef5b8dfd92ac6e373dd0d34454000000000000"], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) 02:35:32 executing program 2: socketpair(0x3, 0x2, 0x9, &(0x7f0000000040)={0xffffffffffffffff}) getsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(0xffffffffffffffff, 0x84, 0xc, &(0x7f0000000180), &(0x7f00000001c0)=0x4) sendmsg$RDMA_NLDEV_CMD_PORT_GET(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="30000000051420002bbd7000fcd9df250800010001000000080003000200000008000100020000000800030002000000"], 0x30}, 0x1, 0x0, 0x0, 0xc040001}, 0x0) socketpair(0x2b, 0x1, 0x6, &(0x7f0000000000)) 02:35:32 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x1, 0x40000) ioctl$DRM_IOCTL_AGP_BIND(r0, 0x40106436, &(0x7f0000000080)={0x0, 0x3d32}) r1 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_SET_MAX_THREADS(r1, 0x5460, 0x0) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) [ 2130.080931][T27678] binder: 27674:27678 ioctl 40046210 0 returned -22 02:35:32 executing program 1: socketpair(0x3, 0x2, 0x9, &(0x7f0000000040)) getsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(0xffffffffffffffff, 0x84, 0xc, &(0x7f0000000180), &(0x7f00000001c0)=0x4) socketpair(0x2b, 0x1, 0x6, &(0x7f0000000000)) [ 2130.129249][T27678] binder: 27674:27678 ioctl c0306201 0 returned -14 02:35:32 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000100)=[@exit_looper], 0x0, 0x0, 0x0}) [ 2130.179532][T27678] binder: BINDER_SET_CONTEXT_MGR already set [ 2130.207574][T27686] binder: 27682:27686 ioctl 40046210 0 returned -22 [ 2130.218268][T27678] binder: 27674:27678 ioctl 4018620d 20000080 returned -16 02:35:32 executing program 2: socketpair(0x3, 0x2, 0x9, &(0x7f0000000040)={0xffffffffffffffff}) getsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(0xffffffffffffffff, 0x84, 0xc, &(0x7f0000000180), &(0x7f00000001c0)=0x4) sendmsg$RDMA_NLDEV_CMD_PORT_GET(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="30000000051420002bbd7000fcd9df250800010001000000080003000200000008000100020000000800030002000000"], 0x30}, 0x1, 0x0, 0x0, 0xc040001}, 0x0) [ 2130.257353][T27686] binder: 27682:27686 ioctl c0306201 20001140 returned -11 02:35:32 executing program 1: socketpair(0x3, 0x2, 0x9, &(0x7f0000000040)) socketpair(0x2b, 0x1, 0x6, &(0x7f0000000000)) 02:35:32 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x110a, 0x2}) 02:35:32 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x1, 0x40000) ioctl$DRM_IOCTL_AGP_BIND(r0, 0x40106436, &(0x7f0000000080)={0x0, 0x3d32}) r1 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_SET_MAX_THREADS(r1, 0x5460, 0x0) 02:35:32 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$TIOCGLCKTRMIOS(0xffffffffffffffff, 0x5456, &(0x7f0000000040)={0x8, 0x401, 0xffff8fb0, 0x0, 0x17, "0125db2581cdae2d99d3da8994052cb377341c"}) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, &(0x7f0000001180)={0x40, 0x8, 0x7fff}) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="0b6300000e3cd7197d5f92c2c41f212ce79be7eaadd19a3fd1521192bf82e360a5b77b432f4fb1f10c62af17f4013c4595d747b3a1975334d9b945ca5cef8f02d971da2bc6d41997204f4911ca338a2f93a1cc9e29d9740d988b677094087c6e6988ec2b47ef5b8dfd92ac6e373dd0d34454000000000000"], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) 02:35:32 executing program 4: socketpair(0x3, 0x2, 0x9, &(0x7f0000000040)={0xffffffffffffffff}) getsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(0xffffffffffffffff, 0x84, 0xc, &(0x7f0000000180), &(0x7f00000001c0)=0x4) sendmsg$RDMA_NLDEV_CMD_PORT_GET(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="30000000051420002bbd7000fcd9df250800010001000000080003000200000008000100020000000800030002000000"], 0x30}, 0x1, 0x0, 0x0, 0xc040001}, 0x0) socketpair(0x2b, 0x1, 0x6, &(0x7f0000000000)) 02:35:32 executing program 2: socketpair(0x3, 0x2, 0x9, &(0x7f0000000040)) getsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(0xffffffffffffffff, 0x84, 0xc, &(0x7f0000000180), &(0x7f00000001c0)=0x4) 02:35:32 executing program 1: socketpair(0x2b, 0x1, 0x6, &(0x7f0000000000)) [ 2130.528647][T27701] binder: 27698:27701 ioctl 40046210 0 returned -22 [ 2130.554980][T27703] binder: 27697:27703 ioctl 40046210 0 returned -22 02:35:32 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x1, 0x40000) ioctl$DRM_IOCTL_AGP_BIND(r0, 0x40106436, &(0x7f0000000080)={0x0, 0x3d32}) syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x800) 02:35:32 executing program 4: socketpair(0x3, 0x2, 0x9, &(0x7f0000000040)={0xffffffffffffffff}) getsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(0xffffffffffffffff, 0x84, 0xc, &(0x7f0000000180), &(0x7f00000001c0)=0x4) sendmsg$RDMA_NLDEV_CMD_PORT_GET(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="30000000051420002bbd7000fcd9df250800010001000000080003000200000008000100020000000800030002000000"], 0x30}, 0x1, 0x0, 0x0, 0xc040001}, 0x0) socketpair(0x2b, 0x1, 0x6, &(0x7f0000000000)) [ 2130.577133][T27701] binder: 27698:27701 ioctl c0306201 20001140 returned -11 [ 2130.583275][T27703] binder: 27697:27703 ioctl c0306201 0 returned -14 02:35:32 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, &(0x7f0000001180)={0x40, 0x8, 0x7fff}) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="0b6300000e3cd7197d5f92c2c41f212ce79be7eaadd19a3fd1521192bf82e360a5b77b432f4fb1f10c62af17f4013c4595d747b3a1975334d9b945ca5cef8f02d971da2bc6d41997204f4911ca338a2f93a1cc9e29d9740d988b677094087c6e6988ec2b47ef5b8dfd92ac6e373dd0d34454000000000000"], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) 02:35:32 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x110a, 0x2}) 02:35:32 executing program 2: socketpair(0x3, 0x2, 0x9, &(0x7f0000000040)) 02:35:32 executing program 1: socketpair(0x0, 0x1, 0x6, &(0x7f0000000000)) 02:35:32 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x1, 0x40000) ioctl$DRM_IOCTL_AGP_BIND(r0, 0x40106436, &(0x7f0000000080)={0x0, 0x3d32}) [ 2130.811111][T27714] binder: 27712:27714 ioctl 40046210 0 returned -22 [ 2130.833590][T27715] binder: 27711:27715 ioctl 40046210 0 returned -22 02:35:32 executing program 4: socketpair(0x3, 0x2, 0x9, &(0x7f0000000040)={0xffffffffffffffff}) getsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(0xffffffffffffffff, 0x84, 0xc, &(0x7f0000000180), &(0x7f00000001c0)=0x4) sendmsg$RDMA_NLDEV_CMD_PORT_GET(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="30000000051420002bbd7000fcd9df250800010001000000080003000200000008000100020000000800030002000000"], 0x30}, 0x1, 0x0, 0x0, 0xc040001}, 0x0) socketpair(0x2b, 0x1, 0x6, &(0x7f0000000000)) [ 2130.855539][T27714] binder: 27712:27714 ioctl c0306201 20001140 returned -11 [ 2130.898675][T27715] binder: 27711:27715 ioctl c0306201 0 returned -14 02:35:33 executing program 1: socketpair(0x0, 0x1, 0x6, &(0x7f0000000000)) 02:35:33 executing program 0: ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, &(0x7f0000001180)={0x40, 0x8, 0x7fff}) ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="0b6300000e3cd7197d5f92c2c41f212ce79be7eaadd19a3fd1521192bf82e360a5b77b432f4fb1f10c62af17f4013c4595d747b3a1975334d9b945ca5cef8f02d971da2bc6d41997204f4911ca338a2f93a1cc9e29d9740d988b677094087c6e6988ec2b47ef5b8dfd92ac6e373dd0d34454000000000000"], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) 02:35:33 executing program 2: socketpair(0x0, 0x2, 0x9, &(0x7f0000000040)) 02:35:33 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x110a, 0x2}) 02:35:33 executing program 5: syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x1, 0x40000) 02:35:33 executing program 4: socketpair(0x3, 0x2, 0x9, &(0x7f0000000040)) getsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(0xffffffffffffffff, 0x84, 0xc, &(0x7f0000000180), &(0x7f00000001c0)=0x4) socketpair(0x2b, 0x1, 0x6, &(0x7f0000000000)) [ 2131.190641][T27736] binder: 27732:27736 ioctl 40046210 0 returned -22 02:35:33 executing program 0: ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, &(0x7f0000001180)={0x40, 0x8, 0x7fff}) ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="0b6300000e3cd7197d5f92c2c41f212ce79be7eaadd19a3fd1521192bf82e360a5b77b432f4fb1f10c62af17f4013c4595d747b3a1975334d9b945ca5cef8f02d971da2bc6d41997204f4911ca338a2f93a1cc9e29d9740d988b677094087c6e6988ec2b47ef5b8dfd92ac6e373dd0d34454000000000000"], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) 02:35:33 executing program 1: socketpair(0x0, 0x1, 0x6, &(0x7f0000000000)) [ 2131.243432][T27736] binder: 27732:27736 ioctl c0306201 0 returned -14 02:35:33 executing program 2: socketpair(0x0, 0x2, 0x9, &(0x7f0000000040)) 02:35:33 executing program 5: syz_open_dev$dri(0x0, 0x1, 0x40000) 02:35:33 executing program 4: socketpair(0x3, 0x2, 0x9, &(0x7f0000000040)) socketpair(0x2b, 0x1, 0x6, &(0x7f0000000000)) 02:35:33 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x110a, 0x2}) 02:35:33 executing program 0: ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, &(0x7f0000001180)={0x40, 0x8, 0x7fff}) ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="0b6300000e3cd7197d5f92c2c41f212ce79be7eaadd19a3fd1521192bf82e360a5b77b432f4fb1f10c62af17f4013c4595d747b3a1975334d9b945ca5cef8f02d971da2bc6d41997204f4911ca338a2f93a1cc9e29d9740d988b677094087c6e6988ec2b47ef5b8dfd92ac6e373dd0d34454000000000000"], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) 02:35:33 executing program 1: socketpair(0x2b, 0x0, 0x6, &(0x7f0000000000)) [ 2131.522483][T27756] binder: 27753:27756 ioctl 40046210 0 returned -22 [ 2131.547360][T27756] binder: BINDER_SET_CONTEXT_MGR already set [ 2131.561207][T27756] binder: 27753:27756 ioctl 4018620d 20000080 returned -16 02:35:33 executing program 2: socketpair(0x0, 0x2, 0x9, &(0x7f0000000040)) 02:35:33 executing program 4: socketpair(0x2b, 0x1, 0x6, &(0x7f0000000000)) 02:35:33 executing program 5: syz_open_dev$dri(0x0, 0x1, 0x40000) 02:35:33 executing program 0: r0 = syz_open_dev$binderN(0x0, 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, &(0x7f0000001180)={0x40, 0x8, 0x7fff}) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="0b6300000e3cd7197d5f92c2c41f212ce79be7eaadd19a3fd1521192bf82e360a5b77b432f4fb1f10c62af17f4013c4595d747b3a1975334d9b945ca5cef8f02d971da2bc6d41997204f4911ca338a2f93a1cc9e29d9740d988b677094087c6e6988ec2b47ef5b8dfd92ac6e373dd0d34454000000000000"], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) 02:35:33 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x110a, 0x2}) 02:35:33 executing program 1: socketpair(0x2b, 0x0, 0x6, &(0x7f0000000000)) 02:35:33 executing program 5: syz_open_dev$dri(0x0, 0x1, 0x40000) [ 2131.821955][T27772] binder: 27768:27772 ioctl 40046210 0 returned -22 02:35:33 executing program 0: r0 = syz_open_dev$binderN(0x0, 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, &(0x7f0000001180)={0x40, 0x8, 0x7fff}) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="0b6300000e3cd7197d5f92c2c41f212ce79be7eaadd19a3fd1521192bf82e360a5b77b432f4fb1f10c62af17f4013c4595d747b3a1975334d9b945ca5cef8f02d971da2bc6d41997204f4911ca338a2f93a1cc9e29d9740d988b677094087c6e6988ec2b47ef5b8dfd92ac6e373dd0d34454000000000000"], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) 02:35:33 executing program 2: socketpair(0x3, 0x0, 0x9, &(0x7f0000000040)) 02:35:33 executing program 4: socketpair(0x0, 0x1, 0x6, &(0x7f0000000000)) 02:35:34 executing program 1: socketpair(0x2b, 0x0, 0x6, &(0x7f0000000000)) 02:35:34 executing program 5: syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x40000) 02:35:34 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x110a, 0x2}) [ 2132.111441][T27790] binder: 27784:27790 ioctl 40046210 0 returned -22 02:35:34 executing program 4: socketpair(0x0, 0x1, 0x6, &(0x7f0000000000)) 02:35:34 executing program 1: socketpair(0x2b, 0x1, 0x0, &(0x7f0000000000)) 02:35:34 executing program 2: socketpair(0x3, 0x0, 0x0, &(0x7f0000000040)) 02:35:34 executing program 0: r0 = syz_open_dev$binderN(0x0, 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, &(0x7f0000001180)={0x40, 0x8, 0x7fff}) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="0b6300000e3cd7197d5f92c2c41f212ce79be7eaadd19a3fd1521192bf82e360a5b77b432f4fb1f10c62af17f4013c4595d747b3a1975334d9b945ca5cef8f02d971da2bc6d41997204f4911ca338a2f93a1cc9e29d9740d988b677094087c6e6988ec2b47ef5b8dfd92ac6e373dd0d34454000000000000"], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) 02:35:34 executing program 5: syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x40000) 02:35:34 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x110a, 0x2}) 02:35:34 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, &(0x7f0000001180)={0x40, 0x8, 0x7fff}) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="0b6300000e3cd7197d5f92c2c41f212ce79be7eaadd19a3fd1521192bf82e360a5b77b432f4fb1f10c62af17f4013c4595d747b3a1975334d9b945ca5cef8f02d971da2bc6d41997204f4911ca338a2f93a1cc9e29d9740d988b677094087c6e6988ec2b47ef5b8dfd92ac6e373dd0d34454000000000000"], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) 02:35:34 executing program 2: socketpair(0x3, 0x0, 0x0, 0x0) 02:35:34 executing program 4: socketpair(0x0, 0x1, 0x6, &(0x7f0000000000)) 02:35:34 executing program 5: syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x40000) [ 2132.445222][T27804] binder: 27798:27804 ioctl 40046210 0 returned -22 02:35:34 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x110a, 0x2}) 02:35:34 executing program 1: socketpair(0x2b, 0x1, 0x0, 0x0) [ 2132.522612][T27809] binder: 27805:27809 ioctl 40046210 0 returned -22 02:35:34 executing program 2: socketpair(0x3, 0x0, 0x0, 0x0) 02:35:34 executing program 4: socketpair(0x2b, 0x0, 0x6, &(0x7f0000000000)) 02:35:34 executing program 5: syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x1, 0x0) 02:35:34 executing program 1: socketpair(0x2b, 0x1, 0x0, 0x0) [ 2132.725344][T27819] binder: BINDER_SET_CONTEXT_MGR already set [ 2132.749937][T27819] binder: 27815:27819 ioctl 4018620d 20000080 returned -16 02:35:34 executing program 2: socketpair(0x3, 0x0, 0x0, 0x0) 02:35:34 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x110a, 0x2}) 02:35:35 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, &(0x7f0000001180)={0x40, 0x8, 0x7fff}) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="0b6300000e3cd7197d5f92c2c41f212ce79be7eaadd19a3fd1521192bf82e360a5b77b432f4fb1f10c62af17f4013c4595d747b3a1975334d9b945ca5cef8f02d971da2bc6d41997204f4911ca338a2f93a1cc9e29d9740d988b677094087c6e6988ec2b47ef5b8dfd92ac6e373dd0d34454000000000000"], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) 02:35:35 executing program 5: socketpair(0x2b, 0x1, 0x0, &(0x7f0000000000)) 02:35:35 executing program 4: socketpair(0x2b, 0x0, 0x6, &(0x7f0000000000)) 02:35:35 executing program 1: socketpair(0x2b, 0x1, 0x0, 0x0) 02:35:35 executing program 2: socketpair(0x0, 0x1, 0x6, &(0x7f0000000000)) 02:35:35 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x110a, 0x2}) 02:35:35 executing program 4: socketpair(0x2b, 0x0, 0x6, &(0x7f0000000000)) 02:35:35 executing program 5: socketpair(0x2b, 0x1, 0x0, &(0x7f0000000000)) 02:35:35 executing program 1: socketpair(0x0, 0x1, 0x6, &(0x7f0000000000)) [ 2133.496934][T27844] binder: 27842:27844 ioctl 40046210 0 returned -22 02:35:35 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x110a, 0x2}) 02:35:35 executing program 2: socketpair(0x3, 0x2, 0x9, &(0x7f0000000040)) getsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(0xffffffffffffffff, 0x84, 0xc, &(0x7f0000000180), &(0x7f00000001c0)=0x4) socketpair(0x2b, 0x1, 0x6, &(0x7f0000000000)) 02:35:35 executing program 5: socketpair(0x2b, 0x1, 0x0, &(0x7f0000000000)) 02:35:35 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, &(0x7f0000001180)={0x40, 0x8, 0x7fff}) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="0b6300000e3cd7197d5f92c2c41f212ce79be7eaadd19a3fd1521192bf82e360a5b77b432f4fb1f10c62af17f4013c4595d747b3a1975334d9b945ca5cef8f02d971da2bc6d41997204f4911ca338a2f93a1cc9e29d9740d988b677094087c6e6988ec2b47ef5b8dfd92ac6e373dd0d34454000000000000"], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) 02:35:35 executing program 4: socketpair(0x2b, 0x1, 0x0, &(0x7f0000000000)) 02:35:35 executing program 3: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x110a, 0x2}) 02:35:35 executing program 1: socketpair(0x0, 0x1, 0x6, &(0x7f0000000000)) 02:35:35 executing program 2: socketpair(0x3, 0x2, 0x9, &(0x7f0000000040)) getsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(0xffffffffffffffff, 0x84, 0xc, &(0x7f0000000180), &(0x7f00000001c0)=0x4) [ 2133.793176][T27861] binder: 27860:27861 ioctl 40046210 0 returned -22 02:35:35 executing program 5: socketpair(0x0, 0x1, 0x0, &(0x7f0000000000)) 02:35:36 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="0b6300000e3cd7197d5f92c2c41f212ce79be7eaadd19a3fd1521192bf82e360a5b77b432f4fb1f10c62af17f4013c4595d747b3a1975334d9b945ca5cef8f02d971da2bc6d41997204f4911ca338a2f93a1cc9e29d9740d988b677094087c6e6988ec2b47ef5b8dfd92ac6e373dd0d34454000000000000"], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) 02:35:36 executing program 4: socketpair(0x2b, 0x1, 0x0, &(0x7f0000000000)) 02:35:36 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x480040, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x110a, 0x2}) 02:35:36 executing program 3: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x110a, 0x2}) 02:35:36 executing program 1: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x110a, 0x2}) [ 2134.110010][T27880] binder: 27874:27880 ioctl 40046210 0 returned -22 02:35:36 executing program 5: socketpair(0x0, 0x1, 0x0, &(0x7f0000000000)) 02:35:36 executing program 4: socketpair(0x2b, 0x1, 0x0, &(0x7f0000000000)) [ 2134.153090][T27880] binder: 27874:27880 ioctl c0306201 20001140 returned -11 02:35:36 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="0b6300000e3cd7197d5f92c2c41f212ce79be7eaadd19a3fd1521192bf82e360a5b77b432f4fb1f10c62af17f4013c4595d747b3a1975334d9b945ca5cef8f02d971da2bc6d41997204f4911ca338a2f93a1cc9e29d9740d988b677094087c6e6988ec2b47ef5b8dfd92ac6e373dd0d34454000000000000"], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) 02:35:36 executing program 3: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x110a, 0x2}) [ 2134.226645][T27884] binder: 27882:27884 ioctl 40046210 0 returned -22 [ 2134.259396][T27884] binder: 27882:27884 ioctl c0306201 0 returned -14 02:35:36 executing program 4: socketpair(0x2b, 0x1, 0x6, 0x0) [ 2134.324430][T27884] binder: BINDER_SET_CONTEXT_MGR already set [ 2134.357922][T27884] binder: 27882:27884 ioctl 4018620d 20000080 returned -16 02:35:36 executing program 1: socketpair(0x2b, 0x1, 0x0, &(0x7f0000000000)) 02:35:36 executing program 5: socketpair(0x0, 0x1, 0x0, &(0x7f0000000000)) 02:35:36 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="0b6300000e3cd7197d5f92c2c41f212ce79be7eaadd19a3fd1521192bf82e360a5b77b432f4fb1f10c62af17f4013c4595d747b3a1975334d9b945ca5cef8f02d971da2bc6d41997204f4911ca338a2f93a1cc9e29d9740d988b677094087c6e6988ec2b47ef5b8dfd92ac6e373dd0d34454000000000000"], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) 02:35:36 executing program 2: socketpair(0x2b, 0x1, 0x0, &(0x7f0000000000)) 02:35:36 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x110a, 0x2}) 02:35:36 executing program 4: socketpair(0x2b, 0x1, 0x6, 0x0) 02:35:36 executing program 1: socketpair(0x2b, 0x1, 0x0, &(0x7f0000000000)) 02:35:36 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="0b6300000e3cd7197d5f92c2c41f212ce79be7eaadd19a3fd1521192bf82e360a5b77b432f4fb1f10c62af17f4013c4595d747b3a1975334d9b945ca5cef8f02d971da2bc6d41997204f4911ca338a2f93a1cc9e29d9740d988b677094087c6e6988ec2b47ef5b8dfd92ac6e373dd0d34454000000000000"], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) 02:35:36 executing program 2: socketpair(0x2b, 0x1, 0x0, &(0x7f0000000000)) 02:35:36 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x110a, 0x2}) 02:35:36 executing program 5: socketpair(0x2b, 0x0, 0x0, &(0x7f0000000000)) 02:35:36 executing program 4: socketpair(0x2b, 0x1, 0x6, 0x0) 02:35:37 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="0b6300000e3cd7197d5f92c2c41f212ce79be7eaadd19a3fd1521192bf82e360a5b77b432f4fb1f10c62af17f4013c4595d747b3a1975334d9b945ca5cef8f02d971da2bc6d41997204f4911ca338a2f93a1cc9e29d9740d988b677094087c6e6988ec2b47ef5b8dfd92ac6e373dd0d34454000000000000"], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) 02:35:37 executing program 1: socketpair(0x2b, 0x1, 0x0, &(0x7f0000000000)) 02:35:37 executing program 2: socketpair(0x2b, 0x1, 0x0, &(0x7f0000000000)) 02:35:37 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x110a, 0x2}) 02:35:37 executing program 5: socketpair(0x2b, 0x0, 0x0, &(0x7f0000000000)) 02:35:37 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000100)=[@decrefs={0x40046307, 0x1}], 0xe4, 0x0, &(0x7f0000000340)="192edaf8621943df81acc8221c73261958e5f8ae85aa447823557a30e6683fb7f101dc128832e2cac0d345d10b74ddae1aeab72f3a0b2bc47880b99b81afb1eae43481ab1453f61f27a53d23aee8264f0864b8a511acda89e97d96874adebda0fea7c668502a1b338e5a4baeb421f214d1d3a67e5e396a00b066627b2e496ac10f604074fdfa175876f46b8095672bc46c98fc6a66d043b398630f89aaee27538ea0e60425a68c0bf77df4eeaa03b17a5d98782b3d47a177cff183e49d47b5f2e6fafc9debf5c7d261ccbdd727a28322da1a27798d8ce0f807c940f846c1cf12697736fe"}) [ 2135.089734][T27930] binder: 27928:27930 ioctl 40046210 0 returned -22 02:35:37 executing program 1: socketpair(0x0, 0x1, 0x0, &(0x7f0000000000)) 02:35:37 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="0b6300000e3cd7197d5f92c2c41f212ce79be7eaadd19a3fd1521192bf82e360a5b77b432f4fb1f10c62af17f4013c4595d747b3a1975334d9b945ca5cef8f02d971da2bc6d41997204f4911ca338a2f93a1cc9e29d9740d988b677094087c6e6988ec2b47ef5b8dfd92ac6e373dd0d34454000000000000"], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) 02:35:37 executing program 5: socketpair(0x2b, 0x0, 0x0, &(0x7f0000000000)) 02:35:37 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x110a, 0x2}) 02:35:37 executing program 2: socketpair(0x0, 0x1, 0x0, &(0x7f0000000000)) 02:35:37 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x110a, 0x2}) [ 2135.342887][T27946] binder: 27940:27946 ioctl 40046210 0 returned -22 02:35:37 executing program 1: socketpair(0x0, 0x1, 0x0, &(0x7f0000000000)) 02:35:37 executing program 5: socketpair(0x2b, 0x1, 0x0, 0x0) 02:35:37 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="0b6300000e3cd7197d5f92c2c41f212ce79be7eaadd19a3fd1521192bf82e360a5b77b432f4fb1f10c62af17f4013c4595d747b3a1975334d9b945ca5cef8f02d971da2bc6d41997204f4911ca338a2f93a1cc9e29d9740d988b677094087c6e6988ec2b47ef5b8dfd92ac6e373dd0d34454000000000000"], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) 02:35:37 executing program 2: socketpair(0x0, 0x1, 0x0, &(0x7f0000000000)) 02:35:37 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x110a, 0x2}) 02:35:37 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5421, 0x400000) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) r2 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) r3 = socket$can_j1939(0x1d, 0x2, 0x7) r4 = mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x6) r5 = socket$nl_sock_diag(0x10, 0x3, 0x4) r6 = bpf$BPF_RAW_TRACEPOINT_OPEN_UNNAMED(0x11, &(0x7f0000000400)={0x0, r0}, 0x10) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x104, 0x0, &(0x7f0000000500)=[@enter_looper, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000040)={@flat=@weak_handle={0x77682a85, 0x110a, 0x1}, @fda={0x66646185, 0x2, 0x0, 0x36}, @fd={0x66642a85, 0x0, r3}}, &(0x7f00000000c0)={0x0, 0x18, 0x38}}}, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000240)={@ptr={0x70742a85, 0x1, &(0x7f0000000100)=""/16, 0x10, 0x2, 0x2f}, @ptr={0x70742a85, 0x1, &(0x7f0000000180)=""/171, 0xab, 0x2, 0x5}, @fda={0x66646185, 0x7, 0x2, 0x6}}, &(0x7f00000002c0)={0x0, 0x28, 0x50}}}, @increfs_done={0x40106308, 0x2}, @free_buffer={0x40086303, r4}, @acquire={0x40046305, 0x5}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000440)={@fd={0x66642a85, 0x0, r5}, @ptr={0x70742a85, 0x0, &(0x7f0000000300)=""/211, 0xd3, 0x1, 0x2f}, @fd={0x66642a85, 0x0, r6}}, &(0x7f00000004c0)={0x0, 0x18, 0x40}}}, @exit_looper], 0x16, 0x0, &(0x7f0000000640)="eddee3baa5721b83e5ed4e7d98bda0b7e1c84dda1776"}) ioctl$GIO_FONTX(r1, 0x4b6b, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000700)={&(0x7f00000006c0)='sched_switch\x00'}, 0x10) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000000)=0x2) 02:35:37 executing program 5: socketpair(0x2b, 0x1, 0x0, 0x0) 02:35:37 executing program 2: socketpair(0x0, 0x1, 0x0, &(0x7f0000000000)) 02:35:37 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x110a, 0x2}) [ 2135.679588][T27966] binder: 27961:27966 ioctl 40046210 0 returned -22 [ 2135.718198][T27968] binder: 27967:27968 ioctl c0306201 0 returned -14 02:35:37 executing program 1: socketpair(0x0, 0x1, 0x0, &(0x7f0000000000)) 02:35:37 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 02:35:37 executing program 5: socketpair(0x2b, 0x1, 0x0, 0x0) 02:35:37 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [@GTPA_FLOW={0x6}]}, 0x1c}}, 0x10) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000180)='/proc/capi/capi20\x00', 0x254000, 0x0) r3 = syz_genetlink_get_family_id$gtp(&(0x7f0000000200)='gtp\x00') sendmsg$GTP_CMD_NEWPDP(r2, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40304d20}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x34, r3, 0x400, 0x70bd25, 0x25dfdbfc, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @private=0xa010102}, @GTPA_NET_NS_FD={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x4}, @GTPA_VERSION={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x4850}, 0x0) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x20000, 0x0) mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1, 0x11, r4, 0x8) ioctl$BINDER_SET_MAX_THREADS(r1, 0x5460, 0x0) [ 2135.955109][T27980] binder: 27977:27980 ioctl 40046210 0 returned -22 02:35:38 executing program 3: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x110a, 0x2}) 02:35:38 executing program 2: socketpair(0x2b, 0x0, 0x0, &(0x7f0000000000)) [ 2135.998418][T27980] binder: 27977:27980 ioctl c0306201 0 returned -14 02:35:38 executing program 1: socketpair(0x2b, 0x0, 0x0, &(0x7f0000000000)) 02:35:38 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 02:35:38 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [@GTPA_FLOW={0x6}]}, 0x1c}}, 0x10) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000180)='/proc/capi/capi20\x00', 0x254000, 0x0) r3 = syz_genetlink_get_family_id$gtp(&(0x7f0000000200)='gtp\x00') sendmsg$GTP_CMD_NEWPDP(r2, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40304d20}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x34, r3, 0x400, 0x70bd25, 0x25dfdbfc, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @private=0xa010102}, @GTPA_NET_NS_FD={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x4}, @GTPA_VERSION={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x4850}, 0x0) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x20000, 0x0) mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1, 0x11, r4, 0x8) ioctl$BINDER_SET_MAX_THREADS(r1, 0x5460, 0x0) 02:35:38 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x1, 0x40000) ioctl$DRM_IOCTL_AGP_BIND(r0, 0x40106436, &(0x7f0000000080)={0x0, 0x3d32}) r1 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_SET_MAX_THREADS(r1, 0x5460, 0x0) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r2, 0xc0405519, 0x0) 02:35:38 executing program 2: socketpair(0x2b, 0x0, 0x0, &(0x7f0000000000)) 02:35:38 executing program 3: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x110a, 0x2}) [ 2136.265104][T27994] binder: 27991:27994 ioctl 40046210 0 returned -22 02:35:38 executing program 1: socketpair(0x2b, 0x0, 0x0, &(0x7f0000000000)) [ 2136.296952][T27994] binder: 27991:27994 ioctl c0306201 0 returned -14 02:35:38 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [@GTPA_FLOW={0x6}]}, 0x1c}}, 0x10) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000180)='/proc/capi/capi20\x00', 0x254000, 0x0) r3 = syz_genetlink_get_family_id$gtp(&(0x7f0000000200)='gtp\x00') sendmsg$GTP_CMD_NEWPDP(r2, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40304d20}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x34, r3, 0x400, 0x70bd25, 0x25dfdbfc, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @private=0xa010102}, @GTPA_NET_NS_FD={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x4}, @GTPA_VERSION={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x4850}, 0x0) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x20000, 0x0) mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1, 0x11, r4, 0x8) ioctl$BINDER_SET_MAX_THREADS(r1, 0x5460, 0x0) 02:35:38 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 02:35:38 executing program 5: setrlimit(0x3, 0x0) 02:35:38 executing program 2: socketpair(0x2b, 0x0, 0x0, &(0x7f0000000000)) 02:35:38 executing program 3: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x110a, 0x2}) 02:35:38 executing program 1: socketpair(0x2b, 0x0, 0x0, &(0x7f0000000000)) [ 2136.584512][T28011] binder: 28006:28011 ioctl 40046210 0 returned -22 [ 2136.618960][T28011] binder: 28006:28011 ioctl c0306201 0 returned -14 02:35:38 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [@GTPA_FLOW={0x6}]}, 0x1c}}, 0x10) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000180)='/proc/capi/capi20\x00', 0x254000, 0x0) r2 = syz_genetlink_get_family_id$gtp(&(0x7f0000000200)='gtp\x00') sendmsg$GTP_CMD_NEWPDP(r1, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40304d20}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x34, r2, 0x400, 0x70bd25, 0x25dfdbfc, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @private=0xa010102}, @GTPA_NET_NS_FD={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x4}, @GTPA_VERSION={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x4850}, 0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x20000, 0x0) mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1, 0x11, r3, 0x8) 02:35:38 executing program 5: setrlimit(0x3, 0x0) 02:35:38 executing program 2: socketpair(0x2b, 0x1, 0x0, 0x0) 02:35:38 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, 0x0, 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) 02:35:38 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, 0x0) 02:35:38 executing program 1: socketpair(0x2b, 0x1, 0x0, 0x0) 02:35:38 executing program 2: socketpair(0x2b, 0x1, 0x0, 0x0) [ 2136.856769][T28026] binder: 28020:28026 ioctl 40046210 0 returned -22 [ 2136.890421][T28026] binder: 28020:28026 ioctl c0306201 20001140 returned -14 02:35:39 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [@GTPA_FLOW={0x6}]}, 0x1c}}, 0x10) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000180)='/proc/capi/capi20\x00', 0x254000, 0x0) r2 = syz_genetlink_get_family_id$gtp(&(0x7f0000000200)='gtp\x00') sendmsg$GTP_CMD_NEWPDP(r1, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40304d20}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x34, r2, 0x400, 0x70bd25, 0x25dfdbfc, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @private=0xa010102}, @GTPA_NET_NS_FD={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x4}, @GTPA_VERSION={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x4850}, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x20000, 0x0) 02:35:39 executing program 5: setrlimit(0x3, 0x0) [ 2136.929181][T28028] binder: 28027:28028 ioctl 4018620d 0 returned -22 02:35:39 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, 0x0) 02:35:39 executing program 1: socketpair(0x2b, 0x1, 0x0, 0x0) 02:35:39 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, 0x0, 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) 02:35:39 executing program 2: socketpair(0x2b, 0x1, 0x0, 0x0) 02:35:39 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [@GTPA_FLOW={0x6}]}, 0x1c}}, 0x10) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000180)='/proc/capi/capi20\x00', 0x254000, 0x0) r2 = syz_genetlink_get_family_id$gtp(&(0x7f0000000200)='gtp\x00') sendmsg$GTP_CMD_NEWPDP(r1, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40304d20}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x34, r2, 0x400, 0x70bd25, 0x25dfdbfc, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @private=0xa010102}, @GTPA_NET_NS_FD={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x4}, @GTPA_VERSION={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x4850}, 0x0) 02:35:39 executing program 5: setrlimit(0x0, 0x0) [ 2137.160350][T28041] binder: 28037:28041 ioctl 4018620d 0 returned -22 02:35:39 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, 0x0) [ 2137.222869][T28044] binder: 28039:28044 ioctl 40046210 0 returned -22 [ 2137.236932][T28044] binder: 28039:28044 ioctl c0306201 20001140 returned -14 02:35:39 executing program 1: socketpair(0x2b, 0x1, 0x0, 0x0) 02:35:39 executing program 2: socketpair(0x2b, 0x0, 0x0, &(0x7f0000000000)) 02:35:39 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [@GTPA_FLOW={0x6}]}, 0x1c}}, 0x10) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000180)='/proc/capi/capi20\x00', 0x254000, 0x0) syz_genetlink_get_family_id$gtp(&(0x7f0000000200)='gtp\x00') 02:35:39 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, 0x0, 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) 02:35:39 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [@GTPA_FLOW={0x6}]}, 0x1c}}, 0x10) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000180)='/proc/capi/capi20\x00', 0x254000, 0x0) r2 = syz_genetlink_get_family_id$gtp(&(0x7f0000000200)='gtp\x00') sendmsg$GTP_CMD_NEWPDP(r1, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40304d20}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x34, r2, 0x400, 0x70bd25, 0x25dfdbfc, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @private=0xa010102}, @GTPA_NET_NS_FD={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x4}, @GTPA_VERSION={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x4850}, 0x0) [ 2137.454684][T28054] binder: 28049:28054 ioctl 4018620d 0 returned -22 02:35:39 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [@GTPA_FLOW={0x6}]}, 0x1c}}, 0x10) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000180)='/proc/capi/capi20\x00', 0x254000, 0x0) r2 = syz_genetlink_get_family_id$gtp(&(0x7f0000000200)='gtp\x00') sendmsg$GTP_CMD_NEWPDP(r1, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40304d20}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x34, r2, 0x400, 0x70bd25, 0x25dfdbfc, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @private=0xa010102}, @GTPA_NET_NS_FD={0x8}, @GTPA_O_TEI={0x8, 0x9, 0x4}, @GTPA_VERSION={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x4850}, 0x0) 02:35:39 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x0, 0x2}) 02:35:39 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, 0x0) [ 2137.557228][T28060] binder: 28058:28060 ioctl 40046210 0 returned -22 [ 2137.604681][T28060] binder: 28058:28060 ioctl c0306201 20001140 returned -14 02:35:39 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [@GTPA_FLOW={0x6}]}, 0x1c}}, 0x10) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) syz_genetlink_get_family_id$gtp(&(0x7f0000000200)='gtp\x00') 02:35:39 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [@GTPA_FLOW={0x6}]}, 0x1c}}, 0x10) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000180)='/proc/capi/capi20\x00', 0x254000, 0x0) syz_genetlink_get_family_id$gtp(&(0x7f0000000200)='gtp\x00') 02:35:39 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) [ 2137.717872][T28067] binder: 28064:28067 ioctl 4018620d 0 returned -22 [ 2137.719944][T28068] binder: BINDER_SET_CONTEXT_MGR already set [ 2137.735496][T28068] binder: 28065:28068 ioctl 4018620d 20000080 returned -16 02:35:39 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)) 02:35:39 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)={0x73622a85, 0x0, 0x2}) 02:35:39 executing program 1: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) r1 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$DRM_IOCTL_AGP_FREE(r0, 0x40206435, &(0x7f0000001180)) ioctl$TIOCSTI(r1, 0x5421, 0x3ffffc) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r2, 0xc0405519, 0x0) setsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r2, 0x84, 0x8, &(0x7f0000000080)=0x8, 0x4) ioctl$PIO_SCRNMAP(r2, 0x4b41, &(0x7f00000000c0)="2d6856b583bc980e7dcb92dd7ae98e6d7e9235c4b0c2560c8e627be4b1f62c2491d3a49ff008c7f64219561b97013eba39207fe1434ddef13b6c02a5243dadd6fe312bb8917832262b9f312c969d3f3f1d76ab3540e097f7c296b06fcd4d32373debf788d0fc5dca55f196fd") ioctl$TIOCGSERIAL(r0, 0x541e, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=""/4096}) [ 2137.864799][T28075] binder: 28072:28075 ioctl 40046210 0 returned -22 [ 2137.891338][T28075] binder: 28072:28075 unknown command 0 02:35:40 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [@GTPA_FLOW={0x6}]}, 0x1c}}, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f0000000200)='gtp\x00') 02:35:40 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {&(0x7f0000000000), 0x3, 0xffffffffffffffff, 0x1c, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) [ 2137.925008][T28075] binder: 28072:28075 ioctl c0306201 20001140 returned -22 [ 2137.964322][T28079] binder: BINDER_SET_CONTEXT_MGR already set [ 2138.006094][T28079] binder: 28076:28079 ioctl 4018620d 20000080 returned -16 [ 2138.020965][T28082] binder: BINDER_SET_CONTEXT_MGR already set [ 2138.035546][T28082] binder: 28077:28082 ioctl 4018620d 20000080 returned -16 02:35:40 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) 02:35:40 executing program 1: setrlimit(0x0, &(0x7f0000000040)={0x1, 0x9}) 02:35:40 executing program 4: socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f0000000200)='gtp\x00') 02:35:40 executing program 3: setrlimit(0x0, &(0x7f0000000040)={0x1, 0x9}) 02:35:40 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)) 02:35:40 executing program 5: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSPTLCK(0xffffffffffffffff, 0x40045431, &(0x7f0000000040)=0x1) ioctl$FUSE_DEV_IOC_CLONE(0xffffffffffffffff, 0x8004e500, &(0x7f0000000000)=r0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r1, 0x4b6b, 0x0) r2 = syz_open_dev$sndctrl(&(0x7f0000000a80)='/dev/snd/controlC#\x00', 0x4f3, 0x0) read$FUSE(r2, 0x0, 0x0) ioctl$TIOCSTI(r1, 0x5421, 0x9) [ 2138.232287][T28089] binder: 28086:28089 ioctl 40046210 0 returned -22 [ 2138.251916][T28089] binder: 28086:28089 unknown command 0 [ 2138.271533][T28089] binder: 28086:28089 ioctl c0306201 20001140 returned -22 02:35:40 executing program 1: setrlimit(0x0, &(0x7f0000000040)={0x1, 0x9}) 02:35:40 executing program 4: socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f0000000200)='gtp\x00') [ 2138.334706][T28094] binder: BINDER_SET_CONTEXT_MGR already set [ 2138.357349][T28094] binder: 28090:28094 ioctl 4018620d 20000080 returned -16 02:35:40 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) 02:35:40 executing program 3: setrlimit(0x0, &(0x7f0000000040)={0x1, 0x9}) 02:35:40 executing program 2: socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f0000000200)='gtp\x00') 02:35:40 executing program 5: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSTI(r1, 0x5421, 0x400000) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r2, 0x4b6b, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r3, 0x4b6b, 0x0) ioctl$TIOCSSOFTCAR(r3, 0x541a, &(0x7f0000000000)=0x2) ioctl$TIOCSTI(r0, 0x5412, 0x6) ioctl$TIOCSTI(r2, 0x5412, 0xa5e7) 02:35:40 executing program 1: setrlimit(0x0, &(0x7f0000000040)={0x1, 0x9}) 02:35:40 executing program 4: socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f0000000200)='gtp\x00') 02:35:40 executing program 3: setrlimit(0x0, &(0x7f0000000040)={0x1, 0x9}) [ 2138.588308][T28107] binder: 28104:28107 ioctl 40046210 0 returned -22 [ 2138.613994][T28107] binder: 28104:28107 unknown command 0 [ 2138.675258][T28107] binder: 28104:28107 ioctl c0306201 20001140 returned -22 02:35:40 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) r1 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)={0x2}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f00000000c0), 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@bridge_dellink={0x28, 0x11, 0x10, 0x70bd26, 0x25dfdbff, {0x7, 0x0, 0x0, 0x0, 0x8900, 0x1400}, [@IFLA_LINK_NETNSID={0x8}]}, 0x28}}, 0x4000000) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) 02:35:40 executing program 1: setrlimit(0x0, 0x0) 02:35:40 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) 02:35:40 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = accept(0xffffffffffffffff, &(0x7f0000000840)=@can, &(0x7f00000008c0)=0x80) r3 = accept4$phonet_pipe(0xffffffffffffffff, &(0x7f0000000900), &(0x7f0000002980)=0x10, 0x80000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001580)={0x18, 0x2, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000ffff000000080000000000005bf1c56c8caa265c0dd968e986e5a8585f4922f8012b6924975ea07bd364bd71e34e41a504739c050c0585d8336d3e1ca5d7ddc4340e8e58faf56fb80d39a624d7b8b3891a2441eca66989c9ca0b8aba"], &(0x7f0000000100)='GPL\x00', 0x8, 0x1000, &(0x7f0000000500)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r4, 0x4b6b, 0x0) ioctl$TIOCMBIC(r4, 0x5417, &(0x7f0000000180)=0x1) r5 = socket$phonet_pipe(0x23, 0x5, 0x2) sendmsg$nl_route(r2, &(0x7f00000002c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)=@getneightbl={0x14, 0x42, 0x200, 0x70bd27, 0x25dfdbfe, {}, ["", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x800}, 0x48800) accept$phonet_pipe(r5, 0x0, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) ioctl$sock_bt_hidp_HIDPCONNADD(r2, 0x400448c8, &(0x7f0000002a80)={r3, r5, 0xffff, 0xb0, &(0x7f00000029c0)="898dde8d59c03b624bd80d60d355759ee1235e70754d82af65cf5776db3d840d787e8a5413b8da8772fb2d934096326a00f1f843292c393d7d9b839528fc2320a60b8b08a9ca18002fd6f332d5eb177db178de52d35834d87395afc7e9cfd71c0aa21c5b8693ef629937332ec8ab49ec89da346baeb8e5950797632488caef20891301496dbbbfc9da508ff43a044cfebd609a38d75b141f8d72736c9a16793e5596cd16a3fb094ae838e7da2f38da3a", 0x9, 0x9, 0xef44, 0x7f, 0x2, 0x3, 0x200, 'syz0\x00'}) r6 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/capi/capi20\x00', 0x200000, 0x0) mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x0) setsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r6, 0x84, 0x8, &(0x7f0000000140), 0x4) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x0, 0x2}) 02:35:40 executing program 3: setrlimit(0x0, 0x0) 02:35:40 executing program 4: sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [@GTPA_FLOW={0x6}]}, 0x1c}}, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f0000000200)='gtp\x00') [ 2138.907505][T28121] binder: 28119:28121 ioctl 40046210 0 returned -22 [ 2138.928002][T28123] binder: 28120:28123 ioctl 40046210 0 returned -22 [ 2138.963609][T28123] binder: 28120:28123 unknown command 0 [ 2138.996307][T28123] binder: 28120:28123 ioctl c0306201 20001140 returned -22 [ 2138.999850][T28128] binder: 28124:28128 ioctl 40046210 0 returned -22 02:35:41 executing program 2: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) syz_open_dev$binderN(0xfffffffffffffffe, 0x0, 0x800) r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r1, 0x4b6b, 0x0) ioctl$VT_GETMODE(r1, 0x5601, &(0x7f0000000080)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x40, 0x0) ioctl$BINDER_SET_MAX_THREADS(r2, 0x541b, 0x0) 02:35:41 executing program 1: setrlimit(0x0, 0x0) [ 2139.042949][T28128] binder: 28124:28128 ioctl c0306201 0 returned -14 02:35:41 executing program 3: setrlimit(0x0, 0x0) 02:35:41 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) 02:35:41 executing program 4: sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [@GTPA_FLOW={0x6}]}, 0x1c}}, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f0000000200)='gtp\x00') 02:35:41 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) r1 = socket$phonet_pipe(0x23, 0x5, 0x2) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r2, 0x89f4, &(0x7f0000002180)={'sit0\x00', &(0x7f0000002100)={'ip6_vti0\x00', 0x0, 0x29, 0x3, 0x1, 0x7, 0x14, @initdev={0xfe, 0x88, [], 0x0, 0x0}, @rand_addr=' \x01\x00', 0x700, 0x7800, 0x4, 0x101}}) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f00000022c0)=0x7fffffff) accept$phonet_pipe(r1, 0x0, 0x0) connect$phonet_pipe(r1, &(0x7f0000000040)={0x23, 0x7, 0x1, 0x6}, 0x10) read$FUSE(0xffffffffffffffff, &(0x7f0000000080)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_BMAP(r0, &(0x7f00000020c0)={0x18, 0x0, r3, {0x8}}, 0x18) sendmsg$RDMA_NLDEV_CMD_DELLINK(0xffffffffffffffff, &(0x7f0000002280)={&(0x7f00000021c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000002240)={&(0x7f0000002200)={0x30, 0x1404, 0x8, 0x70bd26, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x30}, 0x1, 0x0, 0x0, 0x4004080}, 0x4000) [ 2139.193438][T28133] binder: 28131:28133 ioctl c0306201 0 returned -14 02:35:41 executing program 2: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) syz_open_dev$binderN(0xfffffffffffffffe, 0x0, 0x800) r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r1, 0x4b6b, 0x0) ioctl$VT_GETMODE(r1, 0x5601, &(0x7f0000000080)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x40, 0x0) ioctl$BINDER_SET_MAX_THREADS(r2, 0x541b, 0x0) 02:35:41 executing program 1: setrlimit(0x0, 0x0) 02:35:41 executing program 3: setrlimit(0x0, 0x0) [ 2139.321531][T28140] binder: 28135:28140 ioctl 40046210 0 returned -22 [ 2139.357978][T28140] binder: 28135:28140 unknown command 0 02:35:41 executing program 4: sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [@GTPA_FLOW={0x6}]}, 0x1c}}, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f0000000200)='gtp\x00') [ 2139.400238][T28140] binder: 28135:28140 ioctl c0306201 20001140 returned -22 [ 2139.414789][T28144] binder: 28142:28144 ioctl 541b 0 returned -22 [ 2139.465051][T28146] binder: 28143:28146 ioctl c0306201 0 returned -14 02:35:41 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) 02:35:41 executing program 5: sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [@GTPA_FLOW={0x6}]}, 0x1c}}, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f0000000200)='gtp\x00') 02:35:41 executing program 1: setrlimit(0x0, &(0x7f0000000040)={0x0, 0x9}) 02:35:41 executing program 3: setrlimit(0x0, &(0x7f0000000040)={0x0, 0x9}) 02:35:41 executing program 2: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) syz_open_dev$binderN(0xfffffffffffffffe, 0x0, 0x800) r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r1, 0x4b6b, 0x0) ioctl$VT_GETMODE(r1, 0x5601, &(0x7f0000000080)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x40, 0x0) ioctl$BINDER_SET_MAX_THREADS(r2, 0x541b, 0x0) 02:35:41 executing program 4: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [@GTPA_FLOW={0x6}]}, 0x1c}}, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f0000000200)='gtp\x00') [ 2139.671046][T28156] binder: 28153:28156 ioctl 40046210 0 returned -22 [ 2139.708786][T28156] binder: 28153:28156 unknown command 0 02:35:41 executing program 1: setrlimit(0x0, &(0x7f0000000040)) [ 2139.733566][T28156] binder: 28153:28156 ioctl c0306201 20001140 returned -22 [ 2139.772484][T28163] binder: 28160:28163 ioctl c0306201 0 returned -14 02:35:41 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) r1 = socket$phonet_pipe(0x23, 0x5, 0x2) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r2, 0x89f4, &(0x7f0000002180)={'sit0\x00', &(0x7f0000002100)={'ip6_vti0\x00', 0x0, 0x29, 0x3, 0x1, 0x7, 0x14, @initdev={0xfe, 0x88, [], 0x0, 0x0}, @rand_addr=' \x01\x00', 0x700, 0x7800, 0x4, 0x101}}) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f00000022c0)=0x7fffffff) accept$phonet_pipe(r1, 0x0, 0x0) connect$phonet_pipe(r1, &(0x7f0000000040)={0x23, 0x7, 0x1, 0x6}, 0x10) read$FUSE(0xffffffffffffffff, &(0x7f0000000080)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_BMAP(r0, &(0x7f00000020c0)={0x18, 0x0, r3, {0x8}}, 0x18) sendmsg$RDMA_NLDEV_CMD_DELLINK(0xffffffffffffffff, &(0x7f0000002280)={&(0x7f00000021c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000002240)={&(0x7f0000002200)={0x30, 0x1404, 0x8, 0x70bd26, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x30}, 0x1, 0x0, 0x0, 0x4004080}, 0x4000) 02:35:41 executing program 3: setrlimit(0x0, &(0x7f0000000040)) 02:35:41 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="0b6300000e3cd7197d5f92c2c41f212ce79be7eaadd19a3fd1521192bf82e360a5b77b432f4fb1f10c62af17f4013c4595d747b3a1975334d9b945ca"], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) 02:35:41 executing program 2: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) syz_open_dev$binderN(0xfffffffffffffffe, 0x0, 0x800) r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r1, 0x4b6b, 0x0) ioctl$VT_GETMODE(r1, 0x5601, &(0x7f0000000080)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x40, 0x0) 02:35:41 executing program 4: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [@GTPA_FLOW={0x6}]}, 0x1c}}, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f0000000200)='gtp\x00') 02:35:42 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) openat$vim2m(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vim2m\x00', 0x2, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCPKT(r1, 0x5420, &(0x7f0000000080)=0x1) ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, 0xffffffffffff93b4) getsockopt$inet_sctp_SCTP_NODELAY(0xffffffffffffffff, 0x84, 0x3, &(0x7f00000000c0), &(0x7f0000000100)=0x4) [ 2139.957925][T28172] binder: 28168:28172 ioctl 541b 0 returned -22 [ 2139.980870][T28173] binder: 28169:28173 ioctl 40046210 0 returned -22 02:35:42 executing program 1: sendmsg$RDMA_NLDEV_CMD_PORT_GET(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000240)={&(0x7f0000000100)={0x20, 0x1405, 0x1, 0x70bd2b, 0x25dfdbfc, "", [{{0x8, 0x1, 0x1}, {0x8, 0x3, 0x1}}]}, 0x20}, 0x1, 0x0, 0x0, 0x40008c4}, 0x800) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000480)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x10, 0x0, @in={0x2, 0x0, @multicast2}}}, 0x90) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {&(0x7f0000000000), 0x3, 0xffffffffffffffff, 0x1c, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) [ 2140.012213][T28174] binder: 28170:28174 ioctl c0306201 0 returned -14 02:35:42 executing program 2: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) syz_open_dev$binderN(0xfffffffffffffffe, 0x0, 0x800) r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r1, 0x4b6b, 0x0) ioctl$VT_GETMODE(r1, 0x5601, &(0x7f0000000080)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 02:35:42 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="0b6300000e3cd7197d5f92c2c41f212ce79be7eaadd19a3fd1521192bf82e360a5b77b432f4fb1f10c62af17f4013c4595d747b3a1975334d9b945ca"], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) 02:35:42 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) r1 = socket$phonet_pipe(0x23, 0x5, 0x2) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r2, 0x89f4, &(0x7f0000002180)={'sit0\x00', &(0x7f0000002100)={'ip6_vti0\x00', 0x0, 0x29, 0x3, 0x1, 0x7, 0x14, @initdev={0xfe, 0x88, [], 0x0, 0x0}, @rand_addr=' \x01\x00', 0x700, 0x7800, 0x4, 0x101}}) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f00000022c0)=0x7fffffff) accept$phonet_pipe(r1, 0x0, 0x0) connect$phonet_pipe(r1, &(0x7f0000000040)={0x23, 0x7, 0x1, 0x6}, 0x10) read$FUSE(0xffffffffffffffff, &(0x7f0000000080)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_BMAP(r0, &(0x7f00000020c0)={0x18, 0x0, r3, {0x8}}, 0x18) sendmsg$RDMA_NLDEV_CMD_DELLINK(0xffffffffffffffff, &(0x7f0000002280)={&(0x7f00000021c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000002240)={&(0x7f0000002200)={0x30, 0x1404, 0x8, 0x70bd26, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x30}, 0x1, 0x0, 0x0, 0x4004080}, 0x4000) [ 2140.127068][T28179] binder: 28177:28179 ioctl 541b 0 returned -22 02:35:42 executing program 4: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [@GTPA_FLOW={0x6}]}, 0x1c}}, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f0000000200)='gtp\x00') 02:35:42 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="0b6300000e3cd7197d5f92c2c41f212ce79be7eaadd19a3fd1521192bf82e360a5b77b432f4fb1f10c62af17f4013c4595d747b3a1975334d9b945ca"], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) 02:35:42 executing program 1: sendmsg$RDMA_NLDEV_CMD_PORT_GET(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000240)={&(0x7f0000000100)={0x20, 0x1405, 0x1, 0x70bd2b, 0x25dfdbfc, "", [{{0x8, 0x1, 0x1}, {0x8, 0x3, 0x1}}]}, 0x20}, 0x1, 0x0, 0x0, 0x40008c4}, 0x800) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000480)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x10, 0x0, @in={0x2, 0x0, @multicast2}}}, 0x90) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {&(0x7f0000000000), 0x3, 0xffffffffffffffff, 0x1c, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) [ 2140.270992][T28187] binder: 28184:28187 ioctl c0306201 0 returned -14 [ 2140.293874][T28189] binder: 28185:28189 ioctl 40046210 0 returned -22 [ 2140.301166][T28190] binder: 28186:28190 ioctl 541b 0 returned -22 02:35:42 executing program 2: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) syz_open_dev$binderN(0xfffffffffffffffe, 0x0, 0x800) syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r0, 0x4b6b, 0x0) ioctl$VT_GETMODE(r0, 0x5601, &(0x7f0000000080)) 02:35:42 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_DELPDP(r0, 0x0, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f0000000200)='gtp\x00') 02:35:42 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) r1 = socket$phonet_pipe(0x23, 0x5, 0x2) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r2, 0x89f4, &(0x7f0000002180)={'sit0\x00', &(0x7f0000002100)={'ip6_vti0\x00', 0x0, 0x29, 0x3, 0x1, 0x7, 0x14, @initdev={0xfe, 0x88, [], 0x0, 0x0}, @rand_addr=' \x01\x00', 0x700, 0x7800, 0x4, 0x101}}) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f00000022c0)=0x7fffffff) accept$phonet_pipe(r1, 0x0, 0x0) connect$phonet_pipe(r1, &(0x7f0000000040)={0x23, 0x7, 0x1, 0x6}, 0x10) read$FUSE(0xffffffffffffffff, &(0x7f0000000080)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_BMAP(r0, &(0x7f00000020c0)={0x18, 0x0, r3, {0x8}}, 0x18) sendmsg$RDMA_NLDEV_CMD_DELLINK(0xffffffffffffffff, &(0x7f0000002280)={&(0x7f00000021c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000002240)={&(0x7f0000002200)={0x30, 0x1404, 0x8, 0x70bd26, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x30}, 0x1, 0x0, 0x0, 0x4004080}, 0x4000) 02:35:42 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="0b6300000e3cd7197d5f92c2c41f212ce79be7eaadd19a3fd1521192bf82e360a5b77b432f4fb1f10c62af17f4013c4595d747b3a1975334d9b945ca"], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) 02:35:42 executing program 1: sendmsg$RDMA_NLDEV_CMD_PORT_GET(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000240)={&(0x7f0000000100)={0x20, 0x1405, 0x1, 0x70bd2b, 0x25dfdbfc, "", [{{0x8, 0x1, 0x1}, {0x8, 0x3, 0x1}}]}, 0x20}, 0x1, 0x0, 0x0, 0x40008c4}, 0x800) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000480)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x10, 0x0, @in={0x2, 0x0, @multicast2}}}, 0x90) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {&(0x7f0000000000), 0x3, 0xffffffffffffffff, 0x1c, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) [ 2140.480879][T28195] binder: 28193:28195 ioctl 40046210 0 returned -22 [ 2140.520449][T28195] binder: 28193:28195 ioctl c0306201 20001140 returned -11 02:35:42 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="0b6300000e3cd7197d5f92c2c41f212ce79be7eaadd19a3fd1521192bf82e360a5b77b432f4fb1f10c62af17f4013c4595d747b3a1975334d9b945ca"], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) [ 2140.625785][T28203] binder: 28200:28203 ioctl 541b 0 returned -22 [ 2140.650081][T28206] binder: 28201:28206 ioctl 40046210 0 returned -22 02:35:42 executing program 2: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) syz_open_dev$binderN(0xfffffffffffffffe, 0x0, 0x800) syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r0, 0x4b6b, 0x0) 02:35:42 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_DELPDP(r0, 0x0, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f0000000200)='gtp\x00') [ 2140.689199][T28206] binder: 28201:28206 ioctl c0306201 20001140 returned -11 02:35:42 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) r1 = socket$phonet_pipe(0x23, 0x5, 0x2) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r2, 0x89f4, &(0x7f0000002180)={'sit0\x00', &(0x7f0000002100)={'ip6_vti0\x00', 0x0, 0x29, 0x3, 0x1, 0x7, 0x14, @initdev={0xfe, 0x88, [], 0x0, 0x0}, @rand_addr=' \x01\x00', 0x700, 0x7800, 0x4, 0x101}}) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f00000022c0)=0x7fffffff) accept$phonet_pipe(r1, 0x0, 0x0) connect$phonet_pipe(r1, &(0x7f0000000040)={0x23, 0x7, 0x1, 0x6}, 0x10) read$FUSE(0xffffffffffffffff, &(0x7f0000000080)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_BMAP(r0, &(0x7f00000020c0)={0x18, 0x0, r3, {0x8}}, 0x18) 02:35:42 executing program 1: sendmsg$RDMA_NLDEV_CMD_PORT_GET(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000240)={&(0x7f0000000100)={0x20, 0x1405, 0x1, 0x70bd2b, 0x25dfdbfc, "", [{{0x8, 0x1, 0x1}, {0x8, 0x3, 0x1}}]}, 0x20}, 0x1, 0x0, 0x0, 0x40008c4}, 0x800) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {&(0x7f0000000000), 0x3, 0xffffffffffffffff, 0x1c, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) 02:35:42 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) [ 2140.796015][T28210] binder: 28208:28210 ioctl 40046210 0 returned -22 [ 2140.831815][T28210] binder: 28208:28210 ioctl c0306201 20001140 returned -11 02:35:43 executing program 2: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) syz_open_dev$binderN(0xfffffffffffffffe, 0x0, 0x800) syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) [ 2140.904586][T28217] binder: 28212:28217 ioctl 541b 0 returned -22 02:35:43 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="0b6300000e3cd7197d5f92c2c41f212ce79be7eaadd19a3fd1521192bf82e360a5b77b432f4fb1f10c62af17f4013c4595d747b3a1975334d9b945ca"], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) 02:35:43 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_DELPDP(r0, 0x0, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f0000000200)='gtp\x00') [ 2140.969535][T28219] binder: 28216:28219 ioctl 40046210 0 returned -22 [ 2140.995954][T28219] binder: 28216:28219 unknown command 0 02:35:43 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) r1 = socket$phonet_pipe(0x23, 0x5, 0x2) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r2, 0x89f4, &(0x7f0000002180)={'sit0\x00', &(0x7f0000002100)={'ip6_vti0\x00', 0x0, 0x29, 0x3, 0x1, 0x7, 0x14, @initdev={0xfe, 0x88, [], 0x0, 0x0}, @rand_addr=' \x01\x00', 0x700, 0x7800, 0x4, 0x101}}) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f00000022c0)=0x7fffffff) accept$phonet_pipe(r1, 0x0, 0x0) connect$phonet_pipe(r1, &(0x7f0000000040)={0x23, 0x7, 0x1, 0x6}, 0x10) read$FUSE(0xffffffffffffffff, &(0x7f0000000080)={0x2020}, 0x2020) [ 2141.015389][T28219] binder: 28216:28219 ioctl c0306201 20001140 returned -22 02:35:43 executing program 1: sendmsg$RDMA_NLDEV_CMD_PORT_GET(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000240)={&(0x7f0000000100)={0x20, 0x1405, 0x1, 0x70bd2b, 0x25dfdbfc, "", [{{0x8, 0x1, 0x1}, {0x8, 0x3, 0x1}}]}, 0x20}, 0x1, 0x0, 0x0, 0x40008c4}, 0x800) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {&(0x7f0000000000), 0x3, 0xffffffffffffffff, 0x1c, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) 02:35:43 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) [ 2141.126500][T28225] binder: 28221:28225 ioctl 40046210 0 returned -22 02:35:43 executing program 2: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) syz_open_dev$binderN(0xfffffffffffffffe, 0x0, 0x800) syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) 02:35:43 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [@GTPA_FLOW={0x6}]}, 0x1c}}, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f0000000200)='gtp\x00') [ 2141.169507][T28225] binder: 28221:28225 ioctl c0306201 20001140 returned -11 [ 2141.194046][T28229] binder: 28224:28229 ioctl 541b 0 returned -22 02:35:43 executing program 1: sendmsg$RDMA_NLDEV_CMD_PORT_GET(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000240)={&(0x7f0000000100)={0x20, 0x1405, 0x1, 0x70bd2b, 0x25dfdbfc, "", [{{0x8, 0x1, 0x1}, {0x8, 0x3, 0x1}}]}, 0x20}, 0x1, 0x0, 0x0, 0x40008c4}, 0x800) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {&(0x7f0000000000), 0x3, 0xffffffffffffffff, 0x1c, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) 02:35:43 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) r1 = socket$phonet_pipe(0x23, 0x5, 0x2) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r2, 0x89f4, &(0x7f0000002180)={'sit0\x00', &(0x7f0000002100)={'ip6_vti0\x00', 0x0, 0x29, 0x3, 0x1, 0x7, 0x14, @initdev={0xfe, 0x88, [], 0x0, 0x0}, @rand_addr=' \x01\x00', 0x700, 0x7800, 0x4, 0x101}}) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f00000022c0)=0x7fffffff) accept$phonet_pipe(r1, 0x0, 0x0) connect$phonet_pipe(r1, &(0x7f0000000040)={0x23, 0x7, 0x1, 0x6}, 0x10) read$FUSE(0xffffffffffffffff, &(0x7f0000000080)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_BMAP(r0, &(0x7f00000020c0)={0x18, 0x0, r3, {0x8}}, 0x18) 02:35:43 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) r1 = socket$phonet_pipe(0x23, 0x5, 0x2) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r2, 0x89f4, &(0x7f0000002180)={'sit0\x00', &(0x7f0000002100)={'ip6_vti0\x00', 0x0, 0x29, 0x3, 0x1, 0x7, 0x14, @initdev={0xfe, 0x88, [], 0x0, 0x0}, @rand_addr=' \x01\x00', 0x700, 0x7800, 0x4, 0x101}}) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f00000022c0)=0x7fffffff) accept$phonet_pipe(r1, 0x0, 0x0) connect$phonet_pipe(r1, &(0x7f0000000040)={0x23, 0x7, 0x1, 0x6}, 0x10) [ 2141.310818][T28233] binder: 28232:28233 ioctl 40046210 0 returned -22 [ 2141.349778][T28233] binder: 28232:28233 unknown command 0 [ 2141.386253][T28233] binder: 28232:28233 ioctl c0306201 20001140 returned -22 02:35:43 executing program 2: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) syz_open_dev$binderN(0xfffffffffffffffe, 0x0, 0x800) 02:35:43 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f0000000200)='gtp\x00') 02:35:43 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) [ 2141.495698][T28242] binder: 28240:28242 ioctl 541b 0 returned -22 02:35:43 executing program 1: sendmsg$RDMA_NLDEV_CMD_PORT_GET(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000240)={&(0x7f0000000100)={0x20, 0x1405, 0x1, 0x70bd2b, 0x25dfdbfc, "", [{{0x8, 0x1, 0x1}, {0x8, 0x3, 0x1}}]}, 0x20}, 0x1, 0x0, 0x0, 0x40008c4}, 0x800) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {&(0x7f0000000000), 0x3, 0xffffffffffffffff, 0x1c, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) 02:35:43 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) r1 = socket$phonet_pipe(0x23, 0x5, 0x2) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r2, 0x89f4, &(0x7f0000002180)={'sit0\x00', &(0x7f0000002100)={'ip6_vti0\x00', 0x0, 0x29, 0x3, 0x1, 0x7, 0x14, @initdev={0xfe, 0x88, [], 0x0, 0x0}, @rand_addr=' \x01\x00', 0x700, 0x7800, 0x4, 0x101}}) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f00000022c0)=0x7fffffff) accept$phonet_pipe(r1, 0x0, 0x0) 02:35:43 executing program 2: syz_open_dev$binderN(0xfffffffffffffffe, 0x0, 0x800) 02:35:43 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [@GTPA_FLOW={0x6}]}, 0x1c}}, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f0000000200)='gtp\x00') [ 2141.664640][T28251] binder: 28248:28251 ioctl 40046210 0 returned -22 02:35:43 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {&(0x7f0000000000), 0x3, 0xffffffffffffffff, 0x1c, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) 02:35:43 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f0000000200)='gtp\x00') [ 2141.718855][T28255] binder: 28248:28255 unknown command 0 [ 2141.748889][T28255] binder: 28248:28255 ioctl c0306201 20001140 returned -22 [ 2141.780050][T28259] binder: 28256:28259 ioctl 541b 0 returned -22 02:35:43 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="0b6300000e3cd7197d5f92c2c41f212ce79be7eaadd19a3fd1521192bf82"], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) 02:35:43 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [@GTPA_FLOW={0x6}]}, 0x1c}}, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f0000000200)='gtp\x00') 02:35:43 executing program 2: syz_open_dev$binderN(0xfffffffffffffffe, 0x0, 0x0) 02:35:43 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) socket$phonet_pipe(0x23, 0x5, 0x2) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r1, 0x89f4, &(0x7f0000002180)={'sit0\x00', &(0x7f0000002100)={'ip6_vti0\x00', 0x0, 0x29, 0x3, 0x1, 0x7, 0x14, @initdev={0xfe, 0x88, [], 0x0, 0x0}, @rand_addr=' \x01\x00', 0x700, 0x7800, 0x4, 0x101}}) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f00000022c0)=0x7fffffff) 02:35:44 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {&(0x7f0000000000), 0x3, 0xffffffffffffffff, 0x1c, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) 02:35:44 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f0000000200)='gtp\x00') [ 2142.007718][T28270] binder: 28267:28270 ioctl 40046210 0 returned -22 [ 2142.041684][T28270] binder: 28267:28270 ioctl c0306201 20001140 returned -11 [ 2142.052448][T28273] binder: 28269:28273 ioctl 541b 0 returned -22 02:35:44 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [@GTPA_FLOW={0x6}]}, 0x1c}}, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f0000000200)='gtp\x00') 02:35:44 executing program 2: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) syz_open_dev$binderN(0xfffffffffffffffe, 0x0, 0x800) syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) 02:35:44 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) 02:35:44 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) socket$phonet_pipe(0x23, 0x5, 0x2) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r1, 0x89f4, &(0x7f0000002180)={'sit0\x00', &(0x7f0000002100)={'ip6_vti0\x00', 0x0, 0x29, 0x3, 0x1, 0x7, 0x14, @initdev={0xfe, 0x88, [], 0x0, 0x0}, @rand_addr=' \x01\x00', 0x700, 0x7800, 0x4, 0x101}}) 02:35:44 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0}}, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f0000000200)='gtp\x00') 02:35:44 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {&(0x7f0000000000), 0x3, 0xffffffffffffffff, 0x1c, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) 02:35:44 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="0b6300000e3cd7197d5f92c2c41f212ce79be7eaadd19a3fd1521192bf82e360a5b77b432f4fb1f10c62af17f4013c4595d747b3a1975334d9b945ca"], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) 02:35:44 executing program 3: socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f0000000200)='gtp\x00') [ 2142.334645][T28288] binder: 28283:28288 ioctl 40046210 0 returned -22 [ 2142.372454][T28288] binder: 28283:28288 unknown command 0 [ 2142.374980][T28289] binder: 28285:28289 ioctl 541b 0 returned -22 02:35:44 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0}}, 0x0) syz_genetlink_get_family_id$gtp(&(0x7f0000000200)='gtp\x00') 02:35:44 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) socket$phonet_pipe(0x23, 0x5, 0x2) ioctl$sock_ipv6_tunnel_SIOCGETPRL(0xffffffffffffffff, 0x89f4, &(0x7f0000002180)={'sit0\x00', &(0x7f0000002100)={'ip6_vti0\x00', 0x0, 0x29, 0x3, 0x1, 0x7, 0x14, @initdev={0xfe, 0x88, [], 0x0, 0x0}, @rand_addr=' \x01\x00', 0x700, 0x7800, 0x4, 0x101}}) [ 2142.426111][T28288] binder: 28283:28288 ioctl c0306201 20001140 returned -22 02:35:44 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {&(0x7f0000000000), 0x3, 0xffffffffffffffff, 0x1c, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) 02:35:44 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) [ 2142.555913][T28297] binder: 28293:28297 ioctl 40046210 0 returned -22 [ 2142.576472][T28297] binder: 28293:28297 ioctl c0306201 20001140 returned -11 02:35:44 executing program 3: socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f0000000200)='gtp\x00') [ 2142.622582][T28300] binder: 28294:28300 ioctl 541b 0 returned -22 02:35:44 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0}}, 0x0) syz_genetlink_get_family_id$gtp(0x0) 02:35:44 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="0b6300000e3cd7197d5f92c2c41f212ce79be7eaadd19a3fd1521192bf82e360a5b77b432f4fb1f10c62af17f4013c4595d747b3a1975334d9b945ca"], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) 02:35:44 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) socket$phonet_pipe(0x23, 0x5, 0x2) ioctl$sock_ipv6_tunnel_SIOCGETPRL(0xffffffffffffffff, 0x89f4, &(0x7f0000002180)={'sit0\x00', &(0x7f0000002100)={'ip6_vti0\x00', 0x0, 0x29, 0x3, 0x1, 0x7, 0x14, @initdev={0xfe, 0x88, [], 0x0, 0x0}, @rand_addr=' \x01\x00', 0x700, 0x7800, 0x4, 0x101}}) [ 2142.734063][T28304] binder: 28302:28304 ioctl 40046210 0 returned -22 02:35:44 executing program 1: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {&(0x7f0000000000), 0x3, 0xffffffffffffffff, 0x1c, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) [ 2142.785985][T28304] binder: 28302:28304 unknown command 0 [ 2142.817158][T28304] binder: 28302:28304 ioctl c0306201 20001140 returned -22 02:35:44 executing program 3: socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f0000000200)='gtp\x00') [ 2142.879067][T28312] binder: 28308:28312 ioctl 40046210 0 returned -22 [ 2142.917909][T28313] binder: 28311:28313 ioctl 541b 0 returned -22 02:35:45 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) [ 2142.934789][T28312] binder: 28308:28312 ioctl c0306201 20001140 returned -11 02:35:45 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0}}, 0x0) syz_genetlink_get_family_id$gtp(0x0) 02:35:45 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="0b6300000e3cd7197d5f92c2c41f212ce79be7eaadd19a3fd1521192bf82e360a5b77b432f4fb1f10c62af17f4013c4595d747b3a1975334d9b945ca"], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) 02:35:45 executing program 1: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {&(0x7f0000000000), 0x3, 0xffffffffffffffff, 0x1c, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) 02:35:45 executing program 3: sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [@GTPA_FLOW={0x6}]}, 0x1c}}, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f0000000200)='gtp\x00') 02:35:45 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) socket$phonet_pipe(0x23, 0x5, 0x2) ioctl$sock_ipv6_tunnel_SIOCGETPRL(0xffffffffffffffff, 0x89f4, &(0x7f0000002180)={'sit0\x00', &(0x7f0000002100)={'ip6_vti0\x00', 0x0, 0x29, 0x3, 0x1, 0x7, 0x14, @initdev={0xfe, 0x88, [], 0x0, 0x0}, @rand_addr=' \x01\x00', 0x700, 0x7800, 0x4, 0x101}}) 02:35:45 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0}}, 0x0) syz_genetlink_get_family_id$gtp(0x0) [ 2143.131775][T28321] binder: 28319:28321 ioctl 40046210 0 returned -22 [ 2143.165966][T28321] binder: 28319:28321 unknown command 0 [ 2143.191537][T28321] binder: 28319:28321 ioctl c0306201 20001140 returned -22 [ 2143.209279][T28328] binder: 28323:28328 ioctl 40046210 0 returned -22 02:35:45 executing program 3: sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [@GTPA_FLOW={0x6}]}, 0x1c}}, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f0000000200)='gtp\x00') 02:35:45 executing program 1: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {&(0x7f0000000000), 0x3, 0xffffffffffffffff, 0x1c, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) [ 2143.238694][T28328] binder: 28323:28328 ioctl c0306201 20001140 returned -11 [ 2143.251222][T28330] binder: 28329:28330 ioctl 541b 0 returned -22 02:35:45 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="0b6300000e3cd7197d5f92c2c41f21"], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) 02:35:45 executing program 2: sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [@GTPA_FLOW={0x6}]}, 0x1c}}, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f0000000200)='gtp\x00') 02:35:45 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r1, 0x89f4, &(0x7f0000002180)={'sit0\x00', &(0x7f0000002100)={'ip6_vti0\x00', 0x0, 0x29, 0x3, 0x1, 0x7, 0x14, @initdev={0xfe, 0x88, [], 0x0, 0x0}, @rand_addr=' \x01\x00', 0x700, 0x7800, 0x4, 0x101}}) 02:35:45 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0}}, 0x0) syz_genetlink_get_family_id$gtp(0x0) [ 2143.392952][T28336] binder: 28335:28336 ioctl 40046210 0 returned -22 [ 2143.402410][T28336] binder: 28335:28336 ioctl c0306201 20001140 returned -11 02:35:45 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="0b6300000e3cd7197d5f92c2c41f21"], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) 02:35:45 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, 0x0, 0x0) 02:35:45 executing program 3: sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [@GTPA_FLOW={0x6}]}, 0x1c}}, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f0000000200)='gtp\x00') [ 2143.518602][T28342] binder: 28339:28342 ioctl 541b 0 returned -22 02:35:45 executing program 5: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r0, 0x89f4, &(0x7f0000002180)={'sit0\x00', &(0x7f0000002100)={'ip6_vti0\x00', 0x0, 0x29, 0x3, 0x1, 0x7, 0x14, @initdev={0xfe, 0x88, [], 0x0, 0x0}, @rand_addr=' \x01\x00', 0x700, 0x7800, 0x4, 0x101}}) 02:35:45 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="0b6300000e3cd7197d5f92c2c41f21"], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) 02:35:45 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) socket$phonet_pipe(0x23, 0x5, 0x2) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r1, 0x89f4, &(0x7f0000002180)={'sit0\x00', &(0x7f0000002100)={'ip6_vti0\x00', 0x0, 0x29, 0x3, 0x1, 0x7, 0x14, @initdev={0xfe, 0x88, [], 0x0, 0x0}, @rand_addr=' \x01\x00', 0x700, 0x7800, 0x4, 0x101}}) [ 2143.686733][T28349] binder: 28345:28349 ioctl 40046210 0 returned -22 [ 2143.697044][T28349] binder: 28345:28349 ioctl c0306201 20001140 returned -11 02:35:45 executing program 3: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [@GTPA_FLOW={0x6}]}, 0x1c}}, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f0000000200)='gtp\x00') 02:35:45 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) 02:35:45 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, 0x0, 0x0) 02:35:45 executing program 5: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r0, 0x89f4, &(0x7f0000002180)={'sit0\x00', &(0x7f0000002100)={'ip6_vti0\x00', 0x0, 0x29, 0x3, 0x1, 0x7, 0x14, @initdev={0xfe, 0x88, [], 0x0, 0x0}, @rand_addr=' \x01\x00', 0x700, 0x7800, 0x4, 0x101}}) [ 2143.838279][T28356] binder: 28354:28356 ioctl 541b 0 returned -22 [ 2143.862546][T28359] binder: 28355:28359 ioctl 40046210 0 returned -22 02:35:46 executing program 3: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [@GTPA_FLOW={0x6}]}, 0x1c}}, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f0000000200)='gtp\x00') 02:35:46 executing program 4: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r0, 0x89f4, &(0x7f0000002180)={'sit0\x00', &(0x7f0000002100)={'ip6_vti0\x00', 0x0, 0x29, 0x3, 0x1, 0x7, 0x14, @initdev={0xfe, 0x88, [], 0x0, 0x0}, @rand_addr=' \x01\x00', 0x700, 0x7800, 0x4, 0x101}}) [ 2143.958926][T28365] binder: 28362:28365 ioctl 40046210 0 returned -22 02:35:46 executing program 2: sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [@GTPA_FLOW={0x6}]}, 0x1c}}, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f0000000200)='gtp\x00') [ 2144.001931][T28365] binder: 28362:28365 unknown command 0 02:35:46 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, 0x0, 0x0) [ 2144.044834][T28365] binder: 28362:28365 ioctl c0306201 20001140 returned -22 02:35:46 executing program 5: socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCGETPRL(0xffffffffffffffff, 0x89f4, &(0x7f0000002180)={'sit0\x00', &(0x7f0000002100)={'ip6_vti0\x00', 0x0, 0x29, 0x3, 0x1, 0x7, 0x14, @initdev={0xfe, 0x88, [], 0x0, 0x0}, @rand_addr=' \x01\x00', 0x700, 0x7800, 0x4, 0x101}}) 02:35:46 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) 02:35:46 executing program 3: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [@GTPA_FLOW={0x6}]}, 0x1c}}, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f0000000200)='gtp\x00') 02:35:46 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="0b6300000e3cd7197d5f92c2c41f212ce79be7eaadd19a3fd1521192bf82e360a5b77b432f4fb1f10c62af17f4013c4595d747b3a1975334d9b945ca"], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) 02:35:46 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {0x0, 0x3, 0xffffffffffffffff, 0x1c, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) 02:35:46 executing program 2: sendmsg$RDMA_NLDEV_CMD_PORT_GET(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000240)={&(0x7f0000000100)={0x20, 0x1405, 0x1, 0x70bd2b, 0x25dfdbfc, "", [{{0x8, 0x1, 0x1}, {0x8, 0x3, 0x1}}]}, 0x20}, 0x1, 0x0, 0x0, 0x40008c4}, 0x800) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000480)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x10, 0x0, @in={0x2, 0x0, @multicast2}}}, 0x90) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {&(0x7f0000000000), 0x3, r1, 0x1c, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) 02:35:46 executing program 5: socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCGETPRL(0xffffffffffffffff, 0x89f4, &(0x7f0000002180)={'sit0\x00', &(0x7f0000002100)={'ip6_vti0\x00', 0x0, 0x29, 0x3, 0x1, 0x7, 0x14, @initdev={0xfe, 0x88, [], 0x0, 0x0}, @rand_addr=' \x01\x00', 0x700, 0x7800, 0x4, 0x101}}) [ 2144.330912][T28382] binder: 28379:28382 ioctl 40046210 0 returned -22 [ 2144.344669][T28382] binder: 28379:28382 unknown command 0 [ 2144.364130][T28382] binder: 28379:28382 ioctl c0306201 20001140 returned -22 02:35:46 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_DELPDP(r0, 0x0, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f0000000200)='gtp\x00') 02:35:46 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) [ 2144.436806][T28386] binder: 28385:28386 ioctl 40046210 0 returned -22 [ 2144.448961][T28386] binder: 28385:28386 ioctl c0306201 20001140 returned -11 02:35:46 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {0x0, 0x0, 0xffffffffffffffff, 0x1c, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) 02:35:46 executing program 4: sendmsg$RDMA_NLDEV_CMD_PORT_GET(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000240)={&(0x7f0000000100)={0x20, 0x1405, 0x1, 0x70bd2b, 0x25dfdbfc, "", [{{0x8, 0x1, 0x1}, {0x8, 0x3, 0x1}}]}, 0x20}, 0x1, 0x0, 0x0, 0x40008c4}, 0x800) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000480)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x10, 0x0, @in={0x2, 0x0, @multicast2}}}, 0x90) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {&(0x7f0000000000), 0x3, r1, 0x1c, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) 02:35:46 executing program 2: getuid() r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x404) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r1, 0x4b6b, 0x0) ioctl$FIONREAD(r1, 0x541b, &(0x7f0000000040)) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) 02:35:46 executing program 5: socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCGETPRL(0xffffffffffffffff, 0x89f4, &(0x7f0000002180)={'sit0\x00', &(0x7f0000002100)={'ip6_vti0\x00', 0x0, 0x29, 0x3, 0x1, 0x7, 0x14, @initdev={0xfe, 0x88, [], 0x0, 0x0}, @rand_addr=' \x01\x00', 0x700, 0x7800, 0x4, 0x101}}) 02:35:46 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {0x0, 0x0, 0xffffffffffffffff, 0x0, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) 02:35:46 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_DELPDP(r0, 0x0, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f0000000200)='gtp\x00') 02:35:46 executing program 4: getuid() r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x404) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r1, 0x4b6b, 0x0) ioctl$FIONREAD(r1, 0x541b, &(0x7f0000000040)) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) [ 2144.737428][T28400] binder: 28396:28400 ioctl 40046210 0 returned -22 [ 2144.778506][T28400] binder: 28396:28400 unknown command 0 02:35:46 executing program 5: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r0, 0x89f4, 0x0) [ 2144.828235][T28400] binder: 28396:28400 ioctl c0306201 20001140 returned -22 [ 2144.863983][T28407] binder: 28403:28407 ioctl 541b 0 returned -22 02:35:47 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {0x0, 0x0, 0xffffffffffffffff, 0x0, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) [ 2144.921803][T28410] binder: 28408:28410 ioctl 541b 0 returned -22 [ 2144.934000][T28413] binder: BINDER_SET_CONTEXT_MGR already set 02:35:47 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="0b6300000e3cd719"], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) 02:35:47 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_DELPDP(r0, 0x0, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f0000000200)='gtp\x00') [ 2144.974800][T28410] binder: BINDER_SET_CONTEXT_MGR already set [ 2144.975248][T28413] binder: 28403:28413 ioctl 40046207 0 returned -16 [ 2145.006593][T28410] binder: 28408:28410 ioctl 40046207 0 returned -16 02:35:47 executing program 5: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r0, 0x89f4, 0x0) 02:35:47 executing program 4: getuid() r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x404) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r1, 0x4b6b, 0x0) ioctl$FIONREAD(r1, 0x541b, &(0x7f0000000040)) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) 02:35:47 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {0x0, 0x0, 0xffffffffffffffff, 0x0, 0x1, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) 02:35:47 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) [ 2145.119826][T28419] binder: 28416:28419 ioctl 40046210 0 returned -22 [ 2145.151651][T28419] binder: 28416:28419 ioctl c0306201 20001140 returned -11 02:35:47 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f0000000200)='gtp\x00') 02:35:47 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB='\v'], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) [ 2145.287414][T28425] binder: 28422:28425 ioctl 541b 0 returned -22 [ 2145.315081][T28425] binder: BINDER_SET_CONTEXT_MGR already set 02:35:47 executing program 5: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r0, 0x89f4, 0x0) [ 2145.342830][T28425] binder: 28422:28425 ioctl 40046207 0 returned -16 [ 2145.355133][T28430] binder: 28426:28430 ioctl 40046210 0 returned -22 02:35:47 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {0x0, 0x0, 0xffffffffffffffff, 0x1c, 0x0, @in6={0xa, 0x4e22, 0xffff, @empty, 0x8}}}, 0xa0) [ 2145.404801][T28430] binder: 28426:28430 unknown command 0 [ 2145.442119][T28430] binder: 28426:28430 ioctl c0306201 20001140 returned -22 02:35:47 executing program 4: getuid() r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x404) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r1, 0x4b6b, 0x0) ioctl$FIONREAD(r1, 0x541b, &(0x7f0000000040)) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) 02:35:47 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f0000000200)='gtp\x00') [ 2145.470950][T28435] binder: 28432:28435 ioctl 40046210 0 returned -22 02:35:47 executing program 5: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r0, 0x89f4, &(0x7f0000002180)={'sit0\x00', 0x0}) [ 2145.520347][T28435] binder: 28432:28435 unknown command 11 02:35:47 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {0x0, 0x0, 0xffffffffffffffff, 0x1c, 0x0, @in6={0xa, 0x0, 0xffff, @empty, 0x8}}}, 0xa0) [ 2145.580359][T28435] binder: 28432:28435 ioctl c0306201 20001140 returned -22 02:35:47 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="0b6300000e3cd719"], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) 02:35:47 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB='\v'], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) 02:35:47 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f0000000200)='gtp\x00') [ 2145.709825][T28443] binder: 28439:28443 ioctl 541b 0 returned -22 [ 2145.755582][T28443] binder: BINDER_SET_CONTEXT_MGR already set [ 2145.790108][T28443] binder: 28439:28443 ioctl 40046207 0 returned -16 02:35:47 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {0x0, 0x0, 0xffffffffffffffff, 0x1c, 0x0, @in6={0xa, 0x0, 0x0, @empty, 0x8}}}, 0xa0) 02:35:47 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f0000000200)='gtp\x00') [ 2145.836149][T28452] binder: 28449:28452 ioctl 40046210 0 returned -22 [ 2145.837700][T28451] binder: 28448:28451 ioctl 40046210 0 returned -22 [ 2145.856039][T28452] binder: 28449:28452 unknown command 11 02:35:48 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0}}, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f0000000200)='gtp\x00') 02:35:48 executing program 4: getuid() r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x404) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r1, 0x4b6b, 0x0) ioctl$FIONREAD(r1, 0x541b, &(0x7f0000000040)) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) [ 2145.902361][T28452] binder: 28449:28452 ioctl c0306201 20001140 returned -22 02:35:48 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r1, 0x4b6b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000480)={0xc0, 0x0, &(0x7f00000006c0)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x18, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000340)=ANY=[@ANYBLOB="853a6e3580000000d98a2bec3246dd7a3d919de9075f0bd29b4f6fe6e5bf9c2587cc7716a2af6afdd006908fbdd6567ec287ab28df324e4fbba3955023901445200763c2634fcc06bd8a", @ANYRESHEX=r1, @ANYBLOB="0000000000000000000000008561646600000000050000000000000000000000000000003400000000000000852a646600000000", @ANYRES32=r0, @ANYBLOB='\x00'/12], &(0x7f00000000c0)={0x0, 0x18, 0x38}}}, @reply={0x40406301, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000040)={@ptr={0x70742a85, 0x0, &(0x7f0000000600)=""/146, 0x92}, @flat=@weak_handle={0x77682a85, 0x100, 0x2}, @ptr={0x70742a85, 0x0, &(0x7f0000000100)=""/186, 0xba, 0x0, 0x2f}}, &(0x7f0000000240)={0x0, 0x28, 0x40}}}, @clear_death={0x400c630f, 0x1}, @release={0x40046306, 0x2}, @enter_looper, @exit_looper, @release={0x40046306, 0x1}, @increfs={0x40046304, 0x2}], 0x31, 0x0, &(0x7f0000000440)="fc85e0215d6652a05313789768c56f3884d91d1e7cb74e94abbbc09a8880fe31df0a3b77e07c532e228e83dda0282b8aec"}) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r2, 0xc0405519, 0x0) ioctl$SNDRV_CTL_IOCTL_PVERSION(r2, 0x80045500, &(0x7f00000004c0)) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) ioctl$KDSKBLED(r2, 0x4b65, 0x6) 02:35:48 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB='\v'], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) 02:35:48 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {0x0, 0x0, 0xffffffffffffffff, 0x1c, 0x0, @in6={0xa, 0x0, 0x0, @empty}}}, 0xa0) 02:35:48 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) r1 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCSLCKTRMIOS(r1, 0x5457, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x802) r3 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000100)='/proc/capi/capi20\x00', 0x40, 0x0) ioctl$GIO_CMAP(r3, 0x4b70, &(0x7f0000000140)) ioctl$BINDER_THREAD_EXIT(r2, 0x40046208, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x3) ioctl$VT_RESIZE(r4, 0x5609, &(0x7f00000000c0)={0x2, 0x7, 0x401}) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f0000000080)=0x2) 02:35:48 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0}}, 0x0) syz_genetlink_get_family_id$gtp(&(0x7f0000000200)='gtp\x00') [ 2146.147310][T28464] binder: 28460:28464 ioctl 541b 0 returned -22 [ 2146.171225][T28464] binder: BINDER_SET_CONTEXT_MGR already set [ 2146.178434][T28467] binder: 28462:28467 ioctl 40046210 0 returned -22 [ 2146.193518][T28464] binder: 28460:28464 ioctl 40046207 0 returned -16 [ 2146.210007][T28467] binder: 28462:28467 unknown command 11 [ 2146.221330][T28469] binder: 28465:28469 ioctl 541b 0 returned -22 [ 2146.233979][T28470] binder: 28468:28470 ioctl 40046210 0 returned -22 02:35:48 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) [ 2146.244192][T28467] binder: 28462:28467 ioctl c0306201 20001140 returned -22 02:35:48 executing program 2: bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x1d, 0x3, &(0x7f0000000080)=@raw=[@generic={0xb0, 0x0, 0x8, 0x1ff, 0x6}, @btf_id={0x18, 0x4, 0x3, 0x0, 0x1}], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0xa4, &(0x7f0000000100)=""/164, 0x41100, 0x12, [], 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000280)={0x5, 0x1}, 0x8, 0x10, &(0x7f00000002c0)={0x2, 0x1, 0x3ff, 0x10001}, 0x10, 0xffffffffffffffff}, 0x78) 02:35:48 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) clock_gettime(0x0, &(0x7f0000000000)={0x0, 0x0}) ioctl$vim2m_VIDIOC_PREPARE_BUF(r1, 0xc058565d, &(0x7f0000000180)={0x9, 0x3, 0x4, 0x8, 0x81, {r2, r3/1000+60000}, {0x4, 0x1, 0x20, 0x79, 0x9, 0x30, "5826151f"}, 0x4ffffffc, 0x4, @planes=&(0x7f0000000040)={0x40546ecc, 0x4, @mem_offset=0x5f63, 0x8b6}, 0x8, 0x0, r0}) clock_gettime(0x7, &(0x7f0000000100)) ioctl$TIOCSTI(r0, 0x5421, 0x400000) 02:35:48 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="0b6300000e"], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) 02:35:48 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) r1 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCSLCKTRMIOS(r1, 0x5457, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x802) r3 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000100)='/proc/capi/capi20\x00', 0x40, 0x0) ioctl$GIO_CMAP(r3, 0x4b70, &(0x7f0000000140)) ioctl$BINDER_THREAD_EXIT(r2, 0x40046208, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x3) ioctl$VT_RESIZE(r4, 0x5609, &(0x7f00000000c0)={0x2, 0x7, 0x401}) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f0000000080)=0x2) 02:35:48 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0}}, 0x0) syz_genetlink_get_family_id$gtp(0x0) [ 2146.445365][T28476] binder: 28474:28476 ioctl 40046210 0 returned -22 [ 2146.528309][T28483] binder: 28479:28483 ioctl 40046210 0 returned -22 [ 2146.562076][T28483] binder: 28479:28483 ioctl c0306201 20001140 returned -11 02:35:48 executing program 1: socketpair(0x0, 0x3, 0x4, &(0x7f0000003ac0)) 02:35:48 executing program 2: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x50, 0x0, &(0x7f0000000200)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000180)={@flat=@weak_binder={0x77622a85, 0x1000, 0x3}, @flat=@weak_handle={0x77682a85, 0xa, 0x3}, @fda={0x66646185, 0x2, 0x2, 0x3e}}, &(0x7f0000000080)={0x0, 0x18, 0x30}}, 0x40}, @register_looper], 0x95, 0x0, &(0x7f0000000280)="7b02812b2dc89f3d1c5de7a78609435592af262956c018be1e55e75e524960453f6bdb93070e575414b4be70a6aecc114e0ca8826da2dc25225e217673c0fb2278a7eafc470875ad3e3473429ac4cc641e76c7658dce7f41989b0f6dbda85fa8d0f96dd055d792b3c83a8384fbd059e16dd81387ca21b3665728ca251a6f85364b813e8efca3c9ad8dbbf5151e30875a59ccaef370"}) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r2, 0xc0405519, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(0xffffffffffffffff, 0x40405515, &(0x7f00000000c0)={0x2, 0x2, 0x9, 0x8, 'syz1\x00', 0x7fffffff}) syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_SET_MAX_THREADS(0xffffffffffffffff, 0x40046210, 0x0) 02:35:48 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) clock_gettime(0x0, &(0x7f0000000000)={0x0, 0x0}) ioctl$vim2m_VIDIOC_PREPARE_BUF(r1, 0xc058565d, &(0x7f0000000180)={0x9, 0x3, 0x4, 0x8, 0x81, {r2, r3/1000+60000}, {0x4, 0x1, 0x20, 0x79, 0x9, 0x30, "5826151f"}, 0x4ffffffc, 0x4, @planes=&(0x7f0000000040)={0x40546ecc, 0x4, @mem_offset=0x5f63, 0x8b6}, 0x8, 0x0, r0}) clock_gettime(0x7, &(0x7f0000000100)) ioctl$TIOCSTI(r0, 0x5421, 0x400000) [ 2146.595718][T28486] binder: 28484:28486 ioctl 40046210 0 returned -22 02:35:48 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0}}, 0x0) syz_genetlink_get_family_id$gtp(0x0) 02:35:48 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB='\vc'], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) [ 2146.752802][T28490] binder: 28487:28490 ioctl c0306201 0 returned -14 02:35:48 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) setsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x67, &(0x7f0000000040)=0x1, 0x4) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) [ 2146.800985][T28490] binder: 28487:28490 ioctl c0306201 0 returned -14 02:35:48 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) setsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0x67, &(0x7f0000000040)=0x1, 0x4) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) 02:35:48 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) clock_gettime(0x0, &(0x7f0000000000)={0x0, 0x0}) ioctl$vim2m_VIDIOC_PREPARE_BUF(r1, 0xc058565d, &(0x7f0000000180)={0x9, 0x3, 0x4, 0x8, 0x81, {r2, r3/1000+60000}, {0x4, 0x1, 0x20, 0x79, 0x9, 0x30, "5826151f"}, 0x4ffffffc, 0x4, @planes=&(0x7f0000000040)={0x40546ecc, 0x4, @mem_offset=0x5f63, 0x8b6}, 0x8, 0x0, r0}) clock_gettime(0x7, &(0x7f0000000100)) ioctl$TIOCSTI(r0, 0x5421, 0x400000) [ 2146.879616][T28498] binder: 28496:28498 ioctl 40046210 0 returned -22 02:35:49 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0}}, 0x0) syz_genetlink_get_family_id$gtp(0x0) 02:35:49 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r1, 0x40405515, &(0x7f0000000100)={0x5, 0x5, 0x7, 0x4, 'syz1\x00', 0x81}) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) r2 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x1800) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r2, 0xc018620c, &(0x7f0000000080)) [ 2146.925521][T28498] binder: 28496:28498 ioctl c0306201 20001140 returned -11 [ 2146.974008][T28500] binder: 28499:28500 ioctl 541b 0 returned -22 02:35:49 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB='\v'], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) [ 2147.029215][T28505] binder: 28501:28505 ioctl 541b 0 returned -22 02:35:49 executing program 5: setrlimit(0x3, &(0x7f0000000000)={0x8001, 0x81}) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)={0x10, 0x7, 0x2, 0x4, 0x204, 0x1, 0x2, [], 0x0, 0xffffffffffffffff, 0x3, 0x1, 0x2}, 0x40) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) 02:35:49 executing program 1: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) recvmsg$can_raw(r0, &(0x7f0000000380)={&(0x7f0000000180)=@rc={0x1f, @none}, 0xfffffffffffffedc, &(0x7f0000000580)=[{&(0x7f0000000080)}, {&(0x7f00000005c0)=""/150, 0x96}, {&(0x7f00000000c0)=""/74, 0x4a}], 0x3, &(0x7f0000000280)=""/248, 0xf8}, 0x10000) ioctl$TIOCSTI(r0, 0x5421, 0x400000) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) recvmsg$can_raw(r1, &(0x7f0000000540)={&(0x7f00000003c0)=@pppoe={0x18, 0x0, {0x0, @local}}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000440)=""/210, 0xd2}], 0x1}, 0x20000002) 02:35:49 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000080)={0xffffffffffffffff}, 0x106, 0x3}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e22, 0x7fffffff, @mcast1, 0xfffffffb}, {0xa, 0x4e21, 0x7, @mcast2, 0x29bf}, r1, 0xe49}}, 0x48) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$RDMA_NLDEV_CMD_DELLINK(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYBLOB="3800000414000129bd7000ffdbdf2508000100008d110008000100020000000800010000000000e7ff00000100000088000100010000007a6f6c3318faf909a32117d496a3d64ef36400"], 0x38}, 0x1, 0x0, 0x0, 0x24000000}, 0x1) r2 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a, 0x3}) sendmsg$RDMA_NLDEV_CMD_RES_MR_GET(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x20, 0x140d, 0x303, 0x70bd28, 0x25dfdbfd, "", [@RDMA_NLDEV_ATTR_RES_MRN={0x8, 0x3e, 0x4}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x4008001) [ 2147.124929][T28508] binder: 28504:28508 ioctl c018620c 20000080 returned -1 02:35:49 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) clock_gettime(0x0, &(0x7f0000000000)={0x0, 0x0}) ioctl$vim2m_VIDIOC_PREPARE_BUF(r1, 0xc058565d, &(0x7f0000000180)={0x9, 0x3, 0x4, 0x8, 0x81, {r2, r3/1000+60000}, {0x4, 0x1, 0x20, 0x79, 0x9, 0x30, "5826151f"}, 0x4ffffffc, 0x4, @planes=&(0x7f0000000040)={0x40546ecc, 0x4, @mem_offset=0x5f63, 0x8b6}, 0x8, 0x0, r0}) clock_gettime(0x7, &(0x7f0000000100)) 02:35:49 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x1802) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(0xffffffffffffffff, 0xc0045540, &(0x7f0000000200)=0x2) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f0000000000)=0x20) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/hwrng\x00', 0x101800, 0x0) sendmsg$L2TP_CMD_NOOP(r1, &(0x7f00000001c0)={&(0x7f0000000100), 0xc, &(0x7f0000000180)={&(0x7f0000000240)={0x28, 0x0, 0x4, 0x70bd25, 0x25dfdbfb, {}, [@L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x1}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @remote}]}, 0x28}, 0x1, 0x0, 0x0, 0x44040}, 0x40000) r2 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000080)={0x2}) [ 2147.230095][T28512] binder: 28509:28512 ioctl 40046210 0 returned -22 [ 2147.247814][T28513] binder: 28510:28513 ioctl c0306201 0 returned -14 [ 2147.261644][T28512] binder: 28509:28512 unknown command 11 [ 2147.286194][T28513] binder: 28510:28513 ioctl 541b 0 returned -22 [ 2147.293781][T28512] binder: 28509:28512 ioctl c0306201 20001140 returned -22 [ 2147.313730][T28517] binder: 28515:28517 ioctl 40046210 0 returned -22 02:35:49 executing program 1: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x3) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) [ 2147.353066][T28517] binder: 28515:28517 ioctl c0306201 0 returned -14 02:35:49 executing program 5: setrlimit(0x3, &(0x7f0000000000)={0x8001, 0x81}) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)={0x10, 0x7, 0x2, 0x4, 0x204, 0x1, 0x2, [], 0x0, 0xffffffffffffffff, 0x3, 0x1, 0x2}, 0x40) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) 02:35:49 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB='\v'], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) [ 2147.418214][T28520] binder: 28518:28520 ioctl 541b 0 returned -22 02:35:49 executing program 4: openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r0, 0xc0405519, 0x0) clock_gettime(0x0, &(0x7f0000000000)) clock_gettime(0x7, &(0x7f0000000100)) 02:35:49 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_bt_hidp_HIDPCONNADD(0xffffffffffffffff, 0x400448c8, &(0x7f0000001040)={0xffffffffffffffff, r1, 0x0, 0x1000, &(0x7f0000000040)="90f60fcdc3e8b90653f86013d82492b7d4f41a15ea092718cf3a2d79e7f5d1a6deefc6b4126a3a6cbd8106d0c6ae3a4a22cc6c7ba35efe2119848d9d041fd35fc3abee77701973e4796fe9ec3ed1583af7bc3b43f2037a7deda08e1cb9aa1bcd389ebd23bc93a9bdf0de8963a18ef73e127997ad62e6dd012ec3e4d6f78c0aef7ac7b7b21eeec675113bc0826844d65203777fea15da9e09d7251946c4b59a715a3c89deeb3b0948204941ad6347523e63d8603f5d2c2b784417c2c38842393d5fee216575f4802e20af68aab204a3b1c87ef67b7e289f296e101c3188b8f5d03c68379197110b3198628687eec0134e857a3e58560ef2a233bc8b877c53a7e7c65bd746aad3a0499646b2d4f9b1c80cdd47a645a9876b6d63410c824cc3c0eb84b227fbfbcf5f8dfe78aee4080093491c6eb332939416a1eb8cf64f82694bf12cc106a214e486c9db6ea832d703e522e7903981b148601b7ce1934c7debb8c2421f0f2f884cef71da7aa6c545a2c219648fd9463087bb99d5ddc412c4fd60c61ae9b78eff08e6053b14f86f3683c29c5bb4d4d8ee156c30c3873c8d05aa4a66527a88042f6ebd3b2e435d6d194095ac3aaf497f9f360b47efb142efb19586fa5a5e8127c128ab4db366c645e7c61f7ac4083659a021d76da7e5fb6e557a30ab0af681b6bdf71f0441810372cd6739eaabf12ed800e08c59c3dc454a885864019950f38eaeb2c606aa9e2c0679ec1d512082d3fb129030b6ba5370178f50e2fd859aec3942a4bd142720ec6545d28cbf2d27f8d04b354c67f352f8e17e35cd8a851e8b097aec6e0dd7ae9e2b6f7e7851c814cf446708bfbad633ef2551dfae7619f75efc696a4eb313dcf56b710fa38cb75c35fa38af64beac08f38eba1648a1092b43ebb06bf4791bdcae8bc0fe47839386645aecfd29ff8ac9b1fc8e09e286484a2c44f161fae5a0ac737b5e5ee442228ebe7b07a9ebabdbbd601718350dce4af7d2051348f4fc267915e47ea8d49973f10ce30e9e29da11973dbed1f1b59a417cba54476796e8a8676864b22bcd332289e096905b00f7295bc8c82768d8932734d019140a29aca2048aa892da97c7dafa8f50bbda2b0a1d6d61b449b22a7d4042e848ef92bf516623fe231c3202ab7c7c156b61e1ce2b254451741e3ba2c82764b98fe15666e5ca79dae7a191835204c377e1186c8fa1c962361b7f16653eada05b7a17075155008808e8d71aeb8bbebf3c0784d5d8b1f41f5f412f31fb283fde5830ca983d63365becfc8e4d606410bc5ed680c60ddf05112b30f40cef74459928793f73c6056e33fc89ff742cc91681cbdd8d527c76c733f9f1671720266232bd46c8f61ac5258282a5b9db4e725d243d038dcfe1cad9ea8bd9e1de6eef822a800becf5a465ee09067441938e114f1654a86ab498596fe5f46e0efd921fadab8e0f054e962f3b87c9e208bd15124270b46f502052195ee5f43b3e19d4f2265b2250786727de71e4b2497a692cef85769b8969c60067376191549d4cde0ca1fe32d26281e50fad29b61fdb57254dba553dba706daf2ac210c4634006921da2f8512694de723940f569af089c6886c1809c6d0b48bd0ca971a09739ba187125abf97eac42e900d2e084a513bbf0285037aea366170030b62f3c6a315bd7e6829bc5d8c3efd4e58ea43d9baf6d5db88814dd8f81fe2d9c385d594d68adeb46c1747e3548db058f53bd9f6b000aa4d783972df6f62db5c6ce19103dbc017c579da010ed6f8148fda787764cd829610175e7856d0816f52f2fa005957d2319d65b7c5a460a649a3806e36152cdf340b4ad6c2795b8f0f972ec9b9ee117168c5f0a1575c8b8441c789273c973e413b248e4323f30efa2413976aea2843a30036e6b3fcbe3f0ffafa9cea0c6447f6a7f00968295c32e62780f6b75f1de87b4eb4c828a6f51c4991a522f4db8563dd7cd6d1832480c00bfe990a6a2aab261331aa8c8aac88c00ca9a232fa794bcca3c6595ed3a165b5f7a6e0f442355a3e0b683188d09c790f9ccfdcaaa9116defcb4aedca9fa7cde4452909d47c4bfbcb214ab0a59e48ff596d3532e25414630685439a906fd7c030a218df9afb2fece9cfc32e3b6dcc8f78e3390eb21bb159e8a1d668d14fb7791b47c614d0ed3b86b58c89da79a9e60c4e0cf1b63622b2a0509aaed30582759e79886da626c00d4c86aed1aa2e66bb2ef8cd3b61ef46f4157bc6688ea84471903979a0ef5631e4dab5153023573643d2b26940830427c22e318c8415384bfe8359888591e8fc30fd541118a2dac24929a11c592b4963457f99c9cc72ebd37f9bf7216b278372388f77012caf4c93a83c173289e5a7459eb241b8e229f1f643332530131d185c1fb3208a8490793200d79dc458a1b38fb4331fa06033d6ecac437fea9f7bfda6ef456e48fd251d4fb2011bcb78bd192b173c8581a9b6d8af6519a3d54dffc9fc5d980ea81c55e54ff7b2845f4215fda345712898d25821a657f2f0f8f64461b5d2647fa6203e928d9d33a808861eff24b6e67d8b68126bb782de2c20e6c54c0bb7993b3f5f1aea5d65ca2c39d162e1f0b6bd5d20ec59d3a1462a91d419a843805acfe5939be258b94348984e097b67dd96a25d5b354781cf8d245411bc337d14812a006329f9dcfdf06f29932c15f01f016dcc882c63899d3ba4a8a0a377e4f34156f0f29fcd14333ffb1048e8f45ec01966d0a235aae26096b7264b561140917dd26551ffc8ddfea48233202aa00714c067b9d88a9e08928e33bdc5554f59129dacae5e55386c7dd1c88d118fc260c93c5312eb2fcea841d0820d0a54832733c64d5fb72c3631753825265d8780fa43482a3bd5016b2996b5adba3b30365832fd738c80da6b28ce1f579fc0c590ed8323c22fca93fade3a5b7188c1025a9b3b208207b84c1db0a4a6dc4b5163d919507ece2e7ec9ef7ab22da66c45097c5e01eda08d205f17c79030bf0dcad2dbc3f4ea4371bbfc6d2200226e905e52da5893545c3ed725aef167dbcb3145d7e2563fb4d1c4bf362f7c429c79e7974952d5fd6b880cae224ada34cc3471e40292ced908cd2d5971381195d36974b1383f26339ade8c00d58cd13633591066de6a3912cfaf6ef9773814dc820e0ac8b203ac38022488c27b655041bc3f4016e09eb29e9237667ad1310bec19d8e9f8391344a958a3643f8a6c52507df7c486f00bd8c5f6180631d12e2c84b85d55397a9fed1a0678a4c0657a9d2a7e537212ecf3b60c660d13ecc4a147c5019f423f3cb347dcc8920b1cefb14a803b674d018e2b85a277a603b16f24cd15ce5ab199513dd576e88d663ac4bf3f7274b205ae5b071f938306395f7870ce1f9321a8040f4491a65959e991fa8efacf43da67267d51ff1f79c1e7a6f991668445f7fc280b13fe1dc8f01113ca208ce21cc8a3c90a2b439caab8b8e8f805fc105f5e089b8c561319a8fe50c94bd9e164ee6ba77e3c900ccce5e839c158575c5e5a877accaa4b8eba3cd01288e35436053baba136eeb222ada5debca53605029bf664dfe38ed59203f58339f647f5744bd73a11c2ec97e35e10295599ea7ccce907a4331aa830ad46a85b7a060abf1cd106eb8d7fe971b4ad71b0413f5e6e1d2b6e2c18c752460643b9146b7925212f298d9ea0c1f1ad8c743feb7d2adb97f31b023871a184a55f5bffc76d3fe7a0a9f53ae4a8391a4b811d9124527795fe55e5203eed35d4b33a0d170f8703ca914eed7722e27d94fcc7b56879248d9cc8b94640ccab7981088d2fa1818a23b4aa361d5081596ff124747cdbe76edaf334d2ba88790dbd35583d213d37d907f0bfa62cdf6d28eb77405b0d5d1aaa4d266dda13c37eca0a589523611924cf6f6059cf38299bdd42af008b439bf18f58a85fa6c27f2342ea89c4af8e35a27cdee00049ded06848e2765dbeaac122ecbb3e598b57a55beb4a0212db7e3cac2a3b26bba2f032180b0184d1436cf60744f13e1f9baedf11b43f8385b9c6d1fa82cc94bebfd95aae33095614e4988b1f9f3cba210d39027786e9e53646d527941b07973de86102c6cf61ad5d7b5573f5f93e6e14355252802e12d8f755879645f4c7f23328c4389241da399acfa00a2afc4bb50266507cb9522f20ecc990476396143ed748e4bd8dde299516baf4c5b532f95871b00468021aaa9dc69b6cfa4222339a22b7576c9e2768c454fbc03776974188bedf395e8771382008e6a46746bca4cc112d1dee2a95375c57a49d2300cbc8f0c6de053025b3e856ad1e4433ad0559793541b38b22fc4d15dd515a46ee8b74e4ec10992cd8f3d5389967579921ec28852fce69c35cda27ea1edfb166666d7292831a0d87ace4a55d039b704d088038456424c74a8058a2f1a6335f958e9fb8c1a75ab64e3a91c1eee818da2bb515d7323e7ce463143a7381c894670e8d2e05845426e00545e167a25a9413a0fdfc03fd7af54c4de00017948da4c747e77553360f5e86e05159a4103fee78c475a4117ce43bf3ef2d8b43ccad50f97bc49e61ac21e25b2d2f2f52def462aabc22e52aa9f276faf9004b34f61ee43c814cb9b831e017d78649c40c2c0e5212cfbe8a51e2d79c466c40f51624f7be5f2d8bd4496d85677dea9994163fe977561ead34806336e42e968985b50ccb19fa3ba287f89e5befda3c98d031a5530e9e822ff68c248b18e00655c46b2583a6c472336f12966f3381e88d5722bd0d7ff8e635d5dddc51bb439964ef83b5d8473761dc513897ec3693fa9d7ad26791246902126d8fb90b762b1e871d181f9d82ea0d18605430bd8612405e6e4c865d46d10328b854b12754590810576648e5c78a1af5ef3a138929d46e022f83ad5e5476c1dab41a11e5e8b935235abfb8f4d8699853a25e428a2d3e6b7617608a1382888d96cc25af9492f511ec90dcb04a49e6a0b561433edf44d97b1723143c4ba67a728614abfb6aa45069d8140d96fbae6c3dcc0a3f64492818ffbe7015f2ee87f5b2c3900310b66a14fbb8b3292cfade3d0b51968d02233b4c30b124238ba828043c5de6122b45a34c686401a486a113360519718f4af3c47767878df4740c380e0b2ee83b33c37d21ac7db4b37a61aaa2f9b1fec6a4aa66eb795d5d4630c42c8ad47725da7dd9afc1c6e6da80bfc8fb7b578d87426bd9a4a304126c45a186f52c0be930e573ff27496f1a76485b561ead4760ab5ad7db34ec05ecc5b479e4660492ab2e34ae38506454b6a51129d0bdfa05518375b16c9c26e3c6f539a7d1cf041ebe3ae48cbf6e9052a5e999391e7a8105bb9c5089c674a83af3544337546dfae4acc96ece241b92b98b3ec7a1d112ee61f7d94abb59f194b1b37c244d757462d1e1dd7723903d07367b023cc343e803ba51354c35031187442b1b822d9fa59a6fe07c308f891e245c7be61a326fd4b950f61617f2431d39963c602da2d8b3e2f48f7b5466e74a20b85c9da2ec225b6589df7855b0ab3167bb4093f49cf1b7c9402e32520d88c90d64ff026a114abe682d6c7fb4265da3dc5aa7187fe3be578d9b5e19bbdd84c9baf8c88d81d9484b676f7b0bd744a7810fc6c63d3355db5ef4e31d3e77bc832ede50f5707b9cb11bd7d0f3d3b620d4dc5b01cf890cb25e49b00c62e14c813787babdf0df04d73abbdc1c7f026b9212c1aefeb0e27fe68fff7db9ce005d77ee2f8cb892699d28feee88e0c3e6dce7e7f87994d90edc25f657e4b91601eb20940326b81c73252915df0cb684402ff140cea87d5deb9c5055dc759a8686d4d0d80", 0x8, 0x3f, 0x4, 0x9, 0x2, 0x1, 0xffff7fff, 'syz1\x00'}) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) [ 2147.481376][T28520] binder: 28518:28520 ioctl c0306201 0 returned -14 02:35:49 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) sendmsg$RDMA_NLDEV_CMD_SYS_GET(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x28, 0x1406, 0xe7856d19a75713e2, 0x70bd2d, 0x25dfdbfb, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x10) 02:35:49 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f0000000040)=0xffff6bad) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) syz_open_dev$binderN(&(0x7f0000000700)='/dev/binder#\x00', 0x0, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r2, 0x4b6b, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_SCRNMAP(0xffffffffffffffff, 0x4b40, &(0x7f00000006c0)=""/50) ioctl$GIO_FONTX(r3, 0x4b6b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x118, 0x0, &(0x7f0000000500)=[@acquire_done={0x40106309, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@weak_handle={0x77682a85, 0xa, 0x3}, @fda={0x66646185, 0x5, 0x1}, @flat=@weak_binder={0x77622a85, 0x0, 0x8}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@fda={0x66646185, 0x9, 0x0, 0x9}, @ptr={0x70742a85, 0x1, &(0x7f0000000140)=""/153, 0x99, 0x0, 0x1b}, @ptr={0x70742a85, 0x1, &(0x7f0000000200)=""/149, 0x95, 0x1, 0x6}}, &(0x7f0000000340)={0x0, 0x20, 0x48}}}, @dead_binder_done, @enter_looper, @increfs_done={0x40106308, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000440)={@fd={0x66642a85, 0x0, r2}, @fd={0x66642a85, 0x0, r3}, @ptr={0x70742a85, 0x1, &(0x7f0000000380)=""/150, 0x96, 0x2, 0x28}}, &(0x7f00000004c0)={0x0, 0x18, 0x30}}, 0x1000}, @dead_binder_done], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) [ 2147.592231][T28529] binder: 28525:28529 ioctl c0306201 0 returned -14 [ 2147.621529][T28530] binder: 28527:28530 ioctl 40046210 0 returned -22 [ 2147.660403][T28529] binder: 28525:28529 ioctl 541b 0 returned -22 [ 2147.675929][T28533] binder: 28527:28533 unknown command 11 [ 2147.698294][T28534] binder: 28531:28534 ioctl 40046210 0 returned -22 02:35:49 executing program 4: openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r0, 0xc0405519, 0x0) clock_gettime(0x7, &(0x7f0000000100)) [ 2147.716312][T28533] binder: 28527:28533 ioctl c0306201 20001140 returned -22 02:35:49 executing program 5: setrlimit(0x3, &(0x7f0000000000)={0x8001, 0x81}) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)={0x10, 0x7, 0x2, 0x4, 0x204, 0x1, 0x2, [], 0x0, 0xffffffffffffffff, 0x3, 0x1, 0x2}, 0x40) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) 02:35:49 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) [ 2147.800606][T28537] binder: 28535:28537 ioctl c0306201 0 returned -14 02:35:49 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB='\v'], 0x7a, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb4807548784f5d23dd6eee7dfb3d1d7aa504b15f70ed1671caf55b2c617e9691ee7fdc5d2a04c2a4bf6762d91d0e61d407fd4ac2b3c5861c2f316ee88efdbc"}) 02:35:50 executing program 1: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r0, 0x4b6b, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000040)=0x1) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/capi/capi20\x00', 0x4800, 0x0) ioctl$TIOCGSERIAL(r1, 0x541e, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=""/251}) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) syz_open_dev$ptys(0xc, 0x3, 0x1) [ 2147.910600][T28545] binder: 28535:28545 ioctl 40046210 0 returned -22 [ 2147.944232][T28547] binder: 28542:28547 ioctl c0306201 0 returned -14 02:35:50 executing program 4: openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) clock_gettime(0x7, &(0x7f0000000100)) [ 2147.986575][T28547] binder: 28542:28547 ioctl 541b 0 returned -22 [ 2148.001569][T28549] binder: 28546:28549 ioctl 40046210 0 returned -22 02:35:50 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f0000000040)=0xffff6bad) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) syz_open_dev$binderN(&(0x7f0000000700)='/dev/binder#\x00', 0x0, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r2, 0x4b6b, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_SCRNMAP(0xffffffffffffffff, 0x4b40, &(0x7f00000006c0)=""/50) ioctl$GIO_FONTX(r3, 0x4b6b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x118, 0x0, &(0x7f0000000500)=[@acquire_done={0x40106309, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@weak_handle={0x77682a85, 0xa, 0x3}, @fda={0x66646185, 0x5, 0x1}, @flat=@weak_binder={0x77622a85, 0x0, 0x8}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@fda={0x66646185, 0x9, 0x0, 0x9}, @ptr={0x70742a85, 0x1, &(0x7f0000000140)=""/153, 0x99, 0x0, 0x1b}, @ptr={0x70742a85, 0x1, &(0x7f0000000200)=""/149, 0x95, 0x1, 0x6}}, &(0x7f0000000340)={0x0, 0x20, 0x48}}}, @dead_binder_done, @enter_looper, @increfs_done={0x40106308, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000440)={@fd={0x66642a85, 0x0, r2}, @fd={0x66642a85, 0x0, r3}, @ptr={0x70742a85, 0x1, &(0x7f0000000380)=""/150, 0x96, 0x2, 0x28}}, &(0x7f00000004c0)={0x0, 0x18, 0x30}}, 0x1000}, @dead_binder_done], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) 02:35:50 executing program 3: openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r0, 0x4b6b, 0x0) r1 = syz_open_dev$ptys(0xc, 0x3, 0x0) ioctl$TIOCSTI(r1, 0x5421, 0x8) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r2, 0xc0405519, 0x0) sendmsg$RDMA_NLDEV_CMD_STAT_DEL(r2, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x28, 0x1412, 0x8, 0x70bd2a, 0x25dfdbff, "", [@RDMA_NLDEV_ATTR_RES_LQPN={0x8, 0x15, 0x5}, @RDMA_NLDEV_ATTR_STAT_RES={0x8}, @RDMA_NLDEV_ATTR_RES_LQPN={0x8, 0x15, 0x5}]}, 0x28}, 0x1, 0x0, 0x0, 0x11}, 0x8000) [ 2148.052400][T28551] binder: 28548:28551 ioctl 40046210 0 returned -22 02:35:50 executing program 5: setrlimit(0x3, &(0x7f0000000000)={0x8001, 0x81}) syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)={0x10, 0x7, 0x2, 0x4, 0x204, 0x1, 0x2, [], 0x0, 0xffffffffffffffff, 0x3, 0x1, 0x2}, 0x40) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) [ 2148.098623][T28551] binder: 28548:28551 unknown command 11 [ 2148.104290][T28551] binder: 28548:28551 ioctl c0306201 20001140 returned -22 02:35:50 executing program 4: openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) clock_gettime(0x7, &(0x7f0000000100)) [ 2148.175316][T28556] binder: 28555:28556 ioctl c0306201 0 returned -14 02:35:50 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB='\vc'], 0x0, 0x0, 0x0}) 02:35:50 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r1, 0x40045542, &(0x7f0000000040)=0x6) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) r2 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ttyprintk\x00', 0x40102, 0x0) ioctl$TIOCSPTLCK(r2, 0x40045431, &(0x7f00000000c0)) [ 2148.260339][T28561] binder: 28557:28561 ioctl c0306201 0 returned -14 [ 2148.300456][T28563] binder: 28555:28563 ioctl 40046210 0 returned -22 02:35:50 executing program 5: setrlimit(0x3, &(0x7f0000000000)={0x8001, 0x81}) syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)={0x10, 0x7, 0x2, 0x4, 0x204, 0x1, 0x2, [], 0x0, 0xffffffffffffffff, 0x3, 0x1, 0x2}, 0x40) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 02:35:50 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r0, 0x4b6b, 0x0) write$cgroup_netprio_ifpriomap(0xffffffffffffffff, &(0x7f0000000200)={'vcan0', 0x32, 0x34}, 0x8) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$TIOCGLCKTRMIOS(r0, 0x5456, &(0x7f0000000180)={0x8001, 0x1ff, 0x400, 0x4, 0x3, "a1d2f746ba8d72e421819e62b4ca5d39df9075"}) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000040)={0x6, 0x118, 0xfa00, {{0x40, 0xa59, "0d9996ce41a057cb7d27061b669c276c895cf2de3d7ab258a57ddf61d9f569a1516385882ea03ddb7dad97685d5c34807374fca76dfc35a28d20859108e59e4ae687b43503e9af71f349d766eb65ff5ce095c4f65ba342f2c319ea1b64e6460d4559b2eb4fa50c5184a5f40da599261c1af7c7847422bdc632608a96506dc5a6e380eb487afe04bb8a1dc2a8b3f751cc70291c434751a72cb1163a60b6c57fd8c7960dff45ac371c3667b3bccc886500bccf18b8162c65aba3f1be631872c2973a221705a6e49a0ab408488c9569b009aa228a7ad0512a8df1f5203b7bc79d68cf6173945b08622a81e5a56f132ec29d043aa519ed777151dadc98e40c08da39", 0x11, 0x62, 0x3c, 0x80, 0x2, 0xff, 0xfd, 0x1}}}, 0x120) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x541b, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r2, 0x4b6b, 0x0) ioctl$KDGETLED(r2, 0x4b31, &(0x7f0000000240)) ioctl$VT_RESIZE(r0, 0x5609, &(0x7f00000001c0)={0xf8e9, 0xda5, 0x8}) 02:35:50 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f0000000040)=0xffff6bad) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) syz_open_dev$binderN(&(0x7f0000000700)='/dev/binder#\x00', 0x0, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r2, 0x4b6b, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_SCRNMAP(0xffffffffffffffff, 0x4b40, &(0x7f00000006c0)=""/50) ioctl$GIO_FONTX(r3, 0x4b6b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x118, 0x0, &(0x7f0000000500)=[@acquire_done={0x40106309, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@weak_handle={0x77682a85, 0xa, 0x3}, @fda={0x66646185, 0x5, 0x1}, @flat=@weak_binder={0x77622a85, 0x0, 0x8}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@fda={0x66646185, 0x9, 0x0, 0x9}, @ptr={0x70742a85, 0x1, &(0x7f0000000140)=""/153, 0x99, 0x0, 0x1b}, @ptr={0x70742a85, 0x1, &(0x7f0000000200)=""/149, 0x95, 0x1, 0x6}}, &(0x7f0000000340)={0x0, 0x20, 0x48}}}, @dead_binder_done, @enter_looper, @increfs_done={0x40106308, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000440)={@fd={0x66642a85, 0x0, r2}, @fd={0x66642a85, 0x0, r3}, @ptr={0x70742a85, 0x1, &(0x7f0000000380)=""/150, 0x96, 0x2, 0x28}}, &(0x7f00000004c0)={0x0, 0x18, 0x30}}, 0x1000}, @dead_binder_done], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) 02:35:50 executing program 4: clock_gettime(0x7, &(0x7f0000000100)) [ 2148.400351][T28568] binder: 28564:28568 ioctl 541b 0 returned -22 [ 2148.417010][T28569] binder: 28567:28569 ioctl 40046210 0 returned -22 02:35:50 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r1, 0x40045542, &(0x7f0000000040)=0x6) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) r2 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ttyprintk\x00', 0x40102, 0x0) ioctl$TIOCSPTLCK(r2, 0x40045431, &(0x7f00000000c0)) [ 2148.528969][T28575] binder: 28571:28575 ioctl c0306201 0 returned -14 02:35:50 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB='\vc'], 0x0, 0x0, 0x0}) 02:35:50 executing program 5: setrlimit(0x3, &(0x7f0000000000)={0x8001, 0x81}) syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)={0x10, 0x7, 0x2, 0x4, 0x204, 0x1, 0x2, [], 0x0, 0xffffffffffffffff, 0x3, 0x1, 0x2}, 0x40) [ 2148.597806][T28580] binder: 28576:28580 ioctl c0306201 0 returned -14 [ 2148.607041][T28577] binder: 28573:28577 ioctl c0306201 0 returned -14 [ 2148.622338][T28577] binder: 28573:28577 ioctl 541b 0 returned -22 02:35:50 executing program 4: clock_gettime(0x0, &(0x7f0000000100)) [ 2148.760794][T28588] binder: 28584:28588 ioctl 541b 0 returned -22 [ 2148.761600][T28582] binder: 28576:28582 ioctl 40046210 0 returned -22 [ 2148.797772][T28589] binder: 28586:28589 ioctl 40046210 0 returned -22 02:35:50 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r0, 0x4b6b, 0x0) write$cgroup_netprio_ifpriomap(0xffffffffffffffff, &(0x7f0000000200)={'vcan0', 0x32, 0x34}, 0x8) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$TIOCGLCKTRMIOS(r0, 0x5456, &(0x7f0000000180)={0x8001, 0x1ff, 0x400, 0x4, 0x3, "a1d2f746ba8d72e421819e62b4ca5d39df9075"}) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000040)={0x6, 0x118, 0xfa00, {{0x40, 0xa59, "0d9996ce41a057cb7d27061b669c276c895cf2de3d7ab258a57ddf61d9f569a1516385882ea03ddb7dad97685d5c34807374fca76dfc35a28d20859108e59e4ae687b43503e9af71f349d766eb65ff5ce095c4f65ba342f2c319ea1b64e6460d4559b2eb4fa50c5184a5f40da599261c1af7c7847422bdc632608a96506dc5a6e380eb487afe04bb8a1dc2a8b3f751cc70291c434751a72cb1163a60b6c57fd8c7960dff45ac371c3667b3bccc886500bccf18b8162c65aba3f1be631872c2973a221705a6e49a0ab408488c9569b009aa228a7ad0512a8df1f5203b7bc79d68cf6173945b08622a81e5a56f132ec29d043aa519ed777151dadc98e40c08da39", 0x11, 0x62, 0x3c, 0x80, 0x2, 0xff, 0xfd, 0x1}}}, 0x120) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x541b, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r2, 0x4b6b, 0x0) ioctl$KDGETLED(r2, 0x4b31, &(0x7f0000000240)) ioctl$VT_RESIZE(r0, 0x5609, &(0x7f00000001c0)={0xf8e9, 0xda5, 0x8}) 02:35:50 executing program 5: setrlimit(0x3, &(0x7f0000000000)={0x8001, 0x81}) syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) 02:35:51 executing program 4: clock_gettime(0x0, &(0x7f0000000100)) 02:35:51 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r1, 0x40045542, &(0x7f0000000040)=0x6) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) r2 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ttyprintk\x00', 0x40102, 0x0) ioctl$TIOCSPTLCK(r2, 0x40045431, &(0x7f00000000c0)) 02:35:51 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB='\vc'], 0x0, 0x0, 0x0}) 02:35:51 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f0000000040)=0xffff6bad) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) syz_open_dev$binderN(&(0x7f0000000700)='/dev/binder#\x00', 0x0, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r2, 0x4b6b, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_SCRNMAP(0xffffffffffffffff, 0x4b40, &(0x7f00000006c0)=""/50) ioctl$GIO_FONTX(r3, 0x4b6b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x118, 0x0, &(0x7f0000000500)=[@acquire_done={0x40106309, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@weak_handle={0x77682a85, 0xa, 0x3}, @fda={0x66646185, 0x5, 0x1}, @flat=@weak_binder={0x77622a85, 0x0, 0x8}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@fda={0x66646185, 0x9, 0x0, 0x9}, @ptr={0x70742a85, 0x1, &(0x7f0000000140)=""/153, 0x99, 0x0, 0x1b}, @ptr={0x70742a85, 0x1, &(0x7f0000000200)=""/149, 0x95, 0x1, 0x6}}, &(0x7f0000000340)={0x0, 0x20, 0x48}}}, @dead_binder_done, @enter_looper, @increfs_done={0x40106308, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000440)={@fd={0x66642a85, 0x0, r2}, @fd={0x66642a85, 0x0, r3}, @ptr={0x70742a85, 0x1, &(0x7f0000000380)=""/150, 0x96, 0x2, 0x28}}, &(0x7f00000004c0)={0x0, 0x18, 0x30}}, 0x1000}, @dead_binder_done], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) [ 2149.017845][T28595] binder: 28594:28595 ioctl c0306201 0 returned -14 [ 2149.031984][T28595] binder: 28594:28595 ioctl 541b 0 returned -22 [ 2149.073934][T28604] binder: 28599:28604 ioctl 40046210 0 returned -22 02:35:51 executing program 5: setrlimit(0x3, &(0x7f0000000000)={0x8001, 0x81}) syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) [ 2149.123188][T28605] binder: 28600:28605 ioctl 541b 0 returned -22 [ 2149.128641][T28606] binder: 28603:28606 ioctl c0306201 0 returned -14 02:35:51 executing program 4: clock_gettime(0x0, &(0x7f0000000100)) 02:35:51 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r0, 0x4b6b, 0x0) write$cgroup_netprio_ifpriomap(0xffffffffffffffff, &(0x7f0000000200)={'vcan0', 0x32, 0x34}, 0x8) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$TIOCGLCKTRMIOS(r0, 0x5456, &(0x7f0000000180)={0x8001, 0x1ff, 0x400, 0x4, 0x3, "a1d2f746ba8d72e421819e62b4ca5d39df9075"}) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000040)={0x6, 0x118, 0xfa00, {{0x40, 0xa59, "0d9996ce41a057cb7d27061b669c276c895cf2de3d7ab258a57ddf61d9f569a1516385882ea03ddb7dad97685d5c34807374fca76dfc35a28d20859108e59e4ae687b43503e9af71f349d766eb65ff5ce095c4f65ba342f2c319ea1b64e6460d4559b2eb4fa50c5184a5f40da599261c1af7c7847422bdc632608a96506dc5a6e380eb487afe04bb8a1dc2a8b3f751cc70291c434751a72cb1163a60b6c57fd8c7960dff45ac371c3667b3bccc886500bccf18b8162c65aba3f1be631872c2973a221705a6e49a0ab408488c9569b009aa228a7ad0512a8df1f5203b7bc79d68cf6173945b08622a81e5a56f132ec29d043aa519ed777151dadc98e40c08da39", 0x11, 0x62, 0x3c, 0x80, 0x2, 0xff, 0xfd, 0x1}}}, 0x120) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x541b, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r2, 0x4b6b, 0x0) ioctl$KDGETLED(r2, 0x4b31, &(0x7f0000000240)) ioctl$VT_RESIZE(r0, 0x5609, &(0x7f00000001c0)={0xf8e9, 0xda5, 0x8}) 02:35:51 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB='\vc'], 0x0, 0x0, &(0x7f00000010c0)}) 02:35:51 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r1, 0x40045542, &(0x7f0000000040)=0x6) ioctl$BINDER_SET_MAX_THREADS(r0, 0x541b, 0x0) openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ttyprintk\x00', 0x40102, 0x0) 02:35:51 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f0000000040)=0xffff6bad) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) syz_open_dev$binderN(&(0x7f0000000700)='/dev/binder#\x00', 0x0, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r2, 0x4b6b, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_SCRNMAP(0xffffffffffffffff, 0x4b40, &(0x7f00000006c0)=""/50) ioctl$GIO_FONTX(r3, 0x4b6b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x118, 0x0, &(0x7f0000000500)=[@acquire_done={0x40106309, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@weak_handle={0x77682a85, 0xa, 0x3}, @fda={0x66646185, 0x5, 0x1}, @flat=@weak_binder={0x77622a85, 0x0, 0x8}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@fda={0x66646185, 0x9, 0x0, 0x9}, @ptr={0x70742a85, 0x1, &(0x7f0000000140)=""/153, 0x99, 0x0, 0x1b}, @ptr={0x70742a85, 0x1, &(0x7f0000000200)=""/149, 0x95, 0x1, 0x6}}, &(0x7f0000000340)={0x0, 0x20, 0x48}}}, @dead_binder_done, @enter_looper, @increfs_done={0x40106308, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000440)={@fd={0x66642a85, 0x0, r2}, @fd={0x66642a85, 0x0, r3}, @ptr={0x70742a85, 0x1, &(0x7f0000000380)=""/150, 0x96, 0x2, 0x28}}, &(0x7f00000004c0)={0x0, 0x18, 0x30}}, 0x1000}, @dead_binder_done], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 02:35:51 executing program 5: setrlimit(0x3, &(0x7f0000000000)={0x8001, 0x81}) [ 2149.361613][T28615] binder: 28613:28615 ioctl c0306201 0 returned -14 02:35:51 executing program 4: clock_gettime(0x7, 0x0) [ 2149.409116][T28621] binder: 28618:28621 ioctl 541b 0 returned -22 [ 2149.425686][T28622] binder: 28613:28622 ioctl 541b 0 returned -22 02:35:51 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB='\vc'], 0x0, 0x0, &(0x7f00000010c0)}) 02:35:51 executing program 1: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r0, 0xc0405519, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_PREFER_SUBDEVICE(r0, 0x40045542, &(0x7f0000000040)=0x6) openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ttyprintk\x00', 0x40102, 0x0) 02:35:51 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r0, 0x4b6b, 0x0) write$cgroup_netprio_ifpriomap(0xffffffffffffffff, &(0x7f0000000200)={'vcan0', 0x32, 0x34}, 0x8) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$TIOCGLCKTRMIOS(r0, 0x5456, &(0x7f0000000180)={0x8001, 0x1ff, 0x400, 0x4, 0x3, "a1d2f746ba8d72e421819e62b4ca5d39df9075"}) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000040)={0x6, 0x118, 0xfa00, {{0x40, 0xa59, "0d9996ce41a057cb7d27061b669c276c895cf2de3d7ab258a57ddf61d9f569a1516385882ea03ddb7dad97685d5c34807374fca76dfc35a28d20859108e59e4ae687b43503e9af71f349d766eb65ff5ce095c4f65ba342f2c319ea1b64e6460d4559b2eb4fa50c5184a5f40da599261c1af7c7847422bdc632608a96506dc5a6e380eb487afe04bb8a1dc2a8b3f751cc70291c434751a72cb1163a60b6c57fd8c7960dff45ac371c3667b3bccc886500bccf18b8162c65aba3f1be631872c2973a221705a6e49a0ab408488c9569b009aa228a7ad0512a8df1f5203b7bc79d68cf6173945b08622a81e5a56f132ec29d043aa519ed777151dadc98e40c08da39", 0x11, 0x62, 0x3c, 0x80, 0x2, 0xff, 0xfd, 0x1}}}, 0x120) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x541b, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r2, 0x4b6b, 0x0) ioctl$VT_RESIZE(r0, 0x5609, &(0x7f00000001c0)={0xf8e9, 0xda5, 0x8}) [ 2149.545392][T28628] binder: 28624:28628 ioctl c0306201 0 returned -14 02:35:51 executing program 4: clock_gettime(0x7, 0x0) 02:35:51 executing program 5: setrlimit(0x0, &(0x7f0000000000)={0x8001, 0x81}) 02:35:51 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f0000000040)=0xffff6bad) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) syz_open_dev$binderN(&(0x7f0000000700)='/dev/binder#\x00', 0x0, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r2, 0x4b6b, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_SCRNMAP(0xffffffffffffffff, 0x4b40, &(0x7f00000006c0)=""/50) ioctl$GIO_FONTX(r3, 0x4b6b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x118, 0x0, &(0x7f0000000500)=[@acquire_done={0x40106309, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@weak_handle={0x77682a85, 0xa, 0x3}, @fda={0x66646185, 0x5, 0x1}, @flat=@weak_binder={0x77622a85, 0x0, 0x8}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@fda={0x66646185, 0x9, 0x0, 0x9}, @ptr={0x70742a85, 0x1, &(0x7f0000000140)=""/153, 0x99, 0x0, 0x1b}, @ptr={0x70742a85, 0x1, &(0x7f0000000200)=""/149, 0x95, 0x1, 0x6}}, &(0x7f0000000340)={0x0, 0x20, 0x48}}}, @dead_binder_done, @enter_looper, @increfs_done={0x40106308, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000440)={@fd={0x66642a85, 0x0, r2}, @fd={0x66642a85, 0x0, r3}, @ptr={0x70742a85, 0x1, &(0x7f0000000380)=""/150, 0x96, 0x2, 0x28}}, &(0x7f00000004c0)={0x0, 0x18, 0x30}}, 0x1000}, @dead_binder_done], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) [ 2149.684094][T28633] binder: 28629:28633 ioctl 40046210 0 returned -22 [ 2149.714034][T28634] binder: 28632:28634 ioctl c0306201 0 returned -14 02:35:51 executing program 1: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r0, 0xc0405519, 0x0) openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ttyprintk\x00', 0x40102, 0x0) [ 2149.761994][T28634] binder: 28632:28634 ioctl 541b 0 returned -22 [ 2149.799586][T28641] binder: 28638:28641 ioctl c0306201 0 returned -14 02:35:51 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB='\vc'], 0x0, 0x0, &(0x7f00000010c0)}) 02:35:51 executing program 4: clock_gettime(0x7, 0x0) 02:35:51 executing program 5: setrlimit(0x0, 0x0) 02:35:51 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r0, 0x4b6b, 0x0) write$cgroup_netprio_ifpriomap(0xffffffffffffffff, &(0x7f0000000200)={'vcan0', 0x32, 0x34}, 0x8) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$TIOCGLCKTRMIOS(r0, 0x5456, &(0x7f0000000180)={0x8001, 0x1ff, 0x400, 0x4, 0x3, "a1d2f746ba8d72e421819e62b4ca5d39df9075"}) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000040)={0x6, 0x118, 0xfa00, {{0x40, 0xa59, "0d9996ce41a057cb7d27061b669c276c895cf2de3d7ab258a57ddf61d9f569a1516385882ea03ddb7dad97685d5c34807374fca76dfc35a28d20859108e59e4ae687b43503e9af71f349d766eb65ff5ce095c4f65ba342f2c319ea1b64e6460d4559b2eb4fa50c5184a5f40da599261c1af7c7847422bdc632608a96506dc5a6e380eb487afe04bb8a1dc2a8b3f751cc70291c434751a72cb1163a60b6c57fd8c7960dff45ac371c3667b3bccc886500bccf18b8162c65aba3f1be631872c2973a221705a6e49a0ab408488c9569b009aa228a7ad0512a8df1f5203b7bc79d68cf6173945b08622a81e5a56f132ec29d043aa519ed777151dadc98e40c08da39", 0x11, 0x62, 0x3c, 0x80, 0x2, 0xff, 0xfd, 0x1}}}, 0x120) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x541b, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5609, &(0x7f00000001c0)={0xf8e9, 0xda5, 0x8}) 02:35:52 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f0000000040)=0xffff6bad) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) syz_open_dev$binderN(&(0x7f0000000700)='/dev/binder#\x00', 0x0, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r2, 0x4b6b, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_SCRNMAP(0xffffffffffffffff, 0x4b40, &(0x7f00000006c0)=""/50) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x118, 0x0, &(0x7f0000000500)=[@acquire_done={0x40106309, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@weak_handle={0x77682a85, 0xa, 0x3}, @fda={0x66646185, 0x5, 0x1}, @flat=@weak_binder={0x77622a85, 0x0, 0x8}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@fda={0x66646185, 0x9, 0x0, 0x9}, @ptr={0x70742a85, 0x1, &(0x7f0000000140)=""/153, 0x99, 0x0, 0x1b}, @ptr={0x70742a85, 0x1, &(0x7f0000000200)=""/149, 0x95, 0x1, 0x6}}, &(0x7f0000000340)={0x0, 0x20, 0x48}}}, @dead_binder_done, @enter_looper, @increfs_done={0x40106308, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000440)={@fd={0x66642a85, 0x0, r2}, @fd={0x66642a85, 0x0, r3}, @ptr={0x70742a85, 0x1, &(0x7f0000000380)=""/150, 0x96, 0x2, 0x28}}, &(0x7f00000004c0)={0x0, 0x18, 0x30}}, 0x1000}, @dead_binder_done], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) [ 2149.995020][T28648] binder: 28644:28648 ioctl 40046210 0 returned -22 02:35:52 executing program 1: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ttyprintk\x00', 0x40102, 0x0) 02:35:52 executing program 4: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r0, 0x4b6b, 0x0) write$cgroup_netprio_ifpriomap(0xffffffffffffffff, &(0x7f0000000200)={'vcan0', 0x32, 0x34}, 0x8) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$TIOCGLCKTRMIOS(r0, 0x5456, &(0x7f0000000180)={0x8001, 0x1ff, 0x400, 0x4, 0x3, "a1d2f746ba8d72e421819e62b4ca5d39df9075"}) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000040)={0x6, 0x118, 0xfa00, {{0x40, 0xa59, "0d9996ce41a057cb7d27061b669c276c895cf2de3d7ab258a57ddf61d9f569a1516385882ea03ddb7dad97685d5c34807374fca76dfc35a28d20859108e59e4ae687b43503e9af71f349d766eb65ff5ce095c4f65ba342f2c319ea1b64e6460d4559b2eb4fa50c5184a5f40da599261c1af7c7847422bdc632608a96506dc5a6e380eb487afe04bb8a1dc2a8b3f751cc70291c434751a72cb1163a60b6c57fd8c7960dff45ac371c3667b3bccc886500bccf18b8162c65aba3f1be631872c2973a221705a6e49a0ab408488c9569b009aa228a7ad0512a8df1f5203b7bc79d68cf6173945b08622a81e5a56f132ec29d043aa519ed777151dadc98e40c08da39", 0x11, 0x62, 0x3c, 0x80, 0x2, 0xff, 0xfd, 0x1}}}, 0x120) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x541b, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r2, 0x4b6b, 0x0) ioctl$VT_RESIZE(r0, 0x5609, &(0x7f00000001c0)={0xf8e9, 0xda5, 0x8}) 02:35:52 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB='\vc'], 0x3d, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf23702142a8efaadb423553296e34eed6eadf3a9a788cc8b7553a7577fb480"}) 02:35:52 executing program 5: setrlimit(0x0, 0x0) [ 2150.081636][T28652] binder: 28649:28652 ioctl c0306201 0 returned -14 [ 2150.093403][T28653] binder: 28651:28653 ioctl c0306201 0 returned -14 [ 2150.115032][T28652] binder: 28649:28652 ioctl 541b 0 returned -22 02:35:52 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f0000000040)=0xffff6bad) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) syz_open_dev$binderN(&(0x7f0000000700)='/dev/binder#\x00', 0x0, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r2, 0x4b6b, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x118, 0x0, &(0x7f0000000500)=[@acquire_done={0x40106309, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@weak_handle={0x77682a85, 0xa, 0x3}, @fda={0x66646185, 0x5, 0x1}, @flat=@weak_binder={0x77622a85, 0x0, 0x8}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@fda={0x66646185, 0x9, 0x0, 0x9}, @ptr={0x70742a85, 0x1, &(0x7f0000000140)=""/153, 0x99, 0x0, 0x1b}, @ptr={0x70742a85, 0x1, &(0x7f0000000200)=""/149, 0x95, 0x1, 0x6}}, &(0x7f0000000340)={0x0, 0x20, 0x48}}}, @dead_binder_done, @enter_looper, @increfs_done={0x40106308, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000440)={@fd={0x66642a85, 0x0, r2}, @fd={0x66642a85, 0x0, r3}, @ptr={0x70742a85, 0x1, &(0x7f0000000380)=""/150, 0x96, 0x2, 0x28}}, &(0x7f00000004c0)={0x0, 0x18, 0x30}}, 0x1000}, @dead_binder_done], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) [ 2150.224578][T28658] binder: 28656:28658 ioctl c0306201 0 returned -14 [ 2150.254882][T28658] binder: 28656:28658 ioctl 541b 0 returned -22 [ 2150.267356][T28662] binder: 28660:28662 ioctl 40046210 0 returned -22 02:35:52 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r0, 0x4b6b, 0x0) write$cgroup_netprio_ifpriomap(0xffffffffffffffff, &(0x7f0000000200)={'vcan0', 0x32, 0x34}, 0x8) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$TIOCGLCKTRMIOS(r0, 0x5456, &(0x7f0000000180)={0x8001, 0x1ff, 0x400, 0x4, 0x3, "a1d2f746ba8d72e421819e62b4ca5d39df9075"}) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000040)={0x6, 0x118, 0xfa00, {{0x40, 0xa59, "0d9996ce41a057cb7d27061b669c276c895cf2de3d7ab258a57ddf61d9f569a1516385882ea03ddb7dad97685d5c34807374fca76dfc35a28d20859108e59e4ae687b43503e9af71f349d766eb65ff5ce095c4f65ba342f2c319ea1b64e6460d4559b2eb4fa50c5184a5f40da599261c1af7c7847422bdc632608a96506dc5a6e380eb487afe04bb8a1dc2a8b3f751cc70291c434751a72cb1163a60b6c57fd8c7960dff45ac371c3667b3bccc886500bccf18b8162c65aba3f1be631872c2973a221705a6e49a0ab408488c9569b009aa228a7ad0512a8df1f5203b7bc79d68cf6173945b08622a81e5a56f132ec29d043aa519ed777151dadc98e40c08da39", 0x11, 0x62, 0x3c, 0x80, 0x2, 0xff, 0xfd, 0x1}}}, 0x120) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x541b, 0x0) ioctl$VT_RESIZE(r0, 0x5609, &(0x7f00000001c0)={0xf8e9, 0xda5, 0x8}) 02:35:52 executing program 1: syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ttyprintk\x00', 0x40102, 0x0) [ 2150.311338][T28662] binder: 28660:28662 ioctl c0306201 20001140 returned -11 02:35:52 executing program 5: setrlimit(0x0, 0x0) 02:35:52 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB='\vc'], 0x0, 0x0, 0x0}) 02:35:52 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB='\vc'], 0x0, 0x0, &(0x7f00000010c0)}) [ 2150.399086][T28667] binder: 28665:28667 ioctl c0306201 0 returned -14 02:35:52 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f0000000040)=0xffff6bad) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) syz_open_dev$binderN(&(0x7f0000000700)='/dev/binder#\x00', 0x0, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r2, 0x4b6b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x118, 0x0, &(0x7f0000000500)=[@acquire_done={0x40106309, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@weak_handle={0x77682a85, 0xa, 0x3}, @fda={0x66646185, 0x5, 0x1}, @flat=@weak_binder={0x77622a85, 0x0, 0x8}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@fda={0x66646185, 0x9, 0x0, 0x9}, @ptr={0x70742a85, 0x1, &(0x7f0000000140)=""/153, 0x99, 0x0, 0x1b}, @ptr={0x70742a85, 0x1, &(0x7f0000000200)=""/149, 0x95, 0x1, 0x6}}, &(0x7f0000000340)={0x0, 0x20, 0x48}}}, @dead_binder_done, @enter_looper, @increfs_done={0x40106308, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000440)={@fd={0x66642a85, 0x0, r2}, @fd, @ptr={0x70742a85, 0x1, &(0x7f0000000380)=""/150, 0x96, 0x2, 0x28}}, &(0x7f00000004c0)={0x0, 0x18, 0x30}}, 0x1000}, @dead_binder_done], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) [ 2150.481570][T28668] binder: 28666:28668 ioctl c0306201 0 returned -14 [ 2150.511526][T28668] binder: 28666:28668 ioctl 541b 0 returned -22 02:35:52 executing program 5: setrlimit(0x0, &(0x7f0000000000)={0x0, 0x81}) 02:35:52 executing program 1: openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ttyprintk\x00', 0x40102, 0x0) [ 2150.574570][T28676] binder: 28673:28676 ioctl 40046210 0 returned -22 [ 2150.603685][T28677] binder: 28674:28677 ioctl 40046210 0 returned -22 02:35:52 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r0, 0x4b6b, 0x0) write$cgroup_netprio_ifpriomap(0xffffffffffffffff, &(0x7f0000000200)={'vcan0', 0x32, 0x34}, 0x8) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$TIOCGLCKTRMIOS(r0, 0x5456, &(0x7f0000000180)={0x8001, 0x1ff, 0x400, 0x4, 0x3, "a1d2f746ba8d72e421819e62b4ca5d39df9075"}) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000040)={0x6, 0x118, 0xfa00, {{0x40, 0xa59, "0d9996ce41a057cb7d27061b669c276c895cf2de3d7ab258a57ddf61d9f569a1516385882ea03ddb7dad97685d5c34807374fca76dfc35a28d20859108e59e4ae687b43503e9af71f349d766eb65ff5ce095c4f65ba342f2c319ea1b64e6460d4559b2eb4fa50c5184a5f40da599261c1af7c7847422bdc632608a96506dc5a6e380eb487afe04bb8a1dc2a8b3f751cc70291c434751a72cb1163a60b6c57fd8c7960dff45ac371c3667b3bccc886500bccf18b8162c65aba3f1be631872c2973a221705a6e49a0ab408488c9569b009aa228a7ad0512a8df1f5203b7bc79d68cf6173945b08622a81e5a56f132ec29d043aa519ed777151dadc98e40c08da39", 0x11, 0x62, 0x3c, 0x80, 0x2, 0xff, 0xfd, 0x1}}}, 0x120) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$VT_RESIZE(r0, 0x5609, &(0x7f00000001c0)={0xf8e9, 0xda5, 0x8}) [ 2150.665028][T28679] binder: 28678:28679 ioctl c0306201 0 returned -14 02:35:52 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB='\vc'], 0x0, 0x0, &(0x7f00000010c0)}) 02:35:52 executing program 4: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r0, 0x4b6b, 0x0) write$cgroup_netprio_ifpriomap(0xffffffffffffffff, &(0x7f0000000200)={'vcan0', 0x32, 0x34}, 0x8) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$TIOCGLCKTRMIOS(r0, 0x5456, &(0x7f0000000180)={0x8001, 0x1ff, 0x400, 0x4, 0x3, "a1d2f746ba8d72e421819e62b4ca5d39df9075"}) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000040)={0x6, 0x118, 0xfa00, {{0x40, 0xa59, "0d9996ce41a057cb7d27061b669c276c895cf2de3d7ab258a57ddf61d9f569a1516385882ea03ddb7dad97685d5c34807374fca76dfc35a28d20859108e59e4ae687b43503e9af71f349d766eb65ff5ce095c4f65ba342f2c319ea1b64e6460d4559b2eb4fa50c5184a5f40da599261c1af7c7847422bdc632608a96506dc5a6e380eb487afe04bb8a1dc2a8b3f751cc70291c434751a72cb1163a60b6c57fd8c7960dff45ac371c3667b3bccc886500bccf18b8162c65aba3f1be631872c2973a221705a6e49a0ab408488c9569b009aa228a7ad0512a8df1f5203b7bc79d68cf6173945b08622a81e5a56f132ec29d043aa519ed777151dadc98e40c08da39", 0x11, 0x62, 0x3c, 0x80, 0x2, 0xff, 0xfd, 0x1}}}, 0x120) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x541b, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r2, 0x4b6b, 0x0) ioctl$KDGETLED(r2, 0x4b31, &(0x7f0000000240)) ioctl$VT_RESIZE(r0, 0x5609, &(0x7f00000001c0)={0xf8e9, 0xda5, 0x8}) 02:35:52 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f0000000040)=0xffff6bad) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) syz_open_dev$binderN(&(0x7f0000000700)='/dev/binder#\x00', 0x0, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x118, 0x0, &(0x7f0000000500)=[@acquire_done={0x40106309, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@weak_handle={0x77682a85, 0xa, 0x3}, @fda={0x66646185, 0x5, 0x1}, @flat=@weak_binder={0x77622a85, 0x0, 0x8}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@fda={0x66646185, 0x9, 0x0, 0x9}, @ptr={0x70742a85, 0x1, &(0x7f0000000140)=""/153, 0x99, 0x0, 0x1b}, @ptr={0x70742a85, 0x1, &(0x7f0000000200)=""/149, 0x95, 0x1, 0x6}}, &(0x7f0000000340)={0x0, 0x20, 0x48}}}, @dead_binder_done, @enter_looper, @increfs_done={0x40106308, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000440)={@fd={0x66642a85, 0x0, r2}, @fd, @ptr={0x70742a85, 0x1, &(0x7f0000000380)=""/150, 0x96, 0x2, 0x28}}, &(0x7f00000004c0)={0x0, 0x18, 0x30}}, 0x1000}, @dead_binder_done], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:35:52 executing program 5: setrlimit(0x0, &(0x7f0000000000)={0x0, 0x81}) 02:35:52 executing program 1: openat$ttyprintk(0xffffffffffffff9c, 0x0, 0x40102, 0x0) [ 2150.788469][T28685] binder: 28683:28685 ioctl c0306201 0 returned -14 [ 2150.857202][T28688] binder: 28686:28688 ioctl 40046210 0 returned -22 02:35:53 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r0, 0x4b6b, 0x0) write$cgroup_netprio_ifpriomap(0xffffffffffffffff, &(0x7f0000000200)={'vcan0', 0x32, 0x34}, 0x8) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$TIOCGLCKTRMIOS(r0, 0x5456, &(0x7f0000000180)={0x8001, 0x1ff, 0x400, 0x4, 0x3, "a1d2f746ba8d72e421819e62b4ca5d39df9075"}) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000040)={0x6, 0x118, 0xfa00, {{0x40, 0xa59, "0d9996ce41a057cb7d27061b669c276c895cf2de3d7ab258a57ddf61d9f569a1516385882ea03ddb7dad97685d5c34807374fca76dfc35a28d20859108e59e4ae687b43503e9af71f349d766eb65ff5ce095c4f65ba342f2c319ea1b64e6460d4559b2eb4fa50c5184a5f40da599261c1af7c7847422bdc632608a96506dc5a6e380eb487afe04bb8a1dc2a8b3f751cc70291c434751a72cb1163a60b6c57fd8c7960dff45ac371c3667b3bccc886500bccf18b8162c65aba3f1be631872c2973a221705a6e49a0ab408488c9569b009aa228a7ad0512a8df1f5203b7bc79d68cf6173945b08622a81e5a56f132ec29d043aa519ed777151dadc98e40c08da39", 0x11, 0x62, 0x3c, 0x80, 0x2, 0xff, 0xfd, 0x1}}}, 0x120) ioctl$VT_RESIZE(r0, 0x5609, &(0x7f00000001c0)={0xf8e9, 0xda5, 0x8}) [ 2150.909008][T28691] binder: 28689:28691 ioctl c0306201 0 returned -14 02:35:53 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB='\vc'], 0x0, 0x0, &(0x7f00000010c0)}) [ 2150.958992][T28690] binder: 28687:28690 ioctl c0306201 0 returned -14 [ 2150.981488][T28690] binder: 28687:28690 ioctl 541b 0 returned -22 02:35:53 executing program 5: setrlimit(0x0, &(0x7f0000000000)={0x0, 0x81}) 02:35:53 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f0000000040)=0xffff6bad) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) syz_open_dev$binderN(&(0x7f0000000700)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x118, 0x0, &(0x7f0000000500)=[@acquire_done={0x40106309, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@weak_handle={0x77682a85, 0xa, 0x3}, @fda={0x66646185, 0x5, 0x1}, @flat=@weak_binder={0x77622a85, 0x0, 0x8}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@fda={0x66646185, 0x9, 0x0, 0x9}, @ptr={0x70742a85, 0x1, &(0x7f0000000140)=""/153, 0x99, 0x0, 0x1b}, @ptr={0x70742a85, 0x1, &(0x7f0000000200)=""/149, 0x95, 0x1, 0x6}}, &(0x7f0000000340)={0x0, 0x20, 0x48}}}, @dead_binder_done, @enter_looper, @increfs_done={0x40106308, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000440)={@fd, @fd, @ptr={0x70742a85, 0x1, &(0x7f0000000380)=""/150, 0x96, 0x2, 0x28}}, &(0x7f00000004c0)={0x0, 0x18, 0x30}}, 0x1000}, @dead_binder_done], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:35:53 executing program 1: openat$ttyprintk(0xffffffffffffff9c, 0x0, 0x40102, 0x0) 02:35:53 executing program 4: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r0, 0x4b6b, 0x0) write$cgroup_netprio_ifpriomap(0xffffffffffffffff, &(0x7f0000000200)={'vcan0', 0x32, 0x34}, 0x8) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$TIOCGLCKTRMIOS(r0, 0x5456, &(0x7f0000000180)={0x8001, 0x1ff, 0x400, 0x4, 0x3, "a1d2f746ba8d72e421819e62b4ca5d39df9075"}) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000040)={0x6, 0x118, 0xfa00, {{0x40, 0xa59, "0d9996ce41a057cb7d27061b669c276c895cf2de3d7ab258a57ddf61d9f569a1516385882ea03ddb7dad97685d5c34807374fca76dfc35a28d20859108e59e4ae687b43503e9af71f349d766eb65ff5ce095c4f65ba342f2c319ea1b64e6460d4559b2eb4fa50c5184a5f40da599261c1af7c7847422bdc632608a96506dc5a6e380eb487afe04bb8a1dc2a8b3f751cc70291c434751a72cb1163a60b6c57fd8c7960dff45ac371c3667b3bccc886500bccf18b8162c65aba3f1be631872c2973a221705a6e49a0ab408488c9569b009aa228a7ad0512a8df1f5203b7bc79d68cf6173945b08622a81e5a56f132ec29d043aa519ed777151dadc98e40c08da39", 0x11, 0x62, 0x3c, 0x80, 0x2, 0xff, 0xfd, 0x1}}}, 0x120) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x541b, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r2, 0x4b6b, 0x0) ioctl$KDGETLED(r2, 0x4b31, &(0x7f0000000240)) ioctl$VT_RESIZE(r0, 0x5609, &(0x7f00000001c0)={0xf8e9, 0xda5, 0x8}) [ 2151.121623][T28701] binder: 28699:28701 ioctl 40046210 0 returned -22 02:35:53 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r0, 0x4b6b, 0x0) write$cgroup_netprio_ifpriomap(0xffffffffffffffff, &(0x7f0000000200)={'vcan0', 0x32, 0x34}, 0x8) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$TIOCGLCKTRMIOS(r0, 0x5456, &(0x7f0000000180)={0x8001, 0x1ff, 0x400, 0x4, 0x3, "a1d2f746ba8d72e421819e62b4ca5d39df9075"}) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$VT_RESIZE(r0, 0x5609, &(0x7f00000001c0)={0xf8e9, 0xda5, 0x8}) 02:35:53 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB='\vc'], 0x1f, 0x0, &(0x7f00000010c0)="5eed955effe964ce8ac0d70cd98682b80d3f25fb63b3133366b471983acaf2"}) [ 2151.216791][T28706] binder: 28703:28706 ioctl c0306201 0 returned -14 02:35:53 executing program 1: openat$ttyprintk(0xffffffffffffff9c, 0x0, 0x40102, 0x0) 02:35:53 executing program 5: setrlimit(0x0, &(0x7f0000000000)={0x8001}) 02:35:53 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f0000000040)=0xffff6bad) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x118, 0x0, &(0x7f0000000500)=[@acquire_done={0x40106309, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@weak_handle={0x77682a85, 0xa, 0x3}, @fda={0x66646185, 0x5, 0x1}, @flat=@weak_binder={0x77622a85, 0x0, 0x8}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@fda={0x66646185, 0x9, 0x0, 0x9}, @ptr={0x70742a85, 0x1, &(0x7f0000000140)=""/153, 0x99, 0x0, 0x1b}, @ptr={0x70742a85, 0x1, &(0x7f0000000200)=""/149, 0x95, 0x1, 0x6}}, &(0x7f0000000340)={0x0, 0x20, 0x48}}}, @dead_binder_done, @enter_looper, @increfs_done={0x40106308, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000440)={@fd, @fd, @ptr={0x70742a85, 0x1, &(0x7f0000000380)=""/150, 0x96, 0x2, 0x28}}, &(0x7f00000004c0)={0x0, 0x18, 0x30}}, 0x1000}, @dead_binder_done], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) [ 2151.323365][T28710] binder: 28708:28710 ioctl c0306201 0 returned -14 [ 2151.345322][T28710] binder: 28708:28710 ioctl 541b 0 returned -22 02:35:53 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r0, 0x4b6b, 0x0) write$cgroup_netprio_ifpriomap(0xffffffffffffffff, &(0x7f0000000200)={'vcan0', 0x32, 0x34}, 0x8) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$TIOCGLCKTRMIOS(r0, 0x5456, &(0x7f0000000180)={0x8001, 0x1ff, 0x400, 0x4, 0x3, "a1d2f746ba8d72e421819e62b4ca5d39df9075"}) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$VT_RESIZE(r0, 0x5609, &(0x7f00000001c0)={0xf8e9, 0xda5, 0x8}) [ 2151.415680][T28715] binder: 28712:28715 ioctl 40046210 0 returned -22 02:35:53 executing program 4: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r0, 0x4b6b, 0x0) write$cgroup_netprio_ifpriomap(0xffffffffffffffff, &(0x7f0000000200)={'vcan0', 0x32, 0x34}, 0x8) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$TIOCGLCKTRMIOS(r0, 0x5456, &(0x7f0000000180)={0x8001, 0x1ff, 0x400, 0x4, 0x3, "a1d2f746ba8d72e421819e62b4ca5d39df9075"}) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000040)={0x6, 0x118, 0xfa00, {{0x40, 0xa59, "0d9996ce41a057cb7d27061b669c276c895cf2de3d7ab258a57ddf61d9f569a1516385882ea03ddb7dad97685d5c34807374fca76dfc35a28d20859108e59e4ae687b43503e9af71f349d766eb65ff5ce095c4f65ba342f2c319ea1b64e6460d4559b2eb4fa50c5184a5f40da599261c1af7c7847422bdc632608a96506dc5a6e380eb487afe04bb8a1dc2a8b3f751cc70291c434751a72cb1163a60b6c57fd8c7960dff45ac371c3667b3bccc886500bccf18b8162c65aba3f1be631872c2973a221705a6e49a0ab408488c9569b009aa228a7ad0512a8df1f5203b7bc79d68cf6173945b08622a81e5a56f132ec29d043aa519ed777151dadc98e40c08da39", 0x11, 0x62, 0x3c, 0x80, 0x2, 0xff, 0xfd, 0x1}}}, 0x120) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x541b, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r2, 0x4b6b, 0x0) ioctl$KDGETLED(r2, 0x4b31, &(0x7f0000000240)) ioctl$VT_RESIZE(r0, 0x5609, &(0x7f00000001c0)={0xf8e9, 0xda5, 0x8}) 02:35:53 executing program 1: openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ttyprintk\x00', 0x0, 0x0) [ 2151.463432][T28715] binder: 28712:28715 ioctl c0306201 20001140 returned -11 [ 2151.488852][T28721] binder: 28719:28721 ioctl c0306201 0 returned -14 02:35:53 executing program 5: setrlimit(0x0, &(0x7f0000000000)={0x0, 0x81}) 02:35:53 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB='\vc'], 0x1, 0x0, &(0x7f00000010c0)='^'}) 02:35:53 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f0000000040)=0xffff6bad) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x118, 0x0, &(0x7f0000000500)=[@acquire_done={0x40106309, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@weak_handle={0x77682a85, 0xa, 0x3}, @fda={0x66646185, 0x5, 0x1}, @flat=@weak_binder={0x77622a85, 0x0, 0x8}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@fda={0x66646185, 0x9, 0x0, 0x9}, @ptr={0x70742a85, 0x1, &(0x7f0000000140)=""/153, 0x99, 0x0, 0x1b}, @ptr={0x70742a85, 0x1, &(0x7f0000000200)=""/149, 0x95, 0x1, 0x6}}, &(0x7f0000000340)={0x0, 0x20, 0x48}}}, @dead_binder_done, @enter_looper, @increfs_done={0x40106308, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000440)={@fd, @fd, @ptr={0x70742a85, 0x1, &(0x7f0000000380)=""/150, 0x96, 0x2, 0x28}}, &(0x7f00000004c0)={0x0, 0x18, 0x30}}, 0x1000}, @dead_binder_done], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) [ 2151.681668][T28727] binder: 28723:28727 ioctl c0306201 0 returned -14 [ 2151.708963][T28727] binder: 28723:28727 ioctl 541b 0 returned -22 02:35:53 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r0, 0x4b6b, 0x0) write$cgroup_netprio_ifpriomap(0xffffffffffffffff, &(0x7f0000000200)={'vcan0', 0x32, 0x34}, 0x8) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$TIOCGLCKTRMIOS(r0, 0x5456, &(0x7f0000000180)={0x8001, 0x1ff, 0x400, 0x4, 0x3, "a1d2f746ba8d72e421819e62b4ca5d39df9075"}) ioctl$VT_RESIZE(r0, 0x5609, &(0x7f00000001c0)={0xf8e9, 0xda5, 0x8}) 02:35:53 executing program 1: openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ttyprintk\x00', 0x0, 0x0) [ 2151.736055][T28732] binder: 28730:28732 ioctl 40046210 0 returned -22 [ 2151.753042][T28733] binder: 28731:28733 ioctl c0306201 0 returned -14 [ 2151.763998][T28732] binder: 28730:28732 ioctl c0306201 20001140 returned -11 02:35:53 executing program 5: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x20, 0x0, &(0x7f0000000040)=[@clear_death, @clear_death={0x400c630f, 0x1}], 0xa1, 0x0, &(0x7f0000000080)="ebb03cf857abf6da4309ef7a85d2c6c59a5614d3580f5732e0ac21c58b3d3d14c860a699993faa8b84322dfccc3130524ec53215bcae749351c9a0062eb7193e66a354eb8a583baebd3014e85a05af8867cb37b75d7cf70cc3d6abb544738d3caf80a588842e1f580fb6ecedec1f5e5a09525117a74d991b2d97c48643c64167c3855f1cbfcc9721133a42eb683787b58fd63d7209c7d44b1f1795c8255423c94b"}) ioctl$TIOCSTI(r0, 0x5421, 0x400000) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r1, 0x4b6b, 0x0) ioctl$VT_RESIZEX(r1, 0x560a, &(0x7f0000000000)={0x4f72, 0x18, 0x5, 0x7f, 0x0, 0x200}) 02:35:53 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f0000000040)=0xffff6bad) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x118, 0x0, &(0x7f0000000500)=[@acquire_done={0x40106309, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@weak_handle={0x77682a85, 0xa, 0x3}, @fda={0x66646185, 0x5, 0x1}, @flat=@weak_binder={0x77622a85, 0x0, 0x8}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@fda={0x66646185, 0x9, 0x0, 0x9}, @ptr={0x70742a85, 0x1, &(0x7f0000000140)=""/153, 0x99, 0x0, 0x1b}, @ptr={0x70742a85, 0x1, &(0x7f0000000200)=""/149, 0x95, 0x1, 0x6}}, &(0x7f0000000340)={0x0, 0x20, 0x48}}}, @dead_binder_done, @enter_looper, @increfs_done={0x40106308, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000440)={@fd, @fd, @ptr={0x70742a85, 0x1, &(0x7f0000000380)=""/150, 0x96, 0x2, 0x28}}, &(0x7f00000004c0)={0x0, 0x18, 0x30}}, 0x1000}, @dead_binder_done], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:35:53 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0xc02) ioctl$BINDER_SET_MAX_THREADS(r0, 0x5460, 0x0) 02:35:53 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB='\vc'], 0x0, 0x0, &(0x7f00000010c0)}) 02:35:54 executing program 1: openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ttyprintk\x00', 0x0, 0x0) 02:35:54 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r0, 0x4b6b, 0x0) write$cgroup_netprio_ifpriomap(0xffffffffffffffff, &(0x7f0000000200)={'vcan0', 0x32, 0x34}, 0x8) ioctl$KDSETMODE(r0, 0x4b3a, 0x1) ioctl$VT_RESIZE(r0, 0x5609, &(0x7f00000001c0)={0xf8e9, 0xda5, 0x8}) 02:35:54 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB='\vc'], 0x0, 0x0, &(0x7f00000010c0)}) [ 2152.019660][T28745] binder: 28741:28745 ioctl 40046210 0 returned -22 02:35:54 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) recvmmsg(r0, &(0x7f0000004640)=[{{0x0, 0x0, &(0x7f0000003000)=[{0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x9}, 0x9}], 0x1, 0x2, 0x0) 02:35:54 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f0000000040)=0xffff6bad) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x118, 0x0, &(0x7f0000000500)=[@acquire_done={0x40106309, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@weak_handle={0x77682a85, 0xa, 0x3}, @fda={0x66646185, 0x5, 0x1}, @flat=@weak_binder={0x77622a85, 0x0, 0x8}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@fda={0x66646185, 0x9, 0x0, 0x9}, @ptr={0x70742a85, 0x1, &(0x7f0000000140)=""/153, 0x99, 0x0, 0x1b}, @ptr={0x70742a85, 0x1, &(0x7f0000000200)=""/149, 0x95, 0x1, 0x6}}, &(0x7f0000000340)={0x0, 0x20, 0x48}}}, @dead_binder_done, @enter_looper, @increfs_done={0x40106308, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000440)={@fd, @fd, @ptr={0x70742a85, 0x1, &(0x7f0000000380)=""/150, 0x96, 0x2, 0x28}}, &(0x7f00000004c0)={0x0, 0x18, 0x30}}, 0x1000}, @dead_binder_done], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) [ 2152.096635][T28748] binder: 28743:28748 ioctl c0306201 0 returned -14 02:35:54 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r0, 0x4b6b, 0x0) write$cgroup_netprio_ifpriomap(0xffffffffffffffff, &(0x7f0000000200)={'vcan0', 0x32, 0x34}, 0x8) ioctl$VT_RESIZE(r0, 0x5609, &(0x7f00000001c0)={0xf8e9, 0xda5, 0x8}) 02:35:54 executing program 1: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r0, 0x4b6b, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000040)=0x1) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/capi/capi20\x00', 0x4800, 0x0) ioctl$TIOCGSERIAL(r1, 0x541e, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=""/251}) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r2 = syz_open_dev$ptys(0xc, 0x3, 0x1) ioctl$VT_GETMODE(r2, 0x5601, &(0x7f0000000080)) r3 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) write$vga_arbiter(r1, &(0x7f0000000280)=@unlock_all='unlock all\x00', 0xb) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, 0x0) [ 2152.276597][T28756] binder: 28753:28756 ioctl 40046210 0 returned -22 02:35:54 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001140)={0x4, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB='\vc'], 0x0, 0x0, &(0x7f00000010c0)}) 02:35:54 executing program 5: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x20, 0x0, &(0x7f0000000040)=[@clear_death, @clear_death={0x400c630f, 0x1}], 0xa1, 0x0, &(0x7f0000000080)="ebb03cf857abf6da4309ef7a85d2c6c59a5614d3580f5732e0ac21c58b3d3d14c860a699993faa8b84322dfccc3130524ec53215bcae749351c9a0062eb7193e66a354eb8a583baebd3014e85a05af8867cb37b75d7cf70cc3d6abb544738d3caf80a588842e1f580fb6ecedec1f5e5a09525117a74d991b2d97c48643c64167c3855f1cbfcc9721133a42eb683787b58fd63d7209c7d44b1f1795c8255423c94b"}) ioctl$TIOCSTI(r0, 0x5421, 0x400000) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r1, 0x4b6b, 0x0) ioctl$VT_RESIZEX(r1, 0x560a, &(0x7f0000000000)={0x4f72, 0x18, 0x5, 0x7f, 0x0, 0x200}) [ 2152.362052][T28758] binder: 28755:28758 ioctl c0306201 0 returned -14 02:35:54 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f0000000040)=0xffff6bad) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x118, 0x0, &(0x7f0000000500)=[@acquire_done={0x40106309, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@weak_handle={0x77682a85, 0xa, 0x3}, @fda={0x66646185, 0x5, 0x1}, @flat=@weak_binder={0x77622a85, 0x0, 0x8}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@fda={0x66646185, 0x9, 0x0, 0x9}, @ptr={0x70742a85, 0x1, &(0x7f0000000140)=""/153, 0x99, 0x0, 0x1b}, @ptr={0x70742a85, 0x1, &(0x7f0000000200)=""/149, 0x95, 0x1, 0x6}}, &(0x7f0000000340)={0x0, 0x20, 0x48}}}, @dead_binder_done, @enter_looper, @increfs_done={0x40106308, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000440)={@fd, @fd, @ptr={0x70742a85, 0x1, &(0x7f0000000380)=""/150, 0x96, 0x2, 0x28}}, &(0x7f00000004c0)={0x0, 0x18, 0x30}}, 0x1000}, @dead_binder_done], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:35:54 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r0, 0x4b6b, 0x0) ioctl$VT_RESIZE(r0, 0x5609, &(0x7f00000001c0)={0xf8e9, 0xda5, 0x8}) [ 2152.494115][T28766] binder: 28762:28766 ioctl 40046210 0 returned -22 [ 2152.520224][T28764] binder: 28760:28764 ioctl c0306201 0 returned -14 02:35:54 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5421, 0x400000) r1 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$SOCK_DESTROY(r1, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000040)={&(0x7f0000000180)={0x2388, 0x15, 0x100, 0x70bd26, 0x25dfdbfb, {0x1d, 0xc}, [@INET_DIAG_REQ_BYTECODE={0xed, 0x1, "1d00c4330e2daedb19fcaecb69517aff87f140b39c64e910960f61c3fc5a06b95266d8965062bd66706dc17ae5173a520ad81da071c782a7629a92db665a26bbadc5d6dc81d03af94cd7b8e000d3e79385b5696063005d4ff350ce46ee0be715e0415c8f5349db0aeaedd4bad33cee3eb92e840119a073c542bdbc7377a07f3ff70f42b6ddaab5e4b3cb1588d5a77502f1664e57c1280eb2658c43ec799bcf65dceabd0ff4a6c84c9f9a14b726ebb38518035d4db233867f6a164ef8cbd273488f50d62f95e74e75fde42c7a229d3e02674af6789464368b917ad946e522688238a00c1f4f99eb243e"}, @INET_DIAG_REQ_BYTECODE={0x5b, 0x1, "e10ed817f77ab3159134277f2e7e31816c0e23ab3b926609c7712d613c4e795819bece4c115bd7a3ae5bdeba0f221aca029ea9433221d012d8c8b074d2ba696f3a1f4a1721883c67ed54233fbf62740be31bac5c68ea2b"}, @INET_DIAG_REQ_BYTECODE={0x1004, 0x1, "bef84f8aed3a792bb702b37c04cbfa4a17cd7efeeebe623ec0203aa00e0e9574fd4177f6809d78d5e8bb990e68da21d3d61efe6e598f8560660bbc37f0231fdba160c2a9a5b0e78ea0073d843b20d5ac6a75af19daade54929f64cd3b63516e7ef3908ca270577d806322ba67243458d5a243270930295e18ef6e6acd90119c71fb9e7b082b990cb7d8ae994081bec03556a2c84734c7bb1b5d4d1ef49edc96333ed23bc5d4441586bfd6f43447e9d27d376a339b1f84dbff2494feea19abe0bd763f062f5a91279c226bb812178c78940f02a19ace2cf5f9904ba8009339549fd3ee5df06a25315b49a9bdb4b214d40d68366415089ff99b56a0e54c376b107fe7770bbf54de14cad6bd3924cc7f808dd59e16c8ab16d885965ddcc79b396639b92cd05ef2e71ffa2aa30d1af6fd291ce04fbca5c5834c937a5210a7c295406eb117108477730f728e8b31fd282fe8636c81c6f6f7c8d695fda018a5bf300d67f510835cf430d484986453f24847c04f2d64ee90c8394ca21e23c169346fe19c94862ec9f1704ae8101bb296a967490679ff8dfbfc56f6e75326e9d601ea4c2abca6d1eebc2a33ddac386377b8cda43ff0352ffa71b5435fe33490fdd5935c41386fcbb3c0e45fff279c8b905ef928add4aab80b3cbd8a861109cb9654df3ea277ff39163a35b64c3d08f4cfae37a7b6b66c11e7f13c2a2afa0bed9a91acf48e82d6475196881794dcbfc437c43a52f397fe47edea18973b2b73245c0ae0447823673a03ad7c3c85ffd1439aa34c3b97e66956cae336193cfb482f88124428dfb3e3e1a15737abd059f93762ebbe8b77bf7f58cb4a3e01b227c1841881639bd7f85520aa9e9a8446b12570556563e18a3fd50f7f33182ce688427544ebaf97a466acccf8785587c85bbf0a5f0b51ad537c7b7bc7b25786bba3e38ac4c897116f129499d90a7531075b3b6aabd35ca0f375be447cbd00bcc3326973d6c9274c97c08ce7a051ef35a6729dabb5223e690e845f78fbed1efd4f5d826a2ba1eb6b243c4fb2e39449656334ba5a5d452514855540467dedf54103995bfd93ac447ad688e231e62c06b2da01ee302584741a2bf8b66156d672774c39cba9edd3a4e7c9329e1da28f11a4b996e3853bd88374438ad501f830a375dcd1a7d1d6c407dc1f863459c0f0248162d6a90cd1acf64181062808fa4140d302713f457eddfc3e62febb2eada96ef8e86f60f6509801e171660f1ddbb177101aa49dfd0b9edb9daaa71023f26643124789956d7c4214cc77e41342928bb4e9022a7c56cce45bc05e7a8d0fe34ac1ca0546d5d0b2e4b10a7df0e98b81a1d10b2ea763d129dbe0b49613f90b38bd91955537966bcc1e99667a0cbf2dbfd99e9153ca43f6d02503cafd94b3297a7c28070d5b10290382faf1d523ba3baf3a9b20c88a1e805c37914fd13c272ef29821c2fd4bfcc3b66140746b0bb8eca39b6f66961ea2dc15c8d0b5529bb47a223b3671aed8c55bf8d6fc42bc73ea995a601997c5c36279ea0b1725fc32c3fb3c2de6ffa2d5d667801e6bbe827b981c5afd1a5f8b6eb4439e7ea174d4674d799f7258e5afc2457709a920ffc651469908b6409a245b83bcf130dc8a14e89012cb57fe0d0ffbe828a047ca637403fddb17287f800d9fb91d7fb06ae4706bd5c4a9ca2785330b61df328b7fc37fcdc3585a214c73e1d6cafe52168088f2c311842a1c2627cc5417b9469dbd6af47b13783e50da882d97bcdb576ba63dcd16d9a796056166fd02d4930231d2673779008adbc202d3aae0e5e4e1aaa46a1479bd9346146b927c03f4ba63b8e894c58f7093ebf344e4f566cfc39cedade834f7f3593e92d115d933ba680e4421df49b214b057412875cf3142e10de442207f0c26de3d93d57ccc701dbfcf0f2f9c7b4c7931d9317efa890ed36a03c489424774ad7e3851aff45179aee9c80298dd7d8ad8944001f9951f7b6c234abe90ea22547ee9181a6b0a3107e0cf9574b52004e9ea98436ecdcadea7cdceeca813d9e9b85dbecb4bb9e256b6ac8aca65f1fbfa9864c005ea9d3a067240d0ad3eb9e2c22afc7101b91a24d342cd2b86640801ff01d0fd45913c30cc5a511358122b581204af15de81632211b2f5291d6c282e11d0696c234aee7391796991876df230d1c488f3c5ad8c181a80c198d992a5125b0e054f35172f9a39dfe52e96446d8ea8be8aa9518d989a2c8bc28be2264417e4e415a332dd3424e01d3a9a9d120f2f73fcdb9f2c7f4835c0ef5a467408e627443947c608c8b49e06eaf079f7504ef0c8a26b7bc9faf47c4685c299cb5438e45df0614119a7b846030445b4a2a8c7eb6922050adf8673987dd4d7550a46f14d6e1cfdc95931b220cd9371cadaacaab162c8d526c63a6e70a0a51f5ddd5866a65581c4b8abe59b35411b0a3b096bead653380204426ec04cfc4be95a89ce3e704408c3f53742434e80670fce6c62ee2cea9f249c55339e4c3cb472f16b1275af6c0fefc63e5e0170b1cad074d97850a899e7a503365ad0117ef3589c2d0721620e951cd31512117deee57f23bf5a1ba7e57c822f6b6b3eebfe51992bbc53bf6209cc36c90a2c05b621d96719f79854113ebe8baba894442127b4b03ccc6f7946987477b7613f52f326b6d43be11872faa101dc8dea745b20a20ba55422efe504703946576f0eeff9d306496f77793c6ddc4149afe3eacd9189cd6c4408d488019d8de25c4c080c42c9b0c5d5495c77705984eb3b5d2eae8e90eb5330c9fa3915fdec0abe684534e77f841f2312669aae2af2f00d0a5bd9fcaee004d24d923968613bdc52163bf3efb8587f34091ab850d4b2f1ec1fa24c8446613695331182f316d527680b230e7cf3fa836fa98efc6f57c9cebb01f83068276e45aaeadb744b30feb7aafdd384d683cfc3f5dad6e9f39cfb162e9c3f36f4c0bc10f587b76c1aa9c679d7b097ac0b464f64e13de7bbc176a8d2055a6d4e2779270274862fc675e1a82abef68707d59a815647aacea04b0b11784d54fd477d83e84fadde963acdf8a64111951a1e9500873a4ba8906e9dc30ae297d507991c8595923b85cb912151e1e48c7d180fadbeb458096607f3fc0e692d1edb943ddd32240739ee2f83bba9915af3f411ccb56991555a9118eb01c86957c4a95cb17b6d322dda774b4af8ae9c4419b4c291ecf0f4a4b77b058da28a6636abe899d471b48fbd898afa68167dd28c4b1dd1d31a17b83c0131ddd2f5cbfc0bfda26993af22034860c8003541f12c727a90ad3d818331994f06d5a1c78343030a09be1081226d1a4dc409572dfc50f05d60ef7dc75bc07a7d6875e456a9ce62cf0b5ed3d8cfc930d003b39717d1567f10536bde0fe259abdbfcd6c8506d86bb5109c69886c8e32d734ecc20aee027f48d5f666b2652f30c0f07fa3e104a8ac5ac7cc4060ce6a9a2e69f57f26869f9d3ecb3dacdcae5ecbf89c3e9dccfefed9d8d20b13937626ef12468df4e9c6076108e4e2e976484065ff852511a24bd861f45685f426eb11ee5783a862d6b4b0eb0c6d389569471b6a1a553b3b92739f83c27f472641baa6d48ad8bf3171b307cb282a3e4dc9e227a64f6d5f27ab1ab690de979cc5064057af8f5fb7af3c0d1c6aa6442d751032331266ac762be5044f1298cc67aa9ec718803e6e1403e03035fa519360dadd8e9919113687c6a3be0ee3d0fffbd63b4388255ad9eeb78fb2bd1366de219dbc7d34338ea5ef022fed19011711883d4056e37f486a76112095f2531a9249e9d1c469ce8f85a28cfcd99f64680cc965b2bd273f893c66404e7d6b452863418cf4c5c5b9ae0de5b1969113c0f2e5a01f236f1f85135a99a6fce780a9c84043896d3c8b8a69be3091a59add8c3657b859c1b4cd3b42e9e8d2f12cb0e97a45f86e452f5eb5a8e189923f0662d9685ce7c95dc3a03f22760e4e51b192e74b940042012d00266aeb58fff15846d8b8e16e1b21eb239b4431659be2443065d01fb3671ca055ac58a0ee67cbc2a298b43c10442be45411bada6125b5cec890aee4f6867aae1163f8eec6ef2c8793a0b8da30a7f5258971b2c1dc092d81e6d394ad1c2c78b7c6493878b61e134e737ced8d785b8fddb1bb3f0fa8442141b541aa22e4615574707870b6c5938954c522f4b67351fcf8950dabd01b156bc1e9a53a7703a5db6fc4ce15119aabaaeb639836de517e19f159d2b9e947562eacf805c528a3811e4809dc45e1c71facd55336b965a9cbf5fc6f63bf56813b7fa71a26612dbe6bbff1e58d2bc18ccad699d80ab04785593dafc98d1f9e60b018dea3a1a5a608c378bc8e99dc6113db4c4f8a6bb956a794b8281c136df7df41c6f9ba4ebc9bcae463625122206a4307e7baa524bc5613da532d8fad2f0103c41b7caeaf05edd1798c474e6e66f616f39955528b10f50b384120829c3cb81f38a33352bbcbf728fa8a1dccd8df11e88823e312c56a3073236ccf6655a9ef28f32b2fb819c01b02898ec2f01868b53a8e4870544d0d12cc83286df5aee685b9a6c3bf4f17b5549050df9512a7443396bfd37aa4baa5354e3fe863941fa704c8295e67feca77577b0efb4d24e777a9eb764448ad0f174e65e4d801c75247bbf2e7b49f286ec8034f7b8f5ecbffe961e27d151f0b83322a927128e6306ec99102db4742df016ef1d47a1e0268779b044ff7412c9f958746c62c339742a2f375080fc2cdf953abfcdf15d143b386d19e8984dca485f1a675f48c99319d940b083c343497a3206ab4c55809b2e3378eb99342ca7d55160becb72f3c2c8671e5744567a42b3c9d1f11370c654147ed8794b71190e90b0b9d3a1349e6adb8100a44accbcc5449e3e41d988fc4c27cbff69757f4b6cec86d56d15f2e6de3d3abf3c9dbf05c11010232039946313ad1ed9dad74e62d565f07f1e6fb86766907c469203cc440ba4d3967c162c6f6aeadcd985e22db77d2e4ec58f0b30aebad0963f620ed0db8fa895832fbafbb58487938090c4e7c3c7ac11c243c544b73256c76cf04774e3ffec546fa36d06de0edb44680633dacc6abdb16dfbf70ed6b78d52261e25b7ea3393264be2ac7e4743d748784bb94b5e51603b3b855c8d51240a772dc53d9092cf7cae61e64e0b37d7fbec95698d213ce0ca15368f00d0208d33f02d6ef69ab216e1ffbbc14b02feccbc662d3f84f92b72f96f6f4c7a6f0348154b4e567d67d0a4a37c8a6681e77ac37d0d87b4d4c938572780539f8f8ebbd5370acc0f95b7270647dce5a284aec76bc5239a109bd7446af9d11f83d3bda67b4d60da5bde5171980122bff19e085a34242e6d551a860a8527fb86adae5cf965d0456bdc0514e0b30eca5085a7942cddcc5721931ae357d0d47966bfe7fd8284df760bdc2b3113c8b917771b58d34e085ccb0a966c34ac8e4b86a7c4875b8d1740d5c4b488c9c14c576526e5ace6b3b8f5f4dcb4d59a0c6514949b3240e9fe63c8fbb4277a249540d84ccb607d15734dd3f90d4bfd1ef29377afd11b0d50999aeed875b58741a55ae0d0f453c6a2c05714bdb0725e6aad8c004a6418340e4c72f6eb9d7db08125fb18242f3d3dd7733e70826536eecb3218f3cde3d9bf5b8a84accdbe1b782802a2893e3b9fe51019da08bfe65543b26f0c67a89bb11578618fc2e37aee67162a0824cbc233049a11caea15da25dce7601258cb0651263c6335c534c2b821d75b4f13564d5026aa991121dfbee14b5071dd39d42766889e725a087b83cf4220b477e10799a0445b012f93b940d31a9e0689b"}, @INET_DIAG_REQ_BYTECODE={0x1004, 0x1, "9de84935d1e62a0305161e202cde0f6c677f42a5bb6e24046ef8b2ce422164ba1845f3566db95a129a4fa97b4563e067e8607498c891f3dec3152aa8080b52447da1530f944b0d11edee7d7534e11eb6f74ef56eeb98043ac630c4eccfb52ad6a4da94acbe62a38ae30a24c3d10967b5213bb6f2756c90ed2863643a98bba9efb8db5ae47a2d7718aaec755a431d4e723766132274b4cb508dcc7cfbd3c7015ad5dda361edcfff5d940fc1379e6b414452de5f0230fe78299136794084c9207e23716386c578dbd8c139ed321984890ffe0335ce9a7815a2e82df66f5dceed27fd01bfdef44a86266b9ba1f86ac054ffa378da29c2f96868bae49009b7d6dead65e907e052f349c3617bc7929d3ef2df46dfce1f877a47d25685ce88fb11ada5ca6cd5ff660cbc2f345a9eba29bb633196deb70d881cefd81fe1e6147ac43b08b4dfc0315b7ba22f6a558d9c5e953f33ca4952fd755896d5f5a558f9beaa99f02b04ab40b6783419003c8332479d20656604285ff917036adb2c53d8e7dfa84ef2b0f7f96917b5e5fbac2f1b416912ddccf76b2ea34c1ca04f24e9860b1826e82025ee6e7ae8cf21ff9bdcc1383df307cb20b8aa86d479d81d99b603badf500873c09836dd3910d8da14796c14614054662b98b6f5b12cfc67fd172ace0e3c315acadf17861cf840ca7b10b06daecf8bc788002432307076ece6255c09c2476dfcd2af8910345c08eb06a1b3390178fa5c0647a93e20694ae8ed2b2ca40005263c9a2cfaa1a4f0fcc38ce9a48a65bb3fb8e767c3141c14da03d19c1422b2a289d21e97f301ab273656305b8118bf754e02ef74ce63045c0bcbfdd9ea089a99dc1b137f23e49f5c9beb13c684d8cd17016f6daa66afda7ca211b30ac554ac5739aa595b951853299db985a8983bc84790ae6649bf8a5cf679fb2655372694ad8f7f2007ff79b05d098ecd9a1e672acf1d371693d9067f239551c388ab76621398e25fcc760d2a5e5de2425c870c2294714429b20da36e27393c3f4e1127bd51f82fc00f12e36cc9d6e8dd575a471d8073976dec53cb526d860d4677e4786f08a5686ae9eef3328e0586ae1dc3c84b069a4c5bd4e087895dee3f6446267c597f9b6cbf8d0c2219f92a83d52044b02d10042a7169c672b747d82abafb4672788db84178c65c0d9b427f75a5c906d576b24601ad4759ed6a13e11be7391358f76dda3709d0c6c1acc7bd86928f7629fb7ae0bcea33079d2b72b221b99cc1968673e16e456d11726c0ab1fcaf6d3481b8deee186267e3b1082c497fa099225d77d0fb706e98a53b2d8c60cf88c2b4cd65c777d9d11e7c58108652afe7c758c8011afa22e25649513b9824d1d5f6cf4997c77a9c0abfc68e10943a8a351a4467b57086223b231b25585323e66b5a907a399b1df09aeeb35e000d19fbd26462736e06a19985db673c9a736c21e908af216b76d4c521156fc26d0aab9e3cb1d8a21953795ae491b11997613802b9d05a88bdade5c6047682bd4e1561289b00ee53ec5f6ace0988f0e36bf711543b6b69f542035440419cf88d7e112f669a02d3c81ce4ae18b136588d4973ffe8bc9b7214d0f2c9e17eb30fe72bf7b0abb2bf34762e22b67ae8e4d4ac8d28363e0a5d262752c52cc9d508812d87460e8299c490e62442b00caf55688fd93e8379db21b2e2d2c5d3ebe43cfbaa9738585da872cb4e6742e28b59f4021bb4ab7166756b9f26df038a67cc490624cedeaad7dc9b4b7ba1d172d4f89fd81ab7ae4ebf33ce560cae451eed6cfaae781bd24e4a3ca3802528c91a3ef79a6864bc099ce695f0cc8d428b3db72c5fe2e65f30c530a9957e11350458349297229a21cbecedfac4befa378a97a30cf2352040d19e7751cbf818d9b6dda6d6165aef8624fe3f7ff5480cd360f6d8bb5d544251f10458cb1fe3d8fee76cbf2a2f902a1b8397de835ecb1ecfb73009ec91bde1eb37b3642ee217cc946b5e896e8bd528e1557b86ccf66f6287334c28e3af578bf36652f03a51d09fb40b07a48f32161d7007bbb34ca09907996a435e540942d2a3ba596ab3ee79a94facfdddbcabfea87155bfebed1e9cc7c947fecdbe60922e8e66cd2b0236022599c071cfd5ddbc722f7fdb5a44101c045990e9d43bdc51e046012eee59552bcdddaab68c861135dc057ba1d60cf071e5eca0a3eb5c74f278ea0fb883adedb8cea73cad200e76b01e7f84029a2779df16d8b0a163f35925332f5b5622083f2b736bbeacd3c728188d7464b709d2e24632b3f7a7779489755afc9f20d1a3e268b61275fa7cb4239aefb5bd13ee607a414f4fd2ac8dd59af2fe35c722d4905c01e4724811149b9eab554324396c35896ad57a7a316200f148243e427e1686bb4a5cc1f10256b1d393c28205ba8d5ba34612a3084c484188bf942e9f6d56b52068b6eb4783f594ac968b46a2a216052603499c188e7c91cb9229a0220171aa2195cbe980c2e7b2920d2056c4a5d789295d54ebc68a47d8570a43b83d02741ed5f741460a9d982aa36b2a1ec97a0a0f0b38fd92b0969ac981bbcd145dd84a49d83fd827cf2cfce05f90a7245c752eef4c1398d131a47a69159b7efc295bde3572f580e74b849902cc73dde27d1b89f15e4bdab989ac18cd75a13360c2aef3ad52076efbce359f12fced31649886b5c2706fab424f2d26dc9709fa1f7aeebd83df8b7753a8073f24f83414c922b51d994e56386e0aec1e07d0bfec26e19c8b372da2438b582007795ae0cf483d81fd0ccec71dbdb8cabdb30615e4b3875e85ac3f7c44f90fc87678d2b3db18c67df1b4803f386d1b517086528e82c3f906d1f81df297b4faa2fd0766f3737f1ba8cd6719841dfe36a8a597091e0086a8b4df2959c9115ff26b1a79ee747a4a74f04f14b8dc90ac8a68f1a16c760ee578342ef889b587aa8f8e5246c72a2d22d448c669e6a0081f269dea5d738d1e0ef1887865f172ad5943017a572687cafed784a0ef52774e11d020bf7554acbade106c74de1d2b28856f16322a0351a6af0299bbe31e38f40f9fba92130575d8411d1c33a37b3e17e8f0703c9c8cb5897e2114153662f56427f40cfa984a2c63701f45bd5cc4c1c2f71bddb346205e3350ddeb6e6d7d5f553b33cfb591eeb5dd6e690e25e07484d993b7357ee14df5cba2c675bf00ee8ecc17a69c9e106bd0e8a23b9b0d4db564b1807f30ec0e32a7d1a6fc653b5b63f26d11e65ca2ee4f8b32b6fd322f89b275450f008c5a792acba105413610836f6c6c1aab3baca23883a31ab7caa66f7d6fc8d8307ffd9e38f8bcb0878e3954fcd351a0390b1f1ed9f0cb4f2345f2e7ffb18a88e10e4f7d6a93e4e2b3c911a2c2455e74e38ad9d162693f07004ca275e793be59ae694a63e07fcb84591a7c7f161abed91b0ae0b4e5d06603884ce39323f660c33b9b9af2a3ac9935b64b0b80b71310498c6ada51370bb2b2d9004a882be3dcb0ab8e0fc70b270ee18ba8361ca89f7b4ba334aa28e753bef6fed098c175ec5b2471d2e2b27f201a76f41ed1955020c729c1dd1115eb4714459183f99e8c65e1751ee5c196457f9a0a5759345ca4edd3bc6c9d38bdcd1ecdb342889d68fda77ec532eed6fccf1ed46f38fb3efd50cf32fed9be40608f0f7f2863c7e34fffb4657ce322b47e55139c6997a87e27afb5dce429a0064f2cbbbbb5b75987574793884b42361385124d6fe6f8f1ad0c6c1cafc03187a5589c6b1a8d9793f26b6bd4a551dffd03c845ddb4b3f84f605b52784048c1a00bb6d9ee6444b8871305359ec54e676e51a7de12f23a4c4eb6ca342b16876026f90d80c2ba8abd2fb0fcf3656c534a07c100d9020a893679f09c007af4add06b036374c6061f4dff875348d024ea62d55eae7a8e03c190bab4b7fa69fbfade03e5e7275861379228c24cd46808b799fd7a9eca74c6365aa6ba5c94f18dd681197d0cc2a8efb95015b6f91e66e5ee9920e4581c016eab9eb1f51ac853e2b195e77fc5b2ac8d3d7e5ddbb3822a63e933579f8d555ab1469e22c7d1ddcccb0b1981321f4f3eb6d705a5f6338c60365b1416af38f6fe61b81bf3b4ea49b4a56ea8e424631044036c19277a5f82b12bb04c8b01d0243d705bc3a71762d7d8ef518c8ba03c4be9f76c7e9fbfdeca1a5170c8bf3e44af969febd2f2db10d8863ffe5a868c2a98a962167f3f36b57bbeb4f895b0a463a164a46e53cfd1734151d950dd23d8236a180a0ad5d9eed830bed3a3171acee4e2404a5f39ca7f9e6e06aa40f54289437ee1918b0d734dd7ae5b2d379678f68993c08d18829ea97a60e4b19521744fb2aa7c279f36a42fe53f71a1386490e08934d18a7b6287315e9899b288234449ccacdbf76d7b36726a07237753837799ffe5cc22825c50f32cd3495324c7456c8ad56aa042ca97c15437bf41eaf1da18779fe9490d3139019a215f1ca3f94dd47d56c4b1a340b85cb192c87ad75d7ee1f481e5b43b675724cb2eb5b0046e8cec91dfa365d422a7f716173d54d373410af650e8528f15fcc66e94a7fe7a10cf0e6bff6a4c56455a4922a460d281356d0c9e7708905a082d4ba2d12b7ee6803b0840cebbf23c01463a3d48e6a3b84ee1ec1e011fcc0259363540507107954322d1a8d2468403e74dd0b43d345411ae46ea6856711cded9c33e8203c4e28d5e8f86764c4d4a4a48329a9cdfcd38fb9ce37428b4b4065e1827412f60341e72a367f3554f3af0d87aeada792fbd84145e81f2c35aaf9c872730ee6cd4031e5557695fc0574704b5ab1e9dc794dc01ed2242e337fe9ba1fae984f35545c495c2036ee7db208fa39922e7322000064eb6c3dda5f07ec56f4f5436d32404757910bfdd4494a00f223299430aa7f5929fe45b0e1a42ec91e904f7ea79d5e3e2496d55a661593506c058340b2f52ceca031391c008056960236849f94592d749cf7b6659d01de37a75a981828ccd54fcdccb72820b2c7d3f17b6e418a8121538383044ee1d3807f88b4aa11815005ba1e1cf558266803e723257f5c25da83b7c33ae973b708312b8889c1d0f79b940b8bd783d02f327dbf0bc9e191aa6dceeb81d161f7507df41bebedc3707ff72ee34d7358c724cd6959a9a2aa2fa884980d9fe7a56e8c571a5ec3aaafb75089cc7013bb4ce4ef3f280e46086535498fdac4572226171f48db4253bd89f196a33c7e7fdf953e4f71bacab0a06205445cbb9b28f71fa0caa52cb7533eb86c7a1db487cc8fd8858dc2961c3927e828c70def149b66629c898f0ad8cd4b49cb93eb09424cd3a486e1e01437e13f19136a551b1eb6dfc60653d5fc91b046321a5aad75b52212cfa484e520297b6dd01a54ebb8204014b585e13ebd0e314395ddb2fbf506a0bab714fe56d205a87a0476786a9a7591cf29f63ed66ea8bc977b13ee501090efe681ca3dae88ba21290c969b14ae5bf9e3db34643c1e3ce2dbde45458eec391716bf70b9308fe0ec118136d484fe3f5c91b585e1a1e1d199d817772afc57dd5eaacc041501be2c2ca136e39f70c61aa8e994355c53f40cb2ea8b9eef177cae5410e05d699a942ba8354ffe049cb68e659a161463947569c8385f0fbcd75893dc7edf3edd0040168fd5a1b753475de66d12066e719337165793e9c1f5404baf237d8a80d00978c4e87bd38900e83742ae7d0a82f493e90e71836d8c457a65800a130da0656bb24386b599af4caaf4cd462e1093edcee6224ca4f210b4d434d22e85d5973a0ff7dbae80b24d6b013a299d86151d2a91a74e0b2bcac77ba5573aa6daeb2a7"}, @INET_DIAG_REQ_BYTECODE={0x17, 0x1, "70f7d1bd4bd98a65c2ecc1bd62014c93135536"}, @INET_DIAG_REQ_BYTECODE={0xc4, 0x1, "bf73c101fa8411d68d676d26fbc1b65a15449b008a586331286da3f1c4c51f9dbfde59914f719344d51beb41b18382e831c462d46a5fe823e7f338c41e22cc9c377ca130fd6a48c35fcadf30e8fb61840cb6da680097bb5bfe5237ff401be613ad1dcee1f0c6268079454e4e87b71dd6b85e75f13c12f8d02411fc76191aa06f5ada9a18d2ebcd92351d014a2c14984a9d9ab4bdc72626d7a3c3d66a72243ab4a04bf5ea9bed398a1d901059e7719c3c845822315823f2213bd0122b15d1eb3a"}, @INET_DIAG_REQ_BYTECODE={0xa6, 0x1, "4ddc91ea3e8d04881225f2644d8c516e84c5628745376fd420cf6fd4ec9988d144f352c86b41e1a7cd14ef063272cb7115b81bce2c106d0684ad103ec35519de4d396110b909480de36fd3ab43a51533e2ec064cb7d832a633053f8364f5882ba0cab8d114fd0eb764828b25c9e45ac723d229d725f940199f26c2195005e6fb2851d431d9f7635cd513dff95f6f5dbb4e9c1b4e8e71a253f36d1715b5e82919aa29"}, @INET_DIAG_REQ_BYTECODE={0x5f, 0x1, "74442dcc3ae87f713e992f3ec3233934785f26d44038bc508031c83072a605b35ef5349a1b66477ba5bb84ade8e68b3b1a6fe347dd6f411c2607206e2bbcc4138581eee7a1926e21de3458921a4e20d564890d895a8a2eb33f6755"}, @INET_DIAG_REQ_BYTECODE={0x3c, 0x1, "d2531adaa32b323f6d3196a530c4dc311f2689f09c140fa714d3e6fc6f1f407d5018ae64d4b1beaa084af8206ce31282d46bab2b6bde250c"}]}, 0x2388}, 0x1, 0x0, 0x0, 0x8800}, 0x841) r2 = accept4(r1, 0x0, &(0x7f0000008640), 0x80000) setsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r2, 0x84, 0x8, &(0x7f0000008680)=0x9, 0x4) 02:35:54 executing program 1: syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f00000001c0)={0x24, &(0x7f0000000040)={0x0, 0x21, 0x7e, {0x7e, 0xb, "bc856d7a562850452f64ece0060a6121de01f0ec7baac41b1dc40dbde7f48b8d7c0cf97d30207227ae63d48b7da99082057e7129a7478db2a6f1ef19677b4b4b30a3c02bdf0ddf05a30f91c3d7e8d394d621d1112b7ad2912e3ba9f78bce7ffb298ff80255ee97f319efae71e4180b77f3f9ff51f8e4567d681f4dbe"}}, &(0x7f0000000100)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x807}}, &(0x7f0000000140)={0x0, 0x22, 0x15, {[@main=@item_012={0x1, 0x0, 0x8, "96"}, @global=@item_012={0x1, 0x1, 0x5, 't'}, @global=@item_4={0x3, 0x1, 0x4, "d628113f"}, @global=@item_012={0x1, 0x1, 0x6, "a1"}, @main=@item_4={0x3, 0x0, 0xc, "095ca76a"}, @main=@item_4={0x3, 0x0, 0xb, "76789e42"}]}}, &(0x7f0000000180)={0x0, 0x21, 0x9, {0x9, 0x21, 0x0, 0x1, 0x1, {0x22, 0xaa4}}}}, &(0x7f0000000480)={0x2c, &(0x7f0000000200)={0x20, 0x1, 0xd7, "2f730a1dcb71b55a6e85f0658c0c042619d8e57cfe40a2c3f6e89ff68ae3282519744219031f85d2c7b3be44fdfc1958af0887752129c6a88811054ade2c86e93eda6476d3c3198f7086cf682b643c1860811113086554c2dd129f2c7b6ef49c7716f82e4cd464ac0abc09ee8d9df45d1eea7351c2636dc4d8a99d51688930be0e82195e011f56ca13baa7e78f8c17c34c7cbc35f224477a08254f6cb4ba28ff237373f98840d95835d03dff42488a4c5a3202d29139715ca9c8fd0a2724029f5900eaac6eb4ad4f431b17ee2aa6d319ae36ef1c51f758"}, &(0x7f0000000300)={0x0, 0xa, 0x1, 0x9}, &(0x7f0000000340)={0x0, 0x8, 0x1, 0x6}, &(0x7f0000000380)={0x20, 0x1, 0xaf, "96a8486f615a8a35393efc34e3e46fdd419a8593f3efb50ec6d306567dcd1498256a494cc859434ba2c2cf492e63c8973100a333c3dfeb2f486467b3bcf6cbe49c38b0357719055e457d5baa7f5e1f6dc700b5ff277dae8dad9b9df3a1ff8a862f0a2ad62a22fc8d0a191150684d6f938362a56c90e542a6121d6ff16b1b0b3d3f6fd7f7b6dbb6c0921e1be9d4a138287e24213278365f16dde324c20bca795c23844cc6c89619fc2da44d821b3f00"}, &(0x7f0000000440)={0x20, 0x3, 0x1, 0x9}}) ioctl$GIO_SCRNMAP(0xffffffffffffffff, 0x4b40, &(0x7f00000004c0)=""/166) r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f00000005c0)={0x7, 0x0, 0x1}) syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000580)=0x2) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046210, 0x0) [ 2152.710142][T28771] binder: 28769:28771 ioctl c0306201 0 returned -14 02:35:54 executing program 5: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x4020940d, 0x400000) 02:35:54 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x118, 0x0, &(0x7f0000000500)=[@acquire_done={0x40106309, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@weak_handle={0x77682a85, 0xa, 0x3}, @fda={0x66646185, 0x5, 0x1}, @flat=@weak_binder={0x77622a85, 0x0, 0x8}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@fda={0x66646185, 0x9, 0x0, 0x9}, @ptr={0x70742a85, 0x1, &(0x7f0000000140)=""/153, 0x99, 0x0, 0x1b}, @ptr={0x70742a85, 0x1, &(0x7f0000000200)=""/149, 0x95, 0x1, 0x6}}, &(0x7f0000000340)={0x0, 0x20, 0x48}}}, @dead_binder_done, @enter_looper, @increfs_done={0x40106308, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000440)={@fd, @fd, @ptr={0x70742a85, 0x1, &(0x7f0000000380)=""/150, 0x96, 0x2, 0x28}}, &(0x7f00000004c0)={0x0, 0x18, 0x30}}, 0x1000}, @dead_binder_done], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) [ 2152.795202][T28776] binder: 28773:28776 ioctl 40046210 0 returned -22 [ 2152.901200][T28781] binder: 28779:28781 ioctl c0306201 0 returned -14 02:35:55 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x40049409, 0x400000) 02:35:55 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5609, &(0x7f00000001c0)={0xf8e9, 0xda5, 0x8}) 02:35:55 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) recvmmsg(r0, &(0x7f0000004640)=[{{0x0, 0x0, &(0x7f0000003000)=[{&(0x7f0000000a80)=""/4096, 0x1000}, {&(0x7f0000001a80)=""/235, 0xeb}, {&(0x7f0000001b80)=""/254, 0xfe}, {&(0x7f0000001c80)=""/4096, 0x1000}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x9, &(0x7f00000030c0)=""/161, 0xa1}, 0x9}], 0x1, 0x2, 0x0) 02:35:55 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x118, 0x0, &(0x7f0000000500)=[@acquire_done={0x40106309, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@weak_handle={0x77682a85, 0xa, 0x3}, @fda={0x66646185, 0x5, 0x1}, @flat=@weak_binder={0x77622a85, 0x0, 0x8}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@fda={0x66646185, 0x9, 0x0, 0x9}, @ptr={0x70742a85, 0x1, &(0x7f0000000140)=""/153, 0x99, 0x0, 0x1b}, @ptr={0x70742a85, 0x1, &(0x7f0000000200)=""/149, 0x95, 0x1, 0x6}}, &(0x7f0000000340)={0x0, 0x20, 0x48}}}, @dead_binder_done, @enter_looper, @increfs_done={0x40106308, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000440)={@fd, @fd, @ptr={0x70742a85, 0x1, &(0x7f0000000380)=""/150, 0x96, 0x2, 0x28}}, &(0x7f00000004c0)={0x0, 0x18, 0x30}}, 0x1000}, @dead_binder_done], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:35:55 executing program 5: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x4020940d, 0x400000) 02:35:55 executing program 5: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x4020940d, 0x400000) 02:35:55 executing program 3: ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, &(0x7f00000001c0)={0xf8e9, 0xda5, 0x8}) 02:35:55 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x118, 0x0, &(0x7f0000000500)=[@acquire_done={0x40106309, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@weak_handle={0x77682a85, 0xa, 0x3}, @fda={0x66646185, 0x5, 0x1}, @flat=@weak_binder={0x77622a85, 0x0, 0x8}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@fda={0x66646185, 0x9, 0x0, 0x9}, @ptr={0x70742a85, 0x1, &(0x7f0000000140)=""/153, 0x99, 0x0, 0x1b}, @ptr={0x70742a85, 0x1, &(0x7f0000000200)=""/149, 0x95, 0x1, 0x6}}, &(0x7f0000000340)={0x0, 0x20, 0x48}}}, @dead_binder_done, @enter_looper, @increfs_done={0x40106308, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000440)={@fd, @fd, @ptr={0x70742a85, 0x1, &(0x7f0000000380)=""/150, 0x96, 0x2, 0x28}}, &(0x7f00000004c0)={0x0, 0x18, 0x30}}, 0x1000}, @dead_binder_done], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:35:55 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x40049409, 0x400000) 02:35:55 executing program 1: syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f00000001c0)={0x24, &(0x7f0000000040)={0x0, 0x21, 0x7e, {0x7e, 0xb, "bc856d7a562850452f64ece0060a6121de01f0ec7baac41b1dc40dbde7f48b8d7c0cf97d30207227ae63d48b7da99082057e7129a7478db2a6f1ef19677b4b4b30a3c02bdf0ddf05a30f91c3d7e8d394d621d1112b7ad2912e3ba9f78bce7ffb298ff80255ee97f319efae71e4180b77f3f9ff51f8e4567d681f4dbe"}}, &(0x7f0000000100)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x807}}, &(0x7f0000000140)={0x0, 0x22, 0x15, {[@main=@item_012={0x1, 0x0, 0x8, "96"}, @global=@item_012={0x1, 0x1, 0x5, 't'}, @global=@item_4={0x3, 0x1, 0x4, "d628113f"}, @global=@item_012={0x1, 0x1, 0x6, "a1"}, @main=@item_4={0x3, 0x0, 0xc, "095ca76a"}, @main=@item_4={0x3, 0x0, 0xb, "76789e42"}]}}, &(0x7f0000000180)={0x0, 0x21, 0x9, {0x9, 0x21, 0x0, 0x1, 0x1, {0x22, 0xaa4}}}}, &(0x7f0000000480)={0x2c, &(0x7f0000000200)={0x20, 0x1, 0xd7, "2f730a1dcb71b55a6e85f0658c0c042619d8e57cfe40a2c3f6e89ff68ae3282519744219031f85d2c7b3be44fdfc1958af0887752129c6a88811054ade2c86e93eda6476d3c3198f7086cf682b643c1860811113086554c2dd129f2c7b6ef49c7716f82e4cd464ac0abc09ee8d9df45d1eea7351c2636dc4d8a99d51688930be0e82195e011f56ca13baa7e78f8c17c34c7cbc35f224477a08254f6cb4ba28ff237373f98840d95835d03dff42488a4c5a3202d29139715ca9c8fd0a2724029f5900eaac6eb4ad4f431b17ee2aa6d319ae36ef1c51f758"}, &(0x7f0000000300)={0x0, 0xa, 0x1, 0x9}, &(0x7f0000000340)={0x0, 0x8, 0x1, 0x6}, &(0x7f0000000380)={0x20, 0x1, 0xaf, "96a8486f615a8a35393efc34e3e46fdd419a8593f3efb50ec6d306567dcd1498256a494cc859434ba2c2cf492e63c8973100a333c3dfeb2f486467b3bcf6cbe49c38b0357719055e457d5baa7f5e1f6dc700b5ff277dae8dad9b9df3a1ff8a862f0a2ad62a22fc8d0a191150684d6f938362a56c90e542a6121d6ff16b1b0b3d3f6fd7f7b6dbb6c0921e1be9d4a138287e24213278365f16dde324c20bca795c23844cc6c89619fc2da44d821b3f00"}, &(0x7f0000000440)={0x20, 0x3, 0x1, 0x9}}) ioctl$GIO_SCRNMAP(0xffffffffffffffff, 0x4b40, &(0x7f00000004c0)=""/166) r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f00000005c0)={0x7, 0x0, 0x1}) syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000580)=0x2) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046210, 0x0) 02:35:55 executing program 5: ioctl$TIOCSTI(0xffffffffffffffff, 0x4020940d, 0x400000) 02:35:55 executing program 3: ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, &(0x7f00000001c0)={0xf8e9, 0xda5, 0x8}) 02:35:55 executing program 2: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000680)={0x118, 0x0, &(0x7f0000000500)=[@acquire_done={0x40106309, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@weak_handle={0x77682a85, 0xa, 0x3}, @fda={0x66646185, 0x5, 0x1}, @flat=@weak_binder={0x77622a85, 0x0, 0x8}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@fda={0x66646185, 0x9, 0x0, 0x9}, @ptr={0x70742a85, 0x1, &(0x7f0000000140)=""/153, 0x99, 0x0, 0x1b}, @ptr={0x70742a85, 0x1, &(0x7f0000000200)=""/149, 0x95, 0x1, 0x6}}, &(0x7f0000000340)={0x0, 0x20, 0x48}}}, @dead_binder_done, @enter_looper, @increfs_done={0x40106308, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000440)={@fd, @fd, @ptr={0x70742a85, 0x1, &(0x7f0000000380)=""/150, 0x96, 0x2, 0x28}}, &(0x7f00000004c0)={0x0, 0x18, 0x30}}, 0x1000}, @dead_binder_done], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:35:55 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x40049409, 0x400000) [ 2153.559776][T28807] binder: 28805:28807 ioctl 40046210 0 returned -22 02:35:56 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) recvmmsg(r0, &(0x7f0000004640)=[{{0x0, 0x0, &(0x7f0000003000)=[{&(0x7f0000000a80)=""/4096, 0x1000}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x8, &(0x7f00000030c0)=""/161, 0xa1}, 0x9}], 0x1, 0x2, 0x0) 02:35:56 executing program 5: ioctl$TIOCSTI(0xffffffffffffffff, 0x4020940d, 0x400000) 02:35:56 executing program 3: ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, &(0x7f00000001c0)={0xf8e9, 0xda5, 0x8}) 02:35:56 executing program 4: ioctl$TIOCSTI(0xffffffffffffffff, 0x40049409, 0x400000) 02:35:56 executing program 2: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000680)={0x118, 0x0, &(0x7f0000000500)=[@acquire_done={0x40106309, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@weak_handle={0x77682a85, 0xa, 0x3}, @fda={0x66646185, 0x5, 0x1}, @flat=@weak_binder={0x77622a85, 0x0, 0x8}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@fda={0x66646185, 0x9, 0x0, 0x9}, @ptr={0x70742a85, 0x1, &(0x7f0000000140)=""/153, 0x99, 0x0, 0x1b}, @ptr={0x70742a85, 0x1, &(0x7f0000000200)=""/149, 0x95, 0x1, 0x6}}, &(0x7f0000000340)={0x0, 0x20, 0x48}}}, @dead_binder_done, @enter_looper, @increfs_done={0x40106308, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000440)={@fd, @fd, @ptr={0x70742a85, 0x1, &(0x7f0000000380)=""/150, 0x96, 0x2, 0x28}}, &(0x7f00000004c0)={0x0, 0x18, 0x30}}, 0x1000}, @dead_binder_done], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:35:56 executing program 1: syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f00000001c0)={0x24, &(0x7f0000000040)={0x0, 0x21, 0x7e, {0x7e, 0xb, "bc856d7a562850452f64ece0060a6121de01f0ec7baac41b1dc40dbde7f48b8d7c0cf97d30207227ae63d48b7da99082057e7129a7478db2a6f1ef19677b4b4b30a3c02bdf0ddf05a30f91c3d7e8d394d621d1112b7ad2912e3ba9f78bce7ffb298ff80255ee97f319efae71e4180b77f3f9ff51f8e4567d681f4dbe"}}, &(0x7f0000000100)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x807}}, &(0x7f0000000140)={0x0, 0x22, 0x15, {[@main=@item_012={0x1, 0x0, 0x8, "96"}, @global=@item_012={0x1, 0x1, 0x5, 't'}, @global=@item_4={0x3, 0x1, 0x4, "d628113f"}, @global=@item_012={0x1, 0x1, 0x6, "a1"}, @main=@item_4={0x3, 0x0, 0xc, "095ca76a"}, @main=@item_4={0x3, 0x0, 0xb, "76789e42"}]}}, &(0x7f0000000180)={0x0, 0x21, 0x9, {0x9, 0x21, 0x0, 0x1, 0x1, {0x22, 0xaa4}}}}, &(0x7f0000000480)={0x2c, &(0x7f0000000200)={0x20, 0x1, 0xd7, "2f730a1dcb71b55a6e85f0658c0c042619d8e57cfe40a2c3f6e89ff68ae3282519744219031f85d2c7b3be44fdfc1958af0887752129c6a88811054ade2c86e93eda6476d3c3198f7086cf682b643c1860811113086554c2dd129f2c7b6ef49c7716f82e4cd464ac0abc09ee8d9df45d1eea7351c2636dc4d8a99d51688930be0e82195e011f56ca13baa7e78f8c17c34c7cbc35f224477a08254f6cb4ba28ff237373f98840d95835d03dff42488a4c5a3202d29139715ca9c8fd0a2724029f5900eaac6eb4ad4f431b17ee2aa6d319ae36ef1c51f758"}, &(0x7f0000000300)={0x0, 0xa, 0x1, 0x9}, &(0x7f0000000340)={0x0, 0x8, 0x1, 0x6}, &(0x7f0000000380)={0x20, 0x1, 0xaf, "96a8486f615a8a35393efc34e3e46fdd419a8593f3efb50ec6d306567dcd1498256a494cc859434ba2c2cf492e63c8973100a333c3dfeb2f486467b3bcf6cbe49c38b0357719055e457d5baa7f5e1f6dc700b5ff277dae8dad9b9df3a1ff8a862f0a2ad62a22fc8d0a191150684d6f938362a56c90e542a6121d6ff16b1b0b3d3f6fd7f7b6dbb6c0921e1be9d4a138287e24213278365f16dde324c20bca795c23844cc6c89619fc2da44d821b3f00"}, &(0x7f0000000440)={0x20, 0x3, 0x1, 0x9}}) ioctl$GIO_SCRNMAP(0xffffffffffffffff, 0x4b40, &(0x7f00000004c0)=""/166) r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f00000005c0)={0x7, 0x0, 0x1}) syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000580)=0x2) r1 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046210, 0x0) 02:35:56 executing program 4: ioctl$TIOCSTI(0xffffffffffffffff, 0x40049409, 0x400000) 02:35:56 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5609, &(0x7f00000001c0)={0xf8e9, 0xda5, 0x8}) 02:35:56 executing program 2: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000680)={0x118, 0x0, &(0x7f0000000500)=[@acquire_done={0x40106309, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@weak_handle={0x77682a85, 0xa, 0x3}, @fda={0x66646185, 0x5, 0x1}, @flat=@weak_binder={0x77622a85, 0x0, 0x8}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@fda={0x66646185, 0x9, 0x0, 0x9}, @ptr={0x70742a85, 0x1, &(0x7f0000000140)=""/153, 0x99, 0x0, 0x1b}, @ptr={0x70742a85, 0x1, &(0x7f0000000200)=""/149, 0x95, 0x1, 0x6}}, &(0x7f0000000340)={0x0, 0x20, 0x48}}}, @dead_binder_done, @enter_looper, @increfs_done={0x40106308, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000440)={@fd, @fd, @ptr={0x70742a85, 0x1, &(0x7f0000000380)=""/150, 0x96, 0x2, 0x28}}, &(0x7f00000004c0)={0x0, 0x18, 0x30}}, 0x1000}, @dead_binder_done], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:35:56 executing program 5: ioctl$TIOCSTI(0xffffffffffffffff, 0x4020940d, 0x400000) 02:35:56 executing program 4: ioctl$TIOCSTI(0xffffffffffffffff, 0x40049409, 0x400000) [ 2154.302739][T28825] binder: 28824:28825 ioctl 40046210 0 returned -22 02:35:56 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSTI(r0, 0x40049409, 0x400000) 02:35:57 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5452, 0x400000) 02:35:57 executing program 5: r0 = openat$proc_capi20(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSTI(r0, 0x4020940d, 0x400000) 02:35:57 executing program 3: syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, &(0x7f00000001c0)={0xf8e9, 0xda5, 0x8}) 02:35:57 executing program 2: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x118, 0x0, &(0x7f0000000500)=[@acquire_done={0x40106309, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@weak_handle={0x77682a85, 0xa, 0x3}, @fda={0x66646185, 0x5, 0x1}, @flat=@weak_binder={0x77622a85, 0x0, 0x8}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@fda={0x66646185, 0x9, 0x0, 0x9}, @ptr={0x70742a85, 0x1, &(0x7f0000000140)=""/153, 0x99, 0x0, 0x1b}, @ptr={0x70742a85, 0x1, &(0x7f0000000200)=""/149, 0x95, 0x1, 0x6}}, &(0x7f0000000340)={0x0, 0x20, 0x48}}}, @dead_binder_done, @enter_looper, @increfs_done={0x40106308, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000440)={@fd, @fd, @ptr={0x70742a85, 0x1, &(0x7f0000000380)=""/150, 0x96, 0x2, 0x28}}, &(0x7f00000004c0)={0x0, 0x18, 0x30}}, 0x1000}, @dead_binder_done], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:35:57 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSTI(r0, 0x40049409, 0x400000) 02:35:57 executing program 1: syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f00000001c0)={0x24, &(0x7f0000000040)={0x0, 0x21, 0x7e, {0x7e, 0xb, "bc856d7a562850452f64ece0060a6121de01f0ec7baac41b1dc40dbde7f48b8d7c0cf97d30207227ae63d48b7da99082057e7129a7478db2a6f1ef19677b4b4b30a3c02bdf0ddf05a30f91c3d7e8d394d621d1112b7ad2912e3ba9f78bce7ffb298ff80255ee97f319efae71e4180b77f3f9ff51f8e4567d681f4dbe"}}, &(0x7f0000000100)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x807}}, &(0x7f0000000140)={0x0, 0x22, 0x15, {[@main=@item_012={0x1, 0x0, 0x8, "96"}, @global=@item_012={0x1, 0x1, 0x5, 't'}, @global=@item_4={0x3, 0x1, 0x4, "d628113f"}, @global=@item_012={0x1, 0x1, 0x6, "a1"}, @main=@item_4={0x3, 0x0, 0xc, "095ca76a"}, @main=@item_4={0x3, 0x0, 0xb, "76789e42"}]}}, &(0x7f0000000180)={0x0, 0x21, 0x9, {0x9, 0x21, 0x0, 0x1, 0x1, {0x22, 0xaa4}}}}, &(0x7f0000000480)={0x2c, &(0x7f0000000200)={0x20, 0x1, 0xd7, "2f730a1dcb71b55a6e85f0658c0c042619d8e57cfe40a2c3f6e89ff68ae3282519744219031f85d2c7b3be44fdfc1958af0887752129c6a88811054ade2c86e93eda6476d3c3198f7086cf682b643c1860811113086554c2dd129f2c7b6ef49c7716f82e4cd464ac0abc09ee8d9df45d1eea7351c2636dc4d8a99d51688930be0e82195e011f56ca13baa7e78f8c17c34c7cbc35f224477a08254f6cb4ba28ff237373f98840d95835d03dff42488a4c5a3202d29139715ca9c8fd0a2724029f5900eaac6eb4ad4f431b17ee2aa6d319ae36ef1c51f758"}, &(0x7f0000000300)={0x0, 0xa, 0x1, 0x9}, &(0x7f0000000340)={0x0, 0x8, 0x1, 0x6}, &(0x7f0000000380)={0x20, 0x1, 0xaf, "96a8486f615a8a35393efc34e3e46fdd419a8593f3efb50ec6d306567dcd1498256a494cc859434ba2c2cf492e63c8973100a333c3dfeb2f486467b3bcf6cbe49c38b0357719055e457d5baa7f5e1f6dc700b5ff277dae8dad9b9df3a1ff8a862f0a2ad62a22fc8d0a191150684d6f938362a56c90e542a6121d6ff16b1b0b3d3f6fd7f7b6dbb6c0921e1be9d4a138287e24213278365f16dde324c20bca795c23844cc6c89619fc2da44d821b3f00"}, &(0x7f0000000440)={0x20, 0x3, 0x1, 0x9}}) ioctl$GIO_SCRNMAP(0xffffffffffffffff, 0x4b40, &(0x7f00000004c0)=""/166) r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f00000005c0)={0x7, 0x0, 0x1}) syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000580)=0x2) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) 02:35:57 executing program 5: r0 = openat$proc_capi20(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSTI(r0, 0x4020940d, 0x400000) 02:35:57 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSTI(r0, 0x40049409, 0x400000) 02:35:57 executing program 3: syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, &(0x7f00000001c0)={0xf8e9, 0xda5, 0x8}) 02:35:57 executing program 2: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x118, 0x0, &(0x7f0000000500)=[@acquire_done={0x40106309, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@weak_handle={0x77682a85, 0xa, 0x3}, @fda={0x66646185, 0x5, 0x1}, @flat=@weak_binder={0x77622a85, 0x0, 0x8}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@fda={0x66646185, 0x9, 0x0, 0x9}, @ptr={0x70742a85, 0x1, &(0x7f0000000140)=""/153, 0x99, 0x0, 0x1b}, @ptr={0x70742a85, 0x1, &(0x7f0000000200)=""/149, 0x95, 0x1, 0x6}}, &(0x7f0000000340)={0x0, 0x20, 0x48}}}, @dead_binder_done, @enter_looper, @increfs_done={0x40106308, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000440)={@fd, @fd, @ptr={0x70742a85, 0x1, &(0x7f0000000380)=""/150, 0x96, 0x2, 0x28}}, &(0x7f00000004c0)={0x0, 0x18, 0x30}}, 0x1000}, @dead_binder_done], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:35:57 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5452, 0x400000) 02:35:57 executing program 5: r0 = openat$proc_capi20(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSTI(r0, 0x4020940d, 0x400000) 02:35:57 executing program 4: openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(0xffffffffffffffff, 0x40049409, 0x400000) 02:35:57 executing program 3: syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, &(0x7f00000001c0)={0xf8e9, 0xda5, 0x8}) 02:35:57 executing program 2: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x118, 0x0, &(0x7f0000000500)=[@acquire_done={0x40106309, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@weak_handle={0x77682a85, 0xa, 0x3}, @fda={0x66646185, 0x5, 0x1}, @flat=@weak_binder={0x77622a85, 0x0, 0x8}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@fda={0x66646185, 0x9, 0x0, 0x9}, @ptr={0x70742a85, 0x1, &(0x7f0000000140)=""/153, 0x99, 0x0, 0x1b}, @ptr={0x70742a85, 0x1, &(0x7f0000000200)=""/149, 0x95, 0x1, 0x6}}, &(0x7f0000000340)={0x0, 0x20, 0x48}}}, @dead_binder_done, @enter_looper, @increfs_done={0x40106308, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000440)={@fd, @fd, @ptr={0x70742a85, 0x1, &(0x7f0000000380)=""/150, 0x96, 0x2, 0x28}}, &(0x7f00000004c0)={0x0, 0x18, 0x30}}, 0x1000}, @dead_binder_done], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:35:57 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5452, 0x400000) 02:35:57 executing program 5: openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(0xffffffffffffffff, 0x4020940d, 0x400000) 02:35:57 executing program 1: syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f00000001c0)={0x24, &(0x7f0000000040)={0x0, 0x21, 0x7e, {0x7e, 0xb, "bc856d7a562850452f64ece0060a6121de01f0ec7baac41b1dc40dbde7f48b8d7c0cf97d30207227ae63d48b7da99082057e7129a7478db2a6f1ef19677b4b4b30a3c02bdf0ddf05a30f91c3d7e8d394d621d1112b7ad2912e3ba9f78bce7ffb298ff80255ee97f319efae71e4180b77f3f9ff51f8e4567d681f4dbe"}}, &(0x7f0000000100)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x807}}, &(0x7f0000000140)={0x0, 0x22, 0x15, {[@main=@item_012={0x1, 0x0, 0x8, "96"}, @global=@item_012={0x1, 0x1, 0x5, 't'}, @global=@item_4={0x3, 0x1, 0x4, "d628113f"}, @global=@item_012={0x1, 0x1, 0x6, "a1"}, @main=@item_4={0x3, 0x0, 0xc, "095ca76a"}, @main=@item_4={0x3, 0x0, 0xb, "76789e42"}]}}, &(0x7f0000000180)={0x0, 0x21, 0x9, {0x9, 0x21, 0x0, 0x1, 0x1, {0x22, 0xaa4}}}}, &(0x7f0000000480)={0x2c, &(0x7f0000000200)={0x20, 0x1, 0xd7, "2f730a1dcb71b55a6e85f0658c0c042619d8e57cfe40a2c3f6e89ff68ae3282519744219031f85d2c7b3be44fdfc1958af0887752129c6a88811054ade2c86e93eda6476d3c3198f7086cf682b643c1860811113086554c2dd129f2c7b6ef49c7716f82e4cd464ac0abc09ee8d9df45d1eea7351c2636dc4d8a99d51688930be0e82195e011f56ca13baa7e78f8c17c34c7cbc35f224477a08254f6cb4ba28ff237373f98840d95835d03dff42488a4c5a3202d29139715ca9c8fd0a2724029f5900eaac6eb4ad4f431b17ee2aa6d319ae36ef1c51f758"}, &(0x7f0000000300)={0x0, 0xa, 0x1, 0x9}, &(0x7f0000000340)={0x0, 0x8, 0x1, 0x6}, &(0x7f0000000380)={0x20, 0x1, 0xaf, "96a8486f615a8a35393efc34e3e46fdd419a8593f3efb50ec6d306567dcd1498256a494cc859434ba2c2cf492e63c8973100a333c3dfeb2f486467b3bcf6cbe49c38b0357719055e457d5baa7f5e1f6dc700b5ff277dae8dad9b9df3a1ff8a862f0a2ad62a22fc8d0a191150684d6f938362a56c90e542a6121d6ff16b1b0b3d3f6fd7f7b6dbb6c0921e1be9d4a138287e24213278365f16dde324c20bca795c23844cc6c89619fc2da44d821b3f00"}, &(0x7f0000000440)={0x20, 0x3, 0x1, 0x9}}) ioctl$GIO_SCRNMAP(0xffffffffffffffff, 0x4b40, &(0x7f00000004c0)=""/166) r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f00000005c0)={0x7, 0x0, 0x1}) syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000580)=0x2) 02:35:57 executing program 4: openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(0xffffffffffffffff, 0x40049409, 0x400000) 02:35:57 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5609, 0x0) 02:35:57 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x118, 0x0, &(0x7f0000000500)=[@acquire_done={0x40106309, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@weak_handle={0x77682a85, 0xa, 0x3}, @fda={0x66646185, 0x5, 0x1}, @flat=@weak_binder={0x77622a85, 0x0, 0x8}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@fda={0x66646185, 0x9, 0x0, 0x9}, @ptr={0x70742a85, 0x1, &(0x7f0000000140)=""/153, 0x99, 0x0, 0x1b}, @ptr={0x70742a85, 0x1, &(0x7f0000000200)=""/149, 0x95, 0x1, 0x6}}, &(0x7f0000000340)={0x0, 0x20, 0x48}}}, @dead_binder_done, @enter_looper, @increfs_done={0x40106308, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000440)={@fd, @fd, @ptr={0x70742a85, 0x1, &(0x7f0000000380)=""/150, 0x96, 0x2, 0x28}}, &(0x7f00000004c0)={0x0, 0x18, 0x30}}, 0x1000}, @dead_binder_done], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:35:57 executing program 5: openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(0xffffffffffffffff, 0x4020940d, 0x400000) 02:35:57 executing program 0: ioctl$TIOCSTI(0xffffffffffffffff, 0x5452, 0x400000) 02:35:57 executing program 0: ioctl$TIOCSTI(0xffffffffffffffff, 0x5452, 0x400000) 02:35:57 executing program 4: openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(0xffffffffffffffff, 0x40049409, 0x400000) 02:35:57 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x118, 0x0, &(0x7f0000000500)=[@acquire_done={0x40106309, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@weak_handle={0x77682a85, 0xa, 0x3}, @fda={0x66646185, 0x5, 0x1}, @flat=@weak_binder={0x77622a85, 0x0, 0x8}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@fda={0x66646185, 0x9, 0x0, 0x9}, @ptr={0x70742a85, 0x1, &(0x7f0000000140)=""/153, 0x99, 0x0, 0x1b}, @ptr={0x70742a85, 0x1, &(0x7f0000000200)=""/149, 0x95, 0x1, 0x6}}, &(0x7f0000000340)={0x0, 0x20, 0x48}}}, @dead_binder_done, @enter_looper, @increfs_done={0x40106308, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000440)={@fd, @fd, @ptr={0x70742a85, 0x1, &(0x7f0000000380)=""/150, 0x96, 0x2, 0x28}}, &(0x7f00000004c0)={0x0, 0x18, 0x30}}, 0x1000}, @dead_binder_done], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:35:57 executing program 5: openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(0xffffffffffffffff, 0x4020940d, 0x400000) 02:35:57 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5609, 0x0) 02:35:58 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x40049409, 0x0) 02:35:58 executing program 1: syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f00000001c0)={0x24, &(0x7f0000000040)={0x0, 0x21, 0x7e, {0x7e, 0xb, "bc856d7a562850452f64ece0060a6121de01f0ec7baac41b1dc40dbde7f48b8d7c0cf97d30207227ae63d48b7da99082057e7129a7478db2a6f1ef19677b4b4b30a3c02bdf0ddf05a30f91c3d7e8d394d621d1112b7ad2912e3ba9f78bce7ffb298ff80255ee97f319efae71e4180b77f3f9ff51f8e4567d681f4dbe"}}, &(0x7f0000000100)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x807}}, &(0x7f0000000140)={0x0, 0x22, 0x15, {[@main=@item_012={0x1, 0x0, 0x8, "96"}, @global=@item_012={0x1, 0x1, 0x5, 't'}, @global=@item_4={0x3, 0x1, 0x4, "d628113f"}, @global=@item_012={0x1, 0x1, 0x6, "a1"}, @main=@item_4={0x3, 0x0, 0xc, "095ca76a"}, @main=@item_4={0x3, 0x0, 0xb, "76789e42"}]}}, &(0x7f0000000180)={0x0, 0x21, 0x9, {0x9, 0x21, 0x0, 0x1, 0x1, {0x22, 0xaa4}}}}, &(0x7f0000000480)={0x2c, &(0x7f0000000200)={0x20, 0x1, 0xd7, "2f730a1dcb71b55a6e85f0658c0c042619d8e57cfe40a2c3f6e89ff68ae3282519744219031f85d2c7b3be44fdfc1958af0887752129c6a88811054ade2c86e93eda6476d3c3198f7086cf682b643c1860811113086554c2dd129f2c7b6ef49c7716f82e4cd464ac0abc09ee8d9df45d1eea7351c2636dc4d8a99d51688930be0e82195e011f56ca13baa7e78f8c17c34c7cbc35f224477a08254f6cb4ba28ff237373f98840d95835d03dff42488a4c5a3202d29139715ca9c8fd0a2724029f5900eaac6eb4ad4f431b17ee2aa6d319ae36ef1c51f758"}, &(0x7f0000000300)={0x0, 0xa, 0x1, 0x9}, &(0x7f0000000340)={0x0, 0x8, 0x1, 0x6}, &(0x7f0000000380)={0x20, 0x1, 0xaf, "96a8486f615a8a35393efc34e3e46fdd419a8593f3efb50ec6d306567dcd1498256a494cc859434ba2c2cf492e63c8973100a333c3dfeb2f486467b3bcf6cbe49c38b0357719055e457d5baa7f5e1f6dc700b5ff277dae8dad9b9df3a1ff8a862f0a2ad62a22fc8d0a191150684d6f938362a56c90e542a6121d6ff16b1b0b3d3f6fd7f7b6dbb6c0921e1be9d4a138287e24213278365f16dde324c20bca795c23844cc6c89619fc2da44d821b3f00"}, &(0x7f0000000440)={0x20, 0x3, 0x1, 0x9}}) ioctl$GIO_SCRNMAP(0xffffffffffffffff, 0x4b40, &(0x7f00000004c0)=""/166) r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f00000005c0)={0x7, 0x0, 0x1}) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000580)=0x2) 02:35:58 executing program 0: ioctl$TIOCSTI(0xffffffffffffffff, 0x5452, 0x400000) 02:35:58 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x118, 0x0, &(0x7f0000000500)=[@acquire_done={0x40106309, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@weak_handle={0x77682a85, 0xa, 0x3}, @fda={0x66646185, 0x5, 0x1}, @flat=@weak_binder={0x77622a85, 0x0, 0x8}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@fda={0x66646185, 0x9, 0x0, 0x9}, @ptr={0x70742a85, 0x1, &(0x7f0000000140)=""/153, 0x99, 0x0, 0x1b}, @ptr={0x70742a85, 0x1, &(0x7f0000000200)=""/149, 0x95, 0x1, 0x6}}, &(0x7f0000000340)={0x0, 0x20, 0x48}}}, @dead_binder_done, @enter_looper, @increfs_done={0x40106308, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000440)={@fd, @fd, @ptr={0x70742a85, 0x1, &(0x7f0000000380)=""/150, 0x96, 0x2, 0x28}}, &(0x7f00000004c0)={0x0, 0x18, 0x30}}, 0x1000}, @dead_binder_done], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:35:58 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5609, 0x0) 02:35:58 executing program 5: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x4020940d, 0x0) 02:35:58 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x40049409, 0x0) 02:35:58 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000680)={0x118, 0x0, &(0x7f0000000500)=[@acquire_done={0x40106309, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@weak_handle={0x77682a85, 0xa, 0x3}, @fda={0x66646185, 0x5, 0x1}, @flat=@weak_binder={0x77622a85, 0x0, 0x8}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@fda={0x66646185, 0x9, 0x0, 0x9}, @ptr={0x70742a85, 0x1, &(0x7f0000000140)=""/153, 0x99, 0x0, 0x1b}, @ptr={0x70742a85, 0x1, &(0x7f0000000200)=""/149, 0x95, 0x1, 0x6}}, &(0x7f0000000340)={0x0, 0x20, 0x48}}}, @dead_binder_done, @enter_looper, @increfs_done={0x40106308, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000440)={@fd, @fd, @ptr={0x70742a85, 0x1, &(0x7f0000000380)=""/150, 0x96, 0x2, 0x28}}, &(0x7f00000004c0)={0x0, 0x18, 0x30}}, 0x1000}, @dead_binder_done], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:35:58 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5452, 0x400000) 02:35:58 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5609, &(0x7f00000001c0)={0x0, 0xda5, 0x8}) 02:35:58 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x40049409, 0x0) 02:35:58 executing program 5: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x4020940d, 0x0) 02:35:58 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000680)={0x118, 0x0, &(0x7f0000000500)=[@acquire_done={0x40106309, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@weak_handle={0x77682a85, 0xa, 0x3}, @fda={0x66646185, 0x5, 0x1}, @flat=@weak_binder={0x77622a85, 0x0, 0x8}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@fda={0x66646185, 0x9, 0x0, 0x9}, @ptr={0x70742a85, 0x1, &(0x7f0000000140)=""/153, 0x99, 0x0, 0x1b}, @ptr={0x70742a85, 0x1, &(0x7f0000000200)=""/149, 0x95, 0x1, 0x6}}, &(0x7f0000000340)={0x0, 0x20, 0x48}}}, @dead_binder_done, @enter_looper, @increfs_done={0x40106308, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000440)={@fd, @fd, @ptr={0x70742a85, 0x1, &(0x7f0000000380)=""/150, 0x96, 0x2, 0x28}}, &(0x7f00000004c0)={0x0, 0x18, 0x30}}, 0x1000}, @dead_binder_done], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:35:59 executing program 1: syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f00000001c0)={0x24, &(0x7f0000000040)={0x0, 0x21, 0x7e, {0x7e, 0xb, "bc856d7a562850452f64ece0060a6121de01f0ec7baac41b1dc40dbde7f48b8d7c0cf97d30207227ae63d48b7da99082057e7129a7478db2a6f1ef19677b4b4b30a3c02bdf0ddf05a30f91c3d7e8d394d621d1112b7ad2912e3ba9f78bce7ffb298ff80255ee97f319efae71e4180b77f3f9ff51f8e4567d681f4dbe"}}, &(0x7f0000000100)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x807}}, &(0x7f0000000140)={0x0, 0x22, 0x15, {[@main=@item_012={0x1, 0x0, 0x8, "96"}, @global=@item_012={0x1, 0x1, 0x5, 't'}, @global=@item_4={0x3, 0x1, 0x4, "d628113f"}, @global=@item_012={0x1, 0x1, 0x6, "a1"}, @main=@item_4={0x3, 0x0, 0xc, "095ca76a"}, @main=@item_4={0x3, 0x0, 0xb, "76789e42"}]}}, &(0x7f0000000180)={0x0, 0x21, 0x9, {0x9, 0x21, 0x0, 0x1, 0x1, {0x22, 0xaa4}}}}, &(0x7f0000000480)={0x2c, &(0x7f0000000200)={0x20, 0x1, 0xd7, "2f730a1dcb71b55a6e85f0658c0c042619d8e57cfe40a2c3f6e89ff68ae3282519744219031f85d2c7b3be44fdfc1958af0887752129c6a88811054ade2c86e93eda6476d3c3198f7086cf682b643c1860811113086554c2dd129f2c7b6ef49c7716f82e4cd464ac0abc09ee8d9df45d1eea7351c2636dc4d8a99d51688930be0e82195e011f56ca13baa7e78f8c17c34c7cbc35f224477a08254f6cb4ba28ff237373f98840d95835d03dff42488a4c5a3202d29139715ca9c8fd0a2724029f5900eaac6eb4ad4f431b17ee2aa6d319ae36ef1c51f758"}, &(0x7f0000000300)={0x0, 0xa, 0x1, 0x9}, &(0x7f0000000340)={0x0, 0x8, 0x1, 0x6}, &(0x7f0000000380)={0x20, 0x1, 0xaf, "96a8486f615a8a35393efc34e3e46fdd419a8593f3efb50ec6d306567dcd1498256a494cc859434ba2c2cf492e63c8973100a333c3dfeb2f486467b3bcf6cbe49c38b0357719055e457d5baa7f5e1f6dc700b5ff277dae8dad9b9df3a1ff8a862f0a2ad62a22fc8d0a191150684d6f938362a56c90e542a6121d6ff16b1b0b3d3f6fd7f7b6dbb6c0921e1be9d4a138287e24213278365f16dde324c20bca795c23844cc6c89619fc2da44d821b3f00"}, &(0x7f0000000440)={0x20, 0x3, 0x1, 0x9}}) ioctl$GIO_SCRNMAP(0xffffffffffffffff, 0x4b40, &(0x7f00000004c0)=""/166) r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000580)=0x2) 02:35:59 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5452, 0x400000) 02:35:59 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000680)={0x118, 0x0, &(0x7f0000000500)=[@acquire_done={0x40106309, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@weak_handle={0x77682a85, 0xa, 0x3}, @fda={0x66646185, 0x5, 0x1}, @flat=@weak_binder={0x77622a85, 0x0, 0x8}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@fda={0x66646185, 0x9, 0x0, 0x9}, @ptr={0x70742a85, 0x1, &(0x7f0000000140)=""/153, 0x99, 0x0, 0x1b}, @ptr={0x70742a85, 0x1, &(0x7f0000000200)=""/149, 0x95, 0x1, 0x6}}, &(0x7f0000000340)={0x0, 0x20, 0x48}}}, @dead_binder_done, @enter_looper, @increfs_done={0x40106308, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000440)={@fd, @fd, @ptr={0x70742a85, 0x1, &(0x7f0000000380)=""/150, 0x96, 0x2, 0x28}}, &(0x7f00000004c0)={0x0, 0x18, 0x30}}, 0x1000}, @dead_binder_done], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:35:59 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5609, &(0x7f00000001c0)={0x0, 0xda5, 0x8}) 02:35:59 executing program 5: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x4020940d, 0x0) 02:35:59 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000680)={0x118, 0x0, &(0x7f0000000500)=[@acquire_done={0x40106309, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@weak_handle={0x77682a85, 0xa, 0x3}, @fda={0x66646185, 0x5, 0x1}, @flat=@weak_binder={0x77622a85, 0x0, 0x8}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@fda={0x66646185, 0x9, 0x0, 0x9}, @ptr={0x70742a85, 0x1, &(0x7f0000000140)=""/153, 0x99, 0x0, 0x1b}, @ptr={0x70742a85, 0x1, &(0x7f0000000200)=""/149, 0x95, 0x1, 0x6}}, &(0x7f0000000340)={0x0, 0x20, 0x48}}}, @dead_binder_done, @enter_looper, @increfs_done={0x40106308, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000440)={@fd, @fd, @ptr={0x70742a85, 0x1, &(0x7f0000000380)=""/150, 0x96, 0x2, 0x28}}, &(0x7f00000004c0)={0x0, 0x18, 0x30}}, 0x1000}, @dead_binder_done], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:35:59 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5452, 0x400000) 02:35:59 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5609, &(0x7f00000001c0)={0x0, 0xda5, 0x8}) 02:35:59 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 02:35:59 executing program 4: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5609, &(0x7f00000001c0)={0x0, 0xda5, 0x8}) 02:35:59 executing program 5: syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f00000001c0)={0x24, &(0x7f0000000040)={0x0, 0x21, 0x7e, {0x7e, 0xb, "bc856d7a562850452f64ece0060a6121de01f0ec7baac41b1dc40dbde7f48b8d7c0cf97d30207227ae63d48b7da99082057e7129a7478db2a6f1ef19677b4b4b30a3c02bdf0ddf05a30f91c3d7e8d394d621d1112b7ad2912e3ba9f78bce7ffb298ff80255ee97f319efae71e4180b77f3f9ff51f8e4567d681f4dbe"}}, &(0x7f0000000100)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x807}}, &(0x7f0000000140)={0x0, 0x22, 0x15, {[@main=@item_012={0x1, 0x0, 0x8, "96"}, @global=@item_012={0x1, 0x1, 0x5, 't'}, @global=@item_4={0x3, 0x1, 0x4, "d628113f"}, @global=@item_012={0x1, 0x1, 0x6, "a1"}, @main=@item_4={0x3, 0x0, 0xc, "095ca76a"}, @main=@item_4={0x3, 0x0, 0xb, "76789e42"}]}}, &(0x7f0000000180)={0x0, 0x21, 0x9, {0x9, 0x21, 0x0, 0x1, 0x1, {0x22, 0xaa4}}}}, &(0x7f0000000480)={0x2c, &(0x7f0000000200)={0x20, 0x1, 0xd7, "2f730a1dcb71b55a6e85f0658c0c042619d8e57cfe40a2c3f6e89ff68ae3282519744219031f85d2c7b3be44fdfc1958af0887752129c6a88811054ade2c86e93eda6476d3c3198f7086cf682b643c1860811113086554c2dd129f2c7b6ef49c7716f82e4cd464ac0abc09ee8d9df45d1eea7351c2636dc4d8a99d51688930be0e82195e011f56ca13baa7e78f8c17c34c7cbc35f224477a08254f6cb4ba28ff237373f98840d95835d03dff42488a4c5a3202d29139715ca9c8fd0a2724029f5900eaac6eb4ad4f431b17ee2aa6d319ae36ef1c51f758"}, &(0x7f0000000300)={0x0, 0xa, 0x1, 0x9}, &(0x7f0000000340)={0x0, 0x8, 0x1, 0x6}, &(0x7f0000000380)={0x20, 0x1, 0xaf, "96a8486f615a8a35393efc34e3e46fdd419a8593f3efb50ec6d306567dcd1498256a494cc859434ba2c2cf492e63c8973100a333c3dfeb2f486467b3bcf6cbe49c38b0357719055e457d5baa7f5e1f6dc700b5ff277dae8dad9b9df3a1ff8a862f0a2ad62a22fc8d0a191150684d6f938362a56c90e542a6121d6ff16b1b0b3d3f6fd7f7b6dbb6c0921e1be9d4a138287e24213278365f16dde324c20bca795c23844cc6c89619fc2da44d821b3f00"}, &(0x7f0000000440)={0x20, 0x3, 0x1, 0x9}}) ioctl$GIO_SCRNMAP(0xffffffffffffffff, 0x4b40, &(0x7f00000004c0)=""/166) r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f00000005c0)={0x7, 0x0, 0x1}) syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000580)=0x2) syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) [ 2157.245802][T28936] binder: 28931:28936 ioctl c0306201 0 returned -14 02:35:59 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5609, &(0x7f00000001c0)={0xf8e9, 0x0, 0x8}) 02:35:59 executing program 1: syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f00000001c0)={0x24, &(0x7f0000000040)={0x0, 0x21, 0x7e, {0x7e, 0xb, "bc856d7a562850452f64ece0060a6121de01f0ec7baac41b1dc40dbde7f48b8d7c0cf97d30207227ae63d48b7da99082057e7129a7478db2a6f1ef19677b4b4b30a3c02bdf0ddf05a30f91c3d7e8d394d621d1112b7ad2912e3ba9f78bce7ffb298ff80255ee97f319efae71e4180b77f3f9ff51f8e4567d681f4dbe"}}, &(0x7f0000000100)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x807}}, &(0x7f0000000140)={0x0, 0x22, 0x15, {[@main=@item_012={0x1, 0x0, 0x8, "96"}, @global=@item_012={0x1, 0x1, 0x5, 't'}, @global=@item_4={0x3, 0x1, 0x4, "d628113f"}, @global=@item_012={0x1, 0x1, 0x6, "a1"}, @main=@item_4={0x3, 0x0, 0xc, "095ca76a"}, @main=@item_4={0x3, 0x0, 0xb, "76789e42"}]}}, &(0x7f0000000180)={0x0, 0x21, 0x9, {0x9, 0x21, 0x0, 0x1, 0x1, {0x22, 0xaa4}}}}, &(0x7f0000000480)={0x2c, &(0x7f0000000200)={0x20, 0x1, 0xd7, "2f730a1dcb71b55a6e85f0658c0c042619d8e57cfe40a2c3f6e89ff68ae3282519744219031f85d2c7b3be44fdfc1958af0887752129c6a88811054ade2c86e93eda6476d3c3198f7086cf682b643c1860811113086554c2dd129f2c7b6ef49c7716f82e4cd464ac0abc09ee8d9df45d1eea7351c2636dc4d8a99d51688930be0e82195e011f56ca13baa7e78f8c17c34c7cbc35f224477a08254f6cb4ba28ff237373f98840d95835d03dff42488a4c5a3202d29139715ca9c8fd0a2724029f5900eaac6eb4ad4f431b17ee2aa6d319ae36ef1c51f758"}, &(0x7f0000000300)={0x0, 0xa, 0x1, 0x9}, &(0x7f0000000340)={0x0, 0x8, 0x1, 0x6}, &(0x7f0000000380)={0x20, 0x1, 0xaf, "96a8486f615a8a35393efc34e3e46fdd419a8593f3efb50ec6d306567dcd1498256a494cc859434ba2c2cf492e63c8973100a333c3dfeb2f486467b3bcf6cbe49c38b0357719055e457d5baa7f5e1f6dc700b5ff277dae8dad9b9df3a1ff8a862f0a2ad62a22fc8d0a191150684d6f938362a56c90e542a6121d6ff16b1b0b3d3f6fd7f7b6dbb6c0921e1be9d4a138287e24213278365f16dde324c20bca795c23844cc6c89619fc2da44d821b3f00"}, &(0x7f0000000440)={0x20, 0x3, 0x1, 0x9}}) ioctl$GIO_SCRNMAP(0xffffffffffffffff, 0x4b40, &(0x7f00000004c0)=""/166) ioctl$TIOCSPTLCK(0xffffffffffffffff, 0x40045431, &(0x7f0000000580)=0x2) 02:35:59 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 02:35:59 executing program 4: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5609, &(0x7f00000001c0)={0x0, 0xda5, 0x8}) 02:35:59 executing program 0: openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(0xffffffffffffffff, 0x5452, 0x400000) 02:35:59 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5609, &(0x7f00000001c0)={0xf8e9}) [ 2157.674755][T28946] binder: 28942:28946 ioctl c0306201 0 returned -14 02:35:59 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x10, 0x0) 02:35:59 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 02:35:59 executing program 4: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5609, &(0x7f00000001c0)={0x0, 0xda5, 0x8}) 02:35:59 executing program 0: openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(0xffffffffffffffff, 0x5452, 0x400000) 02:35:59 executing program 5 (fault-call:1 fault-nth:0): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5609, &(0x7f00000001c0)={0xf8e9}) [ 2157.870493][T28955] binder: 28952:28955 ioctl c0306201 0 returned -14 [ 2157.917202][T28957] binder: 28953:28957 ioctl 10 0 returned -22 02:36:00 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:36:00 executing program 4: ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, &(0x7f00000001c0)={0x0, 0xda5, 0x8}) [ 2157.966860][T28960] FAULT_INJECTION: forcing a failure. [ 2157.966860][T28960] name failslab, interval 1, probability 0, space 0, times 0 [ 2157.994561][T28960] CPU: 1 PID: 28960 Comm: syz-executor.5 Not tainted 5.11.0-rc2-syzkaller #0 [ 2158.003350][T28960] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2158.013417][T28960] Call Trace: [ 2158.016706][T28960] dump_stack+0x107/0x163 [ 2158.021059][T28960] should_fail.cold+0x5/0xa [ 2158.025584][T28960] ? tomoyo_realpath_from_path+0xc3/0x620 [ 2158.031321][T28960] should_failslab+0x5/0x10 [ 2158.035853][T28960] __kmalloc+0x79/0x440 [ 2158.040037][T28960] ? rcu_read_lock_sched_held+0x3a/0x70 [ 2158.045613][T28960] tomoyo_realpath_from_path+0xc3/0x620 [ 2158.051184][T28960] ? tomoyo_profile+0x42/0x50 [ 2158.055889][T28960] tomoyo_path_number_perm+0x1d5/0x590 [ 2158.061370][T28960] ? tomoyo_path_number_perm+0x18d/0x590 [ 2158.067029][T28960] ? tomoyo_execute_permission+0x4a0/0x4a0 [ 2158.072874][T28960] ? lock_downgrade+0x6d0/0x6d0 [ 2158.077728][T28960] ? __mutex_unlock_slowpath+0xe2/0x610 [ 2158.083295][T28960] ? __fget_files+0x288/0x3d0 [ 2158.087970][T28960] security_file_ioctl+0x50/0xb0 [ 2158.092921][T28960] __x64_sys_ioctl+0xb3/0x200 [ 2158.097597][T28960] do_syscall_64+0x2d/0x70 [ 2158.102026][T28960] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2158.107913][T28960] RIP: 0033:0x45e219 [ 2158.111823][T28960] Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2158.131502][T28960] RSP: 002b:00007f6d17656c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2158.140029][T28960] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 000000000045e219 [ 2158.148010][T28960] RDX: 00000000200001c0 RSI: 0000000000005609 RDI: 0000000000000003 [ 2158.155994][T28960] RBP: 00007f6d17656ca0 R08: 0000000000000000 R09: 0000000000000000 [ 2158.163970][T28960] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2158.171957][T28960] R13: 00007ffedf69595f R14: 00007f6d176579c0 R15: 000000000119bf8c [ 2158.182649][T28960] ERROR: Out of memory at tomoyo_realpath_from_path. 02:36:00 executing program 1: syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f00000001c0)={0x24, &(0x7f0000000040)={0x0, 0x21, 0x7e, {0x7e, 0xb, "bc856d7a562850452f64ece0060a6121de01f0ec7baac41b1dc40dbde7f48b8d7c0cf97d30207227ae63d48b7da99082057e7129a7478db2a6f1ef19677b4b4b30a3c02bdf0ddf05a30f91c3d7e8d394d621d1112b7ad2912e3ba9f78bce7ffb298ff80255ee97f319efae71e4180b77f3f9ff51f8e4567d681f4dbe"}}, &(0x7f0000000100)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x807}}, &(0x7f0000000140)={0x0, 0x22, 0x15, {[@main=@item_012={0x1, 0x0, 0x8, "96"}, @global=@item_012={0x1, 0x1, 0x5, 't'}, @global=@item_4={0x3, 0x1, 0x4, "d628113f"}, @global=@item_012={0x1, 0x1, 0x6, "a1"}, @main=@item_4={0x3, 0x0, 0xc, "095ca76a"}, @main=@item_4={0x3, 0x0, 0xb, "76789e42"}]}}, &(0x7f0000000180)={0x0, 0x21, 0x9, {0x9, 0x21, 0x0, 0x1, 0x1, {0x22, 0xaa4}}}}, &(0x7f0000000480)={0x2c, &(0x7f0000000200)={0x20, 0x1, 0xd7, "2f730a1dcb71b55a6e85f0658c0c042619d8e57cfe40a2c3f6e89ff68ae3282519744219031f85d2c7b3be44fdfc1958af0887752129c6a88811054ade2c86e93eda6476d3c3198f7086cf682b643c1860811113086554c2dd129f2c7b6ef49c7716f82e4cd464ac0abc09ee8d9df45d1eea7351c2636dc4d8a99d51688930be0e82195e011f56ca13baa7e78f8c17c34c7cbc35f224477a08254f6cb4ba28ff237373f98840d95835d03dff42488a4c5a3202d29139715ca9c8fd0a2724029f5900eaac6eb4ad4f431b17ee2aa6d319ae36ef1c51f758"}, &(0x7f0000000300)={0x0, 0xa, 0x1, 0x9}, &(0x7f0000000340)={0x0, 0x8, 0x1, 0x6}, &(0x7f0000000380)={0x20, 0x1, 0xaf, "96a8486f615a8a35393efc34e3e46fdd419a8593f3efb50ec6d306567dcd1498256a494cc859434ba2c2cf492e63c8973100a333c3dfeb2f486467b3bcf6cbe49c38b0357719055e457d5baa7f5e1f6dc700b5ff277dae8dad9b9df3a1ff8a862f0a2ad62a22fc8d0a191150684d6f938362a56c90e542a6121d6ff16b1b0b3d3f6fd7f7b6dbb6c0921e1be9d4a138287e24213278365f16dde324c20bca795c23844cc6c89619fc2da44d821b3f00"}, &(0x7f0000000440)={0x20, 0x3, 0x1, 0x9}}) ioctl$GIO_SCRNMAP(0xffffffffffffffff, 0x4b40, &(0x7f00000004c0)=""/166) ioctl$TIOCSPTLCK(0xffffffffffffffff, 0x40045431, &(0x7f0000000580)=0x2) 02:36:00 executing program 3 (fault-call:1 fault-nth:0): r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x4020940d, 0x400000) 02:36:00 executing program 0: openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(0xffffffffffffffff, 0x5452, 0x400000) 02:36:00 executing program 5 (fault-call:1 fault-nth:1): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5609, &(0x7f00000001c0)={0xf8e9}) 02:36:00 executing program 4: ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, &(0x7f00000001c0)={0x0, 0xda5, 0x8}) [ 2158.465806][T28970] FAULT_INJECTION: forcing a failure. [ 2158.465806][T28970] name failslab, interval 1, probability 0, space 0, times 0 [ 2158.479774][T28970] CPU: 1 PID: 28970 Comm: syz-executor.5 Not tainted 5.11.0-rc2-syzkaller #0 [ 2158.487493][T28973] FAULT_INJECTION: forcing a failure. [ 2158.487493][T28973] name failslab, interval 1, probability 0, space 0, times 0 [ 2158.488551][T28970] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2158.488569][T28970] Call Trace: [ 2158.488579][T28970] dump_stack+0x107/0x163 [ 2158.518769][T28970] should_fail.cold+0x5/0xa [ 2158.523300][T28970] ? tomoyo_encode2.part.0+0xe9/0x3a0 [ 2158.528671][T28970] should_failslab+0x5/0x10 [ 2158.533205][T28970] __kmalloc+0x79/0x440 [ 2158.537369][T28970] ? __d_path+0x160/0x160 [ 2158.541711][T28970] tomoyo_encode2.part.0+0xe9/0x3a0 [ 2158.546922][T28970] tomoyo_encode+0x28/0x50 [ 2158.551347][T28970] tomoyo_realpath_from_path+0x186/0x620 [ 2158.556994][T28970] tomoyo_path_number_perm+0x1d5/0x590 [ 2158.562465][T28970] ? tomoyo_path_number_perm+0x18d/0x590 [ 2158.568103][T28970] ? tomoyo_execute_permission+0x4a0/0x4a0 [ 2158.573950][T28970] ? lock_downgrade+0x6d0/0x6d0 [ 2158.578804][T28970] ? __mutex_unlock_slowpath+0xe2/0x610 [ 2158.584378][T28970] ? __fget_files+0x288/0x3d0 [ 2158.589084][T28970] security_file_ioctl+0x50/0xb0 [ 2158.594040][T28970] __x64_sys_ioctl+0xb3/0x200 [ 2158.598735][T28970] do_syscall_64+0x2d/0x70 [ 2158.603282][T28970] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2158.609193][T28970] RIP: 0033:0x45e219 [ 2158.613091][T28970] Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2158.632700][T28970] RSP: 002b:00007f6d17656c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2158.641124][T28970] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 000000000045e219 [ 2158.649511][T28970] RDX: 00000000200001c0 RSI: 0000000000005609 RDI: 0000000000000003 [ 2158.657490][T28970] RBP: 00007f6d17656ca0 R08: 0000000000000000 R09: 0000000000000000 [ 2158.665472][T28970] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2158.673451][T28970] R13: 00007ffedf69595f R14: 00007f6d176579c0 R15: 000000000119bf8c [ 2158.682904][T28973] CPU: 0 PID: 28973 Comm: syz-executor.3 Not tainted 5.11.0-rc2-syzkaller #0 [ 2158.691694][T28973] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2158.701760][T28973] Call Trace: [ 2158.705052][T28973] dump_stack+0x107/0x163 [ 2158.708614][T28970] ERROR: Out of memory at tomoyo_realpath_from_path. [ 2158.709398][T28973] should_fail.cold+0x5/0xa [ 2158.709430][T28973] ? tomoyo_realpath_from_path+0xc3/0x620 [ 2158.709458][T28973] should_failslab+0x5/0x10 [ 2158.709487][T28973] __kmalloc+0x79/0x440 [ 2158.738352][T28973] ? rcu_read_lock_sched_held+0x3a/0x70 [ 2158.738396][T28973] tomoyo_realpath_from_path+0xc3/0x620 [ 2158.738427][T28973] ? tomoyo_profile+0x42/0x50 [ 2158.755166][T28973] tomoyo_path_number_perm+0x1d5/0x590 [ 2158.760652][T28973] ? tomoyo_path_number_perm+0x18d/0x590 [ 2158.766313][T28973] ? tomoyo_execute_permission+0x4a0/0x4a0 [ 2158.772413][T28973] ? lock_downgrade+0x6d0/0x6d0 [ 2158.777287][T28973] ? __mutex_unlock_slowpath+0xe2/0x610 [ 2158.782866][T28973] ? __fget_files+0x288/0x3d0 [ 2158.787564][T28973] security_file_ioctl+0x50/0xb0 [ 2158.792529][T28973] __x64_sys_ioctl+0xb3/0x200 [ 2158.797462][T28973] do_syscall_64+0x2d/0x70 [ 2158.801898][T28973] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2158.808195][T28973] RIP: 0033:0x45e219 [ 2158.812381][T28973] Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2158.832370][T28973] RSP: 002b:00007f9fca5f5c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2158.840933][T28973] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 000000000045e219 [ 2158.849384][T28973] RDX: 0000000000400000 RSI: 000000004020940d RDI: 0000000000000003 [ 2158.857863][T28973] RBP: 00007f9fca5f5ca0 R08: 0000000000000000 R09: 0000000000000000 02:36:00 executing program 4: ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, &(0x7f00000001c0)={0x0, 0xda5, 0x8}) 02:36:00 executing program 5 (fault-call:1 fault-nth:2): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5609, &(0x7f00000001c0)={0xf8e9}) [ 2158.866296][T28973] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2158.874731][T28973] R13: 00007ffc6e56e4bf R14: 00007f9fca5f69c0 R15: 000000000119bf8c 02:36:01 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5452, 0x0) 02:36:01 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) [ 2158.971044][T28977] FAULT_INJECTION: forcing a failure. [ 2158.971044][T28977] name failslab, interval 1, probability 0, space 0, times 0 02:36:01 executing program 4: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5609, &(0x7f00000001c0)={0x0, 0xda5, 0x8}) [ 2159.024763][T28977] CPU: 0 PID: 28977 Comm: syz-executor.5 Not tainted 5.11.0-rc2-syzkaller #0 [ 2159.033566][T28977] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2159.043644][T28977] Call Trace: [ 2159.046933][T28977] dump_stack+0x107/0x163 [ 2159.049639][T28973] ERROR: Out of memory at tomoyo_realpath_from_path. [ 2159.051277][T28977] should_fail.cold+0x5/0xa [ 2159.051308][T28977] ? tomoyo_encode2.part.0+0xe9/0x3a0 [ 2159.067924][T28977] should_failslab+0x5/0x10 [ 2159.072449][T28977] __kmalloc+0x79/0x440 [ 2159.076631][T28977] ? __d_path+0x160/0x160 [ 2159.081035][T28977] tomoyo_encode2.part.0+0xe9/0x3a0 [ 2159.086261][T28977] tomoyo_encode+0x28/0x50 [ 2159.090694][T28977] tomoyo_realpath_from_path+0x186/0x620 [ 2159.096978][T28977] tomoyo_path_number_perm+0x1d5/0x590 [ 2159.103199][T28977] ? tomoyo_path_number_perm+0x18d/0x590 [ 2159.109523][T28977] ? tomoyo_execute_permission+0x4a0/0x4a0 [ 2159.115707][T28977] ? lock_downgrade+0x6d0/0x6d0 [ 2159.121921][T28977] ? __mutex_unlock_slowpath+0xe2/0x610 [ 2159.128033][T28977] ? __fget_files+0x288/0x3d0 [ 2159.132741][T28977] security_file_ioctl+0x50/0xb0 [ 2159.137714][T28977] __x64_sys_ioctl+0xb3/0x200 [ 2159.143697][T28977] do_syscall_64+0x2d/0x70 [ 2159.149577][T28977] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2159.156232][T28977] RIP: 0033:0x45e219 [ 2159.160426][T28977] Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2159.181331][T28977] RSP: 002b:00007f6d17656c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2159.190443][T28977] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 000000000045e219 [ 2159.198742][T28977] RDX: 00000000200001c0 RSI: 0000000000005609 RDI: 0000000000000003 [ 2159.207075][T28977] RBP: 00007f6d17656ca0 R08: 0000000000000000 R09: 0000000000000000 [ 2159.215522][T28977] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 02:36:01 executing program 3 (fault-call:1 fault-nth:1): r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x4020940d, 0x400000) [ 2159.223897][T28977] R13: 00007ffedf69595f R14: 00007f6d176579c0 R15: 000000000119bf8c [ 2159.262007][T28977] ERROR: Out of memory at tomoyo_realpath_from_path. [ 2159.303958][T28985] FAULT_INJECTION: forcing a failure. [ 2159.303958][T28985] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 2159.317193][T28985] CPU: 0 PID: 28985 Comm: syz-executor.3 Not tainted 5.11.0-rc2-syzkaller #0 [ 2159.326876][T28985] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2159.336953][T28985] Call Trace: [ 2159.341592][T28985] dump_stack+0x107/0x163 [ 2159.346274][T28985] should_fail.cold+0x5/0xa 02:36:01 executing program 5 (fault-call:1 fault-nth:3): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5609, &(0x7f00000001c0)={0xf8e9}) [ 2159.350799][T28985] ? kernel_text_address+0xbd/0xf0 [ 2159.355950][T28985] __alloc_pages_nodemask+0x189/0x730 [ 2159.361350][T28985] ? __alloc_pages_slowpath.constprop.0+0x2240/0x2240 [ 2159.369367][T28985] ? find_held_lock+0x2d/0x110 [ 2159.375490][T28985] cache_grow_begin+0x71/0x420 [ 2159.380289][T28985] cache_alloc_refill+0x27f/0x380 [ 2159.385341][T28985] ? tomoyo_realpath_from_path+0xc3/0x620 [ 2159.391077][T28985] __kmalloc+0x35c/0x440 [ 2159.396312][T28985] ? rcu_read_lock_sched_held+0x3a/0x70 [ 2159.403027][T28985] tomoyo_realpath_from_path+0xc3/0x620 [ 2159.409505][T28985] ? tomoyo_profile+0x42/0x50 [ 2159.414211][T28985] tomoyo_path_number_perm+0x1d5/0x590 [ 2159.419690][T28985] ? tomoyo_path_number_perm+0x18d/0x590 [ 2159.426038][T28985] ? tomoyo_execute_permission+0x4a0/0x4a0 [ 2159.432586][T28985] ? lock_downgrade+0x6d0/0x6d0 [ 2159.437461][T28985] ? __mutex_unlock_slowpath+0xe2/0x610 [ 2159.443059][T28985] ? __fget_files+0x288/0x3d0 [ 2159.447757][T28985] security_file_ioctl+0x50/0xb0 [ 2159.452716][T28985] __x64_sys_ioctl+0xb3/0x200 [ 2159.457416][T28985] do_syscall_64+0x2d/0x70 [ 2159.461875][T28985] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2159.467781][T28985] RIP: 0033:0x45e219 [ 2159.472989][T28985] Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2159.492771][T28985] RSP: 002b:00007f9fca5f5c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 02:36:01 executing program 1: syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f00000001c0)={0x24, &(0x7f0000000040)={0x0, 0x21, 0x7e, {0x7e, 0xb, "bc856d7a562850452f64ece0060a6121de01f0ec7baac41b1dc40dbde7f48b8d7c0cf97d30207227ae63d48b7da99082057e7129a7478db2a6f1ef19677b4b4b30a3c02bdf0ddf05a30f91c3d7e8d394d621d1112b7ad2912e3ba9f78bce7ffb298ff80255ee97f319efae71e4180b77f3f9ff51f8e4567d681f4dbe"}}, &(0x7f0000000100)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x807}}, &(0x7f0000000140)={0x0, 0x22, 0x15, {[@main=@item_012={0x1, 0x0, 0x8, "96"}, @global=@item_012={0x1, 0x1, 0x5, 't'}, @global=@item_4={0x3, 0x1, 0x4, "d628113f"}, @global=@item_012={0x1, 0x1, 0x6, "a1"}, @main=@item_4={0x3, 0x0, 0xc, "095ca76a"}, @main=@item_4={0x3, 0x0, 0xb, "76789e42"}]}}, &(0x7f0000000180)={0x0, 0x21, 0x9, {0x9, 0x21, 0x0, 0x1, 0x1, {0x22, 0xaa4}}}}, &(0x7f0000000480)={0x2c, &(0x7f0000000200)={0x20, 0x1, 0xd7, "2f730a1dcb71b55a6e85f0658c0c042619d8e57cfe40a2c3f6e89ff68ae3282519744219031f85d2c7b3be44fdfc1958af0887752129c6a88811054ade2c86e93eda6476d3c3198f7086cf682b643c1860811113086554c2dd129f2c7b6ef49c7716f82e4cd464ac0abc09ee8d9df45d1eea7351c2636dc4d8a99d51688930be0e82195e011f56ca13baa7e78f8c17c34c7cbc35f224477a08254f6cb4ba28ff237373f98840d95835d03dff42488a4c5a3202d29139715ca9c8fd0a2724029f5900eaac6eb4ad4f431b17ee2aa6d319ae36ef1c51f758"}, &(0x7f0000000300)={0x0, 0xa, 0x1, 0x9}, &(0x7f0000000340)={0x0, 0x8, 0x1, 0x6}, &(0x7f0000000380)={0x20, 0x1, 0xaf, "96a8486f615a8a35393efc34e3e46fdd419a8593f3efb50ec6d306567dcd1498256a494cc859434ba2c2cf492e63c8973100a333c3dfeb2f486467b3bcf6cbe49c38b0357719055e457d5baa7f5e1f6dc700b5ff277dae8dad9b9df3a1ff8a862f0a2ad62a22fc8d0a191150684d6f938362a56c90e542a6121d6ff16b1b0b3d3f6fd7f7b6dbb6c0921e1be9d4a138287e24213278365f16dde324c20bca795c23844cc6c89619fc2da44d821b3f00"}, &(0x7f0000000440)={0x20, 0x3, 0x1, 0x9}}) ioctl$GIO_SCRNMAP(0xffffffffffffffff, 0x4b40, &(0x7f00000004c0)=""/166) ioctl$TIOCSPTLCK(0xffffffffffffffff, 0x40045431, &(0x7f0000000580)=0x2) [ 2159.501964][T28985] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 000000000045e219 [ 2159.509951][T28985] RDX: 0000000000400000 RSI: 000000004020940d RDI: 0000000000000003 [ 2159.518019][T28985] RBP: 00007f9fca5f5ca0 R08: 0000000000000000 R09: 0000000000000000 [ 2159.526463][T28985] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2159.534448][T28985] R13: 00007ffc6e56e4bf R14: 00007f9fca5f69c0 R15: 000000000119bf8c 02:36:01 executing program 3 (fault-call:1 fault-nth:2): r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x4020940d, 0x400000) 02:36:01 executing program 4: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5609, &(0x7f00000001c0)={0x0, 0xda5, 0x8}) 02:36:01 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5452, 0x0) [ 2159.682602][T28992] FAULT_INJECTION: forcing a failure. [ 2159.682602][T28992] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2159.726289][T28992] CPU: 0 PID: 28992 Comm: syz-executor.5 Not tainted 5.11.0-rc2-syzkaller #0 [ 2159.735098][T28992] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2159.740987][T28997] FAULT_INJECTION: forcing a failure. [ 2159.740987][T28997] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2159.745159][T28992] Call Trace: [ 2159.745172][T28992] dump_stack+0x107/0x163 [ 2159.745207][T28992] should_fail.cold+0x5/0xa [ 2159.745239][T28992] _copy_to_user+0x2c/0x150 [ 2159.745268][T28992] simple_read_from_buffer+0xcc/0x160 [ 2159.781135][T28992] proc_fail_nth_read+0x187/0x220 [ 2159.786173][T28992] ? proc_exe_link+0x1d0/0x1d0 [ 2159.790942][T28992] ? security_file_permission+0x248/0x560 [ 2159.796674][T28992] ? proc_exe_link+0x1d0/0x1d0 [ 2159.801440][T28992] vfs_read+0x1b5/0x570 [ 2159.805609][T28992] ksys_read+0x12d/0x250 [ 2159.811208][T28992] ? vfs_write+0xa30/0xa30 [ 2159.815666][T28992] ? syscall_enter_from_user_mode+0x1d/0x50 [ 2159.822692][T28992] do_syscall_64+0x2d/0x70 [ 2159.827213][T28992] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2159.833178][T28992] RIP: 0033:0x417b11 [ 2159.838168][T28992] Code: 75 14 b8 00 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 04 1b 00 00 c3 48 83 ec 08 e8 6a fc ff ff 48 89 04 24 b8 00 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 b3 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01 [ 2159.858945][T28992] RSP: 002b:00007f6d17656c70 EFLAGS: 00000293 ORIG_RAX: 0000000000000000 [ 2159.868739][T28992] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000417b11 [ 2159.877842][T28992] RDX: 000000000000000f RSI: 00007f6d17656cb0 RDI: 0000000000000004 [ 2159.885821][T28992] RBP: 00007f6d17656ca0 R08: 0000000000000000 R09: 0000000000000000 [ 2159.893792][T28992] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000003 [ 2159.902953][T28992] R13: 00007ffedf69595f R14: 00007f6d176579c0 R15: 000000000119bf8c [ 2159.918331][T28997] CPU: 1 PID: 28997 Comm: syz-executor.3 Not tainted 5.11.0-rc2-syzkaller #0 [ 2159.927129][T28997] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2159.937195][T28997] Call Trace: [ 2159.940481][T28997] dump_stack+0x107/0x163 [ 2159.944830][T28997] should_fail.cold+0x5/0xa [ 2159.949355][T28997] _copy_from_user+0x2c/0x180 [ 2159.954056][T28997] do_vfs_ioctl+0xb6b/0x1090 [ 2159.958664][T28997] ? generic_block_fiemap+0x60/0x60 [ 2159.964427][T28997] ? selinux_inode_getsecctx+0x90/0x90 [ 2159.971016][T28997] ? __mutex_unlock_slowpath+0xe2/0x610 [ 2159.976599][T28997] ? __fget_files+0x288/0x3d0 [ 2159.982073][T28997] ? security_file_ioctl+0x5c/0xb0 [ 2159.987200][T28997] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 2159.993471][T28997] __x64_sys_ioctl+0x108/0x200 [ 2159.998256][T28997] do_syscall_64+0x2d/0x70 [ 2160.002689][T28997] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2160.009277][T28997] RIP: 0033:0x45e219 [ 2160.013510][T28997] Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2160.033142][T28997] RSP: 002b:00007f9fca5f5c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2160.042077][T28997] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 000000000045e219 [ 2160.050057][T28997] RDX: 0000000000400000 RSI: 000000004020940d RDI: 0000000000000003 [ 2160.058044][T28997] RBP: 00007f9fca5f5ca0 R08: 0000000000000000 R09: 0000000000000000 [ 2160.066034][T28997] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 02:36:02 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5609, &(0x7f00000001c0)={0xf8e9}) [ 2160.074033][T28997] R13: 00007ffc6e56e4bf R14: 00007f9fca5f69c0 R15: 000000000119bf8c 02:36:02 executing program 4: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5609, &(0x7f00000001c0)={0x0, 0xda5, 0x8}) 02:36:02 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:36:02 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5452, 0x0) 02:36:02 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x2, &(0x7f00000001c0)={0xf8e9}) 02:36:02 executing program 4: syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, &(0x7f00000001c0)={0x0, 0xda5, 0x8}) 02:36:02 executing program 3 (fault-call:1 fault-nth:3): r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x4020940d, 0x400000) 02:36:02 executing program 1: syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f00000001c0)={0x24, &(0x7f0000000040)={0x0, 0x21, 0x7e, {0x7e, 0xb, "bc856d7a562850452f64ece0060a6121de01f0ec7baac41b1dc40dbde7f48b8d7c0cf97d30207227ae63d48b7da99082057e7129a7478db2a6f1ef19677b4b4b30a3c02bdf0ddf05a30f91c3d7e8d394d621d1112b7ad2912e3ba9f78bce7ffb298ff80255ee97f319efae71e4180b77f3f9ff51f8e4567d681f4dbe"}}, &(0x7f0000000100)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x807}}, &(0x7f0000000140)={0x0, 0x22, 0x15, {[@main=@item_012={0x1, 0x0, 0x8, "96"}, @global=@item_012={0x1, 0x1, 0x5, 't'}, @global=@item_4={0x3, 0x1, 0x4, "d628113f"}, @global=@item_012={0x1, 0x1, 0x6, "a1"}, @main=@item_4={0x3, 0x0, 0xc, "095ca76a"}, @main=@item_4={0x3, 0x0, 0xb, "76789e42"}]}}, &(0x7f0000000180)={0x0, 0x21, 0x9, {0x9, 0x21, 0x0, 0x1, 0x1, {0x22, 0xaa4}}}}, &(0x7f0000000480)={0x2c, &(0x7f0000000200)={0x20, 0x1, 0xd7, "2f730a1dcb71b55a6e85f0658c0c042619d8e57cfe40a2c3f6e89ff68ae3282519744219031f85d2c7b3be44fdfc1958af0887752129c6a88811054ade2c86e93eda6476d3c3198f7086cf682b643c1860811113086554c2dd129f2c7b6ef49c7716f82e4cd464ac0abc09ee8d9df45d1eea7351c2636dc4d8a99d51688930be0e82195e011f56ca13baa7e78f8c17c34c7cbc35f224477a08254f6cb4ba28ff237373f98840d95835d03dff42488a4c5a3202d29139715ca9c8fd0a2724029f5900eaac6eb4ad4f431b17ee2aa6d319ae36ef1c51f758"}, &(0x7f0000000300)={0x0, 0xa, 0x1, 0x9}, &(0x7f0000000340)={0x0, 0x8, 0x1, 0x6}, &(0x7f0000000380)={0x20, 0x1, 0xaf, "96a8486f615a8a35393efc34e3e46fdd419a8593f3efb50ec6d306567dcd1498256a494cc859434ba2c2cf492e63c8973100a333c3dfeb2f486467b3bcf6cbe49c38b0357719055e457d5baa7f5e1f6dc700b5ff277dae8dad9b9df3a1ff8a862f0a2ad62a22fc8d0a191150684d6f938362a56c90e542a6121d6ff16b1b0b3d3f6fd7f7b6dbb6c0921e1be9d4a138287e24213278365f16dde324c20bca795c23844cc6c89619fc2da44d821b3f00"}, &(0x7f0000000440)={0x20, 0x3, 0x1, 0x9}}) r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000580)=0x2) 02:36:02 executing program 0 (fault-call:1 fault-nth:0): r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5452, 0x400000) 02:36:02 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x10, &(0x7f00000001c0)={0xf8e9}) 02:36:02 executing program 4: syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, &(0x7f00000001c0)={0x0, 0xda5, 0x8}) [ 2160.535947][T29018] FAULT_INJECTION: forcing a failure. [ 2160.535947][T29018] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2160.560246][T29019] FAULT_INJECTION: forcing a failure. [ 2160.560246][T29019] name failslab, interval 1, probability 0, space 0, times 0 [ 2160.561471][T29018] CPU: 0 PID: 29018 Comm: syz-executor.3 Not tainted 5.11.0-rc2-syzkaller #0 [ 2160.581660][T29018] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2160.591746][T29018] Call Trace: [ 2160.595027][T29018] dump_stack+0x107/0x163 [ 2160.599374][T29018] should_fail.cold+0x5/0xa [ 2160.603879][T29018] _copy_to_user+0x2c/0x150 [ 2160.608396][T29018] simple_read_from_buffer+0xcc/0x160 [ 2160.613786][T29018] proc_fail_nth_read+0x187/0x220 [ 2160.618812][T29018] ? proc_exe_link+0x1d0/0x1d0 [ 2160.623580][T29018] ? security_file_permission+0x248/0x560 [ 2160.629315][T29018] ? proc_exe_link+0x1d0/0x1d0 [ 2160.634086][T29018] vfs_read+0x1b5/0x570 [ 2160.638241][T29018] ksys_read+0x12d/0x250 [ 2160.642478][T29018] ? vfs_write+0xa30/0xa30 [ 2160.646893][T29018] ? syscall_enter_from_user_mode+0x1d/0x50 [ 2160.652824][T29018] do_syscall_64+0x2d/0x70 [ 2160.657233][T29018] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2160.663137][T29018] RIP: 0033:0x417b11 [ 2160.667027][T29018] Code: 75 14 b8 00 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 04 1b 00 00 c3 48 83 ec 08 e8 6a fc ff ff 48 89 04 24 b8 00 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 b3 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01 [ 2160.686639][T29018] RSP: 002b:00007f9fca5f5c70 EFLAGS: 00000293 ORIG_RAX: 0000000000000000 [ 2160.695047][T29018] RAX: ffffffffffffffda RBX: ffffffffffffffff RCX: 0000000000417b11 [ 2160.703014][T29018] RDX: 000000000000000f RSI: 00007f9fca5f5cb0 RDI: 0000000000000004 [ 2160.710976][T29018] RBP: 00007f9fca5f5ca0 R08: 0000000000000000 R09: 0000000000000000 [ 2160.718944][T29018] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000003 [ 2160.726926][T29018] R13: 00007ffc6e56e4bf R14: 00007f9fca5f69c0 R15: 000000000119bf8c [ 2160.734931][T29019] CPU: 1 PID: 29019 Comm: syz-executor.0 Not tainted 5.11.0-rc2-syzkaller #0 [ 2160.743708][T29019] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2160.753781][T29019] Call Trace: [ 2160.757066][T29019] dump_stack+0x107/0x163 [ 2160.761419][T29019] should_fail.cold+0x5/0xa [ 2160.766690][T29019] ? tomoyo_realpath_from_path+0xc3/0x620 [ 2160.772519][T29019] should_failslab+0x5/0x10 [ 2160.777041][T29019] __kmalloc+0x79/0x440 [ 2160.781296][T29019] ? rcu_read_lock_sched_held+0x3a/0x70 [ 2160.787560][T29019] tomoyo_realpath_from_path+0xc3/0x620 [ 2160.793922][T29019] ? tomoyo_profile+0x42/0x50 [ 2160.799890][T29019] tomoyo_path_number_perm+0x1d5/0x590 [ 2160.806384][T29019] ? tomoyo_path_number_perm+0x18d/0x590 [ 2160.812790][T29019] ? tomoyo_execute_permission+0x4a0/0x4a0 [ 2160.819478][T29019] ? lock_downgrade+0x6d0/0x6d0 [ 2160.824351][T29019] ? __mutex_unlock_slowpath+0xe2/0x610 [ 2160.832191][T29019] ? __fget_files+0x288/0x3d0 [ 2160.836895][T29019] security_file_ioctl+0x50/0xb0 [ 2160.841854][T29019] __x64_sys_ioctl+0xb3/0x200 [ 2160.846567][T29019] do_syscall_64+0x2d/0x70 [ 2160.851001][T29019] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2160.856911][T29019] RIP: 0033:0x45e219 [ 2160.860845][T29019] Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2160.881166][T29019] RSP: 002b:00007f106592cc68 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2160.890083][T29019] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 000000000045e219 [ 2160.898906][T29019] RDX: 0000000000400000 RSI: 0000000000005452 RDI: 0000000000000003 [ 2160.908040][T29019] RBP: 00007f106592cca0 R08: 0000000000000000 R09: 0000000000000000 [ 2160.916747][T29019] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2160.925521][T29019] R13: 00007ffc5e89906f R14: 00007f106592d9c0 R15: 000000000119bf8c 02:36:03 executing program 0 (fault-call:1 fault-nth:1): r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5452, 0x400000) [ 2160.946172][T29019] ERROR: Out of memory at tomoyo_realpath_from_path. 02:36:03 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b2f, &(0x7f00000001c0)={0xf8e9}) 02:36:03 executing program 4: syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, &(0x7f00000001c0)={0x0, 0xda5, 0x8}) [ 2161.151422][T29030] FAULT_INJECTION: forcing a failure. [ 2161.151422][T29030] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 2161.165463][T29030] CPU: 1 PID: 29030 Comm: syz-executor.0 Not tainted 5.11.0-rc2-syzkaller #0 [ 2161.174247][T29030] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2161.184327][T29030] Call Trace: [ 2161.187614][T29030] dump_stack+0x107/0x163 [ 2161.191988][T29030] should_fail.cold+0x5/0xa [ 2161.196508][T29030] ? kernel_text_address+0xbd/0xf0 [ 2161.201645][T29030] __alloc_pages_nodemask+0x189/0x730 [ 2161.207040][T29030] ? __alloc_pages_slowpath.constprop.0+0x2240/0x2240 [ 2161.214725][T29030] ? find_held_lock+0x2d/0x110 [ 2161.219516][T29030] cache_grow_begin+0x71/0x420 [ 2161.224312][T29030] cache_alloc_refill+0x27f/0x380 [ 2161.229367][T29030] ? tomoyo_realpath_from_path+0xc3/0x620 [ 2161.235104][T29030] __kmalloc+0x35c/0x440 [ 2161.239371][T29030] ? rcu_read_lock_sched_held+0x3a/0x70 [ 2161.245368][T29030] tomoyo_realpath_from_path+0xc3/0x620 [ 2161.250933][T29030] ? tomoyo_profile+0x42/0x50 [ 2161.255638][T29030] tomoyo_path_number_perm+0x1d5/0x590 [ 2161.262579][T29030] ? tomoyo_path_number_perm+0x18d/0x590 [ 2161.268267][T29030] ? tomoyo_execute_permission+0x4a0/0x4a0 [ 2161.274134][T29030] ? lock_downgrade+0x6d0/0x6d0 [ 2161.279989][T29030] ? __mutex_unlock_slowpath+0xe2/0x610 [ 2161.285667][T29030] ? __fget_files+0x288/0x3d0 [ 2161.291108][T29030] security_file_ioctl+0x50/0xb0 [ 2161.296070][T29030] __x64_sys_ioctl+0xb3/0x200 [ 2161.300767][T29030] do_syscall_64+0x2d/0x70 [ 2161.305205][T29030] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2161.311113][T29030] RIP: 0033:0x45e219 [ 2161.315015][T29030] Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2161.334893][T29030] RSP: 002b:00007f106592cc68 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2161.343339][T29030] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 000000000045e219 02:36:03 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x10c, 0x0, &(0x7f0000000500)=[@acquire_done={0x40106309, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@weak_handle={0x77682a85, 0xa, 0x3}, @fda={0x66646185, 0x5, 0x1}, @flat=@weak_binder={0x77622a85, 0x0, 0x8}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@fda={0x66646185, 0x9, 0x0, 0x9}, @ptr={0x70742a85, 0x1, &(0x7f0000000140)=""/153, 0x99, 0x0, 0x1b}, @ptr={0x70742a85, 0x1, &(0x7f0000000200)=""/149, 0x95, 0x1, 0x6}}, &(0x7f0000000340)={0x0, 0x20, 0x48}}}, @dead_binder_done, @enter_looper, @increfs_done={0x40106308, 0x3}, @transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000440)={@fd, @fd, @ptr={0x70742a85, 0x1, &(0x7f0000000380)=""/150, 0x96, 0x2, 0x28}}, &(0x7f00000004c0)={0x0, 0x18, 0x30}}, 0x1000}], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:36:03 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x4020940d, 0x400000) 02:36:03 executing program 1: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000580)=0x2) 02:36:03 executing program 4: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5609, 0x0) [ 2161.351322][T29030] RDX: 0000000000400000 RSI: 0000000000005452 RDI: 0000000000000003 [ 2161.359322][T29030] RBP: 00007f106592cca0 R08: 0000000000000000 R09: 0000000000000000 [ 2161.367306][T29030] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2161.375289][T29030] R13: 00007ffc5e89906f R14: 00007f106592d9c0 R15: 000000000119bf8c 02:36:03 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b30, &(0x7f00000001c0)={0xf8e9}) 02:36:03 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0xc0, 0x0, &(0x7f0000000500)=[@acquire_done={0x40106309, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@weak_handle={0x77682a85, 0xa, 0x3}, @fda={0x66646185, 0x5, 0x1}, @flat=@weak_binder={0x77622a85, 0x0, 0x8}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@fda={0x66646185, 0x9, 0x0, 0x9}, @ptr={0x70742a85, 0x1, &(0x7f0000000140)=""/153, 0x99, 0x0, 0x1b}, @ptr={0x70742a85, 0x1, &(0x7f0000000200)=""/149, 0x95, 0x1, 0x6}}, &(0x7f0000000340)={0x0, 0x20, 0x48}}}, @dead_binder_done, @enter_looper, @increfs_done={0x40106308, 0x3}], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:36:03 executing program 4: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5609, 0x0) 02:36:03 executing program 1: syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCSPTLCK(0xffffffffffffffff, 0x40045431, &(0x7f0000000580)=0x2) 02:36:03 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x2, 0x400000) 02:36:03 executing program 1: syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCSPTLCK(0xffffffffffffffff, 0x40045431, &(0x7f0000000580)=0x2) 02:36:03 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0xac, 0x0, &(0x7f0000000500)=[@acquire_done={0x40106309, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@weak_handle={0x77682a85, 0xa, 0x3}, @fda={0x66646185, 0x5, 0x1}, @flat=@weak_binder={0x77622a85, 0x0, 0x8}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@fda={0x66646185, 0x9, 0x0, 0x9}, @ptr={0x70742a85, 0x1, &(0x7f0000000140)=""/153, 0x99, 0x0, 0x1b}, @ptr={0x70742a85, 0x1, &(0x7f0000000200)=""/149, 0x95, 0x1, 0x6}}, &(0x7f0000000340)={0x0, 0x20, 0x48}}}, @dead_binder_done, @enter_looper], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:36:03 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b31, &(0x7f00000001c0)={0xf8e9}) 02:36:03 executing program 0 (fault-call:1 fault-nth:2): r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5452, 0x400000) 02:36:03 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x10, 0x400000) 02:36:03 executing program 4: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5609, 0x0) 02:36:04 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0xa8, 0x0, &(0x7f0000000500)=[@acquire_done={0x40106309, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@weak_handle={0x77682a85, 0xa, 0x3}, @fda={0x66646185, 0x5, 0x1}, @flat=@weak_binder={0x77622a85, 0x0, 0x8}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@fda={0x66646185, 0x9, 0x0, 0x9}, @ptr={0x70742a85, 0x1, &(0x7f0000000140)=""/153, 0x99, 0x0, 0x1b}, @ptr={0x70742a85, 0x1, &(0x7f0000000200)=""/149, 0x95, 0x1, 0x6}}, &(0x7f0000000340)={0x0, 0x20, 0x48}}}, @dead_binder_done], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:36:04 executing program 1: syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCSPTLCK(0xffffffffffffffff, 0x40045431, &(0x7f0000000580)=0x2) [ 2161.943415][T29060] FAULT_INJECTION: forcing a failure. [ 2161.943415][T29060] name failslab, interval 1, probability 0, space 0, times 0 [ 2161.988205][T29060] CPU: 1 PID: 29060 Comm: syz-executor.0 Not tainted 5.11.0-rc2-syzkaller #0 [ 2161.997005][T29060] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2162.007072][T29060] Call Trace: [ 2162.010359][T29060] dump_stack+0x107/0x163 [ 2162.014738][T29060] should_fail.cold+0x5/0xa [ 2162.019263][T29060] ? tomoyo_encode2.part.0+0xe9/0x3a0 [ 2162.024657][T29060] should_failslab+0x5/0x10 [ 2162.029186][T29060] __kmalloc+0x79/0x440 [ 2162.033375][T29060] tomoyo_encode2.part.0+0xe9/0x3a0 [ 2162.038595][T29060] tomoyo_encode+0x28/0x50 [ 2162.043027][T29060] tomoyo_realpath_from_path+0x186/0x620 [ 2162.048712][T29060] ? tomoyo_profile+0x42/0x50 [ 2162.053456][T29060] tomoyo_path_number_perm+0x1d5/0x590 [ 2162.058941][T29060] ? tomoyo_path_number_perm+0x18d/0x590 [ 2162.064602][T29060] ? tomoyo_execute_permission+0x4a0/0x4a0 [ 2162.070467][T29060] ? lock_downgrade+0x6d0/0x6d0 [ 2162.075350][T29060] ? __mutex_unlock_slowpath+0xe2/0x610 [ 2162.080938][T29060] ? __fget_files+0x288/0x3d0 02:36:04 executing program 1: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, 0x0) 02:36:04 executing program 1: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, 0x0) [ 2162.085645][T29060] security_file_ioctl+0x50/0xb0 [ 2162.090605][T29060] __x64_sys_ioctl+0xb3/0x200 [ 2162.095299][T29060] do_syscall_64+0x2d/0x70 [ 2162.099740][T29060] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2162.105657][T29060] RIP: 0033:0x45e219 [ 2162.109564][T29060] Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2162.129192][T29060] RSP: 002b:00007f106592cc68 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 02:36:04 executing program 1: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, 0x0) 02:36:04 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x4b47, 0x400000) [ 2162.137736][T29060] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 000000000045e219 [ 2162.145720][T29060] RDX: 0000000000400000 RSI: 0000000000005452 RDI: 0000000000000003 [ 2162.153707][T29060] RBP: 00007f106592cca0 R08: 0000000000000000 R09: 0000000000000000 [ 2162.161693][T29060] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2162.169691][T29060] R13: 00007ffc5e89906f R14: 00007f106592d9c0 R15: 000000000119bf8c [ 2162.282116][T29060] ERROR: Out of memory at tomoyo_realpath_from_path. 02:36:04 executing program 0 (fault-call:1 fault-nth:3): r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5452, 0x400000) 02:36:04 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b32, &(0x7f00000001c0)={0xf8e9}) 02:36:04 executing program 4: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5609, &(0x7f00000001c0)={0x0, 0x0, 0x8}) 02:36:04 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x9c, 0x0, &(0x7f0000000500)=[@acquire_done={0x40106309, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@weak_handle={0x77682a85, 0xa, 0x3}, @fda={0x66646185, 0x5, 0x1}, @flat=@weak_binder={0x77622a85, 0x0, 0x8}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}}, @reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@fda={0x66646185, 0x9, 0x0, 0x9}, @ptr={0x70742a85, 0x1, &(0x7f0000000140)=""/153, 0x99, 0x0, 0x1b}, @ptr={0x70742a85, 0x1, &(0x7f0000000200)=""/149, 0x95, 0x1, 0x6}}, &(0x7f0000000340)={0x0, 0x20, 0x48}}}], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:36:04 executing program 1: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000580)) 02:36:04 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x4b49, 0x400000) 02:36:04 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b33, &(0x7f00000001c0)={0xf8e9}) 02:36:04 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x58, 0x0, &(0x7f0000000500)=[@acquire_done={0x40106309, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@weak_handle={0x77682a85, 0xa, 0x3}, @fda={0x66646185, 0x5, 0x1}, @flat=@weak_binder={0x77622a85, 0x0, 0x8}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}}], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:36:04 executing program 4: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5609, &(0x7f00000001c0)={0x0, 0x0, 0x8}) 02:36:04 executing program 1: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000580)) [ 2162.496060][T29083] FAULT_INJECTION: forcing a failure. [ 2162.496060][T29083] name fail_usercopy, interval 1, probability 0, space 0, times 0 02:36:04 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x4c01, 0x400000) [ 2162.630617][T29083] CPU: 1 PID: 29083 Comm: syz-executor.0 Not tainted 5.11.0-rc2-syzkaller #0 [ 2162.639522][T29083] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2162.649589][T29083] Call Trace: [ 2162.653766][T29083] dump_stack+0x107/0x163 [ 2162.653803][T29083] should_fail.cold+0x5/0xa [ 2162.653833][T29083] _copy_to_user+0x2c/0x150 [ 2162.653862][T29083] simple_read_from_buffer+0xcc/0x160 [ 2162.653896][T29083] proc_fail_nth_read+0x187/0x220 [ 2162.653929][T29083] ? proc_exe_link+0x1d0/0x1d0 [ 2162.653952][T29083] ? security_file_permission+0x248/0x560 [ 2162.653990][T29083] ? proc_exe_link+0x1d0/0x1d0 [ 2162.654017][T29083] vfs_read+0x1b5/0x570 [ 2162.654044][T29083] ksys_read+0x12d/0x250 [ 2162.701295][T29083] ? vfs_write+0xa30/0xa30 [ 2162.705741][T29083] ? syscall_enter_from_user_mode+0x1d/0x50 [ 2162.711681][T29083] do_syscall_64+0x2d/0x70 [ 2162.716120][T29083] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2162.722032][T29083] RIP: 0033:0x417b11 02:36:04 executing program 4: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5609, &(0x7f00000001c0)={0x0, 0x0, 0x8}) [ 2162.725936][T29083] Code: 75 14 b8 00 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 04 1b 00 00 c3 48 83 ec 08 e8 6a fc ff ff 48 89 04 24 b8 00 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 b3 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01 [ 2162.745557][T29083] RSP: 002b:00007f106592cc70 EFLAGS: 00000293 ORIG_RAX: 0000000000000000 [ 2162.753987][T29083] RAX: ffffffffffffffda RBX: ffffffffffffffff RCX: 0000000000417b11 [ 2162.761968][T29083] RDX: 000000000000000f RSI: 00007f106592ccb0 RDI: 0000000000000004 [ 2162.769952][T29083] RBP: 00007f106592cca0 R08: 0000000000000000 R09: 0000000000000000 [ 2162.777949][T29083] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000003 [ 2162.785931][T29083] R13: 00007ffc5e89906f R14: 00007f106592d9c0 R15: 000000000119bf8c 02:36:05 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5452, 0x400000) 02:36:05 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x14, 0x0, &(0x7f0000000500)=[@acquire_done={0x40106309, 0x2}], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:36:05 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b34, &(0x7f00000001c0)={0xf8e9}) 02:36:05 executing program 1: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000580)) 02:36:05 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x541b, 0x400000) 02:36:05 executing program 4: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5609, &(0x7f00000001c0)={0x0, 0xda5}) 02:36:05 executing program 1: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b33, &(0x7f00000001c0)={0xf8e9}) 02:36:05 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b35, &(0x7f00000001c0)={0xf8e9}) 02:36:05 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5421, 0x400000) 02:36:05 executing program 4: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000580)) 02:36:05 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x2, 0x400000) 02:36:05 executing program 1: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b33, &(0x7f00000001c0)={0xf8e9}) 02:36:05 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b36, &(0x7f00000001c0)={0xf8e9}) 02:36:05 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x14, 0x0, &(0x7f0000000500)=[@acquire_done={0x40106309, 0x2}], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:36:05 executing program 4: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000580)) 02:36:05 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5450, 0x400000) 02:36:05 executing program 1: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b33, &(0x7f00000001c0)={0xf8e9}) 02:36:05 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x10, 0x400000) 02:36:05 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b37, &(0x7f00000001c0)={0xf8e9}) 02:36:06 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5451, 0x400000) 02:36:06 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b3a, &(0x7f00000001c0)={0xf8e9}) 02:36:06 executing program 4: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000580)) 02:36:06 executing program 1: ioctl$VT_RESIZE(0xffffffffffffffff, 0x4b33, &(0x7f00000001c0)={0xf8e9}) 02:36:06 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x4b47, 0x400000) 02:36:06 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5452, 0x400000) 02:36:06 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x14, 0x0, &(0x7f0000000500)=[@acquire_done={0x40106309, 0x2}], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:36:06 executing program 4: ioctl$TIOCSPTLCK(0xffffffffffffffff, 0x40045431, &(0x7f0000000580)) 02:36:06 executing program 1: ioctl$VT_RESIZE(0xffffffffffffffff, 0x4b33, &(0x7f00000001c0)={0xf8e9}) 02:36:06 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5460, 0x400000) 02:36:06 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b3b, &(0x7f00000001c0)={0xf8e9}) 02:36:06 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x4b49, 0x400000) 02:36:07 executing program 1: ioctl$VT_RESIZE(0xffffffffffffffff, 0x4b33, &(0x7f00000001c0)={0xf8e9}) 02:36:07 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x4b6b, 0x400000) 02:36:07 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b3c, &(0x7f00000001c0)={0xf8e9}) 02:36:07 executing program 4: ioctl$TIOCSPTLCK(0xffffffffffffffff, 0x40045431, &(0x7f0000000580)) 02:36:07 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5601, 0x400000) 02:36:07 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x4c01, 0x400000) 02:36:07 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x6364, 0x400000) 02:36:07 executing program 1: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b33, &(0x7f00000001c0)={0xf8e9}) 02:36:07 executing program 4: ioctl$TIOCSPTLCK(0xffffffffffffffff, 0x40045431, &(0x7f0000000580)) 02:36:07 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b3d, &(0x7f00000001c0)={0xf8e9}) 02:36:07 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x58, 0x0, &(0x7f0000000500)=[@acquire_done={0x40106309, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000080)={@flat=@weak_handle={0x77682a85, 0xa, 0x3}, @fda={0x66646185, 0x5, 0x1}, @flat=@weak_binder={0x77622a85, 0x0, 0x8}}, &(0x7f0000000100)={0x0, 0x18, 0x38}}}], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:36:07 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x541b, 0x400000) 02:36:08 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b40, &(0x7f00000001c0)={0xf8e9}) 02:36:08 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5421, 0x400000) 02:36:08 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x8913, 0x400000) 02:36:08 executing program 1: syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(0xffffffffffffffff, 0x4b33, &(0x7f00000001c0)={0xf8e9}) 02:36:08 executing program 4: syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCSPTLCK(0xffffffffffffffff, 0x40045431, &(0x7f0000000580)) 02:36:08 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x58, 0x0, &(0x7f0000000500)=[@acquire_done={0x40106309, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000100)}}], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:36:08 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b41, &(0x7f00000001c0)={0xf8e9}) 02:36:08 executing program 1: syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(0xffffffffffffffff, 0x4b33, &(0x7f00000001c0)={0xf8e9}) 02:36:08 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5450, 0x400000) 02:36:08 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x8914, 0x400000) 02:36:08 executing program 4: syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCSPTLCK(0xffffffffffffffff, 0x40045431, &(0x7f0000000580)) 02:36:08 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x58, 0x0, &(0x7f0000000500)=[@acquire_done={0x40106309, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:36:08 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b44, &(0x7f00000001c0)={0xf8e9}) 02:36:08 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5451, 0x400000) 02:36:08 executing program 1: syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(0xffffffffffffffff, 0x4b33, &(0x7f00000001c0)={0xf8e9}) 02:36:08 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x8933, 0x400000) 02:36:08 executing program 1: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b33, 0x0) 02:36:08 executing program 4: syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCSPTLCK(0xffffffffffffffff, 0x40045431, &(0x7f0000000580)) 02:36:08 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x44, 0x0, &(0x7f0000000500)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:36:08 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b45, &(0x7f00000001c0)={0xf8e9}) 02:36:08 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5460, 0x400000) 02:36:08 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x400448c9, 0x400000) 02:36:08 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b46, &(0x7f00000001c0)={0xf8e9}) 02:36:08 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x44, 0x0, &(0x7f0000000500)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:36:08 executing program 1: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b33, 0x0) 02:36:08 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x6364, 0x400000) 02:36:08 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x400448dd, 0x400000) 02:36:08 executing program 4: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, 0x0) 02:36:08 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b47, &(0x7f00000001c0)={0xf8e9}) 02:36:09 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x8913, 0x400000) 02:36:09 executing program 1: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b33, 0x0) 02:36:09 executing program 4: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, 0x0) 02:36:09 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x44, 0x0, &(0x7f0000000500)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:36:09 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x400454ca, 0x400000) 02:36:09 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b48, &(0x7f00000001c0)={0xf8e9}) 02:36:09 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x58, 0x0, &(0x7f0000000500)=[@acquire_done, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:36:09 executing program 1: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b33, &(0x7f00000001c0)) 02:36:09 executing program 4: r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, 0x0) 02:36:09 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x8914, 0x400000) 02:36:09 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b49, &(0x7f00000001c0)={0xf8e9}) 02:36:09 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x40049409, 0x400000) 02:36:09 executing program 4: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b48, &(0x7f00000001c0)={0xf8e9}) 02:36:09 executing program 1: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b48, &(0x7f00000001c0)={0xf8e9}) 02:36:09 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x58, 0x0, &(0x7f0000000500)=[@acquire_done, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:36:09 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x8933, 0x400000) 02:36:09 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b4a, &(0x7f00000001c0)={0xf8e9}) 02:36:09 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x40086602, 0x400000) 02:36:09 executing program 4: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b48, &(0x7f00000001c0)={0xf8e9}) 02:36:09 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x58, 0x0, &(0x7f0000000500)=[@acquire_done, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:36:09 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x58, 0x0, &(0x7f0000000500)=[@acquire_done, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:36:09 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x400448c9, 0x400000) 02:36:09 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b4b, &(0x7f00000001c0)={0xf8e9}) 02:36:09 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x40087602, 0x400000) 02:36:09 executing program 4: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b48, &(0x7f00000001c0)={0xf8e9}) 02:36:09 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x58, 0x0, &(0x7f0000000500)=[@acquire_done={0x40106309, 0x2}, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:36:09 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x58, 0x0, &(0x7f0000000500)=[@acquire_done, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:36:09 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x400448dd, 0x400000) 02:36:09 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x40186366, 0x400000) 02:36:10 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b4c, &(0x7f00000001c0)={0xf8e9}) 02:36:10 executing program 2: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b4b, &(0x7f00000001c0)={0xf8e9}) 02:36:10 executing program 4: ioctl$VT_RESIZE(0xffffffffffffffff, 0x4b48, &(0x7f00000001c0)={0xf8e9}) 02:36:10 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x58, 0x0, &(0x7f0000000500)=[@acquire_done, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:36:10 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x40209410, 0x400000) 02:36:10 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x400454ca, 0x400000) 02:36:10 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b4d, &(0x7f00000001c0)={0xf8e9}) 02:36:10 executing program 4: ioctl$VT_RESIZE(0xffffffffffffffff, 0x4b48, &(0x7f00000001c0)={0xf8e9}) 02:36:10 executing program 2: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b4b, &(0x7f00000001c0)={0xf8e9}) 02:36:10 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x58, 0x0, &(0x7f0000000500)=[@acquire_done, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:36:10 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x40049409, 0x400000) 02:36:10 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x40209411, 0x400000) 02:36:10 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b4e, &(0x7f00000001c0)={0xf8e9}) 02:36:10 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x58, 0x0, &(0x7f0000000500)=[@acquire_done, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:36:10 executing program 4: ioctl$VT_RESIZE(0xffffffffffffffff, 0x4b48, &(0x7f00000001c0)={0xf8e9}) 02:36:10 executing program 2: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b4b, &(0x7f00000001c0)={0xf8e9}) 02:36:10 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x40086602, 0x400000) 02:36:10 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x58, 0x0, &(0x7f0000000500)=[@acquire_done, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:36:10 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x80086301, 0x400000) 02:36:10 executing program 4: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b48, &(0x7f00000001c0)={0xf8e9}) 02:36:10 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b52, &(0x7f00000001c0)={0xf8e9}) 02:36:10 executing program 2: ioctl$VT_RESIZE(0xffffffffffffffff, 0x4b4b, &(0x7f00000001c0)={0xf8e9}) 02:36:10 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x40087602, 0x400000) 02:36:10 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x80086601, 0x400000) 02:36:10 executing program 1: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000680)={0x58, 0x0, &(0x7f0000000500)=[@acquire_done, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:36:10 executing program 4: syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(0xffffffffffffffff, 0x4b48, &(0x7f00000001c0)={0xf8e9}) 02:36:10 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b60, &(0x7f00000001c0)={0xf8e9}) 02:36:10 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x40186366, 0x400000) 02:36:10 executing program 2: ioctl$VT_RESIZE(0xffffffffffffffff, 0x4b4b, &(0x7f00000001c0)={0xf8e9}) 02:36:11 executing program 1: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000680)={0x58, 0x0, &(0x7f0000000500)=[@acquire_done, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:36:11 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x80087601, 0x400000) 02:36:11 executing program 4: syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(0xffffffffffffffff, 0x4b48, &(0x7f00000001c0)={0xf8e9}) 02:36:11 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b61, &(0x7f00000001c0)={0xf8e9}) 02:36:11 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x4020940d, 0x400000) 02:36:11 executing program 2: ioctl$VT_RESIZE(0xffffffffffffffff, 0x4b4b, &(0x7f00000001c0)={0xf8e9}) 02:36:11 executing program 1: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000680)={0x58, 0x0, &(0x7f0000000500)=[@acquire_done, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:36:11 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0xc0045878, 0x400000) 02:36:11 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b62, &(0x7f00000001c0)={0xf8e9}) 02:36:11 executing program 4: syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(0xffffffffffffffff, 0x4b48, &(0x7f00000001c0)={0xf8e9}) 02:36:11 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x80086301, 0x400000) 02:36:11 executing program 2: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b4b, &(0x7f00000001c0)={0xf8e9}) 02:36:11 executing program 1: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x58, 0x0, &(0x7f0000000500)=[@acquire_done, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:36:11 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0xc0045878, 0x400000) 02:36:11 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b63, &(0x7f00000001c0)={0xf8e9}) 02:36:11 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x80086601, 0x400000) 02:36:11 executing program 4: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b48, 0x0) 02:36:11 executing program 2: syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(0xffffffffffffffff, 0x4b4b, &(0x7f00000001c0)={0xf8e9}) 02:36:11 executing program 1: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x58, 0x0, &(0x7f0000000500)=[@acquire_done, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:36:11 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0xc0189436, 0x400000) 02:36:11 executing program 2: syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(0xffffffffffffffff, 0x4b4b, &(0x7f00000001c0)={0xf8e9}) 02:36:11 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x80087601, 0x400000) 02:36:11 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b64, &(0x7f00000001c0)={0xf8e9}) 02:36:11 executing program 4: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b48, 0x0) 02:36:11 executing program 1: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x58, 0x0, &(0x7f0000000500)=[@acquire_done, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:36:11 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0xc020660b, 0x400000) 02:36:11 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0xc0045878, 0x400000) 02:36:11 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b65, &(0x7f00000001c0)={0xf8e9}) 02:36:11 executing program 2: syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(0xffffffffffffffff, 0x4b4b, &(0x7f00000001c0)={0xf8e9}) 02:36:12 executing program 4: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b48, 0x0) 02:36:12 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x4020940d, 0x400002) 02:36:12 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x58, 0x0, &(0x7f0000000500)=[@acquire_done, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:36:12 executing program 4: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b48, &(0x7f00000001c0)) 02:36:12 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0xc0045878, 0x400000) 02:36:12 executing program 2: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b4b, 0x0) 02:36:12 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b66, &(0x7f00000001c0)={0xf8e9}) 02:36:12 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x4020940d, 0x400003) 02:36:12 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x58, 0x0, &(0x7f0000000500)=[@acquire_done, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:36:12 executing program 2: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b4b, 0x0) 02:36:12 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b67, &(0x7f00000001c0)={0xf8e9}) 02:36:12 executing program 4: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b66, &(0x7f00000001c0)={0xf8e9}) 02:36:12 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0xc0189436, 0x400000) 02:36:12 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x4020940d, 0x400004) 02:36:12 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x58, 0x0, &(0x7f0000000500)=[@acquire_done, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:36:12 executing program 2: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b4b, 0x0) 02:36:12 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b68, &(0x7f00000001c0)={0xf8e9}) 02:36:12 executing program 4: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b66, &(0x7f00000001c0)={0xf8e9}) 02:36:12 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0xc020660b, 0x400000) 02:36:12 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x4020940d, 0x400005) 02:36:12 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000680)={0x58, 0x0, &(0x7f0000000500)=[@acquire_done, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:36:12 executing program 2: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b4b, &(0x7f00000001c0)) 02:36:12 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b69, &(0x7f00000001c0)={0xf8e9}) 02:36:12 executing program 4: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b66, &(0x7f00000001c0)={0xf8e9}) 02:36:12 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5452, 0x400002) 02:36:12 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x4020940d, 0x400006) 02:36:12 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000680)={0x58, 0x0, &(0x7f0000000500)=[@acquire_done, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:36:12 executing program 2: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b4b, &(0x7f00000001c0)) 02:36:12 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b6a, &(0x7f00000001c0)={0xf8e9}) 02:36:13 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5452, 0x400003) 02:36:13 executing program 4: ioctl$VT_RESIZE(0xffffffffffffffff, 0x4b66, &(0x7f00000001c0)={0xf8e9}) 02:36:13 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x4020940d, 0x400007) 02:36:13 executing program 2: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b4b, &(0x7f00000001c0)) 02:36:13 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000680)={0x58, 0x0, &(0x7f0000000500)=[@acquire_done, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:36:13 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b6b, &(0x7f00000001c0)={0xf8e9}) 02:36:13 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5452, 0x400004) 02:36:13 executing program 4: ioctl$VT_RESIZE(0xffffffffffffffff, 0x4b66, &(0x7f00000001c0)={0xf8e9}) 02:36:13 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x4020940d, 0x400008) 02:36:13 executing program 2: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x4020940d, 0x400007) 02:36:13 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b6c, &(0x7f00000001c0)={0xf8e9}) 02:36:13 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 02:36:13 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5452, 0x400005) 02:36:13 executing program 2: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x4020940d, 0x400007) 02:36:13 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x4020940d, 0x400300) [ 2171.497498][T29498] binder: 29494:29498 ioctl c0306201 0 returned -14 02:36:13 executing program 4: ioctl$VT_RESIZE(0xffffffffffffffff, 0x4b66, &(0x7f00000001c0)={0xf8e9}) 02:36:13 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5452, 0x400006) 02:36:13 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b6d, &(0x7f00000001c0)={0xf8e9}) 02:36:13 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 02:36:13 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5452, 0x400007) 02:36:13 executing program 2: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x4020940d, 0x400007) 02:36:13 executing program 4: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b66, &(0x7f00000001c0)={0xf8e9}) 02:36:13 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x4020940d, 0x400500) [ 2171.764014][T29510] binder: 29508:29510 ioctl c0306201 0 returned -14 02:36:13 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 02:36:13 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b70, &(0x7f00000001c0)={0xf8e9}) 02:36:14 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5452, 0x400008) [ 2171.949527][T29521] binder: 29517:29521 ioctl c0306201 0 returned -14 02:36:14 executing program 4: syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(0xffffffffffffffff, 0x4b66, &(0x7f00000001c0)={0xf8e9}) 02:36:14 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x4020940d, 0x400600) 02:36:14 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:36:14 executing program 2: ioctl$TIOCSTI(0xffffffffffffffff, 0x4020940d, 0x400007) 02:36:14 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b71, &(0x7f00000001c0)={0xf8e9}) 02:36:14 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x4020940d, 0x400700) 02:36:14 executing program 4: syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(0xffffffffffffffff, 0x4b66, &(0x7f00000001c0)={0xf8e9}) 02:36:14 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5452, 0x400300) 02:36:14 executing program 2: ioctl$TIOCSTI(0xffffffffffffffff, 0x4020940d, 0x400007) 02:36:14 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b72, &(0x7f00000001c0)={0xf8e9}) 02:36:14 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x4020940d, 0x40ff00) 02:36:14 executing program 2: ioctl$TIOCSTI(0xffffffffffffffff, 0x4020940d, 0x400007) 02:36:14 executing program 4: syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(0xffffffffffffffff, 0x4b66, &(0x7f00000001c0)={0xf8e9}) 02:36:14 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5452, 0x400500) 02:36:15 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:36:15 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4bfa, &(0x7f00000001c0)={0xf8e9}) 02:36:15 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x2, 0x0) ioctl$TIOCSTI(r0, 0x4020940d, 0x400000) 02:36:15 executing program 2: r0 = openat$proc_capi20(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSTI(r0, 0x4020940d, 0x400007) 02:36:15 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5452, 0x400600) 02:36:15 executing program 4: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b66, 0x0) 02:36:15 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5452, 0x400700) 02:36:15 executing program 4: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b66, 0x0) 02:36:15 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x4020940d, 0x400000) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r1, 0x4b6b, 0x0) ioctl$TIOCGSERIAL(r1, 0x541e, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=""/234}) 02:36:15 executing program 2: r0 = openat$proc_capi20(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSTI(r0, 0x4020940d, 0x400007) 02:36:15 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4bfb, &(0x7f00000001c0)={0xf8e9}) 02:36:15 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) openat$vim2m(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vim2m\x00', 0x2, 0x0) r1 = syz_open_dev$ptys(0xc, 0x3, 0x0) ioctl$KDGETLED(r1, 0x4b31, &(0x7f0000000000)) ioctl$TIOCSTI(r0, 0x4020940d, 0x400000) 02:36:16 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:36:16 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4c01, &(0x7f00000001c0)={0xf8e9}) 02:36:16 executing program 2: r0 = openat$proc_capi20(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSTI(r0, 0x4020940d, 0x400007) 02:36:16 executing program 4: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b66, 0x0) 02:36:16 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5452, 0x40ff00) 02:36:16 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) socket$l2tp(0x2, 0x2, 0x73) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r1, 0x4b6b, 0x0) ioctl$TIOCSTI(r0, 0x4020940d, 0x6) 02:36:16 executing program 4: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b66, &(0x7f00000001c0)) 02:36:16 executing program 2: openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(0xffffffffffffffff, 0x4020940d, 0x400007) 02:36:16 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5409, &(0x7f00000001c0)={0xf8e9}) 02:36:16 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5452, 0x400000) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r1, 0x4b6b, 0x0) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x4201, 0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x48cb02, 0x0) read$FUSE(r2, &(0x7f0000000180)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INTERRUPT(r3, &(0x7f00000000c0)={0x10, 0x0, r4}, 0x10) ioctl$GIO_CMAP(r2, 0x4b70, &(0x7f0000000000)) 02:36:16 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x4020940d, 0x400000) ioctl$TIOCGLCKTRMIOS(r0, 0x5456, &(0x7f0000000000)={0x7fff, 0x7, 0x0, 0x4, 0xb, "e4fb0519b1585fdd0d368f381a264ddc25c479"}) 02:36:16 executing program 2: openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(0xffffffffffffffff, 0x4020940d, 0x400007) 02:36:17 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x14, 0x0, &(0x7f0000000500)=[@acquire_done], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:36:17 executing program 4: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b66, &(0x7f00000001c0)) 02:36:17 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x540b, &(0x7f00000001c0)={0xf8e9}) 02:36:17 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_INFO(r1, 0xc10c5541, &(0x7f0000000180)={0x40, 0x0, 0x1}) ioctl$TIOCSTI(r0, 0x4020940d, 0x400000) r2 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x8, 0x460040) ioctl$SNDRV_CTL_IOCTL_ELEM_LOCK(r2, 0x40405514, &(0x7f0000000040)={0x5, 0x1, 0x4, 0x4, '\x00', 0x7}) ioctl$SNDRV_CTL_IOCTL_TLV_WRITE(r0, 0xc008551b, &(0x7f0000000000)={0x7, 0x18, [0xda9, 0x8, 0x2, 0x401, 0xee, 0x1]}) 02:36:17 executing program 2: openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(0xffffffffffffffff, 0x4020940d, 0x400007) 02:36:17 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r1, 0x4b6b, 0x0) ioctl$SCSI_IOCTL_SYNC(r0, 0x4) syz_open_dev$tty20(0xc, 0x4, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) r3 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$GIO_FONTX(r3, 0x4b6b, 0x0) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x2, 0x0) ioctl$TIOCSTI(r4, 0x5452, 0xef79) ioctl$GIO_FONTX(r4, 0x4b6b, &(0x7f0000000080)={0x1a5, 0x9, &(0x7f0000000180)}) ioctl$FIONREAD(r2, 0x541b, &(0x7f0000000000)) 02:36:17 executing program 4: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x4b66, &(0x7f00000001c0)) 02:36:17 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$GIO_CMAP(r0, 0x4b70, &(0x7f0000000000)) ioctl$TIOCSTI(r0, 0x4020940d, 0x400000) 02:36:17 executing program 2: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x4020940d, 0x0) 02:36:17 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x540c, &(0x7f00000001c0)={0xf8e9}) 02:36:17 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) write$vga_arbiter(r0, &(0x7f0000000000)=@unlock_all='unlock all\x00', 0xb) ioctl$TIOCSTI(r0, 0x5452, 0x400000) 02:36:17 executing program 4: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x540b, &(0x7f00000001c0)={0xf8e9}) 02:36:18 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x14, 0x0, &(0x7f0000000500)=[@acquire_done], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:36:18 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x540d, &(0x7f00000001c0)={0xf8e9}) 02:36:18 executing program 2: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x4020940d, 0x0) 02:36:18 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r0, 0xc0405519, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0x1, 0x0, 0x10000}) r2 = syz_open_dev$binderN(&(0x7f0000000940)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_SET_MAX_THREADS(r2, 0x40046205, &(0x7f0000000080)=0x3) ioctl$DRM_IOCTL_AGP_FREE(r0, 0x40206435, &(0x7f0000000040)={0x0, r1}) r3 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r3, 0x4020940d, 0x400000) 02:36:18 executing program 0: r0 = accept$phonet_pipe(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000080)=0x10) r1 = socket$phonet_pipe(0x23, 0x5, 0x2) accept$phonet_pipe(r1, 0x0, 0x0) accept$phonet_pipe(r1, &(0x7f00000001c0), &(0x7f0000000200)=0x10) accept4(r0, &(0x7f00000000c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000180)=0x80, 0x800) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$TIOCSTI(r2, 0x5452, 0x400000) 02:36:18 executing program 4: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x540b, &(0x7f00000001c0)={0xf8e9}) 02:36:18 executing program 2: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x4020940d, 0x0) [ 2176.036234][T29643] binder: 29639:29643 ioctl c0306201 0 returned -14 02:36:18 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5452, 0x400000) socketpair(0x1f, 0xa, 0x0, &(0x7f0000000000)) 02:36:18 executing program 4: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x540b, &(0x7f00000001c0)={0xf8e9}) [ 2176.094560][T29647] binder: 29639:29647 ioctl c0306201 0 returned -14 02:36:18 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x540e, &(0x7f00000001c0)={0xf8e9}) 02:36:18 executing program 2: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x540d, &(0x7f00000001c0)={0xf8e9}) 02:36:18 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x4002, 0x0) ioctl$TIOCSTI(r0, 0x4020940d, 0x400000) 02:36:19 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x14, 0x0, &(0x7f0000000500)=[@acquire_done], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:36:19 executing program 4: ioctl$VT_RESIZE(0xffffffffffffffff, 0x540b, &(0x7f00000001c0)={0xf8e9}) 02:36:19 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5452, 0x400000) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000080)={0x2}) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) read$FUSE(r0, &(0x7f0000000180)={0x2020, 0x0, 0x0}, 0x2020) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r0, 0x40405515, &(0x7f0000000040)={0x1, 0x1, 0x5, 0x67, 'syz0\x00', 0x1000}) write$FUSE_INTERRUPT(r1, &(0x7f0000000000)={0x10, 0x0, r2}, 0x10) 02:36:19 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x540f, &(0x7f00000001c0)={0xf8e9}) 02:36:19 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x4020940d, 0x400000) ioctl$VT_RESIZEX(r0, 0x560a, &(0x7f0000000000)={0x1f, 0x3132, 0x1e, 0x9, 0xfff7, 0x5}) 02:36:19 executing program 2: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x540d, &(0x7f00000001c0)={0xf8e9}) 02:36:19 executing program 2: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x540d, &(0x7f00000001c0)={0xf8e9}) 02:36:19 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x18501, 0x0) ioctl$TIOCSTI(r0, 0x5452, 0x400000) 02:36:19 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5410, &(0x7f00000001c0)={0xf8e9}) 02:36:19 executing program 4: ioctl$VT_RESIZE(0xffffffffffffffff, 0x540b, &(0x7f00000001c0)={0xf8e9}) 02:36:19 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x4020940d, 0x400000) ioctl$GIO_CMAP(r0, 0x4b70, &(0x7f00000000c0)) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x80000, 0x0) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(r2, 0xc008551c, &(0x7f0000000080)={0xff, 0x14, [0x1ff, 0x0, 0xfffffffd, 0x20, 0x2]}) mmap$qrtrtun(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0xf, 0x20010, r1, 0x1) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(r1, 0xc008551c, &(0x7f0000000000)={0x10001, 0x18, [0x5f78, 0x18ff82c, 0x5, 0x1000, 0x8, 0xff]}) 02:36:19 executing program 2: ioctl$VT_RESIZE(0xffffffffffffffff, 0x540d, &(0x7f00000001c0)={0xf8e9}) 02:36:20 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x44, 0x0, &(0x7f0000000500)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:36:20 executing program 3: ioctl$VT_GETMODE(0xffffffffffffffff, 0x5601, &(0x7f0000000040)) r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x4020940d, 0x400000) 02:36:20 executing program 4: ioctl$VT_RESIZE(0xffffffffffffffff, 0x540b, &(0x7f00000001c0)={0xf8e9}) 02:36:20 executing program 0: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x111100, 0x0) ioctl$TIOCSTI(r0, 0x5412, 0x20) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x100a, 0x5}) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r1, 0x5452, 0x400000) 02:36:20 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5412, &(0x7f00000001c0)={0xf8e9}) 02:36:20 executing program 2: ioctl$VT_RESIZE(0xffffffffffffffff, 0x540d, &(0x7f00000001c0)={0xf8e9}) 02:36:20 executing program 2: ioctl$VT_RESIZE(0xffffffffffffffff, 0x540d, &(0x7f00000001c0)={0xf8e9}) 02:36:20 executing program 4: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x540b, &(0x7f00000001c0)={0xf8e9}) 02:36:20 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x4020940d, 0x80400002) 02:36:20 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5413, &(0x7f00000001c0)={0xf8e9}) 02:36:20 executing program 0: r0 = syz_init_net_socket$nl_rdma(0xffffffffffffffff, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_CM_ID_GET(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x50, 0x140b, 0x200, 0x70bd2b, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_RES_CM_IDN={0x8, 0x3f, 0x3}, @RDMA_NLDEV_ATTR_RES_CM_IDN={0x8, 0x3f, 0x1}, @RDMA_NLDEV_ATTR_RES_CM_IDN={0x8, 0x3f, 0x3}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x1}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_RES_CM_IDN={0x8, 0x3f, 0x1}]}, 0x50}, 0x1, 0x0, 0x0, 0x4}, 0x10000000) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r1, 0x5452, 0x400000) 02:36:20 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x44, 0x0, &(0x7f0000000500)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:36:20 executing program 2: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x540d, &(0x7f00000001c0)={0xf8e9}) 02:36:20 executing program 4: syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(0xffffffffffffffff, 0x540b, &(0x7f00000001c0)={0xf8e9}) 02:36:20 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) getsockopt$bt_sco_SCO_OPTIONS(r1, 0x11, 0x1, &(0x7f0000000000)=""/170, &(0x7f0000000400)=0x78) r2 = socket$phonet_pipe(0x23, 0x5, 0x2) accept$phonet_pipe(r2, 0x0, 0x0) accept(r2, &(0x7f0000000200)=@x25, &(0x7f0000000180)=0x80) r3 = socket$phonet_pipe(0x23, 0x5, 0x2) syz_init_net_socket$nl_rdma(0xffffffffffffffff, 0x3, 0x14) accept$phonet_pipe(r3, 0x0, 0x0) accept(r3, &(0x7f0000000280)=@rc={0x1f, @none}, &(0x7f0000000100)=0x80) ioctl$TIOCSTI(r0, 0x4020940d, 0x400000) r4 = accept(r3, &(0x7f0000000300)=@tipc, &(0x7f00000001c0)=0x80) accept4$phonet_pipe(r4, &(0x7f0000000380), &(0x7f00000003c0)=0x10, 0x800) socket$phonet_pipe(0x23, 0x5, 0x2) 02:36:20 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x44, 0x0, &(0x7f0000000500)=[@reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x28, 0x0, &(0x7f0000000640)="3ae5348a5f8b35926b3a0c203cf77d6a4d7501cc83410690ff7711844459e39c256b3754d27be012"}) 02:36:20 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5452, 0x400000) 02:36:20 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5414, &(0x7f00000001c0)={0xf8e9}) 02:36:20 executing program 2: syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(0xffffffffffffffff, 0x540d, &(0x7f00000001c0)={0xf8e9}) 02:36:20 executing program 4: syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(0xffffffffffffffff, 0x540b, &(0x7f00000001c0)={0xf8e9}) 02:36:20 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x408400, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x8, 0x10000) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000022c0)='/proc/capi/capi20\x00', 0xe8081, 0x0) ioctl$KDGKBLED(r2, 0x4b64, &(0x7f0000000180)) ioctl$DRM_IOCTL_AGP_FREE(r1, 0x40206435, &(0x7f00000000c0)) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r3, 0x4b6b, 0x0) r4 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$VT_RESIZEX(0xffffffffffffffff, 0x560a, &(0x7f0000000240)={0xfffa, 0x0, 0x1, 0x6, 0x8, 0x2}) r5 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r5, 0xc0405519, 0x0) ioctl$MEDIA_REQUEST_IOC_QUEUE(r0, 0x7c80, 0x0) ioctl$DRM_IOCTL_AGP_FREE(r5, 0x40206435, &(0x7f0000000100)) ioctl$VT_RESIZE(r4, 0x5609, &(0x7f00000001c0)={0x8008, 0x7e, 0x5}) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f0000000040)={0x11, 0x10}, 0x18) ioctl$TIOCSTI(r0, 0x4020940d, 0x400000) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r0, 0xc018620c, &(0x7f0000000200)) r6 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r6, 0xc0405519, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000280)={0x2020}, 0x2020) 02:36:20 executing program 1: r0 = syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x58, 0x0, &(0x7f0000000500)=[@acquire_done, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 02:36:20 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5415, &(0x7f00000001c0)={0xf8e9}) 02:36:20 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) sendmsg$RDMA_NLDEV_CMD_DELLINK(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x18, 0x1404, 0x4, 0x70bd2b, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}]}, 0x18}}, 0x4000000) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) read$FUSE(r0, &(0x7f0000000180)={0x2020, 0x0, 0x0, 0x0}, 0x2020) getgroups(0x1, &(0x7f00000021c0)=[0xee00]) write$FUSE_DIRENTPLUS(r1, &(0x7f0000002200)={0x3d8, 0x0, 0x0, [{{0x1, 0x1, 0x9, 0xfff, 0x1, 0x8000, {0x5, 0x7e, 0x8, 0x8, 0x0, 0x5, 0x2, 0x0, 0x9, 0xa000, 0x4, 0xee01, 0x0, 0x6, 0xfffffffe}}, {0x5, 0xb5e, 0x12, 0x2, '/proc/capi/capi20\x00'}}, {{0x4, 0x0, 0x3, 0xfffffffffffffff7, 0x100, 0xfffffff8, {0x5, 0x81, 0x3d5f, 0x8, 0x10001, 0x1ff, 0x0, 0x4, 0x3, 0x6000, 0xfffff7b9, 0x0, 0xffffffffffffffff, 0x1d, 0x1}}, {0x2, 0x0, 0x2, 0x80000001, '%/'}}, {{0x1, 0x2, 0x88b, 0x3, 0x5, 0x6, {0x4, 0x5, 0x1, 0xffff, 0x7, 0x5, 0x1, 0x588, 0x920f, 0x1000, 0xff, 0xee00, 0x0, 0x3, 0x8}}, {0x3, 0x6, 0x1, 0xffff, '.'}}, {{0x3, 0x2, 0x100, 0xfffffffffffffc01, 0x9, 0x88, {0x3, 0x29bb, 0xfffffffffffffffb, 0x6, 0x7ff, 0x100, 0x5, 0x0, 0x112, 0x6000, 0x7, r2, 0xee00, 0x7eb, 0x9}}, {0x0, 0xb1, 0x0, 0x2}}, {{0x6, 0x2, 0x0, 0x1, 0x8, 0x7cb8, {0x4, 0x8, 0x742, 0x6382, 0x1, 0x5, 0x6, 0x5c, 0xffffffff, 0xa000, 0x2, 0xee01, r3, 0x1cc, 0x1}}, {0x3, 0x80000000, 0xd, 0x5, '^)@,-+\\!:-&({'}}, {{0x2, 0x1, 0x6, 0x4, 0xc0, 0x8, {0x4, 0x40, 0x100, 0x10001, 0x8, 0xe5f8b30, 0x8, 0x20, 0x3, 0x0, 0x8, 0xee01, 0xffffffffffffffff, 0x2, 0x2a5d9861}}, {0x3, 0x2, 0x0, 0x1}}]}, 0x3d8) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r4, 0x4b6b, 0x0) ioctl$TIOCSTI(r4, 0x5452, 0x400000) 02:36:20 executing program 4: syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(0xffffffffffffffff, 0x540b, &(0x7f00000001c0)={0xf8e9}) 02:36:20 executing program 2: syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(0xffffffffffffffff, 0x540d, &(0x7f00000001c0)={0xf8e9}) 02:36:20 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5416, &(0x7f00000001c0)={0xf8e9}) 02:36:20 executing program 1: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5415, &(0x7f00000001c0)={0xf8e9}) 02:36:20 executing program 4: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x540b, 0x0) 02:36:20 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x4020940d, 0x400000) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) sendmsg$nl_route(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xf68496b40446fff}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)=@newlinkprop={0x68, 0x6c, 0x8, 0x70bd2b, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, 0x48060, 0x3c200}, [@IFLA_EXT_MASK={0x8, 0x1d, 0x7}, @IFLA_NUM_RX_QUEUES={0x8, 0x20, 0x1}, @IFLA_PORT_SELF={0x2c, 0x19, 0x0, 0x1, [@IFLA_PORT_INSTANCE_UUID={0x14, 0x4, "bddacfec60ac5270c13bb66dd5fb77b3"}, @IFLA_PORT_INSTANCE_UUID={0x14, 0x4, "5a72dfc825479e834b3b29ef67c800a7"}]}, @IFLA_PHYS_SWITCH_ID={0x9, 0x24, "ca1d5816af"}]}, 0x68}, 0x1, 0x0, 0x0, 0x2285266dbad99cbd}, 0x4) 02:36:20 executing program 2: syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(0xffffffffffffffff, 0x540d, &(0x7f00000001c0)={0xf8e9}) 02:36:20 executing program 0: ioctl$KDGKBLED(0xffffffffffffffff, 0x4b64, &(0x7f0000000000)) r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5452, 0x400000) r1 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$KDSKBLED(r1, 0x4b65, 0x3) 02:36:21 executing program 1: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5415, &(0x7f00000001c0)={0xf8e9}) 02:36:21 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5418, &(0x7f00000001c0)={0xf8e9}) 02:36:21 executing program 4: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x540b, 0x0) 02:36:21 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x4020940d, 0x400000) r1 = syz_open_dev$ptys(0xc, 0x3, 0x1) ioctl$KDGETLED(r1, 0x4b31, &(0x7f0000000000)) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r0, 0xc4c85513, &(0x7f0000000180)={{0x3, 0x4, 0x2, 0x8, 'syz0\x00', 0x8}, 0x0, [0x9, 0x80000000, 0x8, 0x53, 0x5, 0x264d718b, 0x6fac, 0x7fff, 0x3, 0x2, 0x20, 0x100, 0x77, 0x2, 0x2, 0x2, 0x10000, 0x4, 0x400, 0x7, 0xfffffffffffffff9, 0xffffffff, 0xfffffffffffffff7, 0x3ff, 0x2, 0x6, 0xffffffff, 0x4, 0x1f, 0x8, 0x1f, 0x1, 0x4, 0x40000009, 0x401, 0x8, 0x0, 0x0, 0xfffffffffffff89e, 0x3e, 0x589, 0x8, 0x4, 0x7fffffff, 0xfffffffffffffffe, 0x1, 0x6, 0x1, 0xb82, 0x1, 0x9c81, 0x100, 0x8001, 0x10001, 0x1980000000000000, 0x5be, 0x40, 0x1d8, 0x20, 0x3, 0x800, 0x9, 0x7ff, 0x1, 0x5, 0x3, 0x607, 0x973, 0x4, 0x100000000, 0x7, 0x5, 0x5, 0x0, 0x7, 0x8, 0x5, 0x7, 0x7, 0x2, 0xf453, 0x81, 0x8001, 0x0, 0x9, 0x6, 0x1f, 0x7fff, 0x3f, 0xff, 0xfffffffffffeffff, 0x4, 0xff, 0x80, 0x1800, 0x4, 0x6, 0x7, 0x5, 0x6, 0x5e, 0x5, 0x7, 0x0, 0x2, 0x5, 0x1f, 0x7, 0x6, 0x81, 0x800, 0x5, 0x8001, 0x5, 0x0, 0x10000, 0x7, 0x8, 0x3b0, 0xf8, 0x8000, 0x983b, 0x11e350e7, 0x1, 0xba5b, 0x0, 0x10001, 0x3]}) 02:36:21 executing program 1: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5415, &(0x7f00000001c0)={0xf8e9}) 02:36:21 executing program 2: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x540d, 0x0) 02:36:21 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x8001, 0x8000) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f0000000080)={{0x8, 0x3, 0x5, 0xfffffff7, 'syz0\x00', 0x4}, 0x0, [0x1, 0x5bd, 0x0, 0x0, 0x3f, 0x1ff, 0x100000001, 0xffffffff00000000, 0x7f, 0x1, 0x9dd1, 0x6, 0x8, 0x8, 0x7, 0x2, 0x1, 0x3, 0x0, 0x9, 0x8, 0x7ff, 0x0, 0x8, 0x8, 0x15e9, 0x1, 0x7, 0x7, 0x0, 0x800, 0x100, 0x8c1, 0x1, 0x9c7, 0x0, 0x5, 0x27a5bb39, 0x4, 0x1, 0x1, 0x23ad, 0x3, 0x3, 0x0, 0x400, 0x20000000000000, 0x400, 0x400, 0x81, 0x484, 0x9, 0x8001, 0x8, 0x0, 0x7, 0x101, 0xffffffff00000001, 0x80000000, 0x100000001, 0x3, 0x1, 0x80, 0x1ff, 0x1, 0x8, 0x1c, 0x3, 0x100000001, 0x0, 0x3907e408, 0x3ff, 0x4, 0x2, 0x1f, 0x800, 0x3, 0x3, 0x0, 0x1, 0x8, 0x5, 0xffffffffffffffff, 0xfff, 0x399a, 0x4, 0xffffffffffffffd7, 0x40, 0x6, 0x70000, 0xfa7, 0x10000, 0x5, 0xffffffff, 0x4, 0x800, 0x3ff, 0xffff, 0x0, 0x6, 0x6, 0x0, 0x5, 0x81, 0x7, 0x7, 0x40, 0x2, 0xb30, 0x6c, 0x250, 0x9, 0x342, 0x9, 0x0, 0x8, 0x7, 0x10001, 0xfd, 0x1, 0x5, 0x100, 0x7ff, 0x81, 0x0, 0xffffffffffffff80, 0x19, 0x7]}) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x80, 0x0) ioctl$GIO_FONTX(r1, 0x4b6b, &(0x7f0000000980)={0x122, 0xc, &(0x7f0000000580)}) ioctl$TIOCSTI(r1, 0x5452, 0x400000) 02:36:21 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x541b, &(0x7f00000001c0)={0xf8e9}) 02:36:21 executing program 4: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x540b, 0x0) 02:36:21 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x4020940d, 0x400000) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x50200, 0x0) 02:36:21 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x541c, &(0x7f00000001c0)={0xf8e9}) 02:36:21 executing program 1: ioctl$VT_RESIZE(0xffffffffffffffff, 0x5415, &(0x7f00000001c0)={0xf8e9}) 02:36:21 executing program 2: ioctl$KDGKBLED(0xffffffffffffffff, 0x4b64, &(0x7f0000000000)) r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5452, 0x400000) r1 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$KDSKBLED(r1, 0x4b65, 0x3) 02:36:21 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5452, 0x400000) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r1, 0x4b6b, 0x0) ioctl$PIO_SCRNMAP(r1, 0x4b41, &(0x7f0000000180)="eaa669e1db09d1779e888517b40c9c227c8361edcae1f1725174c29f5d06f68fa9ef9a6223f23703252ece6067fcd01c680959aa7c10a4c5bce7b6e7d7893595f73e30913093a622c73162ff28a1a23547c14adc6c0d876a38b9edb707d2562ef071343d9109eb4c67e2079e1d77eb9e86d7877581aa703f66da6fc8f474fcfdb60336eeb525683f846dbde40044abd1e2c54d4089720ba5b60aa1e0b24fbe21e93023eac1af1eb24cec5d7f7d73a3fb214ac6a0c917868e8d18fb1a88e8d9c6465da8777018a1e41eda3f3a8aea77287e05eddf3b6f316320a49768f51a7f8826b1bef867fc50227effa62372380d4465dd4e46039a42ad016db6febccb62d9915840eaa20da9a37673c5e46cb81a88a462db6c30f2b67a13729ab3d68993f02e92c731de5c5321f1e34ab679da319737f90c50dea126150ea8fb006373280d9f367e743b869db2bc78b0e539bfd5ec6ee154887cf69443355e42066a8075e9e5663d96c5275adc1e711867ef42e81fe00e4473fa2753dd961f517e311a26226b2e63e677056339ee537a981bf66c5ac51acf59d601ab5e2e4b3469256a9429becb16e71367c76674c301ae3575fdc350d8398f3d2ad1b1295c762b495b22cedfbb784bee40c2abb2efa70b2fb9b599e4cb5fe107507906ffe0b1baa1e42cb701e31af67aeada91e1777e742230c4f3882992abbb81bf801cb923db50e6d17a6b1b8572353aa264435fec9faaa23448a0553a7f2e76729fc4e9d25fa440b3ca113a1828ee1af6ca0b48cee1b4ae12a4a44fd139527cf93b03f416abe681ea51d14970b9cc97705bd01550539bda1d074e126f888d5374b52854b9ce4655d9bf92d7c22f924e6e32ccbb75f61206a3f16d47530778b699ac51e111756de6d1910f7b716765312b790b6580b97b02378e2bc5d9dff71ccb1f21a43b5221518c6499f6ac00ec7d23728f914b5c0ac79fdcea09a882f49bd2ff1f627b09818ba4ee348516cb992876399430fb93a334faa8a56630faf65e80298622b89c802bb76c9c1ab91506708ffe74bdc5b1fe4db50f7d4f24a4698590919b835731c3e151ad23ac13545bd9340b6c7a38a14ef3e2f2c431bb4f8abbc9307d3f7a748884687ba549cdab97cf5a917903245d491c6931cfff1954971f7e176ea3b0c4fb3336395562483835a29e783aaa1888e3f3c54f2e1f8f74540e4572c887130d1ffeb3ae5f8efd129536f7eb29ee39268660dd7e216e44f32248c881a4676e4b80a5f6d28334783264cbd88b909b978a509e7e098b1ccb4f098c4739210765e42da310d7c5aa39146695ce8898d28a7511f63dfa45ed7e29f780c159d0d198b6dd80b18542289f6eaa4f77f07138c96b4b69ab84fc79f810f2ec060d58e6af2daeca5666d7094da80059986e7d01bad392ec867c876c739016b2cebe4aa827eb1c937674da9336370c30ec04559d318da7c1a4a2865d3b507e2d8b5d67e3a682fd70c2c1ad3c7ca98f4d677c20254aaa2e3d1d4c47042ad4fb10d65a722bbec64176d36a14eaf6943f72b1608eed18d3f4c027bf62e70e03baf523ba315e86686fb56d306bb492c5aff77389d1b426bdaf544654039a0d2b8807d6bbd4fc4ddd67392aefb83a97320e1912d4ca734823fa924a9b22546dcaae5e06dc80a6477d0c3af04f52fcd597e779e8174e725b01be4aaa5eea3532c668da4bf7dc52a1d0caebb6d0d2081d107765b38e1446c7abbd81711fcc9630172444fcc9d183ad36521dfbbbff6ee15e421d651172d99f2a2fe559822bb0e845c5cb79b913b853db241e501f73346d600e3a255e4f950532b3bc70617d83152bd2de300c66d1a6b2184cafd9289c28d578f5661f8e62764ab6f7196728de3673080f76ee9ed8c1cbd5e5aaba66011931458b0e4b1737ddbd13f78550b9388e5f1acf044ce3e61fdbb4466e4a6b763c6adcee0090356affd45c51a7316127041c817827f1c84c29ae4118d0eb9ed146a5fbe2994fbff95997fad06bfaefd28e2f528c3181787a37445730cc9ffe6a8da36d4cd74186992f2b70d18a1f6fe27029a62debb09f61807bff72f90aede747c7fd5fc674e515782731a869d83e16fb405940e757f583924851b454f45344c895e2fdcf8c65680efed5d02686d7cbbdeaeb89578719d8bdcccd40bc1e2c65c54eda9354118c9d2d65d26119960df25d64e0d094f52fe74ce2b26541b38a1cf1c07a4acea2442f3cf21cc4d0ac5321ad1ac27e02bf063d9024140d5df071758736cca07ef4ef58ac53b75c623226da9230e4134959f33e23f9508a6b60e3ef709a9006d35aea1473c69d58e9f4a7a7c6bb97674c6873dbecfc451e13556eded19369e8f4471613f757ec5f6417efc8a542b5d23c0b7b7ebf9b0ece3a7fe4e567cda203ecc06e904e2c047eef2f860c6d47989107099f0c029ee0dd01f6d301a720201ab6bd65c61f30cf45c6fda4fa12cfcfd31b9b7033f3df615b972212d64909596b14b1cb3da68cdb9b4f7649c10f77f3e8d95033ace51a38c6207882ac62a564d4a1a6fa74d97c17789ea6545e2c2d29258b30632d6df8508831ec9e2b03d4ca935ea83cf793096423840d49ba3416047713a025f1668e10177fd01a347fef3828907498a567bf0a6d8f89a059ba4c02465a91ac4333d172087bd566943aa06b097199eef871d6b6c1ece9e4f91a4378c1123a2b90c78c124d321191cf7c3fb0fe87dacbea25a3f45f863b34a552daa3e0d7931fd7decc3c9719cb1809faebcdc41d5443583bd292941ff4b87244819da650cfa68d6c027372c95aa5c377493699213c739fe15ef0870f631ed71e2898480b7e0a8f7560489f3164ceeb9f0db26823db94cacbeeafcc5587f5a1059b968aec8d2c0382febda73a4de0d7647cc3cb2a60e963d756ebc3e58f5af3d608d2508441087aefd9ee10828b8d9b262a8df09a7146dc559ea0ba6070039a6b5c15b1eb542cce3fe4beb918d752124f1614d404780834f03c5f379e569cd81f6b7990afaa4c56723500c68cbbee66a895e05757e72fdaa805338b9f89c7c3f91b71ffffa1813bdb233bf7747605d6ba958d4763566a6883e450e3f985323eea3ebeb2bd8d185b0f39b0524ff7b0bbdc1e7a22d4c6ebcc2b96299ec940a6ab39dfff161d109366528c5cfef503e4280dd58771013ae41a53095b5d6771016c7e0eb182029518609b277d03dc7e42ef6b87118d8f219201e662c0acb7202d742d55dfef739f595365d9bcea4c3a6c5c6fa79f824a5b1d7a2f867dacd6c15a4e1ffd0dcbd4c96deb02b733edb9b9910213f722880dea0727aabf1fb50e2786a06bf5fea88b0aa43abbb7fa38dd72474ca4c5c72a62b692d35b1b7f0e2f6298618943ffed253825ee4e28027fb02003fe7d833f1b36a91f26d28aad9e6de01a1a94d2ba6b87bb159cd2f98e64773db4cb98c3afd0a83b9914454046c005bd3039edbe0da1e78948d0f793fbd0b414bab22e23664f275532801b19a73fdbf0516b08df65d5b481091f9d9e9fa5742fd4e04ba5e871af0c09043d084d48e7d9fdff6b869699ab2ccbaca666568e6ef8417eac2e0c385dcd7f3d039086043f112394c90f68e821aff970ce23f9d978d02a285ffa1afd44b7f89425f86ddbdf04adb1de0c4eef52f1e8897ca3f946077c84d19755962f0848684e4af23f4351d790af2aac402e07187a7d88f25f501adc1226ad1e5d22831fd570286b8450bfd3144ce83a50b4b78eba14d118c2b95b1039fdde4d0e294e0e9bfc443aece80f0b14da0750d3c45c3f230effc19a302afa7c404521c254dcce986a3b72b3eed57ad82027ad749a24d40ad8f803f95f9757cf7f500193111af0bd380d56ca992650edd91ea7b416f974aca5b51bdf33fbc956fa00e836bdbce35bb224d02a3e2e3cf3cefbbda4e7123048e5277900c1beedafb795f9cefaf015954e90f7495013a1372bbd6ae1cac575298e77b3e2d6fbefcc00b344313caf0c7b2507f7c2c31a1e7b63075e11380dd71e4b2082f662dfc32dba86657d4f29370b3c92d70061b709e802e048d798c420a90476c8f61cc293c7fc373c3acf4f9a1a60e0489f16704750407b8d0ed1c1dc733b49e556d18a2b3083f487bd9b0fd408e99a4ec4997ab65e59faec18e3f3bbfa9db47827a5a1a10d27d22ad9e1af6466cece1f76a958b09be83543c94e5f8108532235ab91611cc77ce6efd8d751b6a865f3771129c130b959c250eeb8493fde0b6110d67bba2a4e6a5d5dc2ebc0189a7e2f63ba4c1316e4eaccbb53be79d17f2eabb235a27ce3078b91ab8d4d22ab448d266e39057fef279c75a29ab58338e68ce28cc7fd64ce53664f23ba0820f8f545a81ef3bdc64d5bd4df1819e6bdb92b19c3a69c36f2efffc709efcfc04517dc5c546dcbde3cdcc398411dff297cf4e4b2a2e9656f5af8879430ed813566445eac94fdcc362de527910c9f255b7f490be984d92217e79a70b03a968a5288ba709934b7c135d537dd0e904377108cf85e858d9495cc15fe88f6ae911b212b5b0a4590f3bc787d315038d31258e0fa29e1eec02d6f90856bd6490693654c6e35f131bfa6866a647569b0b636a38f660bca797db6316d39fb2e97a6d0793cc6e53c23464df8e586ce0556bb30221f2ae4279a3fca93e4478f56290c8f0f308c113cbba15fa10b1c54042e390646b1222c843d901fcdd15d4f6e779e08b4b4a64071f4e3ad26ee4e51a7720e033ab37ccc9dab608751ef871d475cbd15d5d6c9196b50e9eee4cb72e6bdfb84aed7e2f18dfd03d6542e8acbec9358910f17ef3f124275a9ec397910922444ff11b746aa90d2d66077d3c826f9e6dbd63edcd467fb6f12e0469d3d3663fe780f4cce982aa705901b2a1aa0f903f264730e93a0479835f15d8df54dd5fd01693f862adf41d45f800d870f7e0c452e88740ee2a87b148ac1375f44e0d8d6ab52d615642629e1703a161577109695f95e3874d2b3646ff565c8424fac2497542883beb46cf8c183f09b6df3998793f6d7809412d18390b2f6b9b673eb95e2778c6cd5dd6fb195655ef04cf00228e4d0ea1d11dd9768ca9178b5a2488f0217a831c78cc1fef4844cd204ba28e0189dbc04cfd1eefacc174acc0e1bd465056c08141710d44ea8494716031f9061ae7a714ea612fbfa8e361a2372105aae79f28909fb2cc59a28269e250170ea9e4864f87468b91ad73ea0d57af453349a1681cec5f3f0249a8d931433b87d7d902c362a0867df0c14b0060359fee709567cbc9b3381733810952c4ad8dac3fc50455d923156c0bb9024a081f47ddabd3c6434d73a28996962f186fd0e9b59772c7b4887e6e96167ede09a7aa5f1d74a4d4874a38aa2af845facc2f482f95d0e64abac8e03ba9fdfdfc8020713e457e671cbd7cbcaead8750cfb657f72242846f8566c2b7e20d2224ba5a2c7240576b6557892948721c1a043a332440f2fe610828a30ae4e0141c988e330a79220fda0aeaf1df37735f2f018def4b28a97a2001cf55c9514a427406160e404e875a42aadb6b3a8aa55ecc41e261273ab433fe1b8fde86a2712b0e16bdb9a1a82d2275f38f0efd60678a26d97a3dc4b36024643bcb85ddd8bdbc9c6edb3f8e3fe219d49f076ea31afb63fc1fea1ad0ad9ae2d71d4420f152d4399637722d8a1f4c4143d0de26aa291430d066621f676e16b51a3e3364a0fad78046ed15d6198de553996ae8f79c09632b7fa9195e62a95d00c7744503ad81798364fccf7e1b35110efaae362ac16cd8ae47f21b42883159bf3d5f3b6f9") 02:36:21 executing program 4: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x540b, &(0x7f00000001c0)) 02:36:21 executing program 1: ioctl$VT_RESIZE(0xffffffffffffffff, 0x5415, &(0x7f00000001c0)={0xf8e9}) 02:36:21 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r1, 0x4b6b, 0x0) ioctl$TIOCSTI(r0, 0x4020940d, 0x74d) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x82281, 0x0) ioctl$KDDELIO(r2, 0x4b35, 0x4) 02:36:21 executing program 0: openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCSTI(r0, 0x5452, 0x400000) ioctl$KDGKBLED(r0, 0x4b64, &(0x7f0000000000)) 02:36:21 executing program 2: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x4020940d, 0x400000) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x50200, 0x0) 02:36:21 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x541d, &(0x7f00000001c0)={0xf8e9}) 02:36:21 executing program 4: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x541c, &(0x7f00000001c0)={0xf8e9}) 02:36:21 executing program 1: ioctl$VT_RESIZE(0xffffffffffffffff, 0x5415, &(0x7f00000001c0)={0xf8e9}) 02:36:21 executing program 2: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x540b, 0x0) 02:36:21 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r0, 0xc0405519, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000000)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x0, 0x0, @in={0x2, 0x4e20, @rand_addr=0x64010100}}}, 0x90) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r1, 0x4b6b, 0x0) ioctl$TIOCSTI(r1, 0x4020940d, 0xfffffffffffffffc) 02:36:21 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x541e, &(0x7f00000001c0)={0xf8e9}) 02:36:21 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5452, 0x400000) sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80008}, 0xc, &(0x7f0000000080)={&(0x7f0000000100)={0x40, 0x140f, 0x1, 0x70bd2b, 0x25dfdbfb, "", [@RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x4}, @RDMA_NLDEV_ATTR_CHARDEV_TYPE={0xc, 0x45, 'rdma_cm\x00'}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_CHARDEV_TYPE={0x9, 0x45, 'issm\x00'}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x2}]}, 0x40}, 0x1, 0x0, 0x0, 0xc0040}, 0x8000) 02:36:21 executing program 4: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x541c, &(0x7f00000001c0)={0xf8e9}) 02:36:22 executing program 1: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5415, &(0x7f00000001c0)={0xf8e9}) 02:36:22 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r0, 0xc0405519, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000000), 0x2, 0x5}}, 0x20) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r1, 0x4020940d, 0x400000) 02:36:22 executing program 2: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x540b, 0x0) 02:36:22 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000005dc0)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5452, 0x400000) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r2, 0x4b6b, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0xc00, 0x0) ioctl$PIO_FONTRESET(r1, 0x4b6d, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x2, 0x0) ioctl$TIOCSLCKTRMIOS(r0, 0x5457, &(0x7f0000000080)) 02:36:22 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x541e, &(0x7f00000001c0)={0xf8e9}) 02:36:22 executing program 4: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x541c, &(0x7f00000001c0)={0xf8e9}) 02:36:22 executing program 1: syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5415, &(0x7f00000001c0)={0xf8e9}) 02:36:22 executing program 2: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x540b, 0x0) 02:36:22 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x80440, 0x0) ioctl$TIOCSTI(r0, 0x4020940d, 0x400000) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) write$RDMA_USER_CM_CMD_JOIN_MCAST(r1, &(0x7f00000000c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000080), 0x4, 0xffffffffffffffff, 0x10, 0x0, @ib={0x1b, 0x100, 0xffff8000, {"ffa0d36741633b6a05aefc0244e591c8"}, 0x101, 0x5, 0x7}}}, 0xa0) 02:36:22 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5421, &(0x7f00000001c0)={0xf8e9}) 02:36:22 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000080)='/proc/capi/capi20\x00', 0x3dfd43, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_LOCK(r0, 0x40405514, &(0x7f0000000000)={0x3, 0x0, 0x7f, 0x0, '\x00', 0x10000}) ioctl$TIOCSTI(r0, 0x5452, 0x400000) 02:36:22 executing program 4: ioctl$VT_RESIZE(0xffffffffffffffff, 0x541c, &(0x7f00000001c0)={0xf8e9}) 02:36:22 executing program 1: syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5415, &(0x7f00000001c0)={0xf8e9}) 02:36:22 executing program 2: ioctl$VT_RESIZE(0xffffffffffffffff, 0x540b, 0x0) 02:36:22 executing program 4: ioctl$VT_RESIZE(0xffffffffffffffff, 0x541c, &(0x7f00000001c0)={0xf8e9}) 02:36:22 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5422, &(0x7f00000001c0)={0xf8e9}) 02:36:22 executing program 0: syz_open_dev$sg(&(0x7f0000000080)='/dev/sg#\x00', 0x4, 0x20000) r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) r1 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ttyprintk\x00', 0x800, 0x0) ioctl$TIOCGPGRP(r1, 0x540f, &(0x7f0000000040)) syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x7, 0x1) ioctl$TIOCSTI(r0, 0x5452, 0x400000) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000140)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_NOTIFY(r3, &(0x7f00000001c0)={0xf, 0x8, 0xfa00, {r4}}, 0x10) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, &(0x7f0000000180)={0x16, 0x98, 0xfa00, {&(0x7f0000000100), 0x0, r4, 0x10, 0x0, @ib={0x1b, 0x1, 0x4, {"5fd98b64536b4bc7656f57bb494c168d"}, 0x100000000, 0x1, 0x401}}}, 0xa0) ioctl$PIO_FONTRESET(r0, 0x4b6d, 0x0) 02:36:22 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x4020940d, 0x400000) r1 = socket$can_j1939(0x1d, 0x2, 0x7) recvmsg$can_j1939(r1, &(0x7f00000004c0)={&(0x7f0000000040)=@tipc=@id, 0x80, &(0x7f0000000100)=[{&(0x7f0000000180)=""/245, 0xf5}, {&(0x7f0000000280)=""/245, 0xf5}, {&(0x7f0000000380)=""/138, 0x8a}, {&(0x7f00000000c0)=""/35, 0x23}], 0x4, &(0x7f0000000440)=""/122, 0x7a}, 0x2000) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000000)) 02:36:22 executing program 1: syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5415, &(0x7f00000001c0)={0xf8e9}) 02:36:22 executing program 2: ioctl$VT_RESIZE(0xffffffffffffffff, 0x540b, 0x0) 02:36:22 executing program 4: ioctl$VT_RESIZE(0xffffffffffffffff, 0x541c, &(0x7f00000001c0)={0xf8e9}) 02:36:22 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x743282, 0x0) ioctl$TIOCSTI(r0, 0x4020940d, 0x400000) r1 = syz_open_dev$tty1(0xc, 0x4, 0x4) ioctl$GIO_FONTX(r1, 0x4b6b, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x2) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000080)=0x15) ioctl$KDGKBENT(r1, 0x4b46, &(0x7f0000000040)={0x3f, 0x43, 0x5}) 02:36:22 executing program 0: ioctl$SNDRV_CTL_IOCTL_TLV_READ(0xffffffffffffffff, 0xc008551a, &(0x7f0000000040)={0x7, 0x4, [0x6]}) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(0xffffffffffffffff, 0x40405515, &(0x7f0000000700)={0x9, 0x1, 0x2, 0x1, 'syz0\x00', 0x9}) r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x40c042, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(r1, 0xc0045540, &(0x7f0000000740)=0x9) recvmsg$can_raw(r0, &(0x7f0000000540)={&(0x7f0000000080)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev}}}, 0x80, &(0x7f0000000440)=[{&(0x7f0000000100)=""/26, 0x1a}, {&(0x7f0000000140)=""/208, 0xd0}, {&(0x7f0000000240)=""/253, 0xfd}, {&(0x7f0000000340)=""/206, 0xce}], 0x4, &(0x7f0000000480)=""/152, 0x98}, 0x40000102) sendmsg$SOCK_DESTROY(r2, &(0x7f00000006c0)={&(0x7f0000000580), 0xc, &(0x7f0000000680)={&(0x7f00000005c0)={0xb4, 0x15, 0x59d96412dab7081f, 0x70bd28, 0x25dfdbfd, {0x8, 0x4}, [@INET_DIAG_REQ_BYTECODE={0x21, 0x1, "6b77e1959f5d1a62131513ab244fcd1a614f31d2f480d5f1f92889c045"}, @INET_DIAG_REQ_BYTECODE={0x7a, 0x1, "0e7de1fab74637944403be770ef1ae9684d475e41199a3286eea51c73cc5cf5007a3b96baa0106fa5e4d40387c507ed793f88634c784eab432f901834d265d6033ebe824c2d223e286b3b519ccc9fb9a37e652e2d92a3cdbc498910229675980c5cf658213047f5a6d7b8bc2ffeee7ea51b380f483af"}]}, 0xb4}, 0x1, 0x0, 0x0, 0x20004000}, 0x48000) ioctl$TIOCSTI(r0, 0x5452, 0x400000) 02:36:22 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5423, &(0x7f00000001c0)={0xf8e9}) 02:36:22 executing program 1: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5415, 0x0) 02:36:22 executing program 2: ioctl$VT_RESIZE(0xffffffffffffffff, 0x540b, 0x0) 02:36:22 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5424, &(0x7f00000001c0)={0xf8e9}) 02:36:23 executing program 4: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x541c, &(0x7f00000001c0)={0xf8e9}) 02:36:23 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5452, 0x400000) ioctl$TIOCGLCKTRMIOS(r0, 0x5456, &(0x7f0000000000)={0x3, 0x2, 0x20, 0x7, 0x11, "c9605ac70ff9ebc302a57fc02de6164a4c47b5"}) ioctl$GIO_CMAP(r0, 0x4b70, &(0x7f00000000c0)) write$qrtrtun(r0, &(0x7f0000000180)="834097d1fa086cb6312514ee2ddeab693c2fb5fcd3aedaee6d7e3b35a1b69b2b01aebf74d1204669f741355b006a5fdd8dfb317b373a0b42212705cc1f943fa227c3c8078ff3ed8fab79fc7c4ccad66dfaafdef6a0aed645fa2e5e45a3d57e478157125fa22ce2f6742dff8b846c265dae8d7f4dda7454a51c0a74a50d5f2fd8b212630f9266a5e81e0951f3f8232551420ef53d40d7b285c9c4ef48a9dc358fe5d9c7b11534f9cfa79a40bd7741b06c929d1c46b318d23f15a25eb12aa9b1bf1245da1c2f7a2417f5e33821ce9d60b3106f8c60ca29816a99b5f3fe7e", 0xdd) ioctl$VT_GETMODE(r0, 0x5601, &(0x7f0000000080)) 02:36:23 executing program 2: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x540b, 0x0) 02:36:23 executing program 1: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5422, &(0x7f00000001c0)={0xf8e9}) 02:36:23 executing program 4: syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(0xffffffffffffffff, 0x541c, &(0x7f00000001c0)={0xf8e9}) 02:36:23 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5425, &(0x7f00000001c0)={0xf8e9}) 02:36:23 executing program 3: setsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(0xffffffffffffffff, 0x84, 0x8, &(0x7f0000000000)=0x2, 0x4) r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x4020940d, 0x400000) 02:36:23 executing program 2: syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(0xffffffffffffffff, 0x540b, 0x0) 02:36:23 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, 0x0) sendmsg$RDMA_NLDEV_CMD_RES_PD_GET(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x30, 0x140e, 0x2, 0x70bd26, 0x25dfdbfd, "", [@RDMA_NLDEV_ATTR_RES_PDN={0x8, 0x3c, 0x2}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x1}]}, 0x30}, 0x1, 0x0, 0x0, 0x4}, 0x4000000) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(r0, 0xc008551c, &(0x7f0000000000)={0x5, 0x4, [0x5]}) ioctl$TIOCSTI(r0, 0x5452, 0x400000) 02:36:23 executing program 4: syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(0xffffffffffffffff, 0x541c, &(0x7f00000001c0)={0xf8e9}) 02:36:23 executing program 1: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5422, &(0x7f00000001c0)={0xf8e9}) 02:36:23 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5427, &(0x7f00000001c0)={0xf8e9}) 02:36:24 executing program 2: syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(0xffffffffffffffff, 0x540b, 0x0) 02:36:24 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x4020940d, 0x400000) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r1, 0x4b6b, 0x0) ioctl$TIOCGPGRP(r1, 0x540f, &(0x7f0000000000)) 02:36:24 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5452, 0x400000) ioctl$GIO_FONTX(0xffffffffffffffff, 0x4b6b, &(0x7f0000000000)={0x1c6, 0x14, &(0x7f0000000180)}) 02:36:24 executing program 1: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5422, &(0x7f00000001c0)={0xf8e9}) 02:36:24 executing program 4: syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(0xffffffffffffffff, 0x541c, &(0x7f00000001c0)={0xf8e9}) 02:36:24 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5428, &(0x7f00000001c0)={0xf8e9}) 02:36:24 executing program 2: syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(0xffffffffffffffff, 0x540b, 0x0) 02:36:24 executing program 4: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x541c, 0x0) 02:36:24 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x2485c0, 0x0) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x80040, 0x0) ioctl$TIOCSTI(r0, 0x4020940d, 0x400000) ioctl$TIOCPKT(r0, 0x5420, &(0x7f0000000000)=0x7f) 02:36:24 executing program 0: openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x0, 0x0) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000080)='/proc/capi/capi20\x00', 0x400640, 0x0) r0 = syz_open_dev$ptys(0xc, 0x3, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000001d40)='/proc/capi/capi20\x00', 0x381000, 0x0) setsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f0000001d80), 0x4) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x0, 0x0) ioctl$TIOCSTI(r2, 0x5452, 0x5) ioctl$TIOCPKT(r0, 0x5420, &(0x7f00000000c0)=0xffffffff) 02:36:24 executing program 1: ioctl$VT_RESIZE(0xffffffffffffffff, 0x5422, &(0x7f00000001c0)={0xf8e9}) 02:36:24 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5429, &(0x7f00000001c0)={0xf8e9}) 02:36:24 executing program 2: syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(0xffffffffffffffff, 0x540b, 0x0) 02:36:24 executing program 4: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x541c, 0x0) 02:36:24 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x4020940d, 0x400000) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x40, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x18, 0x4, &(0x7f00000007c0)=@raw=[@btf_id={0x18, 0x2, 0x3, 0x0, 0x1}, @initr0={0x18, 0x0, 0x0, 0x0, 0x9e0, 0x0, 0x0, 0x0, 0x401}], &(0x7f00000001c0)='syzkaller\x00', 0x2d, 0x20, &(0x7f0000000200)=""/32, 0x41100, 0x2, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000240)={0x5, 0x1000}, 0x8, 0x10, &(0x7f0000000280)={0x5, 0x5, 0x7, 0x3}, 0x10}, 0x78) ioctl$KDSETMODE(r1, 0x4b3a, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x120, 0x0, &(0x7f00000004c0)=[@increfs_done={0x40106308, 0x2}, @transaction_sg={0x40486311, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000080)={@fda={0x66646185, 0x5, 0x1, 0x13}, @flat=@weak_handle={0x77682a85, 0x100, 0x1}, @ptr={0x70742a85, 0x0, &(0x7f0000000040)=""/63, 0x3f, 0x0, 0x25}}, &(0x7f0000000100)={0x0, 0x20, 0x38}}, 0x40}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000340)={@flat=@handle={0x73682a85, 0x1000}, @fd={0x66642a85, 0x0, r2}, @fda={0x66646185, 0x3, 0x1, 0x39}}, &(0x7f00000003c0)={0x0, 0x18, 0x30}}}, @free_buffer, @decrefs={0x40046307, 0x3}, @request_death={0x400c630e, 0x2}, @increfs_done, @transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x50, 0x18, &(0x7f0000000400)={@fda={0x66646185, 0x4, 0x1}, @flat=@binder={0x73622a85, 0x0, 0x2}, @fd={0x66642a85, 0x0, r0}}, &(0x7f0000000480)={0x0, 0x20, 0x38}}}], 0xa4, 0x0, &(0x7f0000000600)="1bd4c8d231c24e888c2fdcf4adff337d8e5aae9c6b7e049547fa7c424a72e65a828320dd0fdeac39b8429fc3dde023f5bd8107c014359b103c7b4a73679e40c3646b4e1f42c6265dd262030749ff3e0f78b29f66f9e4267392350cc68bfd43748f9abed24f8abefbc004d013bf68e2ba1ec66f65562ebc10e4c62504f093e8ec835c82f4d95ac5fc230a115d2d48a5b519b10f08c0212f1c1c7aeec0d5b7da2441ecc90e"}) r3 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r3, 0xc0405519, 0x0) ioctl$sock_bt_hidp_HIDPGETCONNINFO(r3, 0x800448d3, &(0x7f0000000700)={@fixed={[], 0x12}, 0x5, 0xc63f, 0x6, 0x81, 0x8, "e59317d315afa3e6cf14f1fcf443ba02f4930df11540cea4a81c5a1a65eff8541bd9d5b23584ba1d0e2484c6e76bce0124f0f2edab920aff180665ede13b85c0fb11978dcfc9565f6e10f832a22cca74b11746b5cd560e31014e3dccf1fb824144c030d6f0b9b8f1de07190b1a91d0d105a63f1ead5a1963379fdcd1abf05012"}) 02:36:24 executing program 1: ioctl$VT_RESIZE(0xffffffffffffffff, 0x5422, &(0x7f00000001c0)={0xf8e9}) 02:36:24 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5437, &(0x7f00000001c0)={0xf8e9}) 02:36:24 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x200, 0x0) ioctl$TIOCSTI(r0, 0x5452, 0x400000) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r1, 0x4b6b, 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r2, 0x4b6b, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x4) ioctl$GIO_CMAP(r3, 0x4b70, &(0x7f0000000000)) 02:36:24 executing program 2: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5429, &(0x7f00000001c0)={0xf8e9}) 02:36:24 executing program 4: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x541c, 0x0) 02:36:24 executing program 1: ioctl$VT_RESIZE(0xffffffffffffffff, 0x5422, &(0x7f00000001c0)={0xf8e9}) 02:36:25 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN_UNNAMED(0x11, &(0x7f0000000000)={0x0, r0}, 0x10) ioctl$TIOCSTI(r0, 0x4020940d, 0x400000) 02:36:25 executing program 2: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5429, &(0x7f00000001c0)={0xf8e9}) 02:36:25 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5441, &(0x7f00000001c0)={0xf8e9}) 02:36:25 executing program 4: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x541c, &(0x7f00000001c0)) 02:36:25 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) getitimer(0x2, &(0x7f0000000000)) ioctl$TIOCSTI(r0, 0x5452, 0x400000) 02:36:25 executing program 1: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5422, &(0x7f00000001c0)={0xf8e9}) 02:36:25 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x4020940d, 0x400000) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000000)) 02:36:25 executing program 2: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5429, &(0x7f00000001c0)={0xf8e9}) 02:36:25 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5450, &(0x7f00000001c0)={0xf8e9}) 02:36:25 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5452, 0x400000) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000180)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x40, @empty, 0x200}, {0xa, 0x4e20, 0x9ea, @ipv4={[], [], @loopback}, 0x9}, 0xffffffffffffffff, 0x3}}, 0x48) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0xc0000, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_IP(r1, &(0x7f0000000040)={0x3, 0x40, 0xfa00, {{0xa, 0x4e23, 0xa2b78b2, @empty, 0xf1}, {0xa, 0x4e20, 0x4, @dev={0xfe, 0x80, [], 0x18}, 0x1}, 0xffffffffffffffff, 0xecd}}, 0x48) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r2, 0xc0405519, 0x0) r3 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r3, 0xc0405519, 0x0) ioctl$FUSE_DEV_IOC_CLONE(r2, 0x8004e500, &(0x7f00000000c0)=r3) 02:36:25 executing program 4: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5441, &(0x7f00000001c0)={0xf8e9}) 02:36:25 executing program 1: syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5422, &(0x7f00000001c0)={0xf8e9}) 02:36:25 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x4020940d, 0x400000) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r1, 0x4b6b, 0x0) ioctl$TIOCSTI(r1, 0x5412, 0x10000) ioctl$VT_GETMODE(r0, 0x5601, &(0x7f0000000040)) ioctl$TIOCGLCKTRMIOS(r1, 0x5456, &(0x7f0000000080)={0x1, 0x8b, 0x80000000, 0x1, 0x2, "f8b0e3bbdce4d6281d5d456edeabca5c77f869"}) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x9, 0x20002) socket$inet6_sctp(0xa, 0x5, 0x84) 02:36:25 executing program 2: ioctl$VT_RESIZE(0xffffffffffffffff, 0x5429, &(0x7f00000001c0)={0xf8e9}) 02:36:25 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5451, &(0x7f00000001c0)={0xf8e9}) 02:36:25 executing program 4: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5441, &(0x7f00000001c0)={0xf8e9}) 02:36:25 executing program 1: syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5422, &(0x7f00000001c0)={0xf8e9}) 02:36:25 executing program 0: clock_gettime(0x3, &(0x7f0000000000)) nanosleep(&(0x7f0000000080), &(0x7f0000000040)) r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5452, 0x400000) r1 = getpid() sched_rr_get_interval(r1, &(0x7f00000000c0)) 02:36:25 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5452, &(0x7f00000001c0)={0xf8e9}) 02:36:25 executing program 2: ioctl$VT_RESIZE(0xffffffffffffffff, 0x5429, &(0x7f00000001c0)={0xf8e9}) 02:36:25 executing program 3: ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000000)={0x10000, 0x0, 0x1}) ioctl$DRM_IOCTL_SG_ALLOC(0xffffffffffffffff, 0xc0106438, &(0x7f0000000040)={0x4bba, r0}) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r1, 0x4020940d, 0x400000) 02:36:25 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x80942, 0x0) ioctl$TIOCSTI(r0, 0x5452, 0x400000) getgroups(0x5, &(0x7f0000000100)=[0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xee00, 0xee01]) write$FUSE_DIRENTPLUS(r0, &(0x7f0000000300)={0x148, 0x0, 0x0, [{{0x0, 0x0, 0x47b, 0x4, 0xffffffff, 0x6, {0x2, 0x1, 0x0, 0x2, 0x10000, 0x6, 0x100, 0x6, 0x6, 0x1000, 0x2, 0xffffffffffffffff, 0xee01, 0x1, 0xf6}}, {0x2, 0x6, 0x0, 0xba}}, {{0x4, 0x2, 0x8, 0x200, 0x0, 0x60, {0x6, 0x21f, 0x1, 0x2, 0x4, 0x2, 0x2, 0x200, 0x3, 0xa000, 0x80, 0xee00, r1, 0x7, 0x6}}, {0x3, 0x8, 0x3, 0x101, ',{,'}}]}, 0x148) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) r3 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r3, 0xc0405519, 0x0) read$qrtrtun(r3, &(0x7f0000000480)=""/136, 0x88) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r2, 0xc0405519, 0x0) setsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r2, 0x84, 0x8, &(0x7f0000000080)=0x83, 0x4) write$RDMA_USER_CM_CMD_GET_EVENT(r2, &(0x7f0000000000)={0xc, 0x2, 0xfa00, {&(0x7f0000000180)}}, 0x10) syz_open_dev$sndctrl(&(0x7f00000000c0)='/dev/snd/controlC#\x00', 0x3, 0xc8802) 02:36:25 executing program 4: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5441, &(0x7f00000001c0)={0xf8e9}) 02:36:25 executing program 1: syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5422, &(0x7f00000001c0)={0xf8e9}) 02:36:25 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5457, &(0x7f00000001c0)={0xf8e9}) 02:36:25 executing program 3: sendmsg$RDMA_NLDEV_CMD_RES_CM_ID_GET(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x30, 0x140b, 0x800, 0x70bd2b, 0x25dfdbff, "", [@RDMA_NLDEV_ATTR_RES_CM_IDN={0x8}, @RDMA_NLDEV_ATTR_RES_CM_IDN={0x8, 0x3f, 0x5}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}]}, 0x30}, 0x1, 0x0, 0x0, 0x10}, 0x24080040) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000080)='/proc/capi/capi20\x00', 0x50482, 0x0) r0 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$VT_RESIZEX(r0, 0x560a, &(0x7f00000000c0)={0x1, 0x7, 0x4, 0xfff, 0x3, 0xebe}) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r1, 0x4b6b, 0x0) ioctl$GIO_CMAP(r1, 0x4b70, &(0x7f0000000100)) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r2, 0x4020940d, 0x400000) accept$phonet_pipe(r2, &(0x7f0000000000), &(0x7f0000000040)=0x10) 02:36:26 executing program 4: ioctl$VT_RESIZE(0xffffffffffffffff, 0x5441, &(0x7f00000001c0)={0xf8e9}) 02:36:26 executing program 0: openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x200, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x8000, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_FONTX(r0, 0x4b6b, 0x0) ioctl$TIOCSTI(r0, 0x5452, 0x40000000003) 02:36:26 executing program 1: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5422, 0x0) 02:36:26 executing program 2: ioctl$VT_RESIZE(0xffffffffffffffff, 0x5429, &(0x7f00000001c0)={0xf8e9}) 02:36:26 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x545d, &(0x7f00000001c0)={0xf8e9}) 02:36:26 executing program 4: ioctl$VT_RESIZE(0xffffffffffffffff, 0x5441, &(0x7f00000001c0)={0xf8e9}) 02:36:26 executing program 1: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5452, &(0x7f00000001c0)={0xf8e9}) 02:36:26 executing program 2: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5429, &(0x7f00000001c0)={0xf8e9}) 02:36:26 executing program 5: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5460, &(0x7f00000001c0)={0xf8e9}) 02:36:26 executing program 0: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5452, 0x400000) r1 = syz_open_dev$tty1(0xc, 0x4, 0x4) ioctl$GIO_FONTX(r1, 0x4b6b, 0x0) ioctl$TIOCPKT(r1, 0x5420, &(0x7f0000000000)=0x1ff) 02:36:26 executing program 1: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r0, 0x5452, &(0x7f00000001c0)={0xf8e9}) [ 2185.641931][ T1] BUG: unable to handle page fault for address: ffff888001000000 [ 2185.641950][ T1] #PF: supervisor write access in kernel mode [ 2185.641963][ T1] #PF: error_code(0x0003) - permissions violation [ 2185.641976][ T1] PGD fc01067 P4D fc01067 PUD fc02067 PMD 80000000010001e1 [ 2185.642010][ T1] Oops: 0003 [#1] PREEMPT SMP KASAN [ 2185.642030][ T1] CPU: 0 PID: 1 Comm: systemd Not tainted 5.11.0-rc2-syzkaller #0 [ 2185.642053][ T1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2185.642067][ T1] RIP: 0010:vga16fb_imageblit+0xbe9/0x2210 [ 2185.642167][ T1] Code: 83 c5 01 48 89 f8 48 89 f9 48 83 c3 01 48 c1 e8 03 83 e1 07 42 0f b6 04 20 38 c8 7f 08 84 c0 0f 85 27 0f 00 00 41 0f b6 45 ff <88> 02 44 89 f6 31 ff 44 29 ee e8 d8 41 82 fd 49 39 ed 75 b6 4c 89 [ 2185.642190][ T1] RSP: 0018:ffffc90000c7f570 EFLAGS: 00010246 [ 2185.642208][ T1] RAX: 0000000000000000 RBX: ffff888001000001 RCX: 0000000000000000 [ 2185.642224][ T1] RDX: ffff888001000000 RSI: ffffffff83f03c08 RDI: ffff888143a190d8 [ 2185.642240][ T1] RBP: ffff888143a190e0 R08: 0000000000000000 R09: 0000000000000001 [ 2185.642255][ T1] R10: ffffffff83f03c48 R11: 0000000000000001 R12: dffffc0000000000 [ 2185.642272][ T1] R13: ffff888143a190d9 R14: 0000000043a190e0 R15: 0000000000000003 [ 2185.642288][ T1] FS: 00007f1ab3567500(0000) GS:ffff8880b9e00000(0000) knlGS:0000000000000000 [ 2185.642311][ T1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2185.642328][ T1] CR2: ffff888001000000 CR3: 0000000023ab5000 CR4: 00000000001506f0 [ 2185.642344][ T1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 2185.642358][ T1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 2185.642373][ T1] Call Trace: [ 2185.642383][ T1] ? __sanitizer_cov_trace_cmp4+0x1c/0x70 [ 2185.642415][ T1] bit_putcs+0x6e1/0xd20 [ 2185.642441][ T1] ? bit_cursor+0x1720/0x1720 [ 2185.642461][ T1] ? asm_sysvec_apic_timer_interrupt+0x12/0x20 [ 2185.642489][ T1] ? get_color+0x177/0x410 [ 2185.642539][ T1] ? __sanitizer_cov_trace_cmp4+0x1c/0x70 [ 2185.642566][ T1] ? fb_get_color_depth+0x11a/0x240 [ 2185.642591][ T1] ? __sanitizer_cov_trace_switch+0x63/0xf0 [ 2185.642620][ T1] ? bit_cursor+0x1720/0x1720 [ 2185.642641][ T1] fbcon_putcs+0x35a/0x450 [ 2185.642668][ T1] do_update_region+0x399/0x630 [ 2185.642709][ T1] ? con_get_trans_old+0x2a0/0x2a0 [ 2185.642732][ T1] ? fbcon_set_palette+0x422/0x620 [ 2185.642751][ T1] ? var_to_display+0x7f0/0x7f0 [ 2185.642766][ T1] redraw_screen+0x658/0x790 [ 2185.642780][ T1] ? vc_init+0x5a0/0x5a0 [ 2185.642794][ T1] fbcon_blank+0x8c5/0xc30 [ 2185.642809][ T1] ? fbcon_init+0x1950/0x1950 [ 2185.642828][ T1] do_unblank_screen+0x25b/0x470 [ 2185.642841][ T1] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 2185.642863][ T1] vt_ioctl+0x1b83/0x2950 [ 2185.642916][ T1] ? avc_ss_reset+0x170/0x170 [ 2185.642933][ T1] ? complete_change_console+0x3b0/0x3b0 [ 2185.642949][ T1] ? kfree+0x10a/0x270 [ 2185.642965][ T1] ? __sanitizer_cov_trace_const_cmp1+0x22/0x80 [ 2185.642981][ T1] ? tomoyo_path_number_perm+0x24e/0x590 [ 2185.642998][ T1] ? lock_downgrade+0x6d0/0x6d0 [ 2185.643013][ T1] ? tomoyo_execute_permission+0x4a0/0x4a0 [ 2185.643029][ T1] ? n_tty_ioctl_helper+0x5d/0x3a0 [ 2185.643066][ T1] ? __sanitizer_cov_trace_switch+0x63/0xf0 [ 2185.643081][ T1] ? complete_change_console+0x3b0/0x3b0 [ 2185.643096][ T1] tty_ioctl+0xe50/0x1660 [ 2185.643110][ T1] ? tty_fasync+0x390/0x390 [ 2185.643123][ T1] ? __sanitizer_cov_trace_switch+0x63/0xf0 [ 2185.643138][ T1] ? __sanitizer_cov_trace_const_cmp2+0x22/0x80 [ 2185.643154][ T1] ? do_vfs_ioctl+0x27d/0x1090 [ 2185.643167][ T1] ? generic_block_fiemap+0x60/0x60 [ 2185.643179][ T1] ? selinux_inode_getsecctx+0x90/0x90 [ 2185.643191][ T1] ? build_open_flags+0x680/0x680 [ 2185.643205][ T1] ? blkcg_maybe_throttle_current+0x5db/0xd80 [ 2185.643236][ T1] ? security_file_ioctl+0x5c/0xb0 [ 2185.643250][ T1] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 2185.643265][ T1] ? tty_fasync+0x390/0x390 [ 2185.643278][ T1] __x64_sys_ioctl+0x193/0x200 [ 2185.643291][ T1] do_syscall_64+0x2d/0x70 [ 2185.643306][ T1] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2185.643319][ T1] RIP: 0033:0x7f1ab1b37017 [ 2185.643331][ T1] Code: 00 00 00 48 8b 05 81 7e 2b 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 51 7e 2b 00 f7 d8 64 89 01 48 [ 2185.643344][ T1] RSP: 002b:00007ffdef01cef8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2185.643357][ T1] RAX: ffffffffffffffda RBX: 0000000000000013 RCX: 00007f1ab1b37017 [ 2185.643366][ T1] RDX: 0000000000000000 RSI: 0000000000004b3a RDI: 0000000000000013 [ 2185.643374][ T1] RBP: 0000000000000001 R08: 00007ffdef01cef0 R09: 0000000000000000 [ 2185.643382][ T1] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000002 [ 2185.643390][ T1] R13: 0000000000000001 R14: 0000000000000000 R15: 0000561f15af0a10 [ 2185.643401][ T1] Modules linked in: [ 2185.643408][ T1] CR2: ffff888001000000 [ 2185.643417][ T1] ---[ end trace c7c40e41a694d4f0 ]--- [ 2185.643423][ T1] RIP: 0010:vga16fb_imageblit+0xbe9/0x2210 [ 2185.643439][ T1] Code: 83 c5 01 48 89 f8 48 89 f9 48 83 c3 01 48 c1 e8 03 83 e1 07 42 0f b6 04 20 38 c8 7f 08 84 c0 0f 85 27 0f 00 00 41 0f b6 45 ff <88> 02 44 89 f6 31 ff 44 29 ee e8 d8 41 82 fd 49 39 ed 75 b6 4c 89 [ 2185.643452][ T1] RSP: 0018:ffffc90000c7f570 EFLAGS: 00010246 [ 2185.643461][ T1] RAX: 0000000000000000 RBX: ffff888001000001 RCX: 0000000000000000 [ 2185.643470][ T1] RDX: ffff888001000000 RSI: ffffffff83f03c08 RDI: ffff888143a190d8 [ 2185.643479][ T1] RBP: ffff888143a190e0 R08: 0000000000000000 R09: 0000000000000001 [ 2185.643487][ T1] R10: ffffffff83f03c48 R11: 0000000000000001 R12: dffffc0000000000 [ 2185.643495][ T1] R13: ffff888143a190d9 R14: 0000000043a190e0 R15: 0000000000000003 [ 2185.643504][ T1] FS: 00007f1ab3567500(0000) GS:ffff8880b9e00000(0000) knlGS:0000000000000000 [ 2185.643517][ T1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2185.643527][ T1] CR2: ffff888001000000 CR3: 0000000023ab5000 CR4: 00000000001506f0 [ 2185.643535][ T1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 2185.643543][ T1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 2185.643552][ T1] Kernel panic - not syncing: Fatal exception [ 2185.644152][ T1] Kernel Offset: disabled