[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[ 19.880494] random: sshd: uninitialized urandom read (32 bytes read) [?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 24.749434] random: sshd: uninitialized urandom read (32 bytes read) [ 25.237871] random: sshd: uninitialized urandom read (32 bytes read) [ 26.232969] random: sshd: uninitialized urandom read (32 bytes read) Warning: Permanently added '10.128.10.38' (ECDSA) to the list of known hosts. [ 31.742524] random: sshd: uninitialized urandom read (32 bytes read) 2018/06/08 22:50:48 fuzzer started [ 32.917803] random: cc1: uninitialized urandom read (8 bytes read) 2018/06/08 22:50:50 dialing manager at 10.128.0.26:39331 [ 65.437969] can: request_module (can-proto-0) failed. [ 65.447899] can: request_module (can-proto-0) failed. 2018/06/08 22:51:23 kcov=true, comps=true 22:51:30 executing program 0: request_key(&(0x7f0000000000)='dns_resolver\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a}, &(0x7f0000000080)='mime_typeGPL', 0xfffffffffffffffe) 22:51:30 executing program 1: r0 = socket$inet(0x2, 0x2, 0x0) sendmmsg(r0, &(0x7f0000001e80)=[{{&(0x7f0000000080)=@in={0x2, 0x4e20}, 0x80, &(0x7f0000000080), 0x0, &(0x7f0000000080)}}, {{&(0x7f00000002c0)=@in={0x2, 0x4e21, @broadcast=0xffffffff}, 0x80, &(0x7f00000001c0), 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="14000000000000000700000089079800442373c5c0f056555dc7b67b0d63d881d2f4d111fca08ecab27813c63e56287295ff1f58d25ba11d6d41b87f2b2febb4ee16c7c321300a2b35ea33b918669d41e2bb47e937888b219b5b5da9eda27866caa770b071000ba2c1490975f16441fef342429eb42492f2e55e6cf0d5be4fb3c85604739ab85628a9547cdb8e747f2d0240ec30bda87963c826faa0373651e8387744b4605cc1b0652a13d99579cafd9e38b5c88f2915609c1be4abb206a8d70c71737c5f8ec79222f01e19c1b4c05bbe954087d856dc86d8d4f34230fe7fde07baf75dedb1eff974e13041f52f70e899beadeda386fc2e5a51ecee1245870a23e886865fc38dcd7e43058653eafe0ce00b4e2cde4b14fe145fe14c2591f336dc81228677cd05a6e05c21829f83d34d02481c6f783d099a26d51b6ce9a2ac01bed63048e14e7c11ab5b1766cf97ee14610708ebf36bd815aa4f1a4bb195f9bf1c997574f255"], 0x166}}], 0x2, 0x0) 22:51:30 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") pipe2(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) getpeername$ax25(r1, &(0x7f0000000280), &(0x7f00000002c0)=0x10) 22:51:30 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") nanosleep(&(0x7f0000000080)={0x0, 0x1c9c380}, 0x0) 22:51:30 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000040)="415ee1311f16f477671070") faccessat(0xffffffffffffffff, &(0x7f0000000040)='/\x00', 0x3, 0x0) 22:51:30 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000140)={0x303, 0x33}, 0x4) 22:51:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000000080)}}], 0x0, 0x0, &(0x7f0000000340)}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) 22:51:30 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket(0x10, 0x803, 0x0) sendto(r1, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) readv(r1, &(0x7f0000000580)=[{&(0x7f00000000c0)=""/63, 0x3f}, {&(0x7f0000000fc0)=""/4096, 0x1000}, {&(0x7f0000000380)=""/104, 0x68}, {&(0x7f0000000500)=""/89, 0x59}], 0x4) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000f40)=@ethernet={0x0, @random}, 0x80, &(0x7f0000002380), 0x0, &(0x7f0000002400)=""/191, 0xbf}}, {{&(0x7f0000003440)=@l2, 0x80, &(0x7f0000003680), 0x0, &(0x7f00000036c0)=""/64, 0x40}}], 0xf, 0x0, &(0x7f0000003700)={0x77359400}) [ 74.833718] IPVS: ftp: loaded support on port[0] = 21 [ 74.846211] IPVS: ftp: loaded support on port[0] = 21 [ 74.869424] IPVS: ftp: loaded support on port[0] = 21 [ 74.887628] IPVS: ftp: loaded support on port[0] = 21 [ 74.914298] IPVS: ftp: loaded support on port[0] = 21 [ 74.914643] IPVS: ftp: loaded support on port[0] = 21 [ 74.965680] IPVS: ftp: loaded support on port[0] = 21 [ 74.979200] IPVS: ftp: loaded support on port[0] = 21 [ 77.042938] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.049485] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.073459] device bridge_slave_0 entered promiscuous mode [ 77.093348] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.099761] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.117971] device bridge_slave_0 entered promiscuous mode [ 77.127074] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.133486] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.141725] device bridge_slave_0 entered promiscuous mode [ 77.153863] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.160271] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.180847] device bridge_slave_0 entered promiscuous mode [ 77.189077] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.195462] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.204400] device bridge_slave_0 entered promiscuous mode [ 77.220052] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.226470] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.234264] device bridge_slave_0 entered promiscuous mode [ 77.242059] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.248534] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.262923] device bridge_slave_0 entered promiscuous mode [ 77.271514] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.277886] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.286112] device bridge_slave_1 entered promiscuous mode [ 77.292983] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.299386] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.308369] device bridge_slave_0 entered promiscuous mode [ 77.317377] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.323752] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.343266] device bridge_slave_1 entered promiscuous mode [ 77.354773] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.361157] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.368659] device bridge_slave_1 entered promiscuous mode [ 77.376557] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.383062] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.391934] device bridge_slave_1 entered promiscuous mode [ 77.402316] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.408708] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.418351] device bridge_slave_1 entered promiscuous mode [ 77.425648] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.432058] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.442531] device bridge_slave_1 entered promiscuous mode [ 77.451412] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 77.461963] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 77.470622] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 77.477948] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.484416] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.514130] device bridge_slave_1 entered promiscuous mode [ 77.528948] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.535362] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.545369] device bridge_slave_1 entered promiscuous mode [ 77.554276] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 77.562895] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 77.573408] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 77.582083] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 77.591590] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 77.599176] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 77.651895] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 77.686888] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 77.697202] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 77.731383] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 77.739467] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 77.795169] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 77.841074] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 77.976942] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 77.987801] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 77.998604] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 78.109396] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 78.120633] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 78.146143] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 78.158324] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 78.176100] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 78.196480] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 78.206947] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 78.235469] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 78.295846] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 78.305379] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 78.367427] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 78.379274] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 78.447479] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 78.460610] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 78.467552] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 78.498427] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 78.505324] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 78.514576] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 78.521596] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 78.537502] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 78.560225] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 78.577124] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 78.587264] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 78.630956] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 78.639676] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 78.646520] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 78.658613] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 78.704992] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 78.711899] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 78.773196] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 78.794724] team0: Port device team_slave_0 added [ 78.802229] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 78.815888] team0: Port device team_slave_0 added [ 78.854483] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 78.862359] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 78.900943] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 78.925669] team0: Port device team_slave_1 added [ 78.939942] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 78.957821] team0: Port device team_slave_1 added [ 78.975492] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 78.985930] team0: Port device team_slave_0 added [ 78.992421] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 79.004481] team0: Port device team_slave_0 added [ 79.025451] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 79.043228] team0: Port device team_slave_0 added [ 79.063287] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 79.080547] team0: Port device team_slave_0 added [ 79.103008] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 79.121620] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 79.139455] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 79.149189] team0: Port device team_slave_1 added [ 79.160464] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 79.168764] team0: Port device team_slave_0 added [ 79.181162] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 79.194648] team0: Port device team_slave_1 added [ 79.204978] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 79.225494] team0: Port device team_slave_1 added [ 79.231268] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 79.239192] team0: Port device team_slave_1 added [ 79.260448] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 79.269525] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 79.291825] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 79.299270] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 79.312612] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 79.341392] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 79.358157] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 79.374928] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 79.392777] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 79.421352] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 79.442946] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 79.451874] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 79.459525] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 79.467566] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 79.474742] team0: Port device team_slave_0 added [ 79.480177] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 79.488789] team0: Port device team_slave_1 added [ 79.494696] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 79.506694] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 79.517578] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 79.528694] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 79.553963] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 79.574401] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 79.582678] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 79.592294] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 79.599866] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 79.610468] team0: Port device team_slave_1 added [ 79.616266] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 79.625296] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 79.635863] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 79.643106] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 79.651396] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 79.680813] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 79.690621] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 79.704606] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 79.712761] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 79.720654] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 79.728519] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 79.736900] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 79.745268] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 79.752840] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 79.762504] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 79.773932] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 79.788566] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 79.798285] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 79.805482] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 79.813539] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 79.824955] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 79.834456] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 79.846732] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 79.866932] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 79.875421] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 79.887181] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 79.894036] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 79.916472] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 79.935583] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 79.960887] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 79.972874] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 79.980509] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 79.996648] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 80.003796] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 80.012177] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 80.030727] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 80.037758] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 80.050587] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 80.073847] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 80.081292] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 80.088721] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 80.113597] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 80.138191] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 80.146257] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 80.212155] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 80.219544] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 80.229508] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 80.250241] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 80.258635] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 80.278812] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 80.347672] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 80.355553] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 80.373647] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 81.169708] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.176224] bridge0: port 2(bridge_slave_1) entered forwarding state [ 81.183249] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.189640] bridge0: port 1(bridge_slave_0) entered forwarding state [ 81.201998] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 81.233916] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.240326] bridge0: port 2(bridge_slave_1) entered forwarding state [ 81.246998] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.253379] bridge0: port 1(bridge_slave_0) entered forwarding state [ 81.286005] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 81.298506] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.304908] bridge0: port 2(bridge_slave_1) entered forwarding state [ 81.311568] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.317930] bridge0: port 1(bridge_slave_0) entered forwarding state [ 81.326182] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 81.443358] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.449769] bridge0: port 2(bridge_slave_1) entered forwarding state [ 81.456447] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.462827] bridge0: port 1(bridge_slave_0) entered forwarding state [ 81.470829] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 81.498663] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.505062] bridge0: port 2(bridge_slave_1) entered forwarding state [ 81.511721] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.518100] bridge0: port 1(bridge_slave_0) entered forwarding state [ 81.563730] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 81.574825] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 81.583167] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 81.599887] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 81.613474] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 81.621625] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 81.637690] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.644072] bridge0: port 2(bridge_slave_1) entered forwarding state [ 81.650774] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.657172] bridge0: port 1(bridge_slave_0) entered forwarding state [ 81.666373] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 81.784253] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.790674] bridge0: port 2(bridge_slave_1) entered forwarding state [ 81.797346] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.803728] bridge0: port 1(bridge_slave_0) entered forwarding state [ 81.811979] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 81.822930] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.829321] bridge0: port 2(bridge_slave_1) entered forwarding state [ 81.835999] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.842384] bridge0: port 1(bridge_slave_0) entered forwarding state [ 81.854439] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 82.592366] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 82.605871] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 82.638527] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 86.375683] 8021q: adding VLAN 0 to HW filter on device bond0 [ 86.469346] 8021q: adding VLAN 0 to HW filter on device bond0 [ 86.528679] 8021q: adding VLAN 0 to HW filter on device bond0 [ 86.620768] 8021q: adding VLAN 0 to HW filter on device bond0 [ 86.644340] 8021q: adding VLAN 0 to HW filter on device bond0 [ 86.784988] 8021q: adding VLAN 0 to HW filter on device bond0 [ 86.810190] 8021q: adding VLAN 0 to HW filter on device bond0 [ 86.839364] 8021q: adding VLAN 0 to HW filter on device bond0 [ 86.860705] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 86.947271] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 86.971238] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 87.085937] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 87.106163] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 87.237616] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 87.246224] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 87.260595] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 87.363293] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 87.385122] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 87.397595] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 87.433123] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 87.439377] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 87.449525] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 87.512866] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 87.519104] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 87.529954] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 87.655773] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 87.662062] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 87.674406] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 87.690986] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 87.704656] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 87.710801] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 87.737647] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 87.755447] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 87.776891] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 87.790554] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 87.816880] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 87.827522] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 87.856562] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 87.870740] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 87.898745] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 87.935884] 8021q: adding VLAN 0 to HW filter on device team0 [ 87.976485] 8021q: adding VLAN 0 to HW filter on device team0 [ 88.048230] 8021q: adding VLAN 0 to HW filter on device team0 [ 88.100204] 8021q: adding VLAN 0 to HW filter on device team0 [ 88.187411] 8021q: adding VLAN 0 to HW filter on device team0 [ 88.255957] 8021q: adding VLAN 0 to HW filter on device team0 [ 88.289626] 8021q: adding VLAN 0 to HW filter on device team0 [ 88.325473] 8021q: adding VLAN 0 to HW filter on device team0 22:51:47 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000140)={0x303, 0x33}, 0x4) 22:51:47 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(r1, 0x2) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) 22:51:47 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r1 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) write(r1, &(0x7f0000000040)="16", 0x1) sendfile(r1, r1, &(0x7f0000001000), 0xffff) r2 = gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(r1, r1, &(0x7f0000000000), 0xffffffff) tkill(r2, 0x1000000000016) [ 91.132674] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 91.169427] binder: 6647:6648 transaction failed 29189/-22, size 0-0 line 2852 [ 91.189319] binder: undelivered TRANSACTION_ERROR: 29189 22:51:48 executing program 0: creat(&(0x7f0000000000)='./file0\x00', 0x0) r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") getsockopt$inet6_tcp_int(r0, 0x6, 0x0, &(0x7f0000000080), &(0x7f00000000c0)=0x3) 22:51:48 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000140)={0x303, 0x33}, 0x4) 22:51:48 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(r1, 0x2) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) 22:51:48 executing program 2: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount(&(0x7f0000000300)='./file0/file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f000000a000)) 22:51:48 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") bind$inet6(r0, &(0x7f00001c1000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, &(0x7f0000b31000)="f9", 0x1, 0x0, &(0x7f00009e1000)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) 22:51:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000000080)}}], 0x0, 0x0, &(0x7f0000000340)}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) 22:51:48 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r1 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) write(r1, &(0x7f0000000040)="16", 0x1) sendfile(r1, r1, &(0x7f0000001000), 0xffff) r2 = gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(r1, r1, &(0x7f0000000000), 0xffffffff) tkill(r2, 0x1000000000016) 22:51:48 executing program 7: r0 = syz_open_dev$evdev(&(0x7f0000dfdfee)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCGKEYCODE_V2(r0, 0x80284504, &(0x7f0000001140)=""/4096) [ 91.878891] random: crng init done [ 91.899089] binder: 6669:6670 transaction failed 29189/-22, size 0-0 line 2852 22:51:48 executing program 2: r0 = socket(0xa, 0x2400000001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000034000)={0x2, {{0xa, 0x0, 0x0, @mcast2={0xff, 0x2, [], 0x1}}}}, 0x88) 22:51:48 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x82) r1 = memfd_create(&(0x7f0000000140)="74086e750000000000000000008c00", 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, r1) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x7fd) 22:51:48 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000140)={0x303, 0x33}, 0x4) 22:51:48 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000000)=ANY=[@ANYBLOB="6d616e676c65000000037e00c9d58471348a857c4038ce0af765ebaa00000000000000000000000000000000002215803aa1b2cbcb001f00000006000040d6000000000000000004006bb95573833264df7c2d0300ac"], 0x1) 22:51:48 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(r1, 0x2) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) [ 91.942910] binder: undelivered TRANSACTION_ERROR: 29189 22:51:48 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000080)}], 0x1, 0x0) 22:51:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000000080)}}], 0x0, 0x0, &(0x7f0000000340)}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) 22:51:49 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket(0x10, 0x803, 0x0) sendto(r1, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) readv(r1, &(0x7f0000000580)=[{&(0x7f0000000140)=""/202, 0xca}, {&(0x7f0000000fc0)=""/4096, 0x1000}, {&(0x7f0000000380)=""/104, 0x68}, {&(0x7f0000000500)=""/89, 0x59}], 0x4) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000f40)=@ethernet={0x0, @random}, 0x80, &(0x7f0000002380), 0x0, &(0x7f0000002400)=""/191, 0xbf}}, {{&(0x7f0000003440)=@l2, 0x80, &(0x7f0000003680), 0x0, &(0x7f00000036c0)=""/64, 0x40}}], 0xf, 0x0, &(0x7f0000003700)={0x77359400}) 22:51:49 executing program 0: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x5, 0x108000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={"6966623000faffffffffffffff00"}) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000000)={'ifb0\x00'}) r1 = socket(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f00000002c0)=@broute={'broute\x00', 0x20, 0x1, 0x3b0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200010c0], 0x0, &(0x7f0000000000), &(0x7f00000010c0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'syzkaller1\x00', 'ip6tnl0\x00', "01616d61000000004ab2cec800", @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0x2a8, 0x2a8, 0x2f0, [@bpf0={'bpf\x00', 0x210, {{0x3, [{}, {}, {0x6}]}}}]}}, @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffdffffffffc}]}, 0x428) 22:51:49 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(r1, 0x2) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) 22:51:49 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000140)={0x303, 0x33}, 0x4) 22:51:49 executing program 2: lseek(0xffffffffffffffff, 0x0, 0x0) socket$inet6(0xa, 0x2, 0x0) r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") futex(&(0x7f000000cffc), 0x0, 0x0, &(0x7f00006f7000)={0x77359400}, &(0x7f0000877000), 0x0) futex(&(0x7f000000cffc), 0x1, 0x5, &(0x7f00000017c0), &(0x7f0000000080), 0x0) 22:51:49 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000180)="295ee1311f16f477671070") renameat2(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0xffffffffffffffff, &(0x7f00000000c0)='./file0\x00', 0x5) 22:51:49 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r1 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) write(r1, &(0x7f0000000040)="16", 0x1) sendfile(r1, r1, &(0x7f0000001000), 0xffff) r2 = gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(r1, r1, &(0x7f0000000000), 0xffffffff) tkill(r2, 0x1000000000016) 22:51:49 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) [ 92.884361] binder: 6719:6723 transaction failed 29189/-22, size 0-0 line 2852 22:51:49 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000140)={0x303, 0x33}, 0x4) 22:51:49 executing program 1: r0 = inotify_init1(0x0) fcntl$setown(r0, 0x8, 0xffffffffffffffff) fcntl$getownex(r0, 0x10, &(0x7f0000000100)={0x0, 0x0}) ptrace$setopts(0x4206, r1, 0x0, 0x0) ptrace(0x4207, r1) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x1, 0x31, 0xffffffffffffffff, 0x0) ptrace$setregs(0xf, r1, 0x0, &(0x7f0000000000)) 22:51:49 executing program 7: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") sendto$inet(r0, &(0x7f0000000040)="e57ad13a8e045acf", 0x8, 0x0, &(0x7f0000000000)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) [ 92.934729] binder: undelivered TRANSACTION_ERROR: 29189 22:51:49 executing program 0: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x5, 0x108000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={"6966623000faffffffffffffff00"}) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000000)={'ifb0\x00'}) r1 = socket(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f00000002c0)=@broute={'broute\x00', 0x20, 0x1, 0x3b0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200010c0], 0x0, &(0x7f0000000000), &(0x7f00000010c0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'syzkaller1\x00', 'ip6tnl0\x00', "01616d61000000004ab2cec800", @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0x2a8, 0x2a8, 0x2f0, [@bpf0={'bpf\x00', 0x210, {{0x3, [{}, {}, {0x6}]}}}]}}, @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffdffffffffc}]}, 0x428) 22:51:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000000080)}}], 0x0, 0x0, &(0x7f0000000340)}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) 22:51:49 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000140)={0x303, 0x33}, 0x4) 22:51:49 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000000)={'lo\x00'}) 22:51:49 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") vmsplice(0xffffffffffffffff, &(0x7f00000000c0), 0x0, 0x0) 22:51:49 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000140)={0x303, 0x33}, 0x4) 22:51:49 executing program 0: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x5, 0x108000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={"6966623000faffffffffffffff00"}) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000000)={'ifb0\x00'}) r1 = socket(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f00000002c0)=@broute={'broute\x00', 0x20, 0x1, 0x3b0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200010c0], 0x0, &(0x7f0000000000), &(0x7f00000010c0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'syzkaller1\x00', 'ip6tnl0\x00', "01616d61000000004ab2cec800", @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0x2a8, 0x2a8, 0x2f0, [@bpf0={'bpf\x00', 0x210, {{0x3, [{}, {}, {0x6}]}}}]}}, @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffdffffffffc}]}, 0x428) [ 93.125095] binder: 6756:6757 transaction failed 29189/-22, size 0-0 line 2852 [ 93.161225] binder: undelivered TRANSACTION_ERROR: 29189 [ 93.173646] device lo entered promiscuous mode 22:51:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) 22:51:49 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f0000002fc8)={&(0x7f0000000080)=@nl=@kern={0x10}, 0x80, &(0x7f0000002000)=[{&(0x7f00000001c0)="5500000018007f4500fe01b2a4a280930a06000000a84599910000003900090008000c00010000001900150006000000000000dc1338d5440055ec8a21ed0c63a399158a877f29009b84116ef75afb83de448d621a", 0x55}], 0x1, &(0x7f0000000240)=ANY=[]}, 0x0) 22:51:50 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cuse\x00', 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r1, 0x227d, &(0x7f0000000040)) 22:51:50 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc\x00', 0x0, 0x0) clone(0x0, &(0x7f0000b53000), &(0x7f0000000080), &(0x7f0000c35ffc), &(0x7f0000b3bfff)) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x80247008, &(0x7f00000000c0)) 22:51:50 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) 22:51:50 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r1 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) write(r1, &(0x7f0000000040)="16", 0x1) sendfile(r1, r1, &(0x7f0000001000), 0xffff) r2 = gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(r1, r1, &(0x7f0000000000), 0xffffffff) tkill(r2, 0x1000000000016) 22:51:50 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000140)={0x303, 0x33}, 0x4) 22:51:50 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r1, 0xc00c642d, &(0x7f0000000200)) 22:51:50 executing program 0: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x5, 0x108000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={"6966623000faffffffffffffff00"}) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000000)={'ifb0\x00'}) r1 = socket(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f00000002c0)=@broute={'broute\x00', 0x20, 0x1, 0x3b0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200010c0], 0x0, &(0x7f0000000000), &(0x7f00000010c0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'syzkaller1\x00', 'ip6tnl0\x00', "01616d61000000004ab2cec800", @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0x2a8, 0x2a8, 0x2f0, [@bpf0={'bpf\x00', 0x210, {{0x3, [{}, {}, {0x6}]}}}]}}, @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffdffffffffc}]}, 0x428) 22:51:50 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) 22:51:50 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet_smc(0x2b, 0x1, 0x0) close(r1) 22:51:50 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc\x00', 0x0, 0x0) clone(0x0, &(0x7f0000b53000), &(0x7f0000000080), &(0x7f0000c35ffc), &(0x7f0000b3bfff)) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x80247008, &(0x7f00000000c0)) 22:51:50 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000140)={0x303, 0x33}, 0x4) 22:51:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) 22:51:51 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x200000, 0x0) sendmsg$kcm(r1, &(0x7f0000000280)={&(0x7f0000000040)=@pppoe={0x18, 0x0, {0x0, @link_local={0x1, 0x80, 0xc2}, 'lo\x00'}}, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000000600)=[{0x10}], 0x10}, 0x0) 22:51:51 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet_smc(0x2b, 0x1, 0x0) close(r1) 22:51:51 executing program 0: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x5, 0x108000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={"6966623000faffffffffffffff00"}) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000000)={'ifb0\x00'}) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f00000002c0)=@broute={'broute\x00', 0x20, 0x1, 0x3b0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200010c0], 0x0, &(0x7f0000000000), &(0x7f00000010c0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'syzkaller1\x00', 'ip6tnl0\x00', "01616d61000000004ab2cec800", @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0x2a8, 0x2a8, 0x2f0, [@bpf0={'bpf\x00', 0x210, {{0x3, [{}, {}, {0x6}]}}}]}}, @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffdffffffffc}]}, 0x428) 22:51:51 executing program 4: ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000140)={0x303, 0x33}, 0x4) 22:51:51 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc\x00', 0x0, 0x0) clone(0x0, &(0x7f0000b53000), &(0x7f0000000080), &(0x7f0000c35ffc), &(0x7f0000b3bfff)) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x80247008, &(0x7f00000000c0)) 22:51:51 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r1 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) write(r1, &(0x7f0000000040)="16", 0x1) sendfile(r1, r1, &(0x7f0000001000), 0xffff) gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(r1, r1, &(0x7f0000000000), 0xffffffff) 22:51:51 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) 22:51:51 executing program 0: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x5, 0x108000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={"6966623000faffffffffffffff00"}) r1 = socket(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f00000002c0)=@broute={'broute\x00', 0x20, 0x1, 0x3b0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200010c0], 0x0, &(0x7f0000000000), &(0x7f00000010c0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'syzkaller1\x00', 'ip6tnl0\x00', "01616d61000000004ab2cec800", @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0x2a8, 0x2a8, 0x2f0, [@bpf0={'bpf\x00', 0x210, {{0x3, [{}, {}, {0x6}]}}}]}}, @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffdffffffffc}]}, 0x428) 22:51:51 executing program 4: r0 = socket$inet6(0xa, 0x0, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000140)={0x303, 0x33}, 0x4) 22:51:51 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") r1 = socket$inet(0x10, 0x3, 0x6) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) 22:51:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000000080)}}], 0x0, 0x0, &(0x7f0000000340)}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) 22:51:51 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet_smc(0x2b, 0x1, 0x0) close(r1) 22:51:51 executing program 0: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x5, 0x108000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") r1 = socket(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f00000002c0)=@broute={'broute\x00', 0x20, 0x1, 0x3b0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200010c0], 0x0, &(0x7f0000000000), &(0x7f00000010c0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'syzkaller1\x00', 'ip6tnl0\x00', "01616d61000000004ab2cec800", @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0x2a8, 0x2a8, 0x2f0, [@bpf0={'bpf\x00', 0x210, {{0x3, [{}, {}, {0x6}]}}}]}}, @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffdffffffffc}]}, 0x428) [ 94.897464] netlink: 24 bytes leftover after parsing attributes in process `syz-executor1'. [ 94.915535] binder: 6861:6868 transaction failed 29189/-22, size 0-0 line 2852 22:51:51 executing program 0: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x5, 0x108000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x1, 0x0) r0 = socket(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000002c0)=@broute={'broute\x00', 0x20, 0x1, 0x3b0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200010c0], 0x0, &(0x7f0000000000), &(0x7f00000010c0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'syzkaller1\x00', 'ip6tnl0\x00', "01616d61000000004ab2cec800", @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0x2a8, 0x2a8, 0x2f0, [@bpf0={'bpf\x00', 0x210, {{0x3, [{}, {}, {0x6}]}}}]}}, @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffdffffffffc}]}, 0x428) 22:51:51 executing program 2: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x0, 0x4000000004002) mmap(&(0x7f0000000000/0xff7000)=nil, 0xff7000, 0x4, 0x32, 0xffffffffffffffff, 0x0) ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "c630eb722409e7a79d598d4ab27b4e44a3e7c3bbe936cd250e9c01de20400650cb42e58f7e81ed0824082256f75403010000d8f4e183c324fe7ee03aad9ad630", "22729d750ba3d74a3e73401ed9d47345576436ccf8cbd98c86717417adc06c03c059b2d6a4abf6b5b7e1c8941d0fa00f7a57de91798f04d2d3f8ab317065afd2", "004b7ab21a9783a9950faa12d1c3ce81e0aee3b8d057f029bf44a9255db6b6d6"}) 22:51:51 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc\x00', 0x0, 0x0) clone(0x0, &(0x7f0000b53000), &(0x7f0000000080), &(0x7f0000c35ffc), &(0x7f0000b3bfff)) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x80247008, &(0x7f00000000c0)) 22:51:51 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000140)={0x303, 0x33}, 0x4) [ 94.959841] binder: undelivered TRANSACTION_ERROR: 29189 22:51:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000000080)}}], 0x0, 0x0, &(0x7f0000000340)}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) 22:51:51 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") r1 = socket$inet(0x10, 0x3, 0x6) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) 22:51:51 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000000)=0xffffffffffffffe1, 0x4) 22:51:51 executing program 0: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x5, 0x108000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x1, 0x0) r0 = socket(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000002c0)=@broute={'broute\x00', 0x20, 0x1, 0x3b0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200010c0], 0x0, &(0x7f0000000000), &(0x7f00000010c0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'syzkaller1\x00', 'ip6tnl0\x00', "01616d61000000004ab2cec800", @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0x2a8, 0x2a8, 0x2f0, [@bpf0={'bpf\x00', 0x210, {{0x3, [{}, {}, {0x6}]}}}]}}, @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffdffffffffc}]}, 0x428) [ 95.155797] binder: 6898:6899 transaction failed 29189/-22, size 0-0 line 2852 [ 95.179688] netlink: 24 bytes leftover after parsing attributes in process `syz-executor1'. [ 95.221599] binder: undelivered TRANSACTION_ERROR: 29189 22:51:52 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) shutdown(r1, 0x2) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) 22:51:52 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000140)={0x303, 0x33}, 0x4) 22:51:52 executing program 2: r0 = syz_open_dev$evdev(&(0x7f0000dfdfee)='/dev/input/event#\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$EVIOCSABS2F(r0, 0x401845ef, &(0x7f0000000000)) 22:51:52 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc\x00', 0x0, 0x0) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x80247008, &(0x7f00000000c0)) 22:51:52 executing program 0: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x5, 0x108000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x1, 0x0) r0 = socket(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000002c0)=@broute={'broute\x00', 0x20, 0x1, 0x3b0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200010c0], 0x0, &(0x7f0000000000), &(0x7f00000010c0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'syzkaller1\x00', 'ip6tnl0\x00', "01616d61000000004ab2cec800", @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0x2a8, 0x2a8, 0x2f0, [@bpf0={'bpf\x00', 0x210, {{0x3, [{}, {}, {0x6}]}}}]}}, @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffdffffffffc}]}, 0x428) 22:51:52 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") r1 = socket$inet(0x10, 0x3, 0x6) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) 22:51:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000000080)}}], 0x0, 0x0, &(0x7f0000000340)}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) 22:51:52 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r1 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) write(r1, &(0x7f0000000040)="16", 0x1) sendfile(r1, r1, &(0x7f0000001000), 0xffff) gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(r1, r1, &(0x7f0000000000), 0xffffffff) [ 95.766376] binder: 6921:6923 transaction failed 29189/-22, size 0-0 line 2852 [ 95.777586] netlink: 24 bytes leftover after parsing attributes in process `syz-executor1'. [ 95.802423] binder: undelivered TRANSACTION_ERROR: 29189 22:51:53 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000140)={0x303, 0x33}, 0x4) 22:51:53 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f000000d000)=[{&(0x7f0000008000)="4c0000001200ff09fffefd956fa283b724a6008000004e22000000683540150024001d001fc41180b598bc593ab6821148a730de33a49868c62b2ca654a6613b6aabf35d0f1cbc882b079881", 0x4c}], 0x1}, 0x0) 22:51:53 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc\x00', 0x0, 0x0) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x80247008, &(0x7f00000000c0)) 22:51:53 executing program 0: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x5, 0x108000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") r0 = socket(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000002c0)=@broute={'broute\x00', 0x20, 0x1, 0x3b0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200010c0], 0x0, &(0x7f0000000000), &(0x7f00000010c0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'syzkaller1\x00', 'ip6tnl0\x00', "01616d61000000004ab2cec800", @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0x2a8, 0x2a8, 0x2f0, [@bpf0={'bpf\x00', 0x210, {{0x3, [{}, {}, {0x6}]}}}]}}, @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffdffffffffc}]}, 0x428) 22:51:53 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) shutdown(r1, 0x2) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) 22:51:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000000080)}}], 0x0, 0x0, &(0x7f0000000340)}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) 22:51:53 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r1 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) write(r1, &(0x7f0000000040)="16", 0x1) sendfile(r1, r1, &(0x7f0000001000), 0xffff) gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(r1, r1, &(0x7f0000000000), 0xffffffff) 22:51:53 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") r1 = socket$inet(0x10, 0x3, 0x6) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) [ 96.786716] binder: 6945:6947 transaction failed 29189/-22, size 0-0 line 2852 [ 96.789910] netlink: 24 bytes leftover after parsing attributes in process `syz-executor1'. [ 96.806689] netlink: 'syz-executor2': attribute type 29 has an invalid length. [ 96.814161] netlink: 8 bytes leftover after parsing attributes in process `syz-executor2'. [ 96.829316] netlink: 'syz-executor2': attribute type 29 has an invalid length. 22:51:53 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) shutdown(r1, 0x2) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) 22:51:53 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc\x00', 0x0, 0x0) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x80247008, &(0x7f00000000c0)) 22:51:53 executing program 0: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x5, 0x108000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") r0 = socket(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000002c0)=@broute={'broute\x00', 0x20, 0x1, 0x3b0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200010c0], 0x0, &(0x7f0000000000), &(0x7f00000010c0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'syzkaller1\x00', 'ip6tnl0\x00', "01616d61000000004ab2cec800", @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0x2a8, 0x2a8, 0x2f0, [@bpf0={'bpf\x00', 0x210, {{0x3, [{}, {}, {0x6}]}}}]}}, @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffdffffffffc}]}, 0x428) [ 96.836838] netlink: 8 bytes leftover after parsing attributes in process `syz-executor2'. [ 96.849314] binder: undelivered TRANSACTION_ERROR: 29189 22:51:53 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") sendmsg(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) 22:51:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000000080)}}], 0x0, 0x0, &(0x7f0000000340)}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) 22:51:53 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000140)={0x303, 0x33}, 0x4) 22:51:53 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(r1, 0x2) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) 22:51:53 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000400)={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x5}, 0x1c) sendmsg(r0, &(0x7f0000014fc8)={&(0x7f0000006ff0)=@in={0x2, 0x4e23, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x80, &(0x7f0000000040), 0x0, &(0x7f000001ef80)=ANY=[]}, 0x0) [ 97.001241] binder: 6970:6974 transaction failed 29189/-22, size 0-0 line 2852 [ 97.050442] binder: undelivered TRANSACTION_ERROR: 29189 22:51:54 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") clone(0x0, &(0x7f0000b53000), &(0x7f0000000080), &(0x7f0000c35ffc), &(0x7f0000b3bfff)) ioctl$sock_inet_tcp_SIOCATMARK(0xffffffffffffffff, 0x80247008, &(0x7f00000000c0)) 22:51:54 executing program 0: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x5, 0x108000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") r0 = socket(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000002c0)=@broute={'broute\x00', 0x20, 0x1, 0x3b0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200010c0], 0x0, &(0x7f0000000000), &(0x7f00000010c0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'syzkaller1\x00', 'ip6tnl0\x00', "01616d61000000004ab2cec800", @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0x2a8, 0x2a8, 0x2f0, [@bpf0={'bpf\x00', 0x210, {{0x3, [{}, {}, {0x6}]}}}]}}, @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffdffffffffc}]}, 0x428) 22:51:54 executing program 1: socket$inet6(0xa, 0x1, 0x0) r0 = socket$inet(0x10, 0x3, 0x6) sendmsg(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) 22:51:54 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000140)={0x303, 0x33}, 0x4) 22:51:54 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(r1, 0x2) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) 22:51:54 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000), 0xffff) 22:51:54 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r1 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) write(r1, &(0x7f0000000040)="16", 0x1) sendfile(r1, r1, &(0x7f0000001000), 0xffff) r2 = gettid() sendfile(r1, r1, &(0x7f0000000000), 0xffffffff) tkill(r2, 0x1000000000016) 22:51:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000000080)}}], 0x0, 0x0, &(0x7f0000000340)}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) [ 97.775359] netlink: 24 bytes leftover after parsing attributes in process `syz-executor1'. [ 97.784910] binder: 7005:7007 transaction failed 29189/-22, size 0-0 line 2852 22:51:54 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") r1 = socket(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f00000002c0)=@broute={'broute\x00', 0x20, 0x1, 0x3b0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200010c0], 0x0, &(0x7f0000000000), &(0x7f00000010c0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'syzkaller1\x00', 'ip6tnl0\x00', "01616d61000000004ab2cec800", @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0x2a8, 0x2a8, 0x2f0, [@bpf0={'bpf\x00', 0x210, {{0x3, [{}, {}, {0x6}]}}}]}}, @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffdffffffffc}]}, 0x428) 22:51:54 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhost-net\x00', 0x2, 0x0) close(r1) 22:51:54 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(r1, 0x2) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) 22:51:54 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000140)={0x303, 0x33}, 0x4) [ 97.827790] binder: undelivered TRANSACTION_ERROR: 29189 22:51:54 executing program 1: socket$inet6(0xa, 0x1, 0x0) r0 = socket$inet(0x10, 0x3, 0x6) sendmsg(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) 22:51:54 executing program 7: socket$inet6(0xa, 0x1, 0x0) r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc\x00', 0x0, 0x0) clone(0x0, &(0x7f0000b53000), &(0x7f0000000080), &(0x7f0000c35ffc), &(0x7f0000b3bfff)) ioctl$sock_inet_tcp_SIOCATMARK(r0, 0x80247008, &(0x7f00000000c0)) 22:51:54 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000000080)}}], 0x0, 0x0, &(0x7f0000000340)}) ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) 22:51:54 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000140)={0x303, 0x33}, 0x4) [ 97.973759] netlink: 24 bytes leftover after parsing attributes in process `syz-executor1'. 22:51:55 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhost-net\x00', 0x2, 0x0) close(r1) 22:51:55 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(0xffffffffffffffff, 0x2) recvfrom$inet(0xffffffffffffffff, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) 22:51:55 executing program 0: r0 = socket$inet6(0xa, 0x0, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") r1 = socket(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f00000002c0)=@broute={'broute\x00', 0x20, 0x1, 0x3b0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200010c0], 0x0, &(0x7f0000000000), &(0x7f00000010c0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'syzkaller1\x00', 'ip6tnl0\x00', "01616d61000000004ab2cec800", @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0x2a8, 0x2a8, 0x2f0, [@bpf0={'bpf\x00', 0x210, {{0x3, [{}, {}, {0x6}]}}}]}}, @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffdffffffffc}]}, 0x428) 22:51:55 executing program 1: socket$inet6(0xa, 0x1, 0x0) r0 = socket$inet(0x10, 0x3, 0x6) sendmsg(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) 22:51:55 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000000080)}}], 0x0, 0x0, &(0x7f0000000340)}) ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) 22:51:55 executing program 7: socket$inet6(0xa, 0x1, 0x0) r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc\x00', 0x0, 0x0) clone(0x0, &(0x7f0000b53000), &(0x7f0000000080), &(0x7f0000c35ffc), &(0x7f0000b3bfff)) ioctl$sock_inet_tcp_SIOCATMARK(r0, 0x80247008, &(0x7f00000000c0)) 22:51:55 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r1 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) write(r1, &(0x7f0000000040)="16", 0x1) sendfile(r1, r1, &(0x7f0000001000), 0xffff) r2 = gettid() sendfile(r1, r1, &(0x7f0000000000), 0xffffffff) tkill(r2, 0x1000000000016) 22:51:55 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000140)={0x303, 0x33}, 0x4) 22:51:55 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000000080)}}], 0x0, 0x0, &(0x7f0000000340)}) ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) 22:51:55 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000140)={0x303, 0x33}, 0x4) [ 99.151616] netlink: 24 bytes leftover after parsing attributes in process `syz-executor1'. 22:51:55 executing program 3: socket$inet6(0xa, 0x1, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r0, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(r0, 0x2) recvfrom$inet(r0, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) 22:51:55 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhost-net\x00', 0x2, 0x0) close(r1) 22:51:55 executing program 7: socket$inet6(0xa, 0x1, 0x0) r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc\x00', 0x0, 0x0) clone(0x0, &(0x7f0000b53000), &(0x7f0000000080), &(0x7f0000c35ffc), &(0x7f0000b3bfff)) ioctl$sock_inet_tcp_SIOCATMARK(r0, 0x80247008, &(0x7f00000000c0)) 22:51:55 executing program 1: ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") r0 = socket$inet(0x10, 0x3, 0x6) sendmsg(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) [ 99.378726] netlink: 24 bytes leftover after parsing attributes in process `syz-executor1'. 22:51:56 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16") perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000140)={0x303, 0x33}, 0x4) 22:51:56 executing program 0: r0 = socket$inet6(0xa, 0x0, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") r1 = socket(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f00000002c0)=@broute={'broute\x00', 0x20, 0x1, 0x3b0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200010c0], 0x0, &(0x7f0000000000), &(0x7f00000010c0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'syzkaller1\x00', 'ip6tnl0\x00', "01616d61000000004ab2cec800", @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0x2a8, 0x2a8, 0x2f0, [@bpf0={'bpf\x00', 0x210, {{0x3, [{}, {}, {0x6}]}}}]}}, @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffdffffffffc}]}, 0x428) 22:51:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000000080)}}], 0x0, 0x0, &(0x7f0000000340)}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) 22:51:56 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhost-net\x00', 0x2, 0x0) close(r1) 22:51:56 executing program 3: socket$inet6(0xa, 0x1, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r0, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(r0, 0x2) recvfrom$inet(r0, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) 22:51:56 executing program 1: ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") r0 = socket$inet(0x10, 0x3, 0x6) sendmsg(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) 22:51:56 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r1 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) write(r1, &(0x7f0000000040)="16", 0x1) sendfile(r1, r1, &(0x7f0000001000), 0xffff) r2 = gettid() sendfile(r1, r1, &(0x7f0000000000), 0xffffffff) tkill(r2, 0x1000000000016) 22:51:56 executing program 7: ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc\x00', 0x0, 0x0) clone(0x0, &(0x7f0000b53000), &(0x7f0000000080), &(0x7f0000c35ffc), &(0x7f0000b3bfff)) ioctl$sock_inet_tcp_SIOCATMARK(r0, 0x80247008, &(0x7f00000000c0)) [ 100.503651] netlink: 24 bytes leftover after parsing attributes in process `syz-executor1'. 22:51:56 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") close(0xffffffffffffffff) 22:51:56 executing program 3: socket$inet6(0xa, 0x1, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r0, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(r0, 0x2) recvfrom$inet(r0, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) 22:51:56 executing program 1: ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") r0 = socket$inet(0x10, 0x3, 0x6) sendmsg(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) 22:51:56 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16") perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000140)={0x303, 0x33}, 0x4) 22:51:56 executing program 7: ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc\x00', 0x0, 0x0) clone(0x0, &(0x7f0000b53000), &(0x7f0000000080), &(0x7f0000c35ffc), &(0x7f0000b3bfff)) ioctl$sock_inet_tcp_SIOCATMARK(r0, 0x80247008, &(0x7f00000000c0)) [ 100.548482] binder: 7101:7103 transaction failed 29189/-22, size 0-0 line 2852 [ 100.582751] binder: undelivered TRANSACTION_ERROR: 29189 22:51:57 executing program 0: r0 = socket$inet6(0xa, 0x0, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") r1 = socket(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f00000002c0)=@broute={'broute\x00', 0x20, 0x1, 0x3b0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200010c0], 0x0, &(0x7f0000000000), &(0x7f00000010c0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'syzkaller1\x00', 'ip6tnl0\x00', "01616d61000000004ab2cec800", @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0x2a8, 0x2a8, 0x2f0, [@bpf0={'bpf\x00', 0x210, {{0x3, [{}, {}, {0x6}]}}}]}}, @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffdffffffffc}]}, 0x428) 22:51:57 executing program 2: socket$inet6(0xa, 0x1, 0x0) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhost-net\x00', 0x2, 0x0) close(r0) 22:51:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000000080)}}], 0x0, 0x0, &(0x7f0000000340)}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) [ 100.690945] netlink: 24 bytes leftover after parsing attributes in process `syz-executor1'. [ 100.863021] binder: 7146:7148 transaction failed 29189/-22, size 0-0 line 2852 [ 100.878241] binder: undelivered TRANSACTION_ERROR: 29189 22:51:58 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16") perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000140)={0x303, 0x33}, 0x4) 22:51:58 executing program 3: ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r0, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(r0, 0x2) recvfrom$inet(r0, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) 22:51:58 executing program 1: r0 = socket$inet6(0xa, 0x0, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") r1 = socket$inet(0x10, 0x3, 0x6) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) 22:51:58 executing program 2: socket$inet6(0xa, 0x1, 0x0) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhost-net\x00', 0x2, 0x0) close(r0) 22:51:58 executing program 7: ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc\x00', 0x0, 0x0) clone(0x0, &(0x7f0000b53000), &(0x7f0000000080), &(0x7f0000c35ffc), &(0x7f0000b3bfff)) ioctl$sock_inet_tcp_SIOCATMARK(r0, 0x80247008, &(0x7f00000000c0)) 22:51:58 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") r1 = socket(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f00000002c0)=@broute={'broute\x00', 0x20, 0x1, 0x3b0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200010c0], 0x0, &(0x7f0000000000), &(0x7f00000010c0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'syzkaller1\x00', 'ip6tnl0\x00', "01616d61000000004ab2cec800", @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0x2a8, 0x2a8, 0x2f0, [@bpf0={'bpf\x00', 0x210, {{0x3, [{}, {}, {0x6}]}}}]}}, @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffdffffffffc}]}, 0x428) 22:51:58 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r1 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) write(r1, &(0x7f0000000040)="16", 0x1) sendfile(r1, r1, &(0x7f0000001000), 0xffff) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(r1, r1, &(0x7f0000000000), 0xffffffff) tkill(0x0, 0x1000000000016) 22:51:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x0, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000000080)}}], 0x0, 0x0, &(0x7f0000000340)}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) 22:51:58 executing program 2: socket$inet6(0xa, 0x1, 0x0) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhost-net\x00', 0x2, 0x0) close(r0) 22:51:58 executing program 3: ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r0, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(r0, 0x2) recvfrom$inet(r0, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) 22:51:58 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") r1 = socket(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f00000002c0)=@broute={'broute\x00', 0x20, 0x1, 0x3b0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200010c0], 0x0, &(0x7f0000000000), &(0x7f00000010c0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'syzkaller1\x00', 'ip6tnl0\x00', "01616d61000000004ab2cec800", @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0x2a8, 0x2a8, 0x2f0, [@bpf0={'bpf\x00', 0x210, {{0x3, [{}, {}, {0x6}]}}}]}}, @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffdffffffffc}]}, 0x428) 22:51:58 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000140)={0x303, 0x33}, 0x4) [ 101.965562] binder: 7170:7175 transaction failed 29189/-22, size 0-0 line 2852 [ 101.978323] netlink: 24 bytes leftover after parsing attributes in process `syz-executor1'. 22:51:58 executing program 1: r0 = socket$inet6(0xa, 0x0, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") r1 = socket$inet(0x10, 0x3, 0x6) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) [ 102.012661] binder: undelivered TRANSACTION_ERROR: 29189 22:51:58 executing program 7: r0 = socket$inet6(0xa, 0x0, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc\x00', 0x0, 0x0) clone(0x0, &(0x7f0000b53000), &(0x7f0000000080), &(0x7f0000c35ffc), &(0x7f0000b3bfff)) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x80247008, &(0x7f00000000c0)) 22:51:58 executing program 3: ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r0, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(r0, 0x2) recvfrom$inet(r0, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) [ 102.202378] netlink: 24 bytes leftover after parsing attributes in process `syz-executor1'. 22:51:59 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000140)={0x303, 0x33}, 0x4) 22:51:59 executing program 2: ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhost-net\x00', 0x2, 0x0) close(r0) 22:51:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000000080)}}], 0x0, 0x0, &(0x7f0000000340)}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) 22:51:59 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") r1 = socket(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f00000002c0)=@broute={'broute\x00', 0x20, 0x1, 0x3b0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200010c0], 0x0, &(0x7f0000000000), &(0x7f00000010c0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'syzkaller1\x00', 'ip6tnl0\x00', "01616d61000000004ab2cec800", @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0x2a8, 0x2a8, 0x2f0, [@bpf0={'bpf\x00', 0x210, {{0x3, [{}, {}, {0x6}]}}}]}}, @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffdffffffffc}]}, 0x428) 22:51:59 executing program 3: r0 = socket$inet6(0xa, 0x0, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(r1, 0x2) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) 22:51:59 executing program 1: r0 = socket$inet6(0xa, 0x0, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") r1 = socket$inet(0x10, 0x3, 0x6) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) 22:51:59 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r1 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) write(r1, &(0x7f0000000040)="16", 0x1) sendfile(r1, r1, &(0x7f0000001000), 0xffff) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(r1, r1, &(0x7f0000000000), 0xffffffff) tkill(0x0, 0x1000000000016) 22:51:59 executing program 7: r0 = socket$inet6(0xa, 0x0, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc\x00', 0x0, 0x0) clone(0x0, &(0x7f0000b53000), &(0x7f0000000080), &(0x7f0000c35ffc), &(0x7f0000b3bfff)) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x80247008, &(0x7f00000000c0)) [ 102.895953] binder: 7227:7229 transaction failed 29189/-22, size 0-0 line 2852 22:51:59 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000140)={0x303, 0x33}, 0x4) 22:51:59 executing program 2: ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhost-net\x00', 0x2, 0x0) close(r0) 22:51:59 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x0, &(0x7f0000000100)="2957e1311f16f477671070") r1 = socket(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f00000002c0)=@broute={'broute\x00', 0x20, 0x1, 0x3b0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200010c0], 0x0, &(0x7f0000000000), &(0x7f00000010c0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'syzkaller1\x00', 'ip6tnl0\x00', "01616d61000000004ab2cec800", @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0x2a8, 0x2a8, 0x2f0, [@bpf0={'bpf\x00', 0x210, {{0x3, [{}, {}, {0x6}]}}}]}}, @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffdffffffffc}]}, 0x428) [ 102.945596] binder: undelivered TRANSACTION_ERROR: 29189 [ 102.977238] netlink: 24 bytes leftover after parsing attributes in process `syz-executor1'. 22:51:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000000080)}}], 0x0, 0x0, &(0x7f0000000340)}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) 22:51:59 executing program 3: r0 = socket$inet6(0xa, 0x0, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(r1, 0x2) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) 22:51:59 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000140)={0x303, 0x33}, 0x4) 22:51:59 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") r1 = socket$inet(0x10, 0x3, 0x6) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) 22:51:59 executing program 7: r0 = socket$inet6(0xa, 0x0, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc\x00', 0x0, 0x0) clone(0x0, &(0x7f0000b53000), &(0x7f0000000080), &(0x7f0000c35ffc), &(0x7f0000b3bfff)) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x80247008, &(0x7f00000000c0)) 22:51:59 executing program 2: ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhost-net\x00', 0x2, 0x0) close(r0) 22:51:59 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x0, &(0x7f0000000100)="2957e1311f16f477671070") r1 = socket(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f00000002c0)=@broute={'broute\x00', 0x20, 0x1, 0x3b0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200010c0], 0x0, &(0x7f0000000000), &(0x7f00000010c0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'syzkaller1\x00', 'ip6tnl0\x00', "01616d61000000004ab2cec800", @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0x2a8, 0x2a8, 0x2f0, [@bpf0={'bpf\x00', 0x210, {{0x3, [{}, {}, {0x6}]}}}]}}, @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffdffffffffc}]}, 0x428) 22:51:59 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000140)={0x303, 0x33}, 0x4) [ 103.164985] binder: 7260:7263 transaction failed 29189/-22, size 0-0 line 2852 [ 103.194938] netlink: 24 bytes leftover after parsing attributes in process `syz-executor1'. [ 103.212481] binder: undelivered TRANSACTION_ERROR: 29189 22:52:00 executing program 3: r0 = socket$inet6(0xa, 0x0, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(r1, 0x2) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) 22:52:00 executing program 2: r0 = socket$inet6(0xa, 0x0, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhost-net\x00', 0x2, 0x0) close(r1) 22:52:00 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") r1 = socket$inet(0x10, 0x3, 0x6) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) 22:52:00 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x0, &(0x7f0000000100)="2957e1311f16f477671070") r1 = socket(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f00000002c0)=@broute={'broute\x00', 0x20, 0x1, 0x3b0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200010c0], 0x0, &(0x7f0000000000), &(0x7f00000010c0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'syzkaller1\x00', 'ip6tnl0\x00', "01616d61000000004ab2cec800", @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0x2a8, 0x2a8, 0x2f0, [@bpf0={'bpf\x00', 0x210, {{0x3, [{}, {}, {0x6}]}}}]}}, @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffdffffffffc}]}, 0x428) 22:52:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000000080)}}], 0x0, 0x0, &(0x7f0000000340)}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) 22:52:00 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000140)={0x303, 0x33}, 0x4) 22:52:00 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r1 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) write(r1, &(0x7f0000000040)="16", 0x1) sendfile(r1, r1, &(0x7f0000001000), 0xffff) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(r1, r1, &(0x7f0000000000), 0xffffffff) tkill(0x0, 0x1000000000016) 22:52:00 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc\x00', 0x0, 0x0) clone(0x0, &(0x7f0000b53000), &(0x7f0000000080), &(0x7f0000c35ffc), &(0x7f0000b3bfff)) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x80247008, &(0x7f00000000c0)) 22:52:00 executing program 2: r0 = socket$inet6(0xa, 0x0, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhost-net\x00', 0x2, 0x0) close(r1) [ 103.894971] binder: 7299:7301 transaction failed 29189/-22, size 0-0 line 2852 [ 103.897255] netlink: 24 bytes leftover after parsing attributes in process `syz-executor1'. [ 103.928367] binder: undelivered TRANSACTION_ERROR: 29189 22:52:00 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)) r1 = socket(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f00000002c0)=@broute={'broute\x00', 0x20, 0x1, 0x3b0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200010c0], 0x0, &(0x7f0000000000), &(0x7f00000010c0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'syzkaller1\x00', 'ip6tnl0\x00', "01616d61000000004ab2cec800", @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0x2a8, 0x2a8, 0x2f0, [@bpf0={'bpf\x00', 0x210, {{0x3, [{}, {}, {0x6}]}}}]}}, @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffdffffffffc}]}, 0x428) 22:52:00 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000140)={0x303, 0x33}, 0x4) 22:52:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x0, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000000080)}}], 0x0, 0x0, &(0x7f0000000340)}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) 22:52:00 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(r1, 0x2) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) 22:52:00 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") r1 = socket$inet(0x10, 0x3, 0x6) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) 22:52:00 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc\x00', 0x0, 0x0) clone(0x0, &(0x7f0000b53000), &(0x7f0000000080), &(0x7f0000c35ffc), &(0x7f0000b3bfff)) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x80247008, &(0x7f00000000c0)) 22:52:00 executing program 2: r0 = socket$inet6(0xa, 0x0, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhost-net\x00', 0x2, 0x0) close(r1) 22:52:00 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000140)={0x303, 0x33}, 0x4) [ 104.088443] binder: 7329:7331 transaction failed 29189/-22, size 0-0 line 2852 [ 104.154554] netlink: 24 bytes leftover after parsing attributes in process `syz-executor1'. [ 104.168268] binder: undelivered TRANSACTION_ERROR: 29189 22:52:01 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)) r1 = socket(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f00000002c0)=@broute={'broute\x00', 0x20, 0x1, 0x3b0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200010c0], 0x0, &(0x7f0000000000), &(0x7f00000010c0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'syzkaller1\x00', 'ip6tnl0\x00', "01616d61000000004ab2cec800", @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0x2a8, 0x2a8, 0x2f0, [@bpf0={'bpf\x00', 0x210, {{0x3, [{}, {}, {0x6}]}}}]}}, @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffdffffffffc}]}, 0x428) 22:52:01 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(r1, 0x2) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) 22:52:01 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000140)={0x303, 0x33}, 0x4) 22:52:01 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhost-net\x00', 0x2, 0x0) close(r1) 22:52:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x0, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000000080)}}], 0x0, 0x0, &(0x7f0000000340)}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) 22:52:01 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x0, &(0x7f00000000c0)="295ee1311f16f477671070") r1 = socket$inet(0x10, 0x3, 0x6) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) 22:52:01 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r1 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) write(r1, &(0x7f0000000040)="16", 0x1) r2 = gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(r1, r1, &(0x7f0000000000), 0xffffffff) tkill(r2, 0x1000000000016) 22:52:01 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc\x00', 0x0, 0x0) clone(0x0, &(0x7f0000b53000), &(0x7f0000000080), &(0x7f0000c35ffc), &(0x7f0000b3bfff)) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x80247008, &(0x7f00000000c0)) 22:52:01 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000140)={0x303, 0x33}, 0x4) 22:52:01 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)) r1 = socket(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f00000002c0)=@broute={'broute\x00', 0x20, 0x1, 0x3b0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200010c0], 0x0, &(0x7f0000000000), &(0x7f00000010c0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'syzkaller1\x00', 'ip6tnl0\x00', "01616d61000000004ab2cec800", @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0x2a8, 0x2a8, 0x2f0, [@bpf0={'bpf\x00', 0x210, {{0x3, [{}, {}, {0x6}]}}}]}}, @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffdffffffffc}]}, 0x428) 22:52:01 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhost-net\x00', 0x2, 0x0) close(r1) 22:52:01 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(r1, 0x2) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) [ 104.887491] netlink: 24 bytes leftover after parsing attributes in process `syz-executor1'. [ 104.914569] binder: 7363:7372 transaction failed 29189/-22, size 0-0 line 2852 22:52:01 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x0, &(0x7f00000000c0)="295ee1311f16f477671070") r1 = socket$inet(0x10, 0x3, 0x6) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) 22:52:01 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x0, &(0x7f00000000c0)="295ee1311f16f477671070") r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc\x00', 0x0, 0x0) clone(0x0, &(0x7f0000b53000), &(0x7f0000000080), &(0x7f0000c35ffc), &(0x7f0000b3bfff)) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x80247008, &(0x7f00000000c0)) [ 104.987179] binder: undelivered TRANSACTION_ERROR: 29189 22:52:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x0, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000000080)}}], 0x0, 0x0, &(0x7f0000000340)}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) [ 105.104890] netlink: 24 bytes leftover after parsing attributes in process `syz-executor1'. [ 105.150992] binder: 7397:7399 transaction failed 29189/-22, size 0-0 line 2852 [ 105.186857] binder: undelivered TRANSACTION_ERROR: 29189 22:52:02 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000140)={0x303, 0x33}, 0x4) 22:52:02 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhost-net\x00', 0x2, 0x0) close(r1) 22:52:02 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="2957e1311f16") r1 = socket(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f00000002c0)=@broute={'broute\x00', 0x20, 0x1, 0x3b0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200010c0], 0x0, &(0x7f0000000000), &(0x7f00000010c0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'syzkaller1\x00', 'ip6tnl0\x00', "01616d61000000004ab2cec800", @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0x2a8, 0x2a8, 0x2f0, [@bpf0={'bpf\x00', 0x210, {{0x3, [{}, {}, {0x6}]}}}]}}, @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffdffffffffc}]}, 0x428) 22:52:02 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(r1, 0x2) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) 22:52:02 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x0, &(0x7f00000000c0)="295ee1311f16f477671070") r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc\x00', 0x0, 0x0) clone(0x0, &(0x7f0000b53000), &(0x7f0000000080), &(0x7f0000c35ffc), &(0x7f0000b3bfff)) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x80247008, &(0x7f00000000c0)) 22:52:02 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x0, &(0x7f00000000c0)="295ee1311f16f477671070") r1 = socket$inet(0x10, 0x3, 0x6) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) 22:52:02 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r1 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) write(r1, &(0x7f0000000040)="16", 0x1) r2 = gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(r1, r1, &(0x7f0000000000), 0xffffffff) tkill(r2, 0x1000000000016) 22:52:02 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000000080)}}], 0x0, 0x0, &(0x7f0000000340)}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) 22:52:02 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000140)={0x303, 0x33}, 0x4) 22:52:02 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(r1, 0x2) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) [ 105.753425] binder: 7410:7421 transaction failed 29189/-22, size 0-0 line 2852 [ 105.771469] netlink: 24 bytes leftover after parsing attributes in process `syz-executor1'. 22:52:02 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhost-net\x00', 0x2, 0x0) close(r1) 22:52:02 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="2957e1311f16") r1 = socket(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f00000002c0)=@broute={'broute\x00', 0x20, 0x1, 0x3b0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200010c0], 0x0, &(0x7f0000000000), &(0x7f00000010c0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'syzkaller1\x00', 'ip6tnl0\x00', "01616d61000000004ab2cec800", @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0x2a8, 0x2a8, 0x2f0, [@bpf0={'bpf\x00', 0x210, {{0x3, [{}, {}, {0x6}]}}}]}}, @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffdffffffffc}]}, 0x428) [ 105.812137] binder: undelivered TRANSACTION_ERROR: 29189 22:52:02 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)) r1 = socket$inet(0x10, 0x3, 0x6) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) 22:52:02 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x0, &(0x7f00000000c0)="295ee1311f16f477671070") r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc\x00', 0x0, 0x0) clone(0x0, &(0x7f0000b53000), &(0x7f0000000080), &(0x7f0000c35ffc), &(0x7f0000b3bfff)) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x80247008, &(0x7f00000000c0)) 22:52:02 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000000080)}}], 0x0, 0x0, &(0x7f0000000340)}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) [ 105.957725] netlink: 24 bytes leftover after parsing attributes in process `syz-executor1'. [ 105.996410] binder: 7445:7447 transaction failed 29189/-22, size 0-0 line 2852 [ 106.037483] binder: undelivered TRANSACTION_ERROR: 29189 22:52:02 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(r1, 0x2) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) 22:52:02 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r1 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) write(r1, &(0x7f0000000040)="16", 0x1) r2 = gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(r1, r1, &(0x7f0000000000), 0xffffffff) tkill(r2, 0x1000000000016) 22:52:02 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000140)={0x303, 0x33}, 0x4) 22:52:02 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="2957e1311f16") r1 = socket(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f00000002c0)=@broute={'broute\x00', 0x20, 0x1, 0x3b0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200010c0], 0x0, &(0x7f0000000000), &(0x7f00000010c0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'syzkaller1\x00', 'ip6tnl0\x00', "01616d61000000004ab2cec800", @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0x2a8, 0x2a8, 0x2f0, [@bpf0={'bpf\x00', 0x210, {{0x3, [{}, {}, {0x6}]}}}]}}, @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffdffffffffc}]}, 0x428) 22:52:02 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhost-net\x00', 0x2, 0x0) close(r1) 22:52:02 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000000080)}}], 0x0, 0x0, &(0x7f0000000340)}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) 22:52:02 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)) r1 = socket$inet(0x10, 0x3, 0x6) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) 22:52:02 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc\x00', 0x0, 0x0) clone(0x0, &(0x7f0000b53000), &(0x7f0000000080), &(0x7f0000c35ffc), &(0x7f0000b3bfff)) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x80247008, &(0x7f00000000c0)) 22:52:03 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="2957e1311f16f47767") r1 = socket(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f00000002c0)=@broute={'broute\x00', 0x20, 0x1, 0x3b0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200010c0], 0x0, &(0x7f0000000000), &(0x7f00000010c0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'syzkaller1\x00', 'ip6tnl0\x00', "01616d61000000004ab2cec800", @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0x2a8, 0x2a8, 0x2f0, [@bpf0={'bpf\x00', 0x210, {{0x3, [{}, {}, {0x6}]}}}]}}, @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffdffffffffc}]}, 0x428) [ 106.632513] netlink: 24 bytes leftover after parsing attributes in process `syz-executor1'. [ 106.643367] binder: 7462:7466 transaction failed 29189/-22, size 0-0 line 2852 22:52:03 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000140)={0x303, 0x33}, 0x4) 22:52:03 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhost-net\x00', 0x2, 0x0) close(r1) 22:52:03 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(r1, 0x2) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) [ 106.676252] binder: undelivered TRANSACTION_ERROR: 29189 22:52:03 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)) r1 = socket$inet(0x10, 0x3, 0x6) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) 22:52:03 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)="295ee1311f16") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000000080)}}], 0x0, 0x0, &(0x7f0000000340)}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) 22:52:03 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc\x00', 0x0, 0x0) clone(0x0, &(0x7f0000b53000), &(0x7f0000000080), &(0x7f0000c35ffc), &(0x7f0000b3bfff)) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x80247008, &(0x7f00000000c0)) 22:52:03 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="2957e1311f16f47767") r1 = socket(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f00000002c0)=@broute={'broute\x00', 0x20, 0x1, 0x3b0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200010c0], 0x0, &(0x7f0000000000), &(0x7f00000010c0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'syzkaller1\x00', 'ip6tnl0\x00', "01616d61000000004ab2cec800", @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0x2a8, 0x2a8, 0x2f0, [@bpf0={'bpf\x00', 0x210, {{0x3, [{}, {}, {0x6}]}}}]}}, @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffdffffffffc}]}, 0x428) 22:52:03 executing program 4: syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f0000000100)='./file0\x00', 0xe004, 0x1, &(0x7f0000000380)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401000200027000f8", 0x16}], 0x0, &(0x7f00000001c0)=ANY=[]) [ 106.885539] netlink: 24 bytes leftover after parsing attributes in process `syz-executor1'. [ 106.929201] binder: 7501:7504 transaction failed 29189/-22, size 0-0 line 2852 [ 106.965661] binder: undelivered TRANSACTION_ERROR: 29189 22:52:03 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)) r1 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhost-net\x00', 0x2, 0x0) close(r1) 22:52:03 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(r1, 0x2) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) 22:52:03 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16") r1 = socket$inet(0x10, 0x3, 0x6) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) 22:52:03 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="2957e1311f16f47767") r1 = socket(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f00000002c0)=@broute={'broute\x00', 0x20, 0x1, 0x3b0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200010c0], 0x0, &(0x7f0000000000), &(0x7f00000010c0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'syzkaller1\x00', 'ip6tnl0\x00', "01616d61000000004ab2cec800", @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0x2a8, 0x2a8, 0x2f0, [@bpf0={'bpf\x00', 0x210, {{0x3, [{}, {}, {0x6}]}}}]}}, @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffdffffffffc}]}, 0x428) 22:52:03 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)="295ee1311f16") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000000080)}}], 0x0, 0x0, &(0x7f0000000340)}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) 22:52:03 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r1 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xffff) r2 = gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(r1, r1, &(0x7f0000000000), 0xffffffff) tkill(r2, 0x1000000000016) 22:52:03 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") timerfd_gettime(0xffffffffffffffff, &(0x7f00000002c0)) 22:52:03 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc\x00', 0x0, 0x0) clone(0x0, &(0x7f0000b53000), &(0x7f0000000080), &(0x7f0000c35ffc), &(0x7f0000b3bfff)) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x80247008, &(0x7f00000000c0)) [ 107.501678] binder: 7522:7524 transaction failed 29189/-22, size 0-0 line 2852 [ 107.517463] netlink: 24 bytes leftover after parsing attributes in process `syz-executor1'. 22:52:03 executing program 4: perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x3, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = timerfd_create(0x0, 0x0) r1 = dup(r0) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(r1, 0x40085400, &(0x7f0000000140)={0x1ff}) getpid() getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000006c0)={{{@in=@local, @in6=@ipv4={[], [], @multicast2}}}, {{@in=@broadcast}, 0x0, @in6=@ipv4={[], [], @rand_addr}}}, &(0x7f00000007c0)=0xe8) 22:52:03 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(r1, 0x2) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) 22:52:03 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="2957e1311f16f4776710") r1 = socket(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f00000002c0)=@broute={'broute\x00', 0x20, 0x1, 0x3b0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200010c0], 0x0, &(0x7f0000000000), &(0x7f00000010c0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'syzkaller1\x00', 'ip6tnl0\x00', "01616d61000000004ab2cec800", @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0x2a8, 0x2a8, 0x2f0, [@bpf0={'bpf\x00', 0x210, {{0x3, [{}, {}, {0x6}]}}}]}}, @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffdffffffffc}]}, 0x428) 22:52:03 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)) r1 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhost-net\x00', 0x2, 0x0) close(r1) 22:52:03 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r1 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xffff) r2 = gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(r1, r1, &(0x7f0000000000), 0xffffffff) tkill(r2, 0x1000000000016) [ 107.548452] binder: undelivered TRANSACTION_ERROR: 29189 22:52:03 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16") r1 = socket$inet(0x10, 0x3, 0x6) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) 22:52:04 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)="295ee1311f16") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000000080)}}], 0x0, 0x0, &(0x7f0000000340)}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) 22:52:04 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)) r1 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhost-net\x00', 0x2, 0x0) close(r1) 22:52:04 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16") r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc\x00', 0x0, 0x0) clone(0x0, &(0x7f0000b53000), &(0x7f0000000080), &(0x7f0000c35ffc), &(0x7f0000b3bfff)) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x80247008, &(0x7f00000000c0)) 22:52:04 executing program 4: perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x3, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = timerfd_create(0x0, 0x0) r1 = dup(r0) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(r1, 0x40085400, &(0x7f0000000140)={0x1ff}) getpid() getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000006c0)={{{@in=@local, @in6=@ipv4={[], [], @multicast2}}}, {{@in=@broadcast}, 0x0, @in6=@ipv4={[], [], @rand_addr}}}, &(0x7f00000007c0)=0xe8) [ 107.705140] netlink: 24 bytes leftover after parsing attributes in process `syz-executor1'. [ 107.763157] binder: 7559:7560 transaction failed 29189/-22, size 0-0 line 2852 [ 107.810928] binder: undelivered TRANSACTION_ERROR: 29189 22:52:04 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(r1, 0x2) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) 22:52:04 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r1 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xffff) r2 = gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(r1, r1, &(0x7f0000000000), 0xffffffff) tkill(r2, 0x1000000000016) 22:52:04 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="2957e1311f16f4776710") r1 = socket(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f00000002c0)=@broute={'broute\x00', 0x20, 0x1, 0x3b0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200010c0], 0x0, &(0x7f0000000000), &(0x7f00000010c0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'syzkaller1\x00', 'ip6tnl0\x00', "01616d61000000004ab2cec800", @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0x2a8, 0x2a8, 0x2f0, [@bpf0={'bpf\x00', 0x210, {{0x3, [{}, {}, {0x6}]}}}]}}, @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffdffffffffc}]}, 0x428) 22:52:04 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)="295ee1311f16f47767") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000000080)}}], 0x0, 0x0, &(0x7f0000000340)}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) 22:52:04 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") semctl$GETNCNT(0x0, 0x0, 0xe, &(0x7f0000001100)=""/137) 22:52:04 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16") r1 = socket$inet(0x10, 0x3, 0x6) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) 22:52:04 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16") r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc\x00', 0x0, 0x0) clone(0x0, &(0x7f0000b53000), &(0x7f0000000080), &(0x7f0000c35ffc), &(0x7f0000b3bfff)) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x80247008, &(0x7f00000000c0)) 22:52:04 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16") r1 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhost-net\x00', 0x2, 0x0) close(r1) [ 107.925568] netlink: 24 bytes leftover after parsing attributes in process `syz-executor1'. [ 107.927063] binder: 7581:7583 transaction failed 29189/-22, size 0-0 line 2852 22:52:04 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(r1, 0x2) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) 22:52:04 executing program 4: syz_open_dev$evdev(&(0x7f0000dfdfee)='/dev/input/event#\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) listen$netrom(r1, 0x0) 22:52:04 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) write(0xffffffffffffffff, &(0x7f0000000040)="16", 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000), 0xffff) r1 = gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000), 0xffffffff) tkill(r1, 0x1000000000016) [ 108.037331] binder: undelivered TRANSACTION_ERROR: 29189 22:52:04 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16") r1 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhost-net\x00', 0x2, 0x0) close(r1) 22:52:04 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="2957e1311f16f4776710") r1 = socket(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f00000002c0)=@broute={'broute\x00', 0x20, 0x1, 0x3b0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200010c0], 0x0, &(0x7f0000000000), &(0x7f00000010c0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'syzkaller1\x00', 'ip6tnl0\x00', "01616d61000000004ab2cec800", @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0x2a8, 0x2a8, 0x2f0, [@bpf0={'bpf\x00', 0x210, {{0x3, [{}, {}, {0x6}]}}}]}}, @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffdffffffffc}]}, 0x428) 22:52:04 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f47767") r1 = socket$inet(0x10, 0x3, 0x6) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) 22:52:04 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16") r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc\x00', 0x0, 0x0) clone(0x0, &(0x7f0000b53000), &(0x7f0000000080), &(0x7f0000c35ffc), &(0x7f0000b3bfff)) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x80247008, &(0x7f00000000c0)) 22:52:04 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)="295ee1311f16f47767") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000000080)}}], 0x0, 0x0, &(0x7f0000000340)}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) 22:52:04 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) write(0xffffffffffffffff, &(0x7f0000000040)="16", 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000), 0xffff) r1 = gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000), 0xffffffff) tkill(r1, 0x1000000000016) 22:52:04 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket(0x10, 0x803, 0x0) sendto(r1, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) readv(r1, &(0x7f0000000580)=[{&(0x7f0000000140)=""/202, 0xca}, {&(0x7f0000000fc0)=""/4096, 0x1000}, {&(0x7f0000000380)=""/104, 0x68}], 0x3) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f0000000f40)=@ethernet={0x0, @random}, 0x80, &(0x7f0000002380), 0x0, &(0x7f0000002400)=""/191, 0xbf}}, {{&(0x7f0000003440)=@l2, 0x80, &(0x7f0000003680), 0x0, &(0x7f00000036c0)=""/64, 0x40}}], 0xf, 0x0, &(0x7f0000003700)={0x77359400}) 22:52:04 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(r1, 0x2) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) [ 108.179844] binder: 7618:7621 transaction failed 29189/-22, size 0-0 line 2852 [ 108.206447] netlink: 24 bytes leftover after parsing attributes in process `syz-executor1'. 22:52:04 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16") r1 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhost-net\x00', 0x2, 0x0) close(r1) 22:52:04 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) write(0xffffffffffffffff, &(0x7f0000000040)="16", 0x1) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000001000), 0xffff) r1 = gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000), 0xffffffff) tkill(r1, 0x1000000000016) 22:52:04 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(r1, 0x2) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) 22:52:04 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") prctl$setendian(0x14, 0x0) [ 108.244975] binder: undelivered TRANSACTION_ERROR: 29189 22:52:04 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f47767") r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc\x00', 0x0, 0x0) clone(0x0, &(0x7f0000b53000), &(0x7f0000000080), &(0x7f0000c35ffc), &(0x7f0000b3bfff)) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x80247008, &(0x7f00000000c0)) 22:52:04 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") r1 = socket(0x0, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f00000002c0)=@broute={'broute\x00', 0x20, 0x1, 0x3b0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200010c0], 0x0, &(0x7f0000000000), &(0x7f00000010c0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'syzkaller1\x00', 'ip6tnl0\x00', "01616d61000000004ab2cec800", @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0x2a8, 0x2a8, 0x2f0, [@bpf0={'bpf\x00', 0x210, {{0x3, [{}, {}, {0x6}]}}}]}}, @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffdffffffffc}]}, 0x428) 22:52:04 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)="295ee1311f16f47767") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000000080)}}], 0x0, 0x0, &(0x7f0000000340)}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) 22:52:04 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f47767") r1 = socket$inet(0x10, 0x3, 0x6) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) 22:52:04 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") r1 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhost-net\x00', 0x2, 0x0) close(r1) 22:52:04 executing program 4: shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffd000/0x2000)=nil) [ 108.404928] binder: 7653:7654 transaction failed 29189/-22, size 0-0 line 2852 22:52:04 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) write(r1, &(0x7f0000000040)="16", 0x1) sendfile(r1, r1, &(0x7f0000001000), 0xffff) r2 = gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(r1, r1, &(0x7f0000000000), 0xffffffff) tkill(r2, 0x1000000000016) 22:52:04 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") r1 = socket(0x2, 0x0, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f00000002c0)=@broute={'broute\x00', 0x20, 0x1, 0x3b0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200010c0], 0x0, &(0x7f0000000000), &(0x7f00000010c0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'syzkaller1\x00', 'ip6tnl0\x00', "01616d61000000004ab2cec800", @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0x2a8, 0x2a8, 0x2f0, [@bpf0={'bpf\x00', 0x210, {{0x3, [{}, {}, {0x6}]}}}]}}, @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffdffffffffc}]}, 0x428) 22:52:04 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(r1, 0x2) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) [ 108.462336] netlink: 24 bytes leftover after parsing attributes in process `syz-executor1'. [ 108.482729] binder: undelivered TRANSACTION_ERROR: 29189 22:52:04 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") r1 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhost-net\x00', 0x2, 0x0) close(r1) 22:52:04 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") keyctl$dh_compute(0x17, &(0x7f0000000340), &(0x7f0000000380)=""/134, 0x86, &(0x7f00000004c0)={&(0x7f0000000440)={'crc32c-intel\x00'}, &(0x7f0000000480)}) 22:52:06 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f47767") r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc\x00', 0x0, 0x0) clone(0x0, &(0x7f0000b53000), &(0x7f0000000080), &(0x7f0000c35ffc), &(0x7f0000b3bfff)) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x80247008, &(0x7f00000000c0)) 22:52:06 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)="295ee1311f16f4776710") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000000080)}}], 0x0, 0x0, &(0x7f0000000340)}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) 22:52:06 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(r1, 0x2) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) 22:52:06 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f47767") r1 = socket$inet(0x10, 0x3, 0x6) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) 22:52:06 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") r1 = socket(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f00000002c0)=@broute={'broute\x00', 0x20, 0x1, 0x3b0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200010c0], 0x0, &(0x7f0000000000), &(0x7f00000010c0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'syzkaller1\x00', 'ip6tnl0\x00', "01616d61000000004ab2cec800", @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0x2a8, 0x2a8, 0x2f0, [@bpf0={'bpf\x00', 0x210, {{0x3, [{}, {}, {0x6}]}}}]}}, @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffdffffffffc}]}, 0x428) 22:52:06 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") r1 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhost-net\x00', 0x2, 0x0) close(r1) 22:52:06 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) write(r1, &(0x7f0000000040)="16", 0x1) sendfile(r1, r1, &(0x7f0000001000), 0xffff) r2 = gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(r1, r1, &(0x7f0000000000), 0xffffffff) tkill(r2, 0x1000000000016) 22:52:06 executing program 4: 22:52:06 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") r1 = socket(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f00000002c0)=@broute={'broute\x00', 0x20, 0x1, 0x90, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200010c0], 0x0, &(0x7f0000000000), &(0x7f00000010c0)=[{0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffdffffffffc}]}, 0x428) [ 109.865261] netlink: 24 bytes leftover after parsing attributes in process `syz-executor1'. [ 109.894128] binder: 7701:7703 transaction failed 29189/-22, size 0-0 line 2852 22:52:06 executing program 4: [ 109.939199] binder: undelivered TRANSACTION_ERROR: 29189 [ 110.016423] kernel msg: ebtables bug: please report to author: Wrong len argument 22:52:07 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") r1 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhost-net\x00', 0x2, 0x0) close(r1) 22:52:07 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(r1, 0x2) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) 22:52:07 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f4776710") r1 = socket$inet(0x10, 0x3, 0x6) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) 22:52:07 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)="295ee1311f16f4776710") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000000080)}}], 0x0, 0x0, &(0x7f0000000340)}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) 22:52:07 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f47767") r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc\x00', 0x0, 0x0) clone(0x0, &(0x7f0000b53000), &(0x7f0000000080), &(0x7f0000c35ffc), &(0x7f0000b3bfff)) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x80247008, &(0x7f00000000c0)) 22:52:07 executing program 4: 22:52:07 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) write(r1, &(0x7f0000000040)="16", 0x1) sendfile(r1, r1, &(0x7f0000001000), 0xffff) r2 = gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(r1, r1, &(0x7f0000000000), 0xffffffff) tkill(r2, 0x1000000000016) 22:52:07 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") r1 = socket(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f00000002c0)=@broute={'broute\x00', 0x20, 0x1, 0x3b0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200010c0], 0x0, &(0x7f0000000000), &(0x7f00000010c0)=[{0x0, '\x00', 0x0, 0x0, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'syzkaller1\x00', 'ip6tnl0\x00', "01616d61000000004ab2cec800", @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0x2a8, 0x2a8, 0x2f0, [@bpf0={'bpf\x00', 0x210, {{0x3, [{}, {}, {0x6}]}}}]}}, @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffdffffffffc}]}, 0x428) [ 111.194096] binder: 7725:7727 transaction failed 29189/-22, size 0-0 line 2852 [ 111.201579] netlink: 24 bytes leftover after parsing attributes in process `syz-executor1'. [ 111.208552] kernel msg: ebtables bug: please report to author: bad policy 22:52:07 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$EVIOCGSW(0xffffffffffffffff, 0x8040451b, &(0x7f0000000040)=""/47) fstat(0xffffffffffffffff, &(0x7f0000000280)) 22:52:07 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(r1, 0x2) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) 22:52:07 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") r1 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhost-net\x00', 0x2, 0x0) close(r1) [ 111.235489] binder: undelivered TRANSACTION_ERROR: 29189 22:52:07 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") r1 = socket(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f00000002c0)=@broute={'broute\x00', 0x20, 0x1, 0xc0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200010c0], 0x0, &(0x7f0000000000), &(0x7f00000010c0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffdffffffffc}]}, 0x428) 22:52:07 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)="295ee1311f16f4776710") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000000080)}}], 0x0, 0x0, &(0x7f0000000340)}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) 22:52:07 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f4776710") r1 = socket$inet(0x10, 0x3, 0x6) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) 22:52:07 executing program 4: r0 = syz_open_dev$evdev(&(0x7f0000dfdfee)='/dev/input/event#\x00', 0x34a, 0x0) ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f00000000c0)) 22:52:07 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f4776710") r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc\x00', 0x0, 0x0) clone(0x0, &(0x7f0000b53000), &(0x7f0000000080), &(0x7f0000c35ffc), &(0x7f0000b3bfff)) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x80247008, &(0x7f00000000c0)) [ 111.360810] kernel msg: ebtables bug: please report to author: Wrong len argument [ 111.377254] binder: 7751:7757 transaction failed 29189/-22, size 0-0 line 2852 22:52:07 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") r1 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhost-net\x00', 0x2, 0x0) close(r1) 22:52:07 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(r1, 0x2) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) [ 111.434224] binder: undelivered TRANSACTION_ERROR: 29189 [ 111.436769] netlink: 24 bytes leftover after parsing attributes in process `syz-executor1'. 22:52:08 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") r1 = socket(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f00000002c0)=@broute={'broute\x00', 0x20, 0x1, 0x3b0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200010c0], 0x0, &(0x7f0000000000), &(0x7f00000010c0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x0, 0x0, 0x0, 'ip6gre0\x00', 'syzkaller1\x00', 'ip6tnl0\x00', "01616d61000000004ab2cec800", @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0x2a8, 0x2a8, 0x2f0, [@bpf0={'bpf\x00', 0x210, {{0x3, [{}, {}, {0x6}]}}}]}}, @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffdffffffffc}]}, 0x428) 22:52:08 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000000080)}}], 0x0, 0x0, &(0x7f0000000340)}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) 22:52:08 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f4776710") r1 = socket$inet(0x10, 0x3, 0x6) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) 22:52:08 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vhost-net\x00', 0x2, 0x0) close(0xffffffffffffffff) 22:52:08 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f4776710") r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc\x00', 0x0, 0x0) clone(0x0, &(0x7f0000b53000), &(0x7f0000000080), &(0x7f0000c35ffc), &(0x7f0000b3bfff)) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x80247008, &(0x7f00000000c0)) 22:52:08 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(r1, 0x2) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) 22:52:08 executing program 6: socket$inet6(0xa, 0x1, 0x0) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) write(r0, &(0x7f0000000040)="16", 0x1) sendfile(r0, r0, &(0x7f0000001000), 0xffff) r1 = gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(r0, r0, &(0x7f0000000000), 0xffffffff) tkill(r1, 0x1000000000016) 22:52:08 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) getsockopt$inet_sctp6_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f00000000c0)={0x0, 0x7}, &(0x7f0000000100)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000000180)={r1, 0x5}, 0x8) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f760070") r2 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000000)={"740002000085102dc830ee000000005d", 0x126}) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xffffffffffffff92, &(0x7f0000000000)={&(0x7f0000000200)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8, 0x1b}]}, 0x1a6}, 0x1}, 0x0) dup3(r3, r2, 0x0) [ 112.620879] netlink: 24 bytes leftover after parsing attributes in process `syz-executor1'. [ 112.625887] kernel msg: ebtables bug: please report to author: EBT_ENTRY_OR_ENTRIES shouldn't be set in distinguisher 22:52:09 executing program 2: shmget(0x2, 0x1000, 0x0, &(0x7f0000ffe000/0x1000)=nil) 22:52:09 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") r1 = socket$inet(0x10, 0x0, 0x6) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) 22:52:09 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(r1, 0x2) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) 22:52:09 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f4776710") r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc\x00', 0x0, 0x0) clone(0x0, &(0x7f0000b53000), &(0x7f0000000080), &(0x7f0000c35ffc), &(0x7f0000b3bfff)) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x80247008, &(0x7f00000000c0)) 22:52:09 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup(r0) 22:52:09 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000000080)}}], 0x0, 0x0, &(0x7f0000000340)}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) 22:52:09 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") r1 = socket(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f00000002c0)=@broute={'broute\x00', 0x20, 0x1, 0x178, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200010c0], 0x0, &(0x7f0000000000), &(0x7f00000010c0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'syzkaller1\x00', 'ip6tnl0\x00', "01616d61000000004ab2cec800", @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0x70, 0x70, 0xb8}}, @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffdffffffffc}]}, 0x428) 22:52:09 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f0000005000)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000000040)={&(0x7f0000000180)={0x14, 0x19, 0x200000aff, 0x0, 0x0, {0x1c}}, 0x14}, 0x1}, 0x0) [ 112.864676] kernel msg: ebtables bug: please report to author: Wrong len argument 22:52:09 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") r1 = socket$inet(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) 22:52:09 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(r1, 0x2) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) 22:52:09 executing program 6: socket$inet6(0xa, 0x1, 0x0) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) write(r0, &(0x7f0000000040)="16", 0x1) sendfile(r0, r0, &(0x7f0000001000), 0xffff) r1 = gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(r0, r0, &(0x7f0000000000), 0xffffffff) tkill(r1, 0x1000000000016) 22:52:09 executing program 4: r0 = syz_open_dev$evdev(&(0x7f0000dfdfee)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCGSND(r0, 0x8040451a, &(0x7f0000000140)=""/4096) 22:52:09 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000000080)}}], 0x0, 0x0, &(0x7f0000000340)}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) 22:52:09 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc\x00', 0x0, 0x0) clone(0x0, &(0x7f0000b53000), &(0x7f0000000080), &(0x7f0000c35ffc), &(0x7f0000b3bfff)) ioctl$sock_inet_tcp_SIOCATMARK(0xffffffffffffffff, 0x80247008, &(0x7f00000000c0)) 22:52:09 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x23, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) 22:52:09 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") r1 = socket(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f00000002c0)=@broute={'broute\x00', 0x20, 0x1, 0x3b0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200010c0], 0x0, &(0x7f0000000000), &(0x7f00000010c0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'syzkaller1\x00', 'ip6tnl0\x00', "01616d61000000004ab2cec800", @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0x2a8, 0x2a8, 0x2f0, [@bpf0={'bpf\x00', 0x210, {{0x0, [{}, {}, {0x6}]}}}]}}, @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffdffffffffc}]}, 0x428) 22:52:09 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) ioctl$sock_SIOCBRADDBR(r1, 0x89a0, &(0x7f0000000140)) [ 113.522396] netlink: 4 bytes leftover after parsing attributes in process `syz-executor1'. [ 113.533339] xt_bpf: check failed: parse error 22:52:09 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x23, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) 22:52:09 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(r1, 0x2) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) 22:52:09 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") r1 = socket(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f00000002c0)=@broute={'broute\x00', 0x20, 0x1, 0x3b0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200010c0], 0x0, &(0x7f0000000000), &(0x7f00000010c0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'syzkaller1\x00', 'ip6tnl0\x00', "01616d61000000004ab2cec800", @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0x2a8, 0x2a8, 0x2f0, [@bpf0={'bpf\x00', 0x210, {{0x3}}}]}}, @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffdffffffffc}]}, 0x428) 22:52:09 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") r1 = socket$inet(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) [ 113.603803] binder: send failed reply for transaction 33 to 7839:7841 [ 113.616783] binder: undelivered TRANSACTION_COMPLETE [ 113.622175] binder: undelivered TRANSACTION_ERROR: 29189 22:52:10 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000280), 0x0, 0x0, &(0x7f0000000340)}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) 22:52:10 executing program 7: r0 = syz_open_dev$evdev(&(0x7f0000dfdfee)='/dev/input/event#\x00', 0x34a, 0x0) ioctl$EVIOCSKEYCODE(r0, 0x40084504, &(0x7f0000000000)=[0x400020]) 22:52:10 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") preadv(r0, &(0x7f0000000140), 0x0, 0x0) 22:52:10 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x0, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(r1, 0x2) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) [ 113.730455] netlink: 4 bytes leftover after parsing attributes in process `syz-executor1'. [ 113.762311] xt_bpf: check failed: parse error [ 113.795718] binder: send failed reply for transaction 35 to 7867:7868 [ 113.805080] binder: undelivered TRANSACTION_COMPLETE [ 113.810326] binder: undelivered TRANSACTION_ERROR: 29189 22:52:10 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x23, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) 22:52:10 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000280), 0x0, 0x0, &(0x7f0000000340)}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) 22:52:10 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") r1 = socket(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f00000002c0)=@broute={'broute\x00', 0x20, 0x1, 0x380, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200010c0], 0x0, &(0x7f0000000000), &(0x7f00000010c0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'syzkaller1\x00', 'ip6tnl0\x00', "01616d61000000004ab2cec800", @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0x2a8, 0x2a8, 0x2f0, [@bpf0={'bpf\x00', 0x210, {{0x3, [{}, {}, {0x6}]}}}]}}, @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffdffffffffc}]}, 0x428) 22:52:10 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, 0xffffffffffffffff) 22:52:10 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000ff4)='/dev/rfkill\x00', 0x1, 0x0) write$eventfd(r1, &(0x7f0000000140)=0x20400000003, 0x8) 22:52:10 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") r1 = socket$inet(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) 22:52:10 executing program 6: socket$inet6(0xa, 0x1, 0x0) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) write(r0, &(0x7f0000000040)="16", 0x1) sendfile(r0, r0, &(0x7f0000001000), 0xffff) r1 = gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(r0, r0, &(0x7f0000000000), 0xffffffff) tkill(r1, 0x1000000000016) 22:52:10 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x0, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(r1, 0x2) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) [ 114.456109] kernel msg: ebtables bug: please report to author: Wrong len argument [ 114.473566] netlink: 4 bytes leftover after parsing attributes in process `syz-executor1'. 22:52:10 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000280), 0x0, 0x0, &(0x7f0000000340)}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) 22:52:10 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x23, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) 22:52:10 executing program 4: r0 = syz_open_dev$evdev(&(0x7f0000dfdfee)='/dev/input/event#\x00', 0x0, 0x200400) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") write$evdev(r0, &(0x7f000004d000), 0x0) 22:52:10 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000ff4)='/dev/rfkill\x00', 0x1, 0x0) write$eventfd(r1, &(0x7f0000000140)=0x20400000003, 0x8) 22:52:10 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x0, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(r1, 0x2) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) [ 114.510300] binder: send failed reply for transaction 37 to 7897:7912 [ 114.524208] binder: undelivered TRANSACTION_COMPLETE [ 114.529410] binder: undelivered TRANSACTION_ERROR: 29189 22:52:10 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") r1 = socket$inet(0x10, 0x3, 0x6) sendmsg(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) 22:52:10 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") r1 = socket(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f00000002c0)=@broute={'broute\x00', 0x20, 0x1, 0x3b0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200010c0], 0x0, &(0x7f0000000000), &(0x7f00000010c0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'syzkaller1\x00', 'ip6tnl0\x00', "01616d61000000004ab2cec800", @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0x2a8, 0x2a8, 0x2f0, [@bpf0={'bpf\x00', 0x210, {{0x3, [{}, {}, {0x6}]}}}]}}, @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffdffffffffc}]}, 0x428) [ 114.674433] kernel msg: ebtables bug: please report to author: bad policy [ 114.707456] binder: send failed reply for transaction 39 to 7923:7926 [ 114.716319] binder: undelivered TRANSACTION_COMPLETE [ 114.721560] binder: undelivered TRANSACTION_ERROR: 29189 22:52:11 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000000080)}}], 0x0, 0x0, &(0x7f0000000340)}) ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) 22:52:11 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000001440)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000001400)={&(0x7f0000000400)=ANY=[@ANYBLOB="f8000000160001080000000000000000e00000010000000000000000000000007f00000100000000000000000000000000000000000000000000000000000000", @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000000032000000e000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000092039d1ff811fe08f6290b00000000000000000000000000000000000000000000000000000000000000000000b5ffc27df36a5108b939638e54abb6481da0f7498978254f2bdd11be1a85be1509be98c05631e6443d0a35b63dc3d494a39bb7106b8a80bcb2e0706bf6a4f21cb1793e2cf515c40fdce337e010b780250aca578b215b5dbe95fc6133f9ced69bf026b5b620173f2acb558cde1a68af2816d0c4c4c22e42df2baf1774fa50c2afb1929ba1e58b28a512b225f492cbae728887f2376e97eef435752fbc456e9df33f8ef41d3ebcfbe9ac9568698d40d7c0fc9ef4083059cfe8228420ad534dbd8144721aa3bc173c702a8ff3c4cfaeac657829da9a1026cb99efe82256cb6225792ec07313715acd8a18f74e380b5bdc"], 0x3}, 0x1}, 0x0) 22:52:11 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000ff4)='/dev/rfkill\x00', 0x1, 0x0) write$eventfd(r1, &(0x7f0000000140)=0x20400000003, 0x8) 22:52:11 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socket$inet6(0xa, 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x23, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) 22:52:11 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(r1, 0x2) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) 22:52:11 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") r1 = socket$inet(0x10, 0x3, 0x6) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)}, 0x0) 22:52:11 executing program 6: ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) write(r0, &(0x7f0000000040)="16", 0x1) sendfile(r0, r0, &(0x7f0000001000), 0xffff) r1 = gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(r0, r0, &(0x7f0000000000), 0xffffffff) tkill(r1, 0x1000000000016) 22:52:11 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") r1 = socket(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f00000002c0)=@broute={'broute\x00', 0x20, 0x1, 0x380, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200010c0], 0x0, &(0x7f0000000000), &(0x7f00000010c0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'syzkaller1\x00', 'ip6tnl0\x00', "01616d61000000004ab2cec800", @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0x2a8, 0x2a8, 0x2f0, [@bpf0={'bpf\x00', 0x210, {{0x3, [{}, {}, {0x6}]}}}]}}, @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffdffffffffc}]}, 0x428) 22:52:11 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(r1, 0x2) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) [ 115.328443] binder: 7956:7959 transaction failed 29189/-22, size 0-0 line 2852 [ 115.337793] kernel msg: ebtables bug: please report to author: Wrong len argument 22:52:11 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socket$inet6(0xa, 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x23, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) 22:52:11 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") r1 = socket$inet(0x10, 0x3, 0x6) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)}, 0x0) 22:52:11 executing program 4: r0 = socket$inet6(0xa, 0x3, 0x200000088) recvfrom$inet6(r0, &(0x7f0000000080)=""/4, 0xffffff28, 0x20, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r2 = socket$inet6(0xa, 0x8000000000000802, 0x88) sendmsg$inet_sctp(r2, &(0x7f0000a29000)={&(0x7f00005dafe4)=@in6={0xa, 0x4e23, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c, &(0x7f0000fc8000)}, 0x0) 22:52:11 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000ff4)='/dev/rfkill\x00', 0x1, 0x0) write$eventfd(r1, &(0x7f0000000140)=0x20400000003, 0x8) 22:52:11 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") r1 = socket(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f00000002c0)=@broute={'broute\x00', 0x20, 0x1, 0x3b0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200010c0], 0x0, &(0x7f0000000000), &(0x7f00000010c0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'syzkaller1\x00', 'ip6tnl0\x00', "01616d61000000004ab2cec800", @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0x2a8, 0x2a8, 0x2f0, [@bpf0={'bpf\x00', 0x210, {{0x3, [{}, {}, {0x6}]}}}]}}, @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1}, {0x0, '\x00', 0x1, 0xffffffdffffffffc}]}, 0x428) [ 115.377012] binder: send failed reply for transaction 41 to 7949:7951 [ 115.384500] binder: undelivered TRANSACTION_COMPLETE [ 115.389689] binder: undelivered TRANSACTION_ERROR: 29189 22:52:11 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000000080)}}], 0x0, 0x0, &(0x7f0000000340)}) ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) [ 115.437496] binder: undelivered TRANSACTION_ERROR: 29189 [ 115.520015] binder: 7980:7982 transaction failed 29189/-22, size 0-0 line 2852 [ 115.530969] kernel msg: ebtables bug: please report to author: bad policy [ 115.538563] binder: send failed reply for transaction 44 to 7971:7973 [ 115.548855] binder: undelivered TRANSACTION_COMPLETE [ 115.554131] binder: undelivered TRANSACTION_ERROR: 29189 [ 115.628774] binder: undelivered TRANSACTION_ERROR: 29189 22:52:12 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) socket$inet6(0xa, 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x23, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) 22:52:12 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(r1, 0x2) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) 22:52:12 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") r1 = socket$inet(0x10, 0x3, 0x6) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)}, 0x0) 22:52:12 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") write$eventfd(0xffffffffffffffff, &(0x7f0000000140)=0x20400000003, 0x8) 22:52:12 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") r1 = socket(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f00000002c0)=@broute={'broute\x00', 0x20, 0x1, 0x380, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200010c0], 0x0, &(0x7f0000000000), &(0x7f00000010c0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'syzkaller1\x00', 'ip6tnl0\x00', "01616d61000000004ab2cec800", @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0x2a8, 0x2a8, 0x2f0, [@bpf0={'bpf\x00', 0x210, {{0x3, [{}, {}, {0x6}]}}}]}}, @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffffffffffff}]}, 0x428) 22:52:12 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000000080)}}], 0x0, 0x0, &(0x7f0000000340)}) ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) 22:52:12 executing program 6: ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) write(r0, &(0x7f0000000040)="16", 0x1) sendfile(r0, r0, &(0x7f0000001000), 0xffff) r1 = gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(r0, r0, &(0x7f0000000000), 0xffffffff) tkill(r1, 0x1000000000016) 22:52:12 executing program 4: r0 = socket$inet6(0xa, 0x3, 0x200000088) recvfrom$inet6(r0, &(0x7f0000000080)=""/4, 0xffffff28, 0x20, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r2 = socket$inet6(0xa, 0x8000000000000802, 0x88) sendmsg$inet_sctp(r2, &(0x7f0000a29000)={&(0x7f00005dafe4)=@in6={0xa, 0x4e23, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c, &(0x7f0000fc8000)}, 0x0) [ 116.320455] kernel msg: ebtables bug: please report to author: Wrong len argument [ 116.320709] binder: 8003:8005 transaction failed 29189/-22, size 0-0 line 2852 22:52:12 executing program 7: socket$inet6(0xa, 0x1, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000ff4)='/dev/rfkill\x00', 0x1, 0x0) write$eventfd(r0, &(0x7f0000000140)=0x20400000003, 0x8) 22:52:12 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x23, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) 22:52:12 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") r1 = socket$inet(0x10, 0x3, 0x6) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)=[{}], 0x1}, 0x0) 22:52:12 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(r1, 0x2) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) [ 116.373458] binder: send failed reply for transaction 47 to 7996:7998 [ 116.380825] binder: undelivered TRANSACTION_COMPLETE [ 116.386138] binder: undelivered TRANSACTION_ERROR: 29189 22:52:12 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") r1 = socket(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f00000002c0)=@broute={'broute\x00', 0x20, 0x1, 0x3b0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200010c0], 0x0, &(0x7f0000000000), &(0x7f00000010c0)=[{0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x3, 0x0, 0x0, 'ip6gre0\x00', 'syzkaller1\x00', 'ip6tnl0\x00', "01616d61000000004ab2cec800", @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [], 0x2a8, 0x2a8, 0x2f0, [@bpf0={'bpf\x00', 0x210, {{0x3, [{}, {}, {0x6}]}}}]}}, @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00'}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1, 0xffffffffffffffff}, {0x0, '\x00', 0x1}]}, 0x428) 22:52:12 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 22:52:12 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(r1, 0x2) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) [ 116.490484] binder: undelivered TRANSACTION_ERROR: 29189 [ 116.546772] kernel msg: ebtables bug: please report to author: bad policy [ 116.551110] binder: send failed reply for transaction 50 to 8019:8024 [ 116.587811] binder: undelivered TRANSACTION_COMPLETE [ 116.593106] binder: undelivered TRANSACTION_ERROR: 29189 22:52:13 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") r1 = socket$inet(0x10, 0x3, 0x6) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)=[{}], 0x1}, 0x0) 22:52:13 executing program 7: socket$inet6(0xa, 0x1, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000ff4)='/dev/rfkill\x00', 0x1, 0x0) write$eventfd(r0, &(0x7f0000000140)=0x20400000003, 0x8) 22:52:13 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x23, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) 22:52:13 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(r1, 0x2) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) 22:52:13 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") getrusage(0x0, &(0x7f0000000040)) 22:52:13 executing program 0: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(&(0x7f0000000000)='./file0\x00', &(0x7f0000001540)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, &(0x7f0000000080)) r0 = open$dir(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) mknodat(r0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0) name_to_handle_at(r0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)={0xc, 0x0, "d3dc0bbd"}, &(0x7f0000000180), 0x0) 22:52:13 executing program 6: ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r0 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) write(r0, &(0x7f0000000040)="16", 0x1) sendfile(r0, r0, &(0x7f0000001000), 0xffff) r1 = gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(r0, r0, &(0x7f0000000000), 0xffffffff) tkill(r1, 0x1000000000016) 22:52:13 executing program 4: r0 = socket$inet6(0xa, 0x3, 0x200000088) recvfrom$inet6(r0, &(0x7f0000000080)=""/4, 0xffffff28, 0x20, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r2 = socket$inet6(0xa, 0x8000000000000802, 0x88) sendmsg$inet_sctp(r2, &(0x7f0000a29000)={&(0x7f00005dafe4)=@in6={0xa, 0x4e23, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c, &(0x7f0000fc8000)}, 0x0) 22:52:13 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") r1 = socket$inet(0x10, 0x3, 0x6) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)=[{}], 0x1}, 0x0) [ 117.262702] tmpfs: No value for mount option './file0' 22:52:13 executing program 7: socket$inet6(0xa, 0x1, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000ff4)='/dev/rfkill\x00', 0x1, 0x0) write$eventfd(r0, &(0x7f0000000140)=0x20400000003, 0x8) 22:52:13 executing program 5: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) io_setup(0x9, &(0x7f0000000040)=0x0) io_submit(r2, 0x1, &(0x7f0000001700)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000380)="88", 0x1}]) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) io_destroy(r2) tee(r3, r1, 0x8, 0x0) vmsplice(r4, &(0x7f0000000140)=[{&(0x7f00000000c0)="06", 0x1}], 0x1, 0x0) 22:52:13 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x23, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) 22:52:13 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(r1, 0x2) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) 22:52:13 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x1, 0x2f0, [0x0, 0x20000800, 0x20000830, 0x20000860], 0x0, &(0x7f00000000c0), &(0x7f0000000800)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000001500000000000000000073797a5f74756e00000000000000000079616d30000000000000000000000000626f6e645f736c6176655f310000000073697430000000000000000000000000aaaaaaaaaa000000000000000180c20000000000000000000000e001000018020000600200006c696d697400000000000000000000000000000000000000000000000000000020000000000000000000040001040000000000000000000000000000000000000000000000000000636f6d6d656e74000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000fdffffff000000005241544545535400000000000000000000000000000000000000000000000000200000000000000073797a3100000000000000000000000000000000000000000000000000000000"]}, 0x368) [ 117.317376] binder: send failed reply for transaction 52 to 8055:8060 [ 117.324321] binder: undelivered TRANSACTION_COMPLETE [ 117.329519] binder: undelivered TRANSACTION_ERROR: 29189 22:52:13 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") r1 = socket$inet(0x10, 0x3, 0x6) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e2800", 0x26}], 0x1}, 0x0) [ 117.462354] binder: send failed reply for transaction 54 to 8071:8072 [ 117.476199] binder: undelivered TRANSACTION_COMPLETE [ 117.481414] binder: undelivered TRANSACTION_ERROR: 29189 22:52:14 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x23, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) 22:52:14 executing program 7: ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000ff4)='/dev/rfkill\x00', 0x1, 0x0) write$eventfd(r0, &(0x7f0000000140)=0x20400000003, 0x8) 22:52:14 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(r1, 0x2) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) 22:52:14 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x1, 0x2f0, [0x0, 0x20000800, 0x20000830, 0x20000860], 0x0, &(0x7f00000000c0), &(0x7f0000000800)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000001500000000000000000073797a5f74756e00000000000000000079616d30000000000000000000000000626f6e645f736c6176655f310000000073697430000000000000000000000000aaaaaaaaaa000000000000000180c20000000000000000000000e001000018020000600200006c696d697400000000000000000000000000000000000000000000000000000020000000000000000000040001040000000000000000000000000000000000000000000000000000636f6d6d656e74000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000fdffffff000000005241544545535400000000000000000000000000000000000000000000000000200000000000000073797a3100000000000000000000000000000000000000000000000000000000"]}, 0x368) 22:52:14 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") r1 = socket$inet(0x10, 0x3, 0x6) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e2800", 0x26}], 0x1}, 0x0) 22:52:14 executing program 4: r0 = socket$inet6(0xa, 0x3, 0x200000088) recvfrom$inet6(r0, &(0x7f0000000080)=""/4, 0xffffff28, 0x20, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r2 = socket$inet6(0xa, 0x8000000000000802, 0x88) sendmsg$inet_sctp(r2, &(0x7f0000a29000)={&(0x7f00005dafe4)=@in6={0xa, 0x4e23, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c, &(0x7f0000fc8000)}, 0x0) 22:52:14 executing program 5: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) io_setup(0x9, &(0x7f0000000040)=0x0) io_submit(r2, 0x1, &(0x7f0000001700)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, r0, &(0x7f0000000380)="88", 0x1}]) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) io_destroy(r2) tee(r3, r1, 0x8, 0x0) vmsplice(r4, &(0x7f0000000140)=[{&(0x7f00000000c0)="06", 0x1}], 0x1, 0x0) 22:52:14 executing program 6: r0 = socket$inet6(0xa, 0x0, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r1 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) write(r1, &(0x7f0000000040)="16", 0x1) sendfile(r1, r1, &(0x7f0000001000), 0xffff) r2 = gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(r1, r1, &(0x7f0000000000), 0xffffffff) tkill(r2, 0x1000000000016) 22:52:14 executing program 7: ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000ff4)='/dev/rfkill\x00', 0x1, 0x0) write$eventfd(r0, &(0x7f0000000140)=0x20400000003, 0x8) 22:52:14 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") r1 = socket$inet(0x10, 0x3, 0x6) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e2800", 0x26}], 0x1}, 0x0) 22:52:14 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x1, 0x2f0, [0x0, 0x20000800, 0x20000830, 0x20000860], 0x0, &(0x7f00000000c0), &(0x7f0000000800)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000001500000000000000000073797a5f74756e00000000000000000079616d30000000000000000000000000626f6e645f736c6176655f310000000073697430000000000000000000000000aaaaaaaaaa000000000000000180c20000000000000000000000e001000018020000600200006c696d697400000000000000000000000000000000000000000000000000000020000000000000000000040001040000000000000000000000000000000000000000000000000000636f6d6d656e74000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000fdffffff000000005241544545535400000000000000000000000000000000000000000000000000200000000000000073797a3100000000000000000000000000000000000000000000000000000000"]}, 0x368) [ 118.305013] binder: 8109:8114 transaction failed 29189/-22, size 0-0 line 2852 22:52:14 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(r1, 0x2) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) 22:52:14 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x23, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) [ 118.380082] binder: undelivered TRANSACTION_ERROR: 29189 22:52:14 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)}, 0x20004001) shutdown(r1, 0x2) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) 22:52:14 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") r1 = socket$inet(0x10, 0x3, 0x6) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1", 0x39}], 0x1}, 0x0) 22:52:14 executing program 7: ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000ff4)='/dev/rfkill\x00', 0x1, 0x0) write$eventfd(r0, &(0x7f0000000140)=0x20400000003, 0x8) 22:52:14 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x1, 0x2f0, [0x0, 0x20000800, 0x20000830, 0x20000860], 0x0, &(0x7f00000000c0), &(0x7f0000000800)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000001500000000000000000073797a5f74756e00000000000000000079616d30000000000000000000000000626f6e645f736c6176655f310000000073697430000000000000000000000000aaaaaaaaaa000000000000000180c20000000000000000000000e001000018020000600200006c696d697400000000000000000000000000000000000000000000000000000020000000000000000000040001040000000000000000000000000000000000000000000000000000636f6d6d656e74000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000fdffffff000000005241544545535400000000000000000000000000000000000000000000000000200000000000000073797a3100000000000000000000000000000000000000000000000000000000"]}, 0x368) [ 118.480478] binder: 8133:8134 transaction failed 29189/-22, size 0-0 line 2852 22:52:14 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)}, 0x0) shutdown(r1, 0x2) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) 22:52:14 executing program 7: r0 = socket$inet6(0xa, 0x0, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000ff4)='/dev/rfkill\x00', 0x1, 0x0) write$eventfd(r1, &(0x7f0000000140)=0x20400000003, 0x8) [ 118.603715] binder: undelivered TRANSACTION_ERROR: 29189 22:52:15 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x23, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) 22:52:15 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") r1 = socket$inet(0x10, 0x3, 0x6) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1", 0x39}], 0x1}, 0x0) 22:52:15 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x1, 0x2f0, [0x0, 0x20000800, 0x20000830, 0x20000860], 0x0, &(0x7f00000000c0), &(0x7f0000000800)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000001500000000000000000073797a5f74756e00000000000000000079616d30000000000000000000000000626f6e645f736c6176655f310000000073697430000000000000000000000000aaaaaaaaaa000000000000000180c20000000000000000000000e001000018020000600200006c696d697400000000000000000000000000000000000000000000000000000020000000000000000000040001040000000000000000000000000000000000000000000000000000636f6d6d656e74000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000fdffffff000000005241544545535400000000000000000000000000000000000000000000000000200000000000000073797a3100000000000000000000000000000000000000000000000000000000"]}, 0x368) 22:52:15 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)}, 0x0) shutdown(r1, 0x2) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) 22:52:15 executing program 7: r0 = socket$inet6(0xa, 0x0, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000ff4)='/dev/rfkill\x00', 0x1, 0x0) write$eventfd(r1, &(0x7f0000000140)=0x20400000003, 0x8) 22:52:15 executing program 4: r0 = socket$inet6(0xa, 0x3, 0x200000088) recvfrom$inet6(r0, &(0x7f0000000080)=""/4, 0xffffff28, 0x20, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") socket$inet6(0xa, 0x8000000000000802, 0x88) 22:52:15 executing program 5: 22:52:15 executing program 6: r0 = socket$inet6(0xa, 0x0, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r1 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) write(r1, &(0x7f0000000040)="16", 0x1) sendfile(r1, r1, &(0x7f0000001000), 0xffff) r2 = gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(r1, r1, &(0x7f0000000000), 0xffffffff) tkill(r2, 0x1000000000016) [ 119.252283] binder: 8177:8183 transaction failed 29189/-22, size 0-0 line 2852 22:52:15 executing program 0: socket$inet6(0xa, 0x1, 0x0) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x1, 0x2f0, [0x0, 0x20000800, 0x20000830, 0x20000860], 0x0, &(0x7f00000000c0), &(0x7f0000000800)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000001500000000000000000073797a5f74756e00000000000000000079616d30000000000000000000000000626f6e645f736c6176655f310000000073697430000000000000000000000000aaaaaaaaaa000000000000000180c20000000000000000000000e001000018020000600200006c696d697400000000000000000000000000000000000000000000000000000020000000000000000000040001040000000000000000000000000000000000000000000000000000636f6d6d656e74000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000fdffffff000000005241544545535400000000000000000000000000000000000000000000000000200000000000000073797a3100000000000000000000000000000000000000000000000000000000"]}, 0x368) 22:52:15 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)}, 0x0) shutdown(r1, 0x2) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) 22:52:15 executing program 5: 22:52:15 executing program 7: r0 = socket$inet6(0xa, 0x0, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000ff4)='/dev/rfkill\x00', 0x1, 0x0) write$eventfd(r1, &(0x7f0000000140)=0x20400000003, 0x8) 22:52:15 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") r1 = socket$inet(0x10, 0x3, 0x6) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1", 0x39}], 0x1}, 0x0) 22:52:15 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x23, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) [ 119.310264] binder: undelivered TRANSACTION_ERROR: 29189 22:52:15 executing program 5: [ 119.440451] binder_alloc: 8206: binder_alloc_buf, no vma [ 119.446354] binder: 8206:8207 transaction failed 29189/-3, size 0-0 line 2967 [ 119.565870] binder: undelivered TRANSACTION_ERROR: 29189 22:52:16 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)}, 0x20004001) shutdown(0xffffffffffffffff, 0x2) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) 22:52:16 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") r1 = socket$inet(0x10, 0x3, 0x6) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268", 0x43}], 0x1}, 0x0) 22:52:16 executing program 0: socket$inet6(0xa, 0x1, 0x0) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x1, 0x2f0, [0x0, 0x20000800, 0x20000830, 0x20000860], 0x0, &(0x7f00000000c0), &(0x7f0000000800)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000001500000000000000000073797a5f74756e00000000000000000079616d30000000000000000000000000626f6e645f736c6176655f310000000073697430000000000000000000000000aaaaaaaaaa000000000000000180c20000000000000000000000e001000018020000600200006c696d697400000000000000000000000000000000000000000000000000000020000000000000000000040001040000000000000000000000000000000000000000000000000000636f6d6d656e74000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000fdffffff000000005241544545535400000000000000000000000000000000000000000000000000200000000000000073797a3100000000000000000000000000000000000000000000000000000000"]}, 0x368) 22:52:16 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000ff4)='/dev/rfkill\x00', 0x1, 0x0) write$eventfd(r1, &(0x7f0000000140)=0x20400000003, 0x8) 22:52:16 executing program 5: 22:52:16 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x23, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) 22:52:16 executing program 4: r0 = socket$inet6(0xa, 0x3, 0x200000088) recvfrom$inet6(r0, &(0x7f0000000080)=""/4, 0xffffff28, 0x20, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") socket$inet6(0xa, 0x8000000000000802, 0x88) 22:52:16 executing program 6: r0 = socket$inet6(0xa, 0x0, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r1 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) write(r1, &(0x7f0000000040)="16", 0x1) sendfile(r1, r1, &(0x7f0000001000), 0xffff) r2 = gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(r1, r1, &(0x7f0000000000), 0xffffffff) tkill(r2, 0x1000000000016) 22:52:16 executing program 5: [ 120.182774] binder_alloc: 8228: binder_alloc_buf, no vma [ 120.188389] binder: 8228:8231 transaction failed 29189/-3, size 0-0 line 2967 22:52:16 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") r1 = socket$inet(0x10, 0x3, 0x6) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268", 0x43}], 0x1}, 0x0) 22:52:16 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000ff4)='/dev/rfkill\x00', 0x1, 0x0) write$eventfd(r1, &(0x7f0000000140)=0x20400000003, 0x8) 22:52:16 executing program 0: socket$inet6(0xa, 0x1, 0x0) r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x1, 0x2f0, [0x0, 0x20000800, 0x20000830, 0x20000860], 0x0, &(0x7f00000000c0), &(0x7f0000000800)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000001500000000000000000073797a5f74756e00000000000000000079616d30000000000000000000000000626f6e645f736c6176655f310000000073697430000000000000000000000000aaaaaaaaaa000000000000000180c20000000000000000000000e001000018020000600200006c696d697400000000000000000000000000000000000000000000000000000020000000000000000000040001040000000000000000000000000000000000000000000000000000636f6d6d656e74000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000fdffffff000000005241544545535400000000000000000000000000000000000000000000000000200000000000000073797a3100000000000000000000000000000000000000000000000000000000"]}, 0x368) 22:52:16 executing program 5: 22:52:16 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x23, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) 22:52:16 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") r1 = socket$inet(0x10, 0x3, 0x6) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268", 0x43}], 0x1}, 0x0) [ 120.322615] binder: undelivered TRANSACTION_ERROR: 29189 [ 120.398290] binder_alloc: 8256: binder_alloc_buf, no vma [ 120.403865] binder: 8256:8257 transaction failed 29189/-3, size 0-0 line 2967 [ 120.488109] binder: undelivered TRANSACTION_ERROR: 29189 22:52:17 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000ff4)='/dev/rfkill\x00', 0x1, 0x0) write$eventfd(r1, &(0x7f0000000140)=0x20400000003, 0x8) 22:52:17 executing program 5: 22:52:17 executing program 0: ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x1, 0x2f0, [0x0, 0x20000800, 0x20000830, 0x20000860], 0x0, &(0x7f00000000c0), &(0x7f0000000800)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000001500000000000000000073797a5f74756e00000000000000000079616d30000000000000000000000000626f6e645f736c6176655f310000000073697430000000000000000000000000aaaaaaaaaa000000000000000180c20000000000000000000000e001000018020000600200006c696d697400000000000000000000000000000000000000000000000000000020000000000000000000040001040000000000000000000000000000000000000000000000000000636f6d6d656e74000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000fdffffff000000005241544545535400000000000000000000000000000000000000000000000000200000000000000073797a3100000000000000000000000000000000000000000000000000000000"]}, 0x368) 22:52:17 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") r1 = socket$inet(0x10, 0x3, 0x6) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055", 0x48}], 0x1}, 0x0) 22:52:17 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x23, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) 22:52:17 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)}, 0x20004001) shutdown(0xffffffffffffffff, 0x2) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) 22:52:17 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r1 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) write(r1, &(0x7f0000000040)="16", 0x1) sendfile(r1, r1, &(0x7f0000001000), 0xffff) r2 = gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(r1, r1, &(0x7f0000000000), 0xffffffff) tkill(r2, 0x1000000000016) 22:52:17 executing program 4: r0 = socket$inet6(0xa, 0x3, 0x200000088) recvfrom$inet6(r0, &(0x7f0000000080)=""/4, 0xffffff28, 0x20, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") socket$inet6(0xa, 0x8000000000000802, 0x88) 22:52:17 executing program 5: [ 121.170759] binder: 8278:8279 transaction failed 29189/-22, size 0-0 line 2852 22:52:17 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") r1 = socket$inet(0x10, 0x3, 0x6) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055", 0x48}], 0x1}, 0x0) 22:52:17 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x23, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) 22:52:17 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000ff4)='/dev/rfkill\x00', 0x1, 0x0) write$eventfd(r1, &(0x7f0000000140)=0x20400000003, 0x8) 22:52:17 executing program 0: ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x1, 0x2f0, [0x0, 0x20000800, 0x20000830, 0x20000860], 0x0, &(0x7f00000000c0), &(0x7f0000000800)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000001500000000000000000073797a5f74756e00000000000000000079616d30000000000000000000000000626f6e645f736c6176655f310000000073697430000000000000000000000000aaaaaaaaaa000000000000000180c20000000000000000000000e001000018020000600200006c696d697400000000000000000000000000000000000000000000000000000020000000000000000000040001040000000000000000000000000000000000000000000000000000636f6d6d656e74000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000fdffffff000000005241544545535400000000000000000000000000000000000000000000000000200000000000000073797a3100000000000000000000000000000000000000000000000000000000"]}, 0x368) [ 121.234382] binder: undelivered TRANSACTION_ERROR: 29189 22:52:17 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = syz_open_dev$tun(&(0x7f0000000400)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'syzkaller0\x00', 0x9322}) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000040)={'syzkaller0\x00', {0x2, 0x0, @loopback=0x7f000001}}) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_mreqsrc(r2, 0x0, 0x27, &(0x7f000001b000)={@multicast2=0xe0000002, @loopback=0x7f000001, @multicast1=0xe0000001}, 0xc) r3 = socket$inet_udp(0x2, 0x2, 0x0) dup3(r3, r1, 0x0) dup3(r0, r2, 0x0) [ 121.295359] binder: 8296:8297 transaction failed 29189/-22, size 0-0 line 2852 22:52:17 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") r1 = socket$inet(0x10, 0x3, 0x6) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055", 0x48}], 0x1}, 0x0) [ 121.417195] binder: undelivered TRANSACTION_ERROR: 29189 22:52:18 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000ff4)='/dev/rfkill\x00', 0x1, 0x0) write$eventfd(r1, &(0x7f0000000140)=0x20400000003, 0x8) 22:52:18 executing program 0: ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x1, 0x2f0, [0x0, 0x20000800, 0x20000830, 0x20000860], 0x0, &(0x7f00000000c0), &(0x7f0000000800)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000001500000000000000000073797a5f74756e00000000000000000079616d30000000000000000000000000626f6e645f736c6176655f310000000073697430000000000000000000000000aaaaaaaaaa000000000000000180c20000000000000000000000e001000018020000600200006c696d697400000000000000000000000000000000000000000000000000000020000000000000000000040001040000000000000000000000000000000000000000000000000000636f6d6d656e74000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000fdffffff000000005241544545535400000000000000000000000000000000000000000000000000200000000000000073797a3100000000000000000000000000000000000000000000000000000000"]}, 0x368) 22:52:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x23, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) 22:52:18 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") r1 = socket$inet(0x10, 0x3, 0x6) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f", 0x4a}], 0x1}, 0x0) 22:52:18 executing program 5: r0 = memfd_create(&(0x7f00000000c0)="0000009bb2107d66895abaa90279d81da536141330da", 0x4) perf_event_open(&(0x7f000001d000)={0x200000002, 0x70, 0x5, 0x108000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fallocate(r0, 0x3, 0x0, 0x100000000) 22:52:18 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)}, 0x20004001) shutdown(0xffffffffffffffff, 0x2) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) 22:52:18 executing program 4: r0 = socket$inet6(0xa, 0x3, 0x200000088) recvfrom$inet6(r0, &(0x7f0000000080)=""/4, 0xffffff28, 0x20, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") sendmsg$inet_sctp(0xffffffffffffffff, &(0x7f0000a29000)={&(0x7f00005dafe4)=@in6={0xa, 0x4e23, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c, &(0x7f0000fc8000)}, 0x0) 22:52:18 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r1 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) write(r1, &(0x7f0000000040)="16", 0x1) sendfile(r1, r1, &(0x7f0000001000), 0xffff) r2 = gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(r1, r1, &(0x7f0000000000), 0xffffffff) tkill(r2, 0x1000000000016) 22:52:18 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") r1 = socket$inet(0x10, 0x3, 0x6) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f", 0x4a}], 0x1}, 0x0) 22:52:18 executing program 5: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x82) r1 = memfd_create(&(0x7f0000000140)="74086e750000000000000000008c00", 0x0) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) ioctl$LOOP_SET_BLOCK_SIZE(r0, 0x4c09, 0x800) 22:52:18 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000ff4)='/dev/rfkill\x00', 0x1, 0x0) write$eventfd(r1, &(0x7f0000000140)=0x20400000003, 0x8) [ 122.106708] binder: 8326:8328 transaction failed 29189/-22, size 0-0 line 2852 22:52:18 executing program 0: r0 = socket$inet6(0xa, 0x0, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x1, 0x2f0, [0x0, 0x20000800, 0x20000830, 0x20000860], 0x0, &(0x7f00000000c0), &(0x7f0000000800)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000001500000000000000000073797a5f74756e00000000000000000079616d30000000000000000000000000626f6e645f736c6176655f310000000073697430000000000000000000000000aaaaaaaaaa000000000000000180c20000000000000000000000e001000018020000600200006c696d697400000000000000000000000000000000000000000000000000000020000000000000000000040001040000000000000000000000000000000000000000000000000000636f6d6d656e74000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000fdffffff000000005241544545535400000000000000000000000000000000000000000000000000200000000000000073797a3100000000000000000000000000000000000000000000000000000000"]}, 0x368) 22:52:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000003c0)={0x23, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) [ 122.199562] binder: undelivered TRANSACTION_ERROR: 29189 22:52:18 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") r1 = socket$inet(0x10, 0x3, 0x6) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f", 0x4a}], 0x1}, 0x0) 22:52:18 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000ff4)='/dev/rfkill\x00', 0x1, 0x0) write$eventfd(r1, &(0x7f0000000140)=0x20400000003, 0x8) 22:52:18 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") syz_emit_ethernet(0x3e, &(0x7f0000001180)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [], {@ipv6={0x86dd, {0x0, 0x6, "b7e720", 0x8, 0x3a, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [], 0xaa}, {[], @icmpv6=@echo_request={0xffffff82}}}}}}, &(0x7f0000000180)) 22:52:19 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000003c0)={0x23, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) 22:52:19 executing program 0: r0 = socket$inet6(0xa, 0x0, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x1, 0x2f0, [0x0, 0x20000800, 0x20000830, 0x20000860], 0x0, &(0x7f00000000c0), &(0x7f0000000800)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000001500000000000000000073797a5f74756e00000000000000000079616d30000000000000000000000000626f6e645f736c6176655f310000000073697430000000000000000000000000aaaaaaaaaa000000000000000180c20000000000000000000000e001000018020000600200006c696d697400000000000000000000000000000000000000000000000000000020000000000000000000040001040000000000000000000000000000000000000000000000000000636f6d6d656e74000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000fdffffff000000005241544545535400000000000000000000000000000000000000000000000000200000000000000073797a3100000000000000000000000000000000000000000000000000000000"]}, 0x368) 22:52:19 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") r1 = socket$inet(0x10, 0x3, 0x6) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15", 0x4b}], 0x1}, 0x0) 22:52:19 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000ff4)='/dev/rfkill\x00', 0x1, 0x0) write$eventfd(r1, &(0x7f0000000140)=0x20400000003, 0x8) 22:52:19 executing program 5: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270f7f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) 22:52:19 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)}, 0x20004001) shutdown(r1, 0x0) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) 22:52:19 executing program 4: r0 = socket$inet6(0xa, 0x3, 0x200000088) recvfrom$inet6(r0, &(0x7f0000000080)=""/4, 0xffffff28, 0x20, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") sendmsg$inet_sctp(0xffffffffffffffff, &(0x7f0000a29000)={&(0x7f00005dafe4)=@in6={0xa, 0x4e23, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c, &(0x7f0000fc8000)}, 0x0) 22:52:19 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r1 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) write(r1, &(0x7f0000000040)="16", 0x1) sendfile(r1, r1, &(0x7f0000001000), 0xffff) r2 = gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(r1, r1, &(0x7f0000000000), 0xffffffff) tkill(r2, 0x1000000000016) 22:52:19 executing program 5: r0 = epoll_create1(0x0) r1 = dup2(r0, r0) r2 = epoll_create1(0x0) close(r0) syz_fuseblk_mount(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000040)='./file0\x00', 0x8000, 0x0, 0x0, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000080)) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r1, &(0x7f0000000140)) 22:52:19 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") r1 = socket$inet(0x10, 0x3, 0x6) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15", 0x4b}], 0x1}, 0x0) 22:52:19 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)}, 0x20004001) shutdown(r1, 0x0) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) 22:52:19 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000003c0)={0x23, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) 22:52:19 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000ff4)='/dev/rfkill\x00', 0x1, 0x0) write$eventfd(r1, &(0x7f0000000140)=0x20400000003, 0x8) 22:52:19 executing program 0: r0 = socket$inet6(0xa, 0x0, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x1, 0x2f0, [0x0, 0x20000800, 0x20000830, 0x20000860], 0x0, &(0x7f00000000c0), &(0x7f0000000800)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000001500000000000000000073797a5f74756e00000000000000000079616d30000000000000000000000000626f6e645f736c6176655f310000000073697430000000000000000000000000aaaaaaaaaa000000000000000180c20000000000000000000000e001000018020000600200006c696d697400000000000000000000000000000000000000000000000000000020000000000000000000040001040000000000000000000000000000000000000000000000000000636f6d6d656e74000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000fdffffff000000005241544545535400000000000000000000000000000000000000000000000000200000000000000073797a3100000000000000000000000000000000000000000000000000000000"]}, 0x368) 22:52:19 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x23, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) 22:52:19 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") r1 = socket$inet(0x10, 0x3, 0x6) sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000250007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15", 0x4b}], 0x1}, 0x0) [ 123.355906] binder: 8429:8430 transaction failed 29189/-22, size 0-0 line 2852 [ 123.446714] binder: undelivered TRANSACTION_ERROR: 29189 22:52:20 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16") r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000ff4)='/dev/rfkill\x00', 0x1, 0x0) write$eventfd(r1, &(0x7f0000000140)=0x20400000003, 0x8) 22:52:20 executing program 5: r0 = epoll_create1(0x0) r1 = dup2(r0, r0) r2 = epoll_create1(0x0) close(r0) syz_fuseblk_mount(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000040)='./file0\x00', 0x8000, 0x0, 0x0, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000080)) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r1, &(0x7f0000000140)) 22:52:20 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)}, 0x20004001) shutdown(r1, 0x0) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) 22:52:20 executing program 1: perf_event_open(&(0x7f000001d000)={0x200000002, 0x70, 0x5, 0x108000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket(0x11, 0x3, 0x0) r1 = syz_open_dev$tun(&(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x20000000001) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={"6966623000faffffffffffffff00", 0x5001}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'ifb0\x00', 0xa201}) write$tun(r1, &(0x7f00000000c0)={@void, @val, @ipv4={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x33, 0x0, @empty, @multicast1=0xe0000001}, @igmp={0x0, 0x0, 0x0, @multicast1=0xe0000001}}}, 0x26) 22:52:20 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x1, 0x2f0, [0x0, 0x20000800, 0x20000830, 0x20000860], 0x0, &(0x7f00000000c0), &(0x7f0000000800)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000001500000000000000000073797a5f74756e00000000000000000079616d30000000000000000000000000626f6e645f736c6176655f310000000073697430000000000000000000000000aaaaaaaaaa000000000000000180c20000000000000000000000e001000018020000600200006c696d697400000000000000000000000000000000000000000000000000000020000000000000000000040001040000000000000000000000000000000000000000000000000000636f6d6d656e74000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000fdffffff000000005241544545535400000000000000000000000000000000000000000000000000200000000000000073797a3100000000000000000000000000000000000000000000000000000000"]}, 0x368) 22:52:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x23, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) 22:52:20 executing program 4: r0 = socket$inet6(0xa, 0x3, 0x200000088) recvfrom$inet6(r0, &(0x7f0000000080)=""/4, 0xffffff28, 0x20, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") sendmsg$inet_sctp(0xffffffffffffffff, &(0x7f0000a29000)={&(0x7f00005dafe4)=@in6={0xa, 0x4e23, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c, &(0x7f0000fc8000)}, 0x0) 22:52:20 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r1 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) write(r1, &(0x7f0000000040)="16", 0x1) sendfile(r1, r1, &(0x7f0000001000), 0xffff) r2 = gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(r1, r1, &(0x7f0000000000), 0xffffffff) tkill(r2, 0x1000000000016) [ 124.165894] binder: 8445:8447 transaction failed 29189/-22, size 0-0 line 2852 22:52:20 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x1, 0x2f0, [0x0, 0x20000800, 0x20000830, 0x20000860], 0x0, &(0x7f00000000c0), &(0x7f0000000800)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000001500000000000000000073797a5f74756e00000000000000000079616d30000000000000000000000000626f6e645f736c6176655f310000000073697430000000000000000000000000aaaaaaaaaa000000000000000180c20000000000000000000000e001000018020000600200006c696d697400000000000000000000000000000000000000000000000000000020000000000000000000040001040000000000000000000000000000000000000000000000000000636f6d6d656e74000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000fdffffff000000005241544545535400000000000000000000000000000000000000000000000000200000000000000073797a3100000000000000000000000000000000000000000000000000000000"]}, 0x368) 22:52:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x23, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) [ 124.266095] binder: undelivered TRANSACTION_ERROR: 29189 22:52:20 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x1, 0x2f0, [0x0, 0x20000800, 0x20000830, 0x20000860], 0x0, &(0x7f00000000c0), &(0x7f0000000800)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000001500000000000000000073797a5f74756e00000000000000000079616d30000000000000000000000000626f6e645f736c6176655f310000000073697430000000000000000000000000aaaaaaaaaa000000000000000180c20000000000000000000000e001000018020000600200006c696d697400000000000000000000000000000000000000000000000000000020000000000000000000040001040000000000000000000000000000000000000000000000000000636f6d6d656e74000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000fdffffff000000005241544545535400000000000000000000000000000000000000000000000000200000000000000073797a3100000000000000000000000000000000000000000000000000000000"]}, 0x368) [ 124.399253] hrtimer: interrupt took 222792 ns 22:52:20 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x1, 0x2f0, [0x0, 0x20000800, 0x20000830, 0x20000860], 0x0, &(0x7f00000000c0), &(0x7f0000000800)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000001500000000000000000073797a5f74756e00000000000000000079616d30000000000000000000000000626f6e645f736c6176655f310000000073697430000000000000000000000000aaaaaaaaaa000000000000000180c20000000000000000000000e001000018020000600200006c696d697400000000000000000000000000000000000000000000000000000020000000000000000000040001040000000000000000000000000000000000000000000000000000636f6d6d656e74000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000fdffffff000000005241544545535400000000000000000000000000000000000000000000000000200000000000000073797a3100000000000000000000000000000000000000000000000000000000"]}, 0x368) 22:52:20 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x1, 0x2f0, [0x0, 0x20000800, 0x20000830, 0x20000860], 0x0, &(0x7f00000000c0), &(0x7f0000000800)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000001500000000000000000073797a5f74756e00000000000000000079616d30000000000000000000000000626f6e645f736c6176655f310000000073697430000000000000000000000000aaaaaaaaaa000000000000000180c20000000000000000000000e001000018020000600200006c696d697400000000000000000000000000000000000000000000000000000020000000000000000000040001040000000000000000000000000000000000000000000000000000636f6d6d656e74000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000fdffffff000000005241544545535400000000000000000000000000000000000000000000000000200000000000000073797a3100000000000000000000000000000000000000000000000000000000"]}, 0x368) [ 125.115389] binder: 8466:8490 transaction failed 29189/-22, size 0-0 line 2852 [ 125.209869] binder: undelivered TRANSACTION_ERROR: 29189 [ 125.948614] device bridge_slave_1 left promiscuous mode [ 125.954561] bridge0: port 2(bridge_slave_1) entered disabled state [ 125.970293] device bridge_slave_0 left promiscuous mode [ 125.975794] bridge0: port 1(bridge_slave_0) entered disabled state [ 126.273906] IPVS: ftp: loaded support on port[0] = 21 [ 128.040627] team0 (unregistering): Port device team_slave_1 removed [ 128.052180] team0 (unregistering): Port device team_slave_0 removed [ 128.063534] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 128.079703] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 128.109373] bond0 (unregistering): Released all slaves [ 128.687922] bridge0: port 1(bridge_slave_0) entered blocking state [ 128.694357] bridge0: port 1(bridge_slave_0) entered disabled state [ 128.701718] device bridge_slave_0 entered promiscuous mode [ 128.738115] bridge0: port 2(bridge_slave_1) entered blocking state [ 128.744555] bridge0: port 2(bridge_slave_1) entered disabled state [ 128.752403] device bridge_slave_1 entered promiscuous mode [ 128.789917] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 128.825307] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 128.932877] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 128.972691] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 129.145461] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 129.152705] team0: Port device team_slave_0 added [ 129.187748] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 129.196107] team0: Port device team_slave_1 added [ 129.227760] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 129.234636] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 129.243235] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 129.269872] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 129.276768] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 129.287834] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 129.318716] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 129.325882] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 129.337056] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 129.364373] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 129.371523] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 129.385813] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 129.653542] bridge0: port 2(bridge_slave_1) entered blocking state [ 129.659915] bridge0: port 2(bridge_slave_1) entered forwarding state [ 129.666549] bridge0: port 1(bridge_slave_0) entered blocking state [ 129.672902] bridge0: port 1(bridge_slave_0) entered forwarding state [ 129.680261] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 130.144166] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 130.443808] 8021q: adding VLAN 0 to HW filter on device bond0 [ 130.522244] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 130.598795] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 130.604985] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 130.612568] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 130.682796] 8021q: adding VLAN 0 to HW filter on device team0 22:52:27 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x1, 0x2f0, [0x0, 0x20000800, 0x20000830, 0x20000860], 0x0, &(0x7f00000000c0), &(0x7f0000000800)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000001500000000000000000073797a5f74756e00000000000000000079616d30000000000000000000000000626f6e645f736c6176655f310000000073697430000000000000000000000000aaaaaaaaaa000000000000000180c20000000000000000000000e001000018020000600200006c696d697400000000000000000000000000000000000000000000000000000020000000000000000000040001040000000000000000000000000000000000000000000000000000636f6d6d656e74000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000fdffffff000000005241544545535400000000000000000000000000000000000000000000000000200000000000000073797a3100000000000000000000000000000000000000000000000000000000"]}, 0x368) 22:52:27 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r1 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) write(r1, &(0x7f0000000040)="16", 0x1) sendfile(r1, r1, &(0x7f0000001000), 0xffff) r2 = gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(r1, r1, &(0x7f0000000000), 0xffffffff) tkill(r2, 0x1000000000016) 22:52:27 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16") r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000ff4)='/dev/rfkill\x00', 0x1, 0x0) write$eventfd(r1, &(0x7f0000000140)=0x20400000003, 0x8) 22:52:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x23, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) 22:52:27 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)}, 0x20004001) shutdown(r1, 0x2) recvfrom$inet(0xffffffffffffffff, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) 22:52:27 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x40000001, &(0x7f00000000c0)={0x2}, 0x707000) 22:52:27 executing program 4: r0 = socket$inet6(0xa, 0x3, 0x200000088) recvfrom$inet6(r0, &(0x7f0000000080)=""/4, 0xffffff28, 0x20, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) socket$inet6(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x8000000000000802, 0x88) sendmsg$inet_sctp(r1, &(0x7f0000a29000)={&(0x7f00005dafe4)=@in6={0xa, 0x4e23, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c, &(0x7f0000fc8000)}, 0x0) 22:52:27 executing program 1: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000000040)=""/140, 0x8c) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f0000000580)={{0x4000000080}, "706f7274300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000", 0x3b, 0xfffffffffffeffff}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000280)={0x2d8cb47d95373def}) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r0, 0xc05c5340, &(0x7f0000000180)={0x0, 0x0, 0x0, {0x77359400}, 0x0, 0x36}) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r0, 0xc058534b, &(0x7f0000000400)={0x0, 0x0, 0x0, {0x77359400}}) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x0, 0x0) [ 131.180988] binder: 8759:8761 transaction failed 29189/-22, size 0-0 line 2852 22:52:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x23, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) 22:52:27 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x1, 0x2f0, [0x0, 0x20000800, 0x20000830, 0x20000860], 0x0, &(0x7f00000000c0), &(0x7f0000000800)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000001500000000000000000073797a5f74756e00000000000000000079616d30000000000000000000000000626f6e645f736c6176655f310000000073697430000000000000000000000000aaaaaaaaaa000000000000000180c20000000000000000000000e001000018020000600200006c696d697400000000000000000000000000000000000000000000000000000020000000000000000000040001040000000000000000000000000000000000000000000000000000636f6d6d656e74000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000fdffffff000000005241544545535400000000000000000000000000000000000000000000000000200000000000000073797a3100000000000000000000000000000000000000000000000000000000"]}, 0x368) 22:52:27 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16") r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000ff4)='/dev/rfkill\x00', 0x1, 0x0) write$eventfd(r1, &(0x7f0000000140)=0x20400000003, 0x8) 22:52:27 executing program 3: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x6f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, &(0x7f0000000040), 0x0, &(0x7f0000000080)=ANY=[]) [ 131.239909] binder: undelivered TRANSACTION_ERROR: 29189 22:52:27 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x44, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040), &(0x7f0000000080)}}], 0x0, 0x0, &(0x7f0000000340)}) 22:52:27 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000ff4)='/dev/rfkill\x00', 0x1, 0x0) write$eventfd(r1, &(0x7f0000000140)=0x20400000003, 0x8) [ 131.352482] FAT-fs (loop3): bogus number of reserved sectors [ 131.358821] FAT-fs (loop3): Can't find a valid FAT filesystem [ 131.384955] binder: 8782:8785 transaction failed 29189/-22, size 0-0 line 2852 22:52:27 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x1, 0x2f0, [0x0, 0x20000800, 0x20000830, 0x20000860], 0x0, &(0x7f00000000c0), &(0x7f0000000800)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000001500000000000000000073797a5f74756e00000000000000000079616d30000000000000000000000000626f6e645f736c6176655f310000000073697430000000000000000000000000aaaaaaaaaa000000000000000180c20000000000000000000000e001000018020000600200006c696d697400000000000000000000000000000000000000000000000000000020000000000000000000040001040000000000000000000000000000000000000000000000000000636f6d6d656e74000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000fdffffff000000005241544545535400000000000000000000000000000000000000000000000000200000000000000073797a3100000000000000000000000000000000000000000000000000000000"]}, 0x368) 22:52:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x23, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) 22:52:27 executing program 3: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x6f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, &(0x7f0000000040), 0x0, &(0x7f0000000080)=ANY=[]) [ 131.451247] binder: undelivered TRANSACTION_ERROR: 29189 [ 131.529475] binder: 8794:8795 transaction failed 29189/-22, size 0-0 line 2852 [ 131.559274] device bridge_slave_1 left promiscuous mode [ 131.564876] bridge0: port 2(bridge_slave_1) entered disabled state [ 131.587524] FAT-fs (loop3): bogus number of reserved sectors [ 131.593645] FAT-fs (loop3): Can't find a valid FAT filesystem [ 131.637620] binder: undelivered TRANSACTION_ERROR: 29189 [ 131.647928] device bridge_slave_0 left promiscuous mode [ 131.653526] bridge0: port 1(bridge_slave_0) entered disabled state [ 131.688978] IPVS: ftp: loaded support on port[0] = 21 [ 131.746852] team0 (unregistering): Port device team_slave_1 removed [ 131.761265] team0 (unregistering): Port device team_slave_0 removed [ 131.774649] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 131.920735] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 132.033437] bond0 (unregistering): Released all slaves [ 132.647057] bridge0: port 1(bridge_slave_0) entered blocking state [ 132.653474] bridge0: port 1(bridge_slave_0) entered disabled state [ 132.660769] device bridge_slave_0 entered promiscuous mode [ 132.697009] bridge0: port 2(bridge_slave_1) entered blocking state [ 132.703453] bridge0: port 2(bridge_slave_1) entered disabled state [ 132.710722] device bridge_slave_1 entered promiscuous mode [ 132.747515] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 132.784130] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 132.890314] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 132.928590] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 133.093454] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 133.100802] team0: Port device team_slave_0 added [ 133.137008] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 133.144481] team0: Port device team_slave_1 added [ 133.179173] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 133.215362] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 133.252995] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 133.281177] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 133.288336] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 133.303057] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 133.572315] bridge0: port 2(bridge_slave_1) entered blocking state [ 133.578780] bridge0: port 2(bridge_slave_1) entered forwarding state [ 133.585419] bridge0: port 1(bridge_slave_0) entered blocking state [ 133.591784] bridge0: port 1(bridge_slave_0) entered forwarding state [ 133.598948] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 134.304115] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 134.377272] 8021q: adding VLAN 0 to HW filter on device bond0 [ 134.451802] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 134.526583] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 134.532760] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 134.540223] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 134.609252] 8021q: adding VLAN 0 to HW filter on device team0 22:52:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x23, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) 22:52:31 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r1, &(0x7f0000000000)=@file={0x1, './file0\x00'}, 0x6e) recvmsg(r2, &(0x7f000095cfc8)={&(0x7f0000893ff8)=@sco, 0x80, &(0x7f00000a4fb0), 0x0, &(0x7f0000b30000)}, 0x0) r3 = dup2(r1, r2) write$cgroup_int(r3, &(0x7f0000000000)=ANY=[], 0x0) 22:52:31 executing program 4: r0 = socket$inet6(0xa, 0x3, 0x200000088) recvfrom$inet6(r0, &(0x7f0000000080)=""/4, 0xffffff28, 0x20, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) socket$inet6(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x8000000000000802, 0x88) sendmsg$inet_sctp(r1, &(0x7f0000a29000)={&(0x7f00005dafe4)=@in6={0xa, 0x4e23, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c, &(0x7f0000fc8000)}, 0x0) 22:52:31 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r1 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) write(r1, &(0x7f0000000040)="16", 0x1) sendfile(r1, r1, &(0x7f0000001000), 0xffff) r2 = gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(r1, r1, &(0x7f0000000000), 0xffffffff) tkill(r2, 0x1000000000016) 22:52:31 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r2, 0x0, 0x27, &(0x7f0000000040)={@multicast2=0xe0000002, @loopback=0x7f000001, @loopback=0x7f000001}, 0xc) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000000)={'lo\x00'}) 22:52:31 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6(0xa, 0x80001, 0x0) getsockopt$bt_hci(r1, 0x0, 0x3, &(0x7f00001e3000)=""/30, &(0x7f0000d23000)=0x2a0) 22:52:31 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000ff4)='/dev/rfkill\x00', 0x1, 0x0) write$eventfd(r1, &(0x7f0000000140)=0x20400000003, 0x8) 22:52:31 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x1, 0x2f0, [0x0, 0x20000800, 0x20000830, 0x20000860], 0x0, &(0x7f00000000c0), &(0x7f0000000800)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000001500000000000000000073797a5f74756e00000000000000000079616d30000000000000000000000000626f6e645f736c6176655f310000000073697430000000000000000000000000aaaaaaaaaa000000000000000180c20000000000000000000000e001000018020000600200006c696d697400000000000000000000000000000000000000000000000000000020000000000000000000040001040000000000000000000000000000000000000000000000000000636f6d6d656e74000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000fdffffff000000005241544545535400000000000000000000000000000000000000000000000000200000000000000073797a3100000000000000000000000000000000000000000000000000000000"]}, 0x368) [ 135.031930] binder: 9075:9076 transaction failed 29189/-22, size 0-0 line 2852 [ 135.048496] binder: undelivered TRANSACTION_ERROR: 29189 [ 135.082632] binder_alloc: 9078: binder_alloc_buf, no vma [ 135.088250] binder: 9078:9079 transaction failed 29189/-3, size 0-0 line 2967 22:52:31 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000ff4)='/dev/rfkill\x00', 0x1, 0x0) write$eventfd(r1, &(0x7f0000000140)=0x20400000003, 0x8) 22:52:31 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x2e4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndtimer(&(0x7f0000000040)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000029fcc)={{0x0, 0x2}}) ioctl$SNDRV_TIMER_IOCTL_STATUS(r0, 0x80605414, &(0x7f0000000100)=""/91) 22:52:31 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16") r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x1, 0x2f0, [0x0, 0x20000800, 0x20000830, 0x20000860], 0x0, &(0x7f00000000c0), &(0x7f0000000800)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000001500000000000000000073797a5f74756e00000000000000000079616d30000000000000000000000000626f6e645f736c6176655f310000000073697430000000000000000000000000aaaaaaaaaa000000000000000180c20000000000000000000000e001000018020000600200006c696d697400000000000000000000000000000000000000000000000000000020000000000000000000040001040000000000000000000000000000000000000000000000000000636f6d6d656e74000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000fdffffff000000005241544545535400000000000000000000000000000000000000000000000000200000000000000073797a3100000000000000000000000000000000000000000000000000000000"]}, 0x368) [ 135.126159] device lo entered promiscuous mode [ 135.138336] device lo left promiscuous mode [ 135.188478] device lo entered promiscuous mode 22:52:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x23, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) 22:52:31 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000ff4)='/dev/rfkill\x00', 0x1, 0x0) write$eventfd(r1, &(0x7f0000000140)=0x20400000003, 0x8) [ 135.237562] device lo left promiscuous mode [ 135.245351] binder: undelivered TRANSACTION_ERROR: 29189 22:52:31 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x2e4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndtimer(&(0x7f0000000040)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000029fcc)={{0x0, 0x2}}) ioctl$SNDRV_TIMER_IOCTL_STATUS(r0, 0x80605414, &(0x7f0000000100)=""/91) 22:52:31 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16") r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x1, 0x2f0, [0x0, 0x20000800, 0x20000830, 0x20000860], 0x0, &(0x7f00000000c0), &(0x7f0000000800)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000001500000000000000000073797a5f74756e00000000000000000079616d30000000000000000000000000626f6e645f736c6176655f310000000073697430000000000000000000000000aaaaaaaaaa000000000000000180c20000000000000000000000e001000018020000600200006c696d697400000000000000000000000000000000000000000000000000000020000000000000000000040001040000000000000000000000000000000000000000000000000000636f6d6d656e74000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000fdffffff000000005241544545535400000000000000000000000000000000000000000000000000200000000000000073797a3100000000000000000000000000000000000000000000000000000000"]}, 0x368) 22:52:31 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x2e4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndtimer(&(0x7f0000000040)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000029fcc)={{0x0, 0x2}}) ioctl$SNDRV_TIMER_IOCTL_STATUS(r0, 0x80605414, &(0x7f0000000100)=""/91) 22:52:31 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x2e4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndtimer(&(0x7f0000000040)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000029fcc)={{0x0, 0x2}}) ioctl$SNDRV_TIMER_IOCTL_STATUS(r0, 0x80605414, &(0x7f0000000100)=""/91) [ 135.725882] binder_alloc: 9112: binder_alloc_buf, no vma [ 135.731501] binder: 9112:9115 transaction failed 29189/-3, size 0-0 line 2967 [ 135.790098] binder: undelivered TRANSACTION_ERROR: 29189 22:52:32 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16") r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x1, 0x2f0, [0x0, 0x20000800, 0x20000830, 0x20000860], 0x0, &(0x7f00000000c0), &(0x7f0000000800)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000001500000000000000000073797a5f74756e00000000000000000079616d30000000000000000000000000626f6e645f736c6176655f310000000073697430000000000000000000000000aaaaaaaaaa000000000000000180c20000000000000000000000e001000018020000600200006c696d697400000000000000000000000000000000000000000000000000000020000000000000000000040001040000000000000000000000000000000000000000000000000000636f6d6d656e74000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000fdffffff000000005241544545535400000000000000000000000000000000000000000000000000200000000000000073797a3100000000000000000000000000000000000000000000000000000000"]}, 0x368) 22:52:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x0, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x23, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) 22:52:32 executing program 4: r0 = socket$inet6(0xa, 0x3, 0x200000088) recvfrom$inet6(r0, &(0x7f0000000080)=""/4, 0xffffff28, 0x20, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) socket$inet6(0xa, 0x1, 0x0) r1 = socket$inet6(0xa, 0x8000000000000802, 0x88) sendmsg$inet_sctp(r1, &(0x7f0000a29000)={&(0x7f00005dafe4)=@in6={0xa, 0x4e23, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c, &(0x7f0000fc8000)}, 0x0) 22:52:32 executing program 3: 22:52:32 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r1 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) write(r1, &(0x7f0000000040)="16", 0x1) sendfile(r1, r1, &(0x7f0000001000), 0xffff) r2 = gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(r1, r1, &(0x7f0000000000), 0xffffffff) tkill(r2, 0x1000000000016) 22:52:32 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x2e4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndtimer(&(0x7f0000000040)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_STATUS(r0, 0x80605414, &(0x7f0000000100)=""/91) 22:52:32 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000ff4)='/dev/rfkill\x00', 0x1, 0x0) write$eventfd(r1, &(0x7f0000000140)=0x20400000003, 0x8) 22:52:32 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socket$key(0xf, 0x3, 0x2) socket$key(0xf, 0x3, 0x2) r1 = socket(0x10, 0x2, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x0, 0x0) sendfile(r1, r2, &(0x7f00000000c0)=0x39, 0x4000000000000003) 22:52:32 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000ff4)='/dev/rfkill\x00', 0x1, 0x0) write$eventfd(r1, &(0x7f0000000140)=0x20400000003, 0x8) [ 136.059157] binder_alloc: 9146: binder_alloc_buf, no vma [ 136.064733] binder: 9146:9151 transaction failed 29189/-3, size 0-0 line 2967 22:52:32 executing program 3: 22:52:32 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x1, 0x2f0, [0x0, 0x20000800, 0x20000830, 0x20000860], 0x0, &(0x7f00000000c0), &(0x7f0000000800)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000001500000000000000000073797a5f74756e00000000000000000079616d30000000000000000000000000626f6e645f736c6176655f310000000073697430000000000000000000000000aaaaaaaaaa000000000000000180c20000000000000000000000e001000018020000600200006c696d697400000000000000000000000000000000000000000000000000000020000000000000000000040001040000000000000000000000000000000000000000000000000000636f6d6d656e74000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000fdffffff000000005241544545535400000000000000000000000000000000000000000000000000200000000000000073797a3100000000000000000000000000000000000000000000000000000000"]}, 0x368) 22:52:32 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socket$key(0xf, 0x3, 0x2) socket$key(0xf, 0x3, 0x2) r1 = socket(0x10, 0x2, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x0, 0x0) sendfile(r1, r2, &(0x7f00000000c0)=0x39, 0x4000000000000003) 22:52:32 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x2e4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000029fcc)={{0x0, 0x2}}) ioctl$SNDRV_TIMER_IOCTL_STATUS(0xffffffffffffffff, 0x80605414, &(0x7f0000000100)=""/91) 22:52:32 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000ff4)='/dev/rfkill\x00', 0x0, 0x0) write$eventfd(r1, &(0x7f0000000140)=0x20400000003, 0x8) 22:52:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x23, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) [ 136.192348] binder: undelivered TRANSACTION_ERROR: 29189 22:52:32 executing program 3: [ 136.266410] binder_alloc: 9178: binder_alloc_buf, no vma [ 136.272005] binder: 9178:9179 transaction failed 29189/-3, size 0-0 line 2967 [ 136.376657] binder: undelivered TRANSACTION_ERROR: 29189 22:52:33 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000ff4)='/dev/rfkill\x00', 0x1, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000140)=0x20400000003, 0x8) 22:52:33 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x1, 0x2f0, [0x0, 0x20000800, 0x20000830, 0x20000860], 0x0, &(0x7f00000000c0), &(0x7f0000000800)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000001500000000000000000073797a5f74756e00000000000000000079616d30000000000000000000000000626f6e645f736c6176655f310000000073697430000000000000000000000000aaaaaaaaaa000000000000000180c20000000000000000000000e001000018020000600200006c696d697400000000000000000000000000000000000000000000000000000020000000000000000000040001040000000000000000000000000000000000000000000000000000636f6d6d656e74000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000fdffffff000000005241544545535400000000000000000000000000000000000000000000000000200000000000000073797a3100000000000000000000000000000000000000000000000000000000"]}, 0x368) 22:52:33 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r1 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) write(r1, &(0x7f0000000040)="16", 0x1) sendfile(r1, r1, &(0x7f0000001000), 0xffff) r2 = gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(r1, r1, &(0x7f0000000000), 0xffffffff) tkill(r2, 0x1000000000016) 22:52:33 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x2e4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000029fcc)={{0x0, 0x2}}) ioctl$SNDRV_TIMER_IOCTL_STATUS(0xffffffffffffffff, 0x80605414, &(0x7f0000000100)=""/91) 22:52:33 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x23, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) 22:52:33 executing program 3: 22:52:33 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socket$key(0xf, 0x3, 0x2) socket$key(0xf, 0x3, 0x2) r1 = socket(0x10, 0x2, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x0, 0x0) sendfile(r1, r2, &(0x7f00000000c0)=0x39, 0x4000000000000003) 22:52:33 executing program 4: r0 = socket$inet6(0xa, 0x3, 0x200000088) recvfrom$inet6(r0, &(0x7f0000000080)=""/4, 0xffffff28, 0x20, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet6(0xa, 0x8000000000000802, 0x88) sendmsg$inet_sctp(r1, &(0x7f0000a29000)={&(0x7f00005dafe4)=@in6={0xa, 0x4e23, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c, &(0x7f0000fc8000)}, 0x0) 22:52:33 executing program 3: 22:52:33 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socket$key(0xf, 0x3, 0x2) socket$key(0xf, 0x3, 0x2) r1 = socket(0x10, 0x2, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x0, 0x0) sendfile(r1, r2, &(0x7f00000000c0)=0x39, 0x4000000000000003) [ 136.927429] binder_alloc: 9201: binder_alloc_buf, no vma [ 136.933245] binder: 9201:9205 transaction failed 29189/-3, size 0-0 line 2967 22:52:33 executing program 3: 22:52:33 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000ff4)='/dev/rfkill\x00', 0x1, 0x0) write$eventfd(r1, &(0x7f0000000140), 0x8) 22:52:33 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x1, 0x2f0, [0x0, 0x20000800, 0x20000830, 0x20000860], 0x0, &(0x7f00000000c0), &(0x7f0000000800)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000001500000000000000000073797a5f74756e00000000000000000079616d30000000000000000000000000626f6e645f736c6176655f310000000073697430000000000000000000000000aaaaaaaaaa000000000000000180c20000000000000000000000e001000018020000600200006c696d697400000000000000000000000000000000000000000000000000000020000000000000000000040001040000000000000000000000000000000000000000000000000000636f6d6d656e74000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000fdffffff000000005241544545535400000000000000000000000000000000000000000000000000200000000000000073797a3100000000000000000000000000000000000000000000000000000000"]}, 0x368) 22:52:33 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x23, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) 22:52:33 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x2e4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000029fcc)={{0x0, 0x2}}) ioctl$SNDRV_TIMER_IOCTL_STATUS(0xffffffffffffffff, 0x80605414, &(0x7f0000000100)=""/91) 22:52:33 executing program 3: [ 137.054435] binder: undelivered TRANSACTION_ERROR: 29189 [ 137.110353] binder_alloc: 9224: binder_alloc_buf, no vma [ 137.115960] binder: 9224:9225 transaction failed 29189/-3, size 0-0 line 2967 22:52:33 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socket$key(0xf, 0x3, 0x2) socket$key(0xf, 0x3, 0x2) r1 = socket(0x10, 0x2, 0x0) sendfile(r1, 0xffffffffffffffff, &(0x7f00000000c0)=0x39, 0x4000000000000003) 22:52:33 executing program 7: [ 137.266253] binder: undelivered TRANSACTION_ERROR: 29189 22:52:34 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x23, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) 22:52:34 executing program 1: r0 = syz_open_dev$sndtimer(&(0x7f0000000040)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000029fcc)={{0x0, 0x2}}) ioctl$SNDRV_TIMER_IOCTL_STATUS(r0, 0x80605414, &(0x7f0000000100)=""/91) 22:52:34 executing program 7: perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x3, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) msgget$private(0x0, 0x0) msgctl$MSG_STAT(0x0, 0xb, &(0x7f0000000040)=""/3) 22:52:34 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socket$key(0xf, 0x3, 0x2) socket$key(0xf, 0x3, 0x2) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, &(0x7f00000000c0)=0x39, 0x4000000000000003) 22:52:34 executing program 4: r0 = socket$inet6(0xa, 0x3, 0x200000088) recvfrom$inet6(r0, &(0x7f0000000080)=""/4, 0xffffff28, 0x20, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet6(0xa, 0x8000000000000802, 0x88) sendmsg$inet_sctp(r1, &(0x7f0000a29000)={&(0x7f00005dafe4)=@in6={0xa, 0x4e23, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c, &(0x7f0000fc8000)}, 0x0) 22:52:34 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r1 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) write(r1, &(0x7f0000000040)="16", 0x1) sendfile(r1, r1, &(0x7f0000001000), 0xffff) r2 = gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(r1, r1, &(0x7f0000000000), 0xffffffff) tkill(r2, 0x1000000000016) 22:52:34 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x1, 0x2f0, [0x0, 0x20000800, 0x20000830, 0x20000860], 0x0, &(0x7f00000000c0), &(0x7f0000000800)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000001500000000000000000073797a5f74756e00000000000000000079616d30000000000000000000000000626f6e645f736c6176655f310000000073697430000000000000000000000000aaaaaaaaaa000000000000000180c20000000000000000000000e001000018020000600200006c696d697400000000000000000000000000000000000000000000000000000020000000000000000000040001040000000000000000000000000000000000000000000000000000636f6d6d656e74000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000fdffffff000000005241544545535400000000000000000000000000000000000000000000000000200000000000000073797a3100000000000000000000000000000000000000000000000000000000"]}, 0x368) 22:52:34 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000000)={0x0, 0x3, 0x0, 0x21000000, &(0x7f0000fff000/0x1000)=nil}) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$KVM_GET_DIRTY_LOG(r1, 0x4010ae42, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000c00000/0x400000)=nil}) 22:52:34 executing program 1: r0 = syz_open_dev$sndtimer(&(0x7f0000000040)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000029fcc)={{0x0, 0x2}}) ioctl$SNDRV_TIMER_IOCTL_STATUS(r0, 0x80605414, &(0x7f0000000100)=""/91) [ 137.873245] binder: 9255:9260 transaction failed 29189/-22, size 0-0 line 2852 22:52:34 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x1, 0x2f0, [0x0, 0x20000800, 0x20000830, 0x20000860], 0x0, &(0x7f00000000c0), &(0x7f0000000800)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000001500000000000000000073797a5f74756e00000000000000000079616d30000000000000000000000000626f6e645f736c6176655f310000000073697430000000000000000000000000aaaaaaaaaa000000000000000180c20000000000000000000000e001000018020000600200006c696d697400000000000000000000000000000000000000000000000000000020000000000000000000040001040000000000000000000000000000000000000000000000000000636f6d6d656e74000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000fdffffff000000005241544545535400000000000000000000000000000000000000000000000000200000000000000073797a3100000000000000000000000000000000000000000000000000000000"]}, 0x368) 22:52:34 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f000065ffa8)={0x26, 'hash\x00', 0x0, 0x0, 'vmac(aes-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000100)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg(r2, &(0x7f0000002380)=[{{&(0x7f0000000980)=@rc={0x1f}, 0x80, &(0x7f0000000a00)=[{&(0x7f0000005dc0)="a75838fe7241ca29e41f8d80539a6d33b4b230a59fe8cbefb01dd47861e201cbd6741dbdd6fa437aa8ebf9dacb3796976e7d513ed7f2796995b1fab6ffe33758a779c0683912119361a8d39203e03493cf72b1ba49bcabe7af914aec1e73bf6c80f13f5acb3069b281466ebbd53b5727c86f12b8542b211c8f0e4ea9e1454d7971cdd35d5c50edacfa42000c307e9c82e3c0a861268ea5b29ce8f25ad6bbd06b9dcc99dbb58af5f2b95b36444a970dd6bfdf941d45bb38221051e6e4eee3a37d30a5a62fd6e989d100d85228000ce536cdd1f8c0f322bd016e680ceb6b36b79c59eea6db186a0c9921c7de456f55b083914e92e84f50b9771b2990413b6f1f086d63ea42770a7ef8aa3c8248a3197e62debd40b6c1e408b7d279735c1862ca94c12700bb9bb5b4eda6131e9388ce449c198c4500f96cc2351277bf8ca6dc1501526c7b6d4d7dfc601a38865c0892d50a3202016ca0bc08ac7d529089f87c3bf98594550a60a8d5b199fd76d944b61b99f8392a8a4a43646f86c1387ea25d7a9b5950cd4d721caab9a630a6689b43ff26ba1162e1a30de8d7d2c900c9516b7a7cd46a406b8508d4a55b38f51e79b98ffba499a1db2b2996e7d0519f04e42da2f7126108ac46445e1980d54cc3ee9e4b82c156d77c00ffbac35a89af046ebabe98c9a7d5f1cced24b75908a1a3bd647d1d5c15549011cd436faf00f6463f944cf6", 0x200}], 0x1}}, {{0x0, 0x0, &(0x7f0000001040)=[{&(0x7f0000000f40)="b6", 0x1}], 0x1, &(0x7f0000001080)=[{0x10}], 0x10}}], 0x2, 0x0) 22:52:34 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socket$key(0xf, 0x3, 0x2) r1 = socket(0x10, 0x2, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x0, 0x0) sendfile(r1, r2, &(0x7f00000000c0)=0x39, 0x4000000000000003) 22:52:34 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x23, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) 22:52:34 executing program 1: r0 = syz_open_dev$sndtimer(&(0x7f0000000040)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000029fcc)={{0x0, 0x2}}) ioctl$SNDRV_TIMER_IOCTL_STATUS(r0, 0x80605414, &(0x7f0000000100)=""/91) [ 138.009792] binder: undelivered TRANSACTION_ERROR: 29189 22:52:34 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x1, 0x2f0, [0x0, 0x20000800, 0x20000830, 0x20000860], 0x0, &(0x7f00000000c0), &(0x7f0000000800)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000001500000000000000000073797a5f74756e00000000000000000079616d30000000000000000000000000626f6e645f736c6176655f310000000073697430000000000000000000000000aaaaaaaaaa000000000000000180c20000000000000000000000e001000018020000600200006c696d697400000000000000000000000000000000000000000000000000000020000000000000000000040001040000000000000000000000000000000000000000000000000000636f6d6d656e74000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000fdffffff000000005241544545535400000000000000000000000000000000000000000000000000200000000000000073797a3100000000000000000000000000000000000000000000000000000000"]}, 0x368) 22:52:34 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)}, 0x20004001) shutdown(r1, 0x2) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x0, &(0x7f00000000c0)={0x2}, 0x707000) [ 138.071885] binder: 9282:9283 transaction failed 29189/-22, size 0-0 line 2852 [ 138.162499] binder: undelivered TRANSACTION_ERROR: 29189 22:52:35 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socket$key(0xf, 0x3, 0x2) r1 = socket(0x10, 0x2, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x0, 0x0) sendfile(r1, r2, &(0x7f00000000c0)=0x39, 0x4000000000000003) 22:52:35 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x23, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) 22:52:35 executing program 7: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") read(r0, &(0x7f0000000040)=""/11, 0xfffffffffffffcef) 22:52:35 executing program 1: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x2e4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndtimer(&(0x7f0000000040)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000029fcc)={{0x0, 0x2}}) ioctl$SNDRV_TIMER_IOCTL_STATUS(r0, 0x80605414, &(0x7f0000000100)=""/91) 22:52:35 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket(0x0, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x1, 0x2f0, [0x0, 0x20000800, 0x20000830, 0x20000860], 0x0, &(0x7f00000000c0), &(0x7f0000000800)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000001500000000000000000073797a5f74756e00000000000000000079616d30000000000000000000000000626f6e645f736c6176655f310000000073697430000000000000000000000000aaaaaaaaaa000000000000000180c20000000000000000000000e001000018020000600200006c696d697400000000000000000000000000000000000000000000000000000020000000000000000000040001040000000000000000000000000000000000000000000000000000636f6d6d656e74000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000fdffffff000000005241544545535400000000000000000000000000000000000000000000000000200000000000000073797a3100000000000000000000000000000000000000000000000000000000"]}, 0x368) 22:52:35 executing program 3: r0 = syz_open_dev$evdev(&(0x7f0000dfdfee)='/dev/input/event#\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$EVIOCGSND(r0, 0x8040451a, &(0x7f0000000140)=""/4096) 22:52:35 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16") timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r1 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) write(r1, &(0x7f0000000040)="16", 0x1) sendfile(r1, r1, &(0x7f0000001000), 0xffff) r2 = gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(r1, r1, &(0x7f0000000000), 0xffffffff) tkill(r2, 0x1000000000016) 22:52:35 executing program 4: r0 = socket$inet6(0xa, 0x3, 0x200000088) recvfrom$inet6(r0, &(0x7f0000000080)=""/4, 0xffffff28, 0x20, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet6(0xa, 0x8000000000000802, 0x88) sendmsg$inet_sctp(r1, &(0x7f0000a29000)={&(0x7f00005dafe4)=@in6={0xa, 0x4e23, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c, &(0x7f0000fc8000)}, 0x0) 22:52:35 executing program 7: getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1b, &(0x7f0000000240)=ANY=[@ANYBLOB="4e000000db81c95eb03f8ae6aef9b9acb806203424e1ef11292e86b7d0fdb2ed83c37ca0bac6cf164297168c2457e04706a730d9939431e2f369578e00a237bc0700666e635e852d9b04a6a1d9b93c20fd0a7d4f5c2c59cbd31601dc90174f28f687b3178733"], &(0x7f0000001200)=0x1) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00005befdc)) r1 = syz_open_pts(r0, 0x20201) ioctl$TCSETS(r1, 0x5402, &(0x7f0000000200)={0x0, 0x9}) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write(r1, &(0x7f0000000140), 0x28d) 22:52:35 executing program 1: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x2e4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndtimer(&(0x7f0000000040)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000029fcc)={{0x0, 0x2}}) ioctl$SNDRV_TIMER_IOCTL_STATUS(r0, 0x80605414, &(0x7f0000000100)=""/91) [ 138.766155] binder: 9320:9323 transaction failed 29189/-22, size 0-0 line 2852 22:52:35 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x1d4) connect$inet6(r1, &(0x7f0000000140)={0xa}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f00000002c0), &(0x7f0000000300)=0x14) 22:52:35 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket(0xa, 0x0, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x1, 0x2f0, [0x0, 0x20000800, 0x20000830, 0x20000860], 0x0, &(0x7f00000000c0), &(0x7f0000000800)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000001500000000000000000073797a5f74756e00000000000000000079616d30000000000000000000000000626f6e645f736c6176655f310000000073697430000000000000000000000000aaaaaaaaaa000000000000000180c20000000000000000000000e001000018020000600200006c696d697400000000000000000000000000000000000000000000000000000020000000000000000000040001040000000000000000000000000000000000000000000000000000636f6d6d656e74000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000fdffffff000000005241544545535400000000000000000000000000000000000000000000000000200000000000000073797a3100000000000000000000000000000000000000000000000000000000"]}, 0x368) 22:52:35 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x0, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x23, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) 22:52:35 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socket$key(0xf, 0x3, 0x2) r1 = socket(0x10, 0x2, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x0, 0x0) sendfile(r1, r2, &(0x7f00000000c0)=0x39, 0x4000000000000003) [ 138.858394] binder: undelivered TRANSACTION_ERROR: 29189 22:52:35 executing program 1: perf_event_open(&(0x7f000025c000)={0x0, 0x70, 0x2e4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndtimer(&(0x7f0000000040)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000029fcc)={{0x0, 0x2}}) ioctl$SNDRV_TIMER_IOCTL_STATUS(r0, 0x80605414, &(0x7f0000000100)=""/91) 22:52:35 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x1d4) connect$inet6(r1, &(0x7f0000000140)={0xa}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f00000002c0), &(0x7f0000000300)=0x14) 22:52:35 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socket$key(0xf, 0x3, 0x2) r1 = socket(0x10, 0x2, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x0, 0x0) sendfile(r1, r2, &(0x7f00000000c0)=0x39, 0x4000000000000003) [ 139.056268] binder: send failed reply for transaction 99 to 9345:9346 [ 139.066362] binder: undelivered TRANSACTION_COMPLETE [ 139.071568] binder: undelivered TRANSACTION_ERROR: 29189 22:52:35 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x1, 0x2f0, [0x0, 0x20000800, 0x20000830, 0x20000860], 0x0, &(0x7f00000000c0), &(0x7f0000000800)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000001500000000000000000073797a5f74756e00000000000000000079616d30000000000000000000000000626f6e645f736c6176655f310000000073697430000000000000000000000000aaaaaaaaaa000000000000000180c20000000000000000000000e001000018020000600200006c696d697400000000000000000000000000000000000000000000000000000020000000000000000000040001040000000000000000000000000000000000000000000000000000636f6d6d656e74000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000fdffffff000000005241544545535400000000000000000000000000000000000000000000000000200000000000000073797a3100000000000000000000000000000000000000000000000000000000"]}, 0x368) 22:52:35 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x0, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x23, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) 22:52:35 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndtimer(&(0x7f0000000040)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000029fcc)={{0x0, 0x2}}) ioctl$SNDRV_TIMER_IOCTL_STATUS(r0, 0x80605414, &(0x7f0000000100)=""/91) 22:52:35 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x1d4) connect$inet6(r1, &(0x7f0000000140)={0xa}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f00000002c0), &(0x7f0000000300)=0x14) 22:52:35 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socket$key(0xf, 0x3, 0x2) r1 = socket(0x10, 0x2, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x0, 0x0) sendfile(r1, r2, &(0x7f00000000c0)=0x39, 0x4000000000000003) 22:52:35 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16") timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r1 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) write(r1, &(0x7f0000000040)="16", 0x1) sendfile(r1, r1, &(0x7f0000001000), 0xffff) r2 = gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(r1, r1, &(0x7f0000000000), 0xffffffff) tkill(r2, 0x1000000000016) 22:52:35 executing program 7: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_inet_tcp_SIOCATMARK(0xffffffffffffffff, 0x4028700f, &(0x7f0000000040)) bpf$MAP_CREATE(0x0, &(0x7f0000000280)={0xf, 0x4, 0x4, 0x6, 0x0, 0xffffffffffffff9c, 0x0, [0xa]}, 0x2c) 22:52:35 executing program 4: recvfrom$inet6(0xffffffffffffffff, &(0x7f0000000080)=""/4, 0xffffff28, 0x20, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet6(0xa, 0x8000000000000802, 0x88) sendmsg$inet_sctp(r1, &(0x7f0000a29000)={&(0x7f00005dafe4)=@in6={0xa, 0x4e23, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c, &(0x7f0000fc8000)}, 0x0) 22:52:36 executing program 4: recvfrom$inet6(0xffffffffffffffff, &(0x7f0000000080)=""/4, 0xffffff28, 0x20, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet6(0xa, 0x8000000000000802, 0x88) sendmsg$inet_sctp(r1, &(0x7f0000a29000)={&(0x7f00005dafe4)=@in6={0xa, 0x4e23, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c, &(0x7f0000fc8000)}, 0x0) 22:52:36 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndtimer(&(0x7f0000000040)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000029fcc)={{0x0, 0x2}}) ioctl$SNDRV_TIMER_IOCTL_STATUS(r0, 0x80605414, &(0x7f0000000100)=""/91) 22:52:36 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x1d4) connect$inet6(r1, &(0x7f0000000140)={0xa}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f00000002c0), &(0x7f0000000300)=0x14) 22:52:36 executing program 7: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(tea-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000005940)=[{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000001c0)="48107936edbbc8353b1bcef5de3280f2687c2620032770501ef8a908213c16f3b1", 0x21}], 0x1, &(0x7f0000000640)}], 0x1, 0x0) 22:52:36 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x1, 0x0, [0x0, 0x20000800, 0x20000830, 0x20000860], 0x0, &(0x7f00000000c0), &(0x7f0000000800)=ANY=[]}, 0x368) 22:52:36 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socket$key(0xf, 0x3, 0x2) r1 = socket(0x10, 0x2, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x0, 0x0) sendfile(r1, r2, &(0x7f00000000c0)=0x39, 0x4000000000000003) 22:52:36 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x0, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x23, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) [ 139.774278] binder: send failed reply for transaction 101 to 9373:9374 [ 139.797878] binder: undelivered TRANSACTION_COMPLETE [ 139.803054] binder: undelivered TRANSACTION_ERROR: 29189 [ 139.856918] kernel msg: ebtables bug: please report to author: Wrong len argument [ 139.968665] binder: send failed reply for transaction 103 to 9407:9410 [ 139.984152] binder: undelivered TRANSACTION_COMPLETE [ 139.989343] binder: undelivered TRANSACTION_ERROR: 29189 22:52:36 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x1d4) connect$inet6(r1, &(0x7f0000000140)={0xa}, 0x1c) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f00000002c0), &(0x7f0000000300)=0x14) 22:52:36 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndtimer(&(0x7f0000000040)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000029fcc)={{0x0, 0x2}}) ioctl$SNDRV_TIMER_IOCTL_STATUS(r0, 0x80605414, &(0x7f0000000100)=""/91) 22:52:36 executing program 4: recvfrom$inet6(0xffffffffffffffff, &(0x7f0000000080)=""/4, 0xffffff28, 0x20, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet6(0xa, 0x8000000000000802, 0x88) sendmsg$inet_sctp(r1, &(0x7f0000a29000)={&(0x7f00005dafe4)=@in6={0xa, 0x4e23, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c, &(0x7f0000fc8000)}, 0x0) 22:52:36 executing program 5: socket$inet6(0xa, 0x1, 0x0) socket$key(0xf, 0x3, 0x2) socket$key(0xf, 0x3, 0x2) r0 = socket(0x10, 0x2, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x0, 0x0) sendfile(r0, r1, &(0x7f00000000c0)=0x39, 0x4000000000000003) 22:52:36 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x23, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) 22:52:36 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x1, 0x0, [0x0, 0x20000800, 0x20000830, 0x20000860], 0x0, &(0x7f00000000c0), &(0x7f0000000800)=ANY=[@ANYBLOB]}, 0x368) 22:52:36 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16") timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r1 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) write(r1, &(0x7f0000000040)="16", 0x1) sendfile(r1, r1, &(0x7f0000001000), 0xffff) r2 = gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(r1, r1, &(0x7f0000000000), 0xffffffff) tkill(r2, 0x1000000000016) 22:52:36 executing program 7: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(tea-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000005940)=[{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000001c0)="48107936edbbc8353b1bcef5de3280f2687c2620032770501ef8a908213c16f3b1", 0x21}], 0x1, &(0x7f0000000640)}], 0x1, 0x0) [ 140.547519] kernel msg: ebtables bug: please report to author: Wrong len argument 22:52:36 executing program 4: r0 = socket$inet6(0xa, 0x0, 0x200000088) recvfrom$inet6(r0, &(0x7f0000000080)=""/4, 0xffffff28, 0x20, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r2 = socket$inet6(0xa, 0x8000000000000802, 0x88) sendmsg$inet_sctp(r2, &(0x7f0000a29000)={&(0x7f00005dafe4)=@in6={0xa, 0x4e23, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c, &(0x7f0000fc8000)}, 0x0) 22:52:36 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x1, 0x178, [0x0, 0x20000800, 0x20000830, 0x20000860], 0x0, &(0x7f00000000c0), &(0x7f0000000800)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000001500000000000000000073797a5f74756e00000000000000000079616d30000000000000000000000000626f6e645f736c6176655f310000000073697430000000000000000000000000aaaaaaaaaa000000000000000180c20000000000000000000000e001000018020000600200006c696d697400000000000000000000000000000000000000000000000000000020000000000000000000040001040000000000000000000000000000000000000000000000000000636f6d6d656e740000000000000000000000000000000000000000000000000000010000000000000000000000000000"]}, 0x368) 22:52:36 executing program 7: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(tea-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000005940)=[{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000001c0)="48107936edbbc8353b1bcef5de3280f2687c2620032770501ef8a908213c16f3b1", 0x21}], 0x1, &(0x7f0000000640)}], 0x1, 0x0) 22:52:36 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x1d4) connect$inet6(r1, &(0x7f0000000140)={0xa}, 0x1c) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f00000002c0), &(0x7f0000000300)=0x14) 22:52:36 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x23, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) 22:52:37 executing program 5: socket$inet6(0xa, 0x1, 0x0) socket$key(0xf, 0x3, 0x2) socket$key(0xf, 0x3, 0x2) r0 = socket(0x10, 0x2, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x0, 0x0) sendfile(r0, r1, &(0x7f00000000c0)=0x39, 0x4000000000000003) 22:52:37 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x2e4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndtimer(&(0x7f0000000040)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000029fcc)={{0x0, 0x2}}) ioctl$SNDRV_TIMER_IOCTL_STATUS(r0, 0x80605414, &(0x7f0000000100)=""/91) [ 140.639465] binder: send failed reply for transaction 105 to 9436:9442 [ 140.658976] binder: undelivered TRANSACTION_COMPLETE [ 140.664228] binder: undelivered TRANSACTION_ERROR: 29189 [ 140.676759] kernel msg: ebtables bug: please report to author: Wrong len argument 22:52:37 executing program 4: r0 = socket$inet6(0xa, 0x0, 0x200000088) recvfrom$inet6(r0, &(0x7f0000000080)=""/4, 0xffffff28, 0x20, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r2 = socket$inet6(0xa, 0x8000000000000802, 0x88) sendmsg$inet_sctp(r2, &(0x7f0000a29000)={&(0x7f00005dafe4)=@in6={0xa, 0x4e23, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c, &(0x7f0000fc8000)}, 0x0) 22:52:37 executing program 7: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(tea-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000005940)=[{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000001c0)="48107936edbbc8353b1bcef5de3280f2687c2620032770501ef8a908213c16f3b1", 0x21}], 0x1, &(0x7f0000000640)}], 0x1, 0x0) 22:52:37 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x1, 0x234, [0x0, 0x20000800, 0x20000830, 0x20000860], 0x0, &(0x7f00000000c0), &(0x7f0000000800)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000001500000000000000000073797a5f74756e00000000000000000079616d30000000000000000000000000626f6e645f736c6176655f310000000073697430000000000000000000000000aaaaaaaaaa000000000000000180c20000000000000000000000e001000018020000600200006c696d697400000000000000000000000000000000000000000000000000000020000000000000000000040001040000000000000000000000000000000000000000000000000000636f6d6d656e7400000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"]}, 0x368) [ 140.834637] binder: send failed reply for transaction 107 to 9464:9465 [ 140.845186] binder: undelivered TRANSACTION_COMPLETE [ 140.850409] binder: undelivered TRANSACTION_ERROR: 29189 [ 140.911446] kernel msg: ebtables bug: please report to author: Wrong len argument 22:52:37 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x1d4) connect$inet6(r1, &(0x7f0000000140)={0xa}, 0x1c) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f00000002c0), &(0x7f0000000300)=0x14) 22:52:37 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x23, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) 22:52:37 executing program 5: socket$inet6(0xa, 0x1, 0x0) socket$key(0xf, 0x3, 0x2) socket$key(0xf, 0x3, 0x2) r0 = socket(0x10, 0x2, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x0, 0x0) sendfile(r0, r1, &(0x7f00000000c0)=0x39, 0x4000000000000003) 22:52:37 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x2e4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndtimer(&(0x7f0000000040)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000029fcc)={{0x0, 0x2}}) ioctl$SNDRV_TIMER_IOCTL_STATUS(r0, 0x80605414, &(0x7f0000000100)=""/91) 22:52:37 executing program 7: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(tea-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000005940)=[{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000001c0)="48107936edbbc8353b1bcef5de3280f2687c2620032770501ef8a908213c16f3b1", 0x21}], 0x1, &(0x7f0000000640)}], 0x1, 0x0) 22:52:37 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x1, 0x292, [0x0, 0x20000800, 0x20000830, 0x20000860], 0x0, &(0x7f00000000c0), &(0x7f0000000800)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000001500000000000000000073797a5f74756e00000000000000000079616d30000000000000000000000000626f6e645f736c6176655f310000000073697430000000000000000000000000aaaaaaaaaa000000000000000180c20000000000000000000000e001000018020000600200006c696d697400000000000000000000000000000000000000000000000000000020000000000000000000040001040000000000000000000000000000000000000000000000000000636f6d6d656e74000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006d61726b000000000000000000000000000000000000000000000000000000001000"]}, 0x368) 22:52:37 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r1 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) write(r1, &(0x7f0000000040)="16", 0x1) sendfile(r1, r1, &(0x7f0000001000), 0xffff) r2 = gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(r1, r1, &(0x7f0000000000), 0xffffffff) tkill(r2, 0x1000000000016) 22:52:37 executing program 4: r0 = socket$inet6(0xa, 0x0, 0x200000088) recvfrom$inet6(r0, &(0x7f0000000080)=""/4, 0xffffff28, 0x20, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r2 = socket$inet6(0xa, 0x8000000000000802, 0x88) sendmsg$inet_sctp(r2, &(0x7f0000a29000)={&(0x7f00005dafe4)=@in6={0xa, 0x4e23, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c, &(0x7f0000fc8000)}, 0x0) [ 141.511762] kernel msg: ebtables bug: please report to author: Wrong len argument 22:52:37 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x1d4) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f00000002c0), &(0x7f0000000300)=0x14) 22:52:37 executing program 7: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(tea-generic)\x00'}, 0x58) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000005940)=[{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000001c0)="48107936edbbc8353b1bcef5de3280f2687c2620032770501ef8a908213c16f3b1", 0x21}], 0x1, &(0x7f0000000640)}], 0x1, 0x0) 22:52:37 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x0, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x23, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) 22:52:37 executing program 5: ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socket$key(0xf, 0x3, 0x2) socket$key(0xf, 0x3, 0x2) r0 = socket(0x10, 0x2, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x0, 0x0) sendfile(r0, r1, &(0x7f00000000c0)=0x39, 0x4000000000000003) 22:52:37 executing program 4: r0 = socket$inet6(0xa, 0x3, 0x0) recvfrom$inet6(r0, &(0x7f0000000080)=""/4, 0xffffff28, 0x20, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r2 = socket$inet6(0xa, 0x8000000000000802, 0x88) sendmsg$inet_sctp(r2, &(0x7f0000a29000)={&(0x7f00005dafe4)=@in6={0xa, 0x4e23, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c, &(0x7f0000fc8000)}, 0x0) 22:52:37 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x1, 0x2c1, [0x0, 0x20000800, 0x20000830, 0x20000860], 0x0, &(0x7f00000000c0), &(0x7f0000000800)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000001500000000000000000073797a5f74756e00000000000000000079616d30000000000000000000000000626f6e645f736c6176655f310000000073697430000000000000000000000000aaaaaaaaaa000000000000000180c20000000000000000000000e001000018020000600200006c696d697400000000000000000000000000000000000000000000000000000020000000000000000000040001040000000000000000000000000000000000000000000000000000636f6d6d656e74000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000fdffffff0000000052415445455354000000000000000000000000000000000000"]}, 0x368) [ 141.589469] binder: send failed reply for transaction 109 to 9495:9497 [ 141.598792] binder: undelivered TRANSACTION_COMPLETE [ 141.604107] binder: undelivered TRANSACTION_ERROR: 29189 22:52:38 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x2e4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndtimer(&(0x7f0000000040)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000029fcc)={{0x0, 0x2}}) ioctl$SNDRV_TIMER_IOCTL_STATUS(r0, 0x80605414, &(0x7f0000000100)=""/91) [ 141.708660] kernel msg: ebtables bug: please report to author: Wrong len argument [ 141.779874] binder: send failed reply for transaction 111 to 9516:9523 [ 141.792901] binder: undelivered TRANSACTION_COMPLETE [ 141.798149] binder: undelivered TRANSACTION_ERROR: 29189 22:52:38 executing program 7: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000005940)=[{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000001c0)="48107936edbbc8353b1bcef5de3280f2687c2620032770501ef8a908213c16f3b1", 0x21}], 0x1, &(0x7f0000000640)}], 0x1, 0x0) 22:52:38 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x1d4) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f00000002c0), &(0x7f0000000300)=0x14) 22:52:38 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x0, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x23, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) 22:52:38 executing program 5: ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socket$key(0xf, 0x3, 0x2) socket$key(0xf, 0x3, 0x2) r0 = socket(0x10, 0x2, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x0, 0x0) sendfile(r0, r1, &(0x7f00000000c0)=0x39, 0x4000000000000003) 22:52:38 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r1 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) write(r1, &(0x7f0000000040)="16", 0x1) sendfile(r1, r1, &(0x7f0000001000), 0xffff) r2 = gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(r1, r1, &(0x7f0000000000), 0xffffffff) tkill(r2, 0x1000000000016) 22:52:38 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x2e4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndtimer(&(0x7f0000000040)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000029fcc)) ioctl$SNDRV_TIMER_IOCTL_STATUS(r0, 0x80605414, &(0x7f0000000100)=""/91) 22:52:38 executing program 4: r0 = socket$inet6(0xa, 0x3, 0x0) recvfrom$inet6(r0, &(0x7f0000000080)=""/4, 0xffffff28, 0x20, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r2 = socket$inet6(0xa, 0x8000000000000802, 0x88) sendmsg$inet_sctp(r2, &(0x7f0000a29000)={&(0x7f00005dafe4)=@in6={0xa, 0x4e23, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c, &(0x7f0000fc8000)}, 0x0) 22:52:38 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x1, 0x2d9, [0x0, 0x20000800, 0x20000830, 0x20000860], 0x0, &(0x7f00000000c0), &(0x7f0000000800)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000001500000000000000000073797a5f74756e00000000000000000079616d30000000000000000000000000626f6e645f736c6176655f310000000073697430000000000000000000000000aaaaaaaaaa000000000000000180c20000000000000000000000e001000018020000600200006c696d697400000000000000000000000000000000000000000000000000000020000000000000000000040001040000000000000000000000000000000000000000000000000000636f6d6d656e74000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000fdffffff000000005241544545535400000000000000000000000000000000000000000000000000200000000000000073797a310000000000"]}, 0x368) [ 142.414371] kernel msg: ebtables bug: please report to author: Wrong len argument 22:52:38 executing program 1: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x2e4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndtimer(&(0x7f0000000040)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000029fcc)={{0x0, 0x2}}) ioctl$SNDRV_TIMER_IOCTL_STATUS(0xffffffffffffffff, 0x80605414, &(0x7f0000000100)=""/91) 22:52:38 executing program 7: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") bind$alg(0xffffffffffffffff, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(tea-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r1 = accept$alg(0xffffffffffffffff, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000005940)=[{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000001c0)="48107936edbbc8353b1bcef5de3280f2687c2620032770501ef8a908213c16f3b1", 0x21}], 0x1, &(0x7f0000000640)}], 0x1, 0x0) 22:52:38 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x1d4) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f00000002c0), &(0x7f0000000300)=0x14) 22:52:38 executing program 5: ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socket$key(0xf, 0x3, 0x2) socket$key(0xf, 0x3, 0x2) r0 = socket(0x10, 0x2, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x0, 0x0) sendfile(r0, r1, &(0x7f00000000c0)=0x39, 0x4000000000000003) 22:52:38 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x0, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x23, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) 22:52:38 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x1, 0x2e5, [0x0, 0x20000800, 0x20000830, 0x20000860], 0x0, &(0x7f00000000c0), &(0x7f0000000800)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000001500000000000000000073797a5f74756e00000000000000000079616d30000000000000000000000000626f6e645f736c6176655f310000000073697430000000000000000000000000aaaaaaaaaa000000000000000180c20000000000000000000000e001000018020000600200006c696d697400000000000000000000000000000000000000000000000000000020000000000000000000040001040000000000000000000000000000000000000000000000000000636f6d6d656e74000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000fdffffff000000005241544545535400000000000000000000000000000000000000000000000000200000000000000073797a310000000000000000000000000000000000"]}, 0x368) 22:52:38 executing program 4: r0 = socket$inet6(0xa, 0x3, 0x0) recvfrom$inet6(r0, &(0x7f0000000080)=""/4, 0xffffff28, 0x20, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r2 = socket$inet6(0xa, 0x8000000000000802, 0x88) sendmsg$inet_sctp(r2, &(0x7f0000a29000)={&(0x7f00005dafe4)=@in6={0xa, 0x4e23, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c, &(0x7f0000fc8000)}, 0x0) [ 142.486354] binder: send failed reply for transaction 113 to 9546:9549 [ 142.502303] binder: undelivered TRANSACTION_COMPLETE [ 142.507604] binder: undelivered TRANSACTION_ERROR: 29189 [ 142.640690] kernel msg: ebtables bug: please report to author: Wrong len argument [ 142.711367] binder: send failed reply for transaction 115 to 9573:9578 [ 142.722155] binder: undelivered TRANSACTION_COMPLETE [ 142.727412] binder: undelivered TRANSACTION_ERROR: 29189 22:52:39 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r1, &(0x7f0000000140)={0xa}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f00000002c0), &(0x7f0000000300)=0x14) 22:52:39 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r1 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) write(r1, &(0x7f0000000040)="16", 0x1) sendfile(r1, r1, &(0x7f0000001000), 0xffff) r2 = gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(r1, r1, &(0x7f0000000000), 0xffffffff) tkill(r2, 0x1000000000016) 22:52:39 executing program 5: r0 = socket$inet6(0xa, 0x0, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socket$key(0xf, 0x3, 0x2) socket$key(0xf, 0x3, 0x2) r1 = socket(0x10, 0x2, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x0, 0x0) sendfile(r1, r2, &(0x7f00000000c0)=0x39, 0x4000000000000003) 22:52:39 executing program 7: socket$inet6(0xa, 0x2, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(tea-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000005940)=[{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000001c0)="48107936edbbc8353b1bcef5de3280f2687c2620032770501ef8a908213c16f3b1", 0x21}], 0x1, &(0x7f0000000640)}], 0x1, 0x0) 22:52:39 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$packet(0x11, 0x2, 0x300) r2 = dup2(r1, r1) r3 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r3, 0x0, 0x80, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x1, 0x2f0, [0x0, 0x20000800, 0x20000830, 0x20000860], 0x0, &(0x7f00000000c0), &(0x7f0000000800)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0x15, 0x0, 0x0, 'syz_tun\x00', 'yam0\x00', 'bond_slave_1\x00', 'sit0\x00', @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, [], @link_local={0x1, 0x80, 0xc2}, [], 0x1e0, 0x218, 0x260, [@limit={'limit\x00', 0x20, {{0x0, 0x401}}}, @comment={'comment\x00', 0x100}]}, [@common=@mark={'mark\x00', 0x10, {{0x0, 0xfffffffffffffffd}}}]}, @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00'}}}}]}]}, 0x368) sendto$inet6(r2, &(0x7f0000000040), 0x0, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x3, @dev={0xfe, 0x80}}, 0x1c) 22:52:39 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x23, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) 22:52:39 executing program 4: r0 = socket$inet6(0xa, 0x3, 0x200000088) recvfrom$inet6(0xffffffffffffffff, &(0x7f0000000080)=""/4, 0xffffff28, 0x20, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r2 = socket$inet6(0xa, 0x8000000000000802, 0x88) sendmsg$inet_sctp(r2, &(0x7f0000a29000)={&(0x7f00005dafe4)=@in6={0xa, 0x4e23, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c, &(0x7f0000fc8000)}, 0x0) 22:52:39 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x1, 0x2eb, [0x0, 0x20000800, 0x20000830, 0x20000860], 0x0, &(0x7f00000000c0), &(0x7f0000000800)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000001500000000000000000073797a5f74756e00000000000000000079616d30000000000000000000000000626f6e645f736c6176655f310000000073697430000000000000000000000000aaaaaaaaaa000000000000000180c20000000000000000000000e001000018020000600200006c696d697400000000000000000000000000000000000000000000000000000020000000000000000000040001040000000000000000000000000000000000000000000000000000636f6d6d656e74000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000fdffffff000000005241544545535400000000000000000000000000000000000000000000000000200000000000000073797a310000000000000000000000000000000000000000000000"]}, 0x368) 22:52:39 executing program 7: socket$inet6(0xa, 0x2, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(tea-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000005940)=[{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000001c0)="48107936edbbc8353b1bcef5de3280f2687c2620032770501ef8a908213c16f3b1", 0x21}], 0x1, &(0x7f0000000640)}], 0x1, 0x0) [ 143.331970] kernel msg: ebtables bug: please report to author: Wrong len argument 22:52:39 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x1, 0x2ee, [0x0, 0x20000800, 0x20000830, 0x20000860], 0x0, &(0x7f00000000c0), &(0x7f0000000800)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000001500000000000000000073797a5f74756e00000000000000000079616d30000000000000000000000000626f6e645f736c6176655f310000000073697430000000000000000000000000aaaaaaaaaa000000000000000180c20000000000000000000000e001000018020000600200006c696d697400000000000000000000000000000000000000000000000000000020000000000000000000040001040000000000000000000000000000000000000000000000000000636f6d6d656e74000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000fdffffff000000005241544545535400000000000000000000000000000000000000000000000000200000000000000073797a310000000000000000000000000000000000000000000000000000"]}, 0x368) 22:52:39 executing program 4: r0 = socket$inet6(0xa, 0x3, 0x200000088) recvfrom$inet6(0xffffffffffffffff, &(0x7f0000000080)=""/4, 0xffffff28, 0x20, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r2 = socket$inet6(0xa, 0x8000000000000802, 0x88) sendmsg$inet_sctp(r2, &(0x7f0000a29000)={&(0x7f00005dafe4)=@in6={0xa, 0x4e23, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c, &(0x7f0000fc8000)}, 0x0) 22:52:39 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x23, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) 22:52:39 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x1d4) connect$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f00000002c0), &(0x7f0000000300)=0x14) 22:52:39 executing program 5: r0 = socket$inet6(0xa, 0x0, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socket$key(0xf, 0x3, 0x2) socket$key(0xf, 0x3, 0x2) r1 = socket(0x10, 0x2, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x0, 0x0) sendfile(r1, r2, &(0x7f00000000c0)=0x39, 0x4000000000000003) 22:52:39 executing program 1: rt_sigprocmask(0x0, &(0x7f0000039ff8)={0xfffffffffffffffa}, 0x0, 0x8) r0 = socket$inet6(0xa, 0x802, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = getpgrp(0x0) r2 = gettid() rt_tgsigqueueinfo(r1, r2, 0x20, &(0x7f0000000080)={0x0, 0x0, 0x1}) [ 143.431514] binder: send failed reply for transaction 117 to 9596:9608 [ 143.446674] binder: undelivered TRANSACTION_COMPLETE [ 143.451932] binder: undelivered TRANSACTION_ERROR: 29189 [ 143.499824] kernel msg: ebtables bug: please report to author: Wrong len argument 22:52:39 executing program 7: socket$inet6(0xa, 0x2, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(tea-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000005940)=[{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000001c0)="48107936edbbc8353b1bcef5de3280f2687c2620032770501ef8a908213c16f3b1", 0x21}], 0x1, &(0x7f0000000640)}], 0x1, 0x0) 22:52:39 executing program 5: r0 = socket$inet6(0xa, 0x0, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socket$key(0xf, 0x3, 0x2) socket$key(0xf, 0x3, 0x2) r1 = socket(0x10, 0x2, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x0, 0x0) sendfile(r1, r2, &(0x7f00000000c0)=0x39, 0x4000000000000003) [ 143.638198] binder: send failed reply for transaction 119 to 9631:9632 [ 143.652634] binder: undelivered TRANSACTION_COMPLETE [ 143.657830] binder: undelivered TRANSACTION_ERROR: 29189 22:52:40 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x23, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) 22:52:40 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x1, 0x2ef, [0x0, 0x20000800, 0x20000830, 0x20000860], 0x0, &(0x7f00000000c0), &(0x7f0000000800)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000001500000000000000000073797a5f74756e00000000000000000079616d30000000000000000000000000626f6e645f736c6176655f310000000073697430000000000000000000000000aaaaaaaaaa000000000000000180c20000000000000000000000e001000018020000600200006c696d697400000000000000000000000000000000000000000000000000000020000000000000000000040001040000000000000000000000000000000000000000000000000000636f6d6d656e74000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000fdffffff000000005241544545535400000000000000000000000000000000000000000000000000200000000000000073797a31000000000000000000000000000000000000000000000000000000"]}, 0x368) 22:52:40 executing program 7: ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(tea-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000005940)=[{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000001c0)="48107936edbbc8353b1bcef5de3280f2687c2620032770501ef8a908213c16f3b1", 0x21}], 0x1, &(0x7f0000000640)}], 0x1, 0x0) 22:52:40 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r1 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) write(r1, &(0x7f0000000040)="16", 0x1) sendfile(r1, r1, &(0x7f0000001000), 0xffff) r2 = gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(r1, r1, &(0x7f0000000000), 0xffffffff) tkill(r2, 0x1000000000016) 22:52:40 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socket$key(0xf, 0x3, 0x2) socket$key(0xf, 0x3, 0x2) r1 = socket(0x10, 0x2, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x0, 0x0) sendfile(r1, r2, &(0x7f00000000c0)=0x39, 0x4000000000000003) 22:52:40 executing program 4: r0 = socket$inet6(0xa, 0x3, 0x200000088) recvfrom$inet6(0xffffffffffffffff, &(0x7f0000000080)=""/4, 0xffffff28, 0x20, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r2 = socket$inet6(0xa, 0x8000000000000802, 0x88) sendmsg$inet_sctp(r2, &(0x7f0000a29000)={&(0x7f00005dafe4)=@in6={0xa, 0x4e23, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c, &(0x7f0000fc8000)}, 0x0) 22:52:40 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000040)="415ee1311f16f477671070") gettid() timer_create(0x0, &(0x7f0000044000), &(0x7f0000044000)) r1 = memfd_create(&(0x7f0000000300)="0000000010573860b48e03ab0b8110408d893dac540318386fc7e2d740bd31e757e1ae2e3d919d036f2e3d2a17abca4287afd240c0f4b24d623af9f16312755a71654bf931e5704191541d13f5762dadc275e112a8030bf0621fa161bc744923b22b21b6ababbc86cdc1e0a0569fbd31345e7978c3c7175089f36fc12006e0575ef969c45e8fb854b36f9a3319fb30c0a76fe0f7a3ccb89b7c7bbede0de110c40d2ed349c687122fa098892b87a16cc3540fdf9cb289a4509aaddcb1e389bf2239dcd6c886587dcefea2204935721c83bacd0f177f5f229407ced0623ac9e98abb967cf5fd5b867eb063f3ba1e0e046aeb0da0312d171f4aa734acc712e6f7273a832227698f5c25fc87f25e961c3fdc9d4e0f2a1ec6a0ef46662046e9ff54f225e07b831d6bc401043f360748cdbb1e750d1d3de8f0b8bddb94362933c22f69bc71c1d69edc4c49f191925f48b6c41c1fd5deebe6981ea2b653f17d8ead11da91fdc4f377722ce6332852d3101c063105191e585ba7cbd3fe352a3e1889c84f626500000000ff2e70", 0x0) write(0xffffffffffffffff, &(0x7f0000000040)="16", 0x1) sendfile(r1, r1, &(0x7f0000001000), 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, &(0x7f00000005c0)={0x0, @in6={{0xa, 0x0, 0x4, @remote={0xfe, 0x80, [], 0xbb}, 0x5}}}, &(0x7f00000002c0)=0x84) fcntl$addseals(r1, 0x409, 0x8) fsetxattr(r1, &(0x7f0000000000)=@known='system.posix_acl_access\x00', &(0x7f0000000080)="02000000b2de30925a1d964243791761ef9e39fb6ca87aac88e2eca883369ed56870d13d9b4ead92a681770568e16fd47240f2", 0x4, 0x0) 22:52:40 executing program 3: socket$inet6(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x1d4) connect$inet6(r0, &(0x7f0000000140)={0xa}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), &(0x7f0000000300)=0x14) 22:52:40 executing program 7: ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(tea-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000005940)=[{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000001c0)="48107936edbbc8353b1bcef5de3280f2687c2620032770501ef8a908213c16f3b1", 0x21}], 0x1, &(0x7f0000000640)}], 0x1, 0x0) [ 144.239369] kernel msg: ebtables bug: please report to author: Wrong len argument 22:52:40 executing program 3: socket$inet6(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x1d4) connect$inet6(r0, &(0x7f0000000140)={0xa}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), &(0x7f0000000300)=0x14) 22:52:40 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x23, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) 22:52:40 executing program 1: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f0000000100)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000010000)="eb3c906d6b66732e66617400020401000200027000f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) umount2(&(0x7f00000001c0)='./file0\x00', 0x0) 22:52:40 executing program 4: r0 = socket$inet6(0xa, 0x3, 0x200000088) recvfrom$inet6(r0, &(0x7f0000000080)=""/4, 0xffffff28, 0x0, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r2 = socket$inet6(0xa, 0x8000000000000802, 0x88) sendmsg$inet_sctp(r2, &(0x7f0000a29000)={&(0x7f00005dafe4)=@in6={0xa, 0x4e23, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c, &(0x7f0000fc8000)}, 0x0) 22:52:40 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socket$key(0xf, 0x3, 0x2) socket$key(0xf, 0x3, 0x2) r1 = socket(0x10, 0x2, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x0, 0x0) sendfile(r1, r2, &(0x7f00000000c0)=0x39, 0x4000000000000003) [ 144.306332] binder: send failed reply for transaction 121 to 9663:9665 [ 144.318997] binder: undelivered TRANSACTION_COMPLETE [ 144.324288] binder: undelivered TRANSACTION_ERROR: 29189 22:52:40 executing program 0: preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f00000004c0)=""/148, 0x1bf}], 0x1b6, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip_mr_cache\x00') preadv(r0, &(0x7f0000000480)=[{&(0x7f0000000380)=""/242, 0xf2}], 0x1, 0x10400003) 22:52:40 executing program 7: ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(tea-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000005940)=[{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000001c0)="48107936edbbc8353b1bcef5de3280f2687c2620032770501ef8a908213c16f3b1", 0x21}], 0x1, &(0x7f0000000640)}], 0x1, 0x0) 22:52:40 executing program 3: socket$inet6(0xa, 0x1, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x1d4) connect$inet6(r0, &(0x7f0000000140)={0xa}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), &(0x7f0000000300)=0x14) [ 144.474855] binder: send failed reply for transaction 123 to 9689:9690 [ 144.491774] binder: undelivered TRANSACTION_COMPLETE [ 144.497076] binder: undelivered TRANSACTION_ERROR: 29189 22:52:41 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x23, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) 22:52:41 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socket$key(0xf, 0x3, 0x2) socket$key(0xf, 0x3, 0x2) r1 = socket(0x10, 0x2, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x0, 0x0) sendfile(r1, r2, &(0x7f00000000c0)=0x39, 0x4000000000000003) 22:52:41 executing program 0: perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x3, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setrlimit(0x2, &(0x7f0000000040)) setrlimit(0x0, &(0x7f0000000080)) 22:52:41 executing program 1: r0 = syz_open_dev$evdev(&(0x7f0000dfdfee)='/dev/input/event#\x00', 0x34a, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$EVIOCGKEYCODE(r0, 0x80084504, &(0x7f0000000000)=""/116) 22:52:41 executing program 7: r0 = socket$inet6(0xa, 0x0, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(tea-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000005940)=[{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000001c0)="48107936edbbc8353b1bcef5de3280f2687c2620032770501ef8a908213c16f3b1", 0x21}], 0x1, &(0x7f0000000640)}], 0x1, 0x0) 22:52:41 executing program 3: ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x1d4) connect$inet6(r0, &(0x7f0000000140)={0xa}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), &(0x7f0000000300)=0x14) 22:52:41 executing program 4: r0 = socket$inet6(0xa, 0x3, 0x200000088) recvfrom$inet6(r0, &(0x7f0000000080)=""/4, 0xffffff28, 0x0, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r2 = socket$inet6(0xa, 0x8000000000000802, 0x88) sendmsg$inet_sctp(r2, &(0x7f0000a29000)={&(0x7f00005dafe4)=@in6={0xa, 0x4e23, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c, &(0x7f0000fc8000)}, 0x0) 22:52:41 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r1 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) write(r1, &(0x7f0000000040)="16", 0x1) sendfile(r1, r1, &(0x7f0000001000), 0xffff) r2 = gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(r1, r1, &(0x7f0000000000), 0xffffffff) tkill(r2, 0x1000000000016) [ 145.201258] mmap: syz-executor0 (9727): VmData 18522112 exceed data ulimit 0. Update limits or use boot option ignore_rlimit_data. 22:52:41 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x23, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) 22:52:41 executing program 3: ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x1d4) connect$inet6(r0, &(0x7f0000000140)={0xa}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), &(0x7f0000000300)=0x14) 22:52:41 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") setsockopt$inet6_group_source_req(r0, 0x29, 0x2c, &(0x7f0000000140)={0x0, {{0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x1, [], 0x1}}}}, 0x108) 22:52:41 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") socket$key(0xf, 0x3, 0x2) socket$key(0xf, 0x3, 0x2) r1 = socket(0x10, 0x2, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x0, 0x0) sendfile(r1, r2, &(0x7f00000000c0)=0x39, 0x4000000000000003) [ 145.254596] binder: send failed reply for transaction 125 to 9719:9720 [ 145.265214] binder: undelivered TRANSACTION_COMPLETE [ 145.270495] binder: undelivered TRANSACTION_ERROR: 29189 22:52:41 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6(0xa, 0x80001, 0x0) getsockopt$bt_hci(r1, 0x0, 0x63, &(0x7f00001e3000)=""/30, &(0x7f0000d23000)=0x1e) 22:52:41 executing program 7: r0 = socket$inet6(0xa, 0x0, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(tea-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000005940)=[{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000001c0)="48107936edbbc8353b1bcef5de3280f2687c2620032770501ef8a908213c16f3b1", 0x21}], 0x1, &(0x7f0000000640)}], 0x1, 0x0) 22:52:41 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x1, 0x2f0, [0x0, 0x20000800, 0x20000830, 0x20000860], 0x0, &(0x7f00000000c0), &(0x7f0000000800)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000001500000000000000000073797a5f74756e00000000000000000079616d30000000000000000000000000626f6e645f736c6176655f310000000073697430000000000000000000000000aaaaaaaaaa000000000000000180c20000000000000000000000e001000018020000600200006c696d697400000000000000000000000000000000000000000000000000000020000000000000000000040001040000000000000000000000000000000000000000000000000000636f6d6d656e74000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000fdffffff000000005241544545535400000000000000000000000000000000000000000000000000200000000000000073797a3100000000000000000000000000000000000000000000000000000000"]}, 0x368) sendto$inet6(0xffffffffffffffff, &(0x7f0000000040), 0x0, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x1c) [ 145.432625] binder: send failed reply for transaction 127 to 9741:9747 [ 145.443803] binder: undelivered TRANSACTION_COMPLETE [ 145.449005] binder: undelivered TRANSACTION_ERROR: 29189 22:52:42 executing program 3: ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x1d4) connect$inet6(r0, &(0x7f0000000140)={0xa}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000002c0), &(0x7f0000000300)=0x14) 22:52:42 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r1 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) write(r1, &(0x7f0000000040)="16", 0x1) sendfile(r1, r1, &(0x7f0000001000), 0xffff) r2 = gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(r1, r1, &(0x7f0000000000), 0xffffffff) tkill(r2, 0x1000000000016) 22:52:42 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f47767") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x23, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) 22:52:42 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") socket$key(0xf, 0x3, 0x2) socket$key(0xf, 0x3, 0x2) r1 = socket(0x10, 0x2, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x0, 0x0) sendfile(r1, r2, &(0x7f00000000c0)=0x39, 0x4000000000000003) 22:52:42 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f000065ffa8)={0x26, 'hash\x00', 0x0, 0x0, 'vmac(aes-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000100)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg(r2, &(0x7f0000002380)=[{{&(0x7f0000000140)=@pptp={0x18, 0x2, {0x0, @multicast2=0xe0000002}}, 0x80, &(0x7f0000000440)=[{&(0x7f0000000280)="d853b1643bdf52b13ec2d708dd941890ecd6498812657b80110bf1f9c1ec77fd81b6cd3b21fbac3302f3bfb915c2e1d86305900aa44afaafad3642afc36869254592f79774dfb9a6caacef0bf9cf728a0d1b1d", 0x53}], 0x1, 0x0, 0x0, 0x4044080}, 0x3}, {{&(0x7f00000004c0)=@un=@file={0x1, './file0\x00'}, 0x80, &(0x7f0000000600)=[{&(0x7f0000000540)="6b7160cfd55f84b00de9038a4e045ac8f23dbcc77dc9dd751552144aab5f2dddbbff94bbdfd0f43e99aeb22b7500be20c846f36c3ff1309febcf350732891e18cdf5a875f8539d82472c65b8190ee3ea63d7c0bfac68b928918e4f7f9f4f28444b525138f9f499c68fb2c176381df95d330a9eb7cd689f997311851c37b428eb3161285f11b60384f697b5a86e8c04c37d07c4d60ebe", 0x96}], 0x1, &(0x7f00000026c0)=[{0xf0, 0x0, 0x7, "9d8105f7f7005104b99d2d04a80422ae17daa439bc2b32e46b29d8089b938c4219c5be1a959e16582d7caaf46c2ab58e9d5176ceeacd127855130cf22d9ce034137531383fd34f77e5a87feae9ee1eaddd1aa3fa12a535aeb47778f7397cdda53c840836bf26ab0fab4591b43ee5fb35651e2232c397ad40a356486dd6b3dc3ba0ccca0eaace3369712731ecc17bc866eddf92407bdf937bbe69c01c76f63a129830d2471fb00e792d98d487e10eaef299958d30654332cf5ed7be328b07accb7f657e89fab2c828c7c413439987c4cac76a645049d0a37decee8a9a"}], 0xf0, 0x4000000}, 0x7fffffff}, {{0x0, 0x0, &(0x7f0000001040)=[{&(0x7f0000000f40)="b62ce676090e5bf7dff8e18f43d00c63e355e5aac7e58d84d90b37ce71af0d279db0f082c8bb2190bee7caf5835e7424805ae1fdd4d8d3d4a1aa0a8d0874019c3c814b387c8655f88dadcaf401b139", 0x4f}], 0x1, &(0x7f0000001080)=[{0x78, 0x0, 0x101, "07ef55134c74a8f4f4126ba45483b1bb330ec894782d3888e24efa2ea5c2a7b4a0001bab8dc07cf4daabfb6456c60cf1c19635663d390957a0f19048799cc4f04900d2d1635fc22f5c9918053827c61277da44a0c1df3e5f13dd56dea86b24765fcd78e390e345"}], 0x78}, 0x1}], 0x3, 0x20040000) 22:52:42 executing program 1: futex(&(0x7f000000cffc)=0x4, 0x0, 0x4, &(0x7f0000852ff8)={0x77359400}, &(0x7f0000000040), 0x0) perf_event_open(&(0x7f000001d000)={0x200000002, 0x70, 0x0, 0x108000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x0) semtimedop(0x0, &(0x7f00000002c0)=[{}, {0x0, 0x9}], 0x2, &(0x7f0000000300)={0x0, 0x1c9c380}) ioctl(r0, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") 22:52:42 executing program 4: r0 = socket$inet6(0xa, 0x3, 0x200000088) recvfrom$inet6(r0, &(0x7f0000000080)=""/4, 0xffffff28, 0x0, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r2 = socket$inet6(0xa, 0x8000000000000802, 0x88) sendmsg$inet_sctp(r2, &(0x7f0000a29000)={&(0x7f00005dafe4)=@in6={0xa, 0x4e23, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c, &(0x7f0000fc8000)}, 0x0) 22:52:42 executing program 7: r0 = socket$inet6(0xa, 0x0, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(tea-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000005940)=[{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000001c0)="48107936edbbc8353b1bcef5de3280f2687c2620032770501ef8a908213c16f3b1", 0x21}], 0x1, &(0x7f0000000640)}], 0x1, 0x0) 22:52:42 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f47767") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x23, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) 22:52:42 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") socket$key(0xf, 0x3, 0x2) socket$key(0xf, 0x3, 0x2) r1 = socket(0x10, 0x2, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x0, 0x0) sendfile(r1, r2, &(0x7f00000000c0)=0x39, 0x4000000000000003) 22:52:42 executing program 3: r0 = socket$inet6(0xa, 0x0, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x1d4) connect$inet6(r1, &(0x7f0000000140)={0xa}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f00000002c0), &(0x7f0000000300)=0x14) [ 146.127515] binder: send failed reply for transaction 129 to 9777:9780 [ 146.139566] binder: undelivered TRANSACTION_COMPLETE [ 146.144797] binder: undelivered TRANSACTION_ERROR: 29189 22:52:42 executing program 0: r0 = socket(0x11, 0x80002, 0x0) ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f0000000040)={0x0, {0x2, 0x0, @rand_addr}, {0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, {0x2, 0x0, @rand_addr}, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)='bridge0\x00'}) 22:52:42 executing program 7: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(tea-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000005940)=[{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000001c0)="48107936edbbc8353b1bcef5de3280f2687c2620032770501ef8a908213c16f3b1", 0x21}], 0x1, &(0x7f0000000640)}], 0x1, 0x0) 22:52:42 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)) socket$key(0xf, 0x3, 0x2) socket$key(0xf, 0x3, 0x2) r1 = socket(0x10, 0x2, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x0, 0x0) sendfile(r1, r2, &(0x7f00000000c0)=0x39, 0x4000000000000003) 22:52:42 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f47767") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x23, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) [ 146.294133] binder: send failed reply for transaction 131 to 9799:9800 [ 146.326837] binder: undelivered TRANSACTION_COMPLETE [ 146.332098] binder: undelivered TRANSACTION_ERROR: 29189 [ 146.405217] binder: send failed reply for transaction 133 to 9816:9817 [ 146.412596] binder: undelivered TRANSACTION_COMPLETE [ 146.417842] binder: undelivered TRANSACTION_ERROR: 29189 22:52:43 executing program 3: r0 = socket$inet6(0xa, 0x0, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x1d4) connect$inet6(r1, &(0x7f0000000140)={0xa}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f00000002c0), &(0x7f0000000300)=0x14) 22:52:43 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") sendto$inet6(r0, &(0x7f0000000140), 0x0, 0x0, &(0x7f0000000040)={0xa, 0x4e24, 0x0, @local={0xfe, 0x80, [], 0xaa}, 0x80000000}, 0x1c) 22:52:43 executing program 7: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(tea-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000005940)=[{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000001c0)="48107936edbbc8353b1bcef5de3280f2687c2620032770501ef8a908213c16f3b1", 0x21}], 0x1, &(0x7f0000000640)}], 0x1, 0x0) 22:52:43 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f4776710") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x23, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) 22:52:43 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)) socket$key(0xf, 0x3, 0x2) socket$key(0xf, 0x3, 0x2) r1 = socket(0x10, 0x2, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x0, 0x0) sendfile(r1, r2, &(0x7f00000000c0)=0x39, 0x4000000000000003) 22:52:43 executing program 4: r0 = socket$inet6(0xa, 0x3, 0x200000088) recvfrom$inet6(r0, &(0x7f0000000080)=""/4, 0xffffff28, 0x20, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) r1 = socket$inet6(0xa, 0x0, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r2 = socket$inet6(0xa, 0x8000000000000802, 0x88) sendmsg$inet_sctp(r2, &(0x7f0000a29000)={&(0x7f00005dafe4)=@in6={0xa, 0x4e23, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c, &(0x7f0000fc8000)}, 0x0) 22:52:43 executing program 1: r0 = socket$inet6(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x200000002, 0x70, 0x5, 0x108000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg(r0, &(0x7f00000001c0)={&(0x7f0000000080)=@nl=@kern={0x10}, 0x80, &(0x7f0000002000)=[{&(0x7f0000000100)="550000001e007f5300fe01b2a4a280930a06000000a8430891000000080008000a000c0000dc1338d54400009b84136ef75afb83de448daa7227c43ab8220000060cec4fab91d40000000000000000000000000000", 0x55}], 0x1, &(0x7f0000000400)}, 0x0) 22:52:43 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") timer_create(0x0, &(0x7f0000044000), &(0x7f0000044000)) r1 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) write(r1, &(0x7f0000000040)="16", 0x1) sendfile(r1, r1, &(0x7f0000001000), 0xffff) r2 = gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(r1, r1, &(0x7f0000000000), 0xffffffff) tkill(r2, 0x1000000000016) 22:52:43 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)) socket$key(0xf, 0x3, 0x2) socket$key(0xf, 0x3, 0x2) r1 = socket(0x10, 0x2, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x0, 0x0) sendfile(r1, r2, &(0x7f00000000c0)=0x39, 0x4000000000000003) 22:52:43 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") shmctl$SHM_STAT(0x0, 0xd, &(0x7f0000000000)=""/99) 22:52:43 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f4776710") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x23, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) [ 147.227768] netlink: 49 bytes leftover after parsing attributes in process `syz-executor1'. [ 147.248998] binder: send failed reply for transaction 135 to 9837:9845 [ 147.262759] binder: undelivered TRANSACTION_COMPLETE [ 147.268078] binder: undelivered TRANSACTION_ERROR: 29189 22:52:43 executing program 7: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(tea-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000005940)=[{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000001c0)="48107936edbbc8353b1bcef5de3280f2687c2620032770501ef8a908213c16f3b1", 0x21}], 0x1, &(0x7f0000000640)}], 0x1, 0x0) 22:52:43 executing program 3: r0 = socket$inet6(0xa, 0x0, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x1d4) connect$inet6(r1, &(0x7f0000000140)={0xa}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f00000002c0), &(0x7f0000000300)=0x14) [ 147.278330] netlink: 49 bytes leftover after parsing attributes in process `syz-executor1'. 22:52:43 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16") socket$key(0xf, 0x3, 0x2) socket$key(0xf, 0x3, 0x2) r1 = socket(0x10, 0x2, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x0, 0x0) sendfile(r1, r2, &(0x7f00000000c0)=0x39, 0x4000000000000003) 22:52:43 executing program 0: r0 = socket(0x11, 0xa, 0x0) r1 = syz_open_dev$tun(&(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0xa01) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={"6966623000faffffffffffffff00", 0x4fff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'ifb0\x00', 0xa201}) r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r2, 0x88200) sendfile(r1, r2, &(0x7f0000d83ff8), 0x8000fffffffe) futex(&(0x7f0000000ffc)=0x200000000002, 0x0, 0x0, &(0x7f0000fd3ff0)={0x77359400}, &(0x7f0000000ffc), 0x0) 22:52:43 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f4776710") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x23, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) 22:52:43 executing program 1: perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x3, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = gettid() process_vm_readv(r0, &(0x7f0000000140), 0x0, &(0x7f0000001400), 0x0, 0x0) [ 147.388774] binder: send failed reply for transaction 137 to 9856:9861 [ 147.399226] binder: undelivered TRANSACTION_COMPLETE [ 147.404470] binder: undelivered TRANSACTION_ERROR: 29189 [ 147.507415] binder: send failed reply for transaction 139 to 9877:9879 [ 147.517810] binder: undelivered TRANSACTION_COMPLETE [ 147.523110] binder: undelivered TRANSACTION_ERROR: 29189 22:52:44 executing program 7: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl(r0, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(tea-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000005940)=[{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000001c0)="48107936edbbc8353b1bcef5de3280f2687c2620032770501ef8a908213c16f3b1", 0x21}], 0x1, &(0x7f0000000640)}], 0x1, 0x0) 22:52:44 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000003c0)={0x23, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) 22:52:44 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x1d4) connect$inet6(r1, &(0x7f0000000140)={0xa}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f00000002c0), &(0x7f0000000300)=0x14) 22:52:44 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16") socket$key(0xf, 0x3, 0x2) socket$key(0xf, 0x3, 0x2) r1 = socket(0x10, 0x2, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x0, 0x0) sendfile(r1, r2, &(0x7f00000000c0)=0x39, 0x4000000000000003) 22:52:44 executing program 1: r0 = socket$inet6(0xa, 0x2000000000001, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000687000)=0x9, 0x135) bind$inet6(r0, &(0x7f0000402000)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r0, &(0x7f00007a8fff), 0x0, 0x20000000, &(0x7f0000f62fe4)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) 22:52:44 executing program 4: r0 = socket$inet6(0xa, 0x3, 0x200000088) recvfrom$inet6(r0, &(0x7f0000000080)=""/4, 0xffffff28, 0x20, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) r1 = socket$inet6(0xa, 0x0, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r2 = socket$inet6(0xa, 0x8000000000000802, 0x88) sendmsg$inet_sctp(r2, &(0x7f0000a29000)={&(0x7f00005dafe4)=@in6={0xa, 0x4e23, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c, &(0x7f0000fc8000)}, 0x0) 22:52:44 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") timer_create(0x0, &(0x7f0000044000), &(0x7f0000044000)) r1 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) write(r1, &(0x7f0000000040)="16", 0x1) sendfile(r1, r1, &(0x7f0000001000), 0xffff) r2 = gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(r1, r1, &(0x7f0000000000), 0xffffffff) tkill(r2, 0x1000000000016) 22:52:44 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000001440)={&(0x7f0000000000)={0x10}, 0xc, &(0x7f0000001400)={&(0x7f0000000200)=@allocspi={0xf8, 0x16, 0x801, 0x0, 0x0, {{{@in=@multicast1=0xe0000001, @in=@loopback=0x7f000001}, {@in, 0x0, 0x32}, @in=@multicast2=0xe0000002}}}, 0xf8}, 0x1}, 0x0) 22:52:44 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000003c0)={0x23, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) 22:52:44 executing program 7: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl(r0, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(tea-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000005940)=[{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000001c0)="48107936edbbc8353b1bcef5de3280f2687c2620032770501ef8a908213c16f3b1", 0x21}], 0x1, &(0x7f0000000640)}], 0x1, 0x0) 22:52:44 executing program 0: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount(&(0x7f0000000100)='./file0\x00', &(0x7f00000002c0)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, &(0x7f0000000280)) execve(&(0x7f0000000040)='./file0\x00', &(0x7f0000000180), &(0x7f0000000300)) 22:52:44 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16") socket$key(0xf, 0x3, 0x2) socket$key(0xf, 0x3, 0x2) r1 = socket(0x10, 0x2, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x0, 0x0) sendfile(r1, r2, &(0x7f00000000c0)=0x39, 0x4000000000000003) 22:52:44 executing program 1: perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x3, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setrlimit(0x100000000000000, &(0x7f0000000080)) 22:52:44 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x1d4) connect$inet6(r1, &(0x7f0000000140)={0xa}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f00000002c0), &(0x7f0000000300)=0x14) 22:52:45 executing program 7: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl(r0, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(tea-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000005940)=[{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000001c0)="48107936edbbc8353b1bcef5de3280f2687c2620032770501ef8a908213c16f3b1", 0x21}], 0x1, &(0x7f0000000640)}], 0x1, 0x0) 22:52:45 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000003c0)={0x23, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\n\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) 22:52:45 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") socket$key(0xf, 0x3, 0x2) socket$key(0xf, 0x3, 0x2) r1 = socket(0x10, 0x2, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x0, 0x0) sendfile(r1, r2, &(0x7f00000000c0)=0x39, 0x4000000000000003) 22:52:46 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") timer_create(0x0, &(0x7f0000044000), &(0x7f0000044000)) r1 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) write(r1, &(0x7f0000000040)="16", 0x1) sendfile(r1, r1, &(0x7f0000001000), 0xffff) r2 = gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(r1, r1, &(0x7f0000000000), 0xffffffff) tkill(r2, 0x1000000000016) 22:52:46 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f00000000c0)={"6c6f3a0500", {0x2, 0x0, @dev={0xac, 0x14, 0x14}}}) 22:52:46 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000280)=ANY=[@ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) 22:52:46 executing program 1: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f00000012c0)='./cgroup/syz1\x00', 0x1ff) 22:52:46 executing program 7: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(tea-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000005940)=[{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000001c0)="48107936edbbc8353b1bcef5de3280f2687c2620032770501ef8a908213c16f3b1", 0x21}], 0x1, &(0x7f0000000640)}], 0x1, 0x0) 22:52:46 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") socket$key(0xf, 0x3, 0x2) socket$key(0xf, 0x3, 0x2) r1 = socket(0x10, 0x2, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x0, 0x0) sendfile(r1, r2, &(0x7f00000000c0)=0x39, 0x4000000000000003) 22:52:46 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x1d4) connect$inet6(r1, &(0x7f0000000140)={0xa}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f00000002c0), &(0x7f0000000300)=0x14) 22:52:46 executing program 4: r0 = socket$inet6(0xa, 0x3, 0x200000088) recvfrom$inet6(r0, &(0x7f0000000080)=""/4, 0xffffff28, 0x20, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) r1 = socket$inet6(0xa, 0x0, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r2 = socket$inet6(0xa, 0x8000000000000802, 0x88) sendmsg$inet_sctp(r2, &(0x7f0000a29000)={&(0x7f00005dafe4)=@in6={0xa, 0x4e23, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c, &(0x7f0000fc8000)}, 0x0) 22:52:46 executing program 7: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(tea-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000005940)=[{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000001c0)="48107936edbbc8353b1bcef5de3280f2687c2620032770501ef8a908213c16f3b1", 0x21}], 0x1, &(0x7f0000000640)}], 0x1, 0x0) [ 149.866785] binder: 9966:9967 unknown command 536871040 [ 149.873656] binder: 9966:9967 ioctl c0306201 200003c0 returned -22 22:52:46 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f00000000c0)={"6c6f3a0500", {0x2, 0x0, @dev={0xac, 0x14, 0x14}}}) 22:52:46 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x1d4) connect$inet6(r1, &(0x7f0000000140)={0xa}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f00000002c0), &(0x7f0000000300)=0x14) 22:52:46 executing program 1: perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x3, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setrlimit(0xf00000000000000, &(0x7f0000000080)) 22:52:46 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB, @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) 22:52:46 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") socket$key(0xf, 0x3, 0x2) socket$key(0xf, 0x3, 0x2) r1 = socket(0x10, 0x2, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x0, 0x0) sendfile(r1, r2, &(0x7f00000000c0)=0x39, 0x4000000000000003) 22:52:46 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup2(0xffffffffffffffff, 0xffffffffffffffff) r1 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x1, 0x2f0, [0x0, 0x20000800, 0x20000830, 0x20000860], 0x0, &(0x7f00000000c0), &(0x7f0000000800)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000ff1500000000000000000073797a5f74756e00000000000000000079616d30000000000000000000000000626f6e645f736c6176655f310000000073697430000000000000000000000000aaaaaaaaaa000000000000000180c20000000000000000000000e001000018020000600200006c696d697400000000000000000000000000000000000000000000000000000020000000000000000000000001040000000000000000000000000000000000000000000000000000636f6d6d656e74000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000fdffffff000000005241544545535400000000000000000000000000000000000000000000000000200000000000000073797a3100000000000000000000000000000000000000000000000000000000"]}, 0x368) 22:52:46 executing program 7: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(tea-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000005940)=[{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000001c0)="48107936edbbc8353b1bcef5de3280f2687c2620032770501ef8a908213c16f3b1", 0x21}], 0x1, &(0x7f0000000640)}], 0x1, 0x0) [ 150.028402] binder: 9992:9993 unknown command 536871040 [ 150.071531] binder: 9992:9993 ioctl c0306201 200003c0 returned -22 [ 150.114813] kernel msg: ebtables bug: please report to author: nentries does not equal the nr of entries in the (last) chain [ 150.188351] kernel msg: ebtables bug: please report to author: nentries does not equal the nr of entries in the (last) chain 22:52:47 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000dfdfee)='/dev/input/event#\x00', 0x7ff800003, 0x800000002) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") write$evdev(r0, &(0x7f000004d000)=[{{}, 0x0, 0x10000001}, {{0x2}}], 0x30) 22:52:47 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") socket$key(0xf, 0x3, 0x2) socket$key(0xf, 0x3, 0x2) r1 = socket(0x10, 0x2, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x0, 0x0) sendfile(r1, r2, &(0x7f00000000c0)=0x39, 0x4000000000000003) 22:52:47 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x16, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) 22:52:47 executing program 7: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(tea-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000005940)=[{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000001c0)="48107936edbbc8353b1bcef5de3280f2687c2620032770501ef8a908213c16f3b1", 0x21}], 0x1, &(0x7f0000000640)}], 0x1, 0x0) 22:52:47 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="2957e1311f16f477671070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f000065ffa8)={0x26, 'hash\x00', 0x0, 0x0, 'vmac(aes-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000100)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg(r2, &(0x7f0000002380)=[{{&(0x7f0000000140)=@pptp={0x18, 0x2, {0x0, @multicast2=0xe0000002}}, 0x80, &(0x7f0000000440)=[{&(0x7f0000000280)="d853b1643bdf52b13ec2d708dd941890ecd6498812657b80110bf1f9c1ec77fd81b6cd3b21fbac3302f3bfb915c2e1d86305900aa44afaafad3642afc36869254592f79774dfb9a6caacef0bf9cf728a0d1b1db7488024d6d568037d67", 0x5d}], 0x1, 0x0, 0x0, 0x4044080}, 0x3}, {{&(0x7f00000004c0)=@un=@file={0x1, './file0\x00'}, 0x80, &(0x7f0000000600)=[{&(0x7f0000000540)="6b7160cfd55f84b00de9038a4e045ac8f23dbcc77dc9dd751552144aab5f2dddbbff94bbdfd0f43e99aeb22b7500be20c846f36c3ff1309febcf350732891e18cdf5a875f8539d82472c65b8190ee3ea63d7c0bfac68b928918e4f7f9f4f28444b525138f9f499c68fb2c176381df95d330a9eb7cd689f997311851c37b428eb3161285f11b60384f697b5a86e8c04c37d07c4d60ebe", 0x96}], 0x1, &(0x7f00000026c0)=[{0xf0, 0x0, 0x7, "9d8105f7f7005104b99d2d04a80422ae17daa439bc2b32e46b29d8089b938c4219c5be1a959e16582d7caaf46c2ab58e9d5176ceeacd127855130cf22d9ce034137531383fd34f77e5a87feae9ee1eaddd1aa3fa12a535aeb47778f7397cdda53c840836bf26ab0fab4591b43ee5fb35651e2232c397ad40a356486dd6b3dc3ba0ccca0eaace3369712731ecc17bc866eddf92407bdf937bbe69c01c76f63a129830d2471fb00e792d98d487e10eaef299958d30654332cf5ed7be328b07accb7f657e89fab2c828c7c413439987c4cac76a645049d0a37decee8a9a"}], 0xf0, 0x4000000}, 0x7fffffff}, {{0x0, 0x0, &(0x7f0000001040)=[{&(0x7f0000000f40)="b62ce676090e5bf7dff8e18f43d00c63e355e5aac7e58d84d90b37ce71af0d279db0f082c8bb2190bee7caf5835e7424805ae1fdd4d8d3d4a1aa0a8d0874019c3c814b387c8655f88dadcaf401b139", 0x4f}], 0x1, &(0x7f0000001080)=[{0x78, 0x0, 0x101, "07ef55134c74a8f4f4126ba45483b1bb330ec894782d3888e24efa2ea5c2a7b4a0001bab8dc07cf4daabfb6456c60cf1c19635663d390957a0f19048799cc4f04900d2d1635fc22f5c9918053827c61277da44a0c1df3e5f13dd56dea86b24765fcd78e390e345"}], 0x78}, 0x1}], 0x3, 0x20040000) 22:52:47 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r1 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) write(0xffffffffffffffff, &(0x7f0000000040)="16", 0x1) sendfile(r1, r1, &(0x7f0000001000), 0xffff) r2 = gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(r1, r1, &(0x7f0000000000), 0xffffffff) tkill(r2, 0x1000000000016) 22:52:47 executing program 4: r0 = socket$inet6(0xa, 0x3, 0x200000088) recvfrom$inet6(r0, &(0x7f0000000080)=""/4, 0xffffff28, 0x20, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r2 = socket$inet6(0xa, 0x8000000000000802, 0x88) sendmsg$inet_sctp(r2, &(0x7f0000a29000)={&(0x7f00005dafe4)=@in6={0xa, 0x4e23, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c, &(0x7f0000fc8000)}, 0x0) 22:52:47 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x1d4) connect$inet6(r1, &(0x7f0000000140)={0xa}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f00000002c0), &(0x7f0000000300)=0x14) 22:52:47 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x0, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x1d4) connect$inet6(r1, &(0x7f0000000140)={0xa}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f00000002c0), &(0x7f0000000300)=0x14) 22:52:47 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x9, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) 22:52:47 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r1 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) write(0xffffffffffffffff, &(0x7f0000000040)="16", 0x1) sendfile(r1, r1, &(0x7f0000001000), 0xffff) r2 = gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(r1, r1, &(0x7f0000000000), 0xffffffff) tkill(r2, 0x1000000000016) 22:52:47 executing program 7: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(tea-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000005940)=[{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000001c0)="48107936edbbc8353b1bcef5de3280f2687c2620032770501ef8a908213c16f3b1", 0x21}], 0x1, &(0x7f0000000640)}], 0x1, 0x0) 22:52:47 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(r1, 0x2) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x40000001, &(0x7f00000000c0)={0x2}, 0x707000) 22:52:47 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000dfdfee)='/dev/input/event#\x00', 0x34a, 0x0) ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000000)=[0x0, 0x7]) 22:52:47 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") socket$key(0xf, 0x3, 0x2) socket$key(0xf, 0x3, 0x2) r1 = socket(0x10, 0x2, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x0, 0x0) sendfile(r1, r2, &(0x7f00000000c0)=0x39, 0x4000000000000003) [ 151.292061] binder: send failed reply for transaction 146 to 10027:10028 [ 151.304143] binder: undelivered TRANSACTION_COMPLETE [ 151.309403] binder: undelivered TRANSACTION_ERROR: 29189 [ 151.376121] binder: 10037:10044 unknown command 32768 22:52:47 executing program 7: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(tea-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000005940)=[{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000001c0)="48107936edbbc8353b1bcef5de3280f2687c2620032770501ef8a908213c16f3b1", 0x21}], 0x1, &(0x7f0000000640)}], 0x1, 0x0) 22:52:47 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") socket$key(0xf, 0x3, 0x2) socket$key(0xf, 0x3, 0x2) r1 = socket(0x10, 0x2, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x0, 0x0) sendfile(r1, r2, &(0x7f00000000c0)=0x39, 0x4000000000000003) [ 151.425812] binder: 10037:10044 ioctl c0306201 200003c0 returned -22 22:52:48 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x10, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) 22:52:48 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r1 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) write(0xffffffffffffffff, &(0x7f0000000040)="16", 0x1) sendfile(r1, r1, &(0x7f0000001000), 0xffff) r2 = gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(r1, r1, &(0x7f0000000000), 0xffffffff) tkill(r2, 0x1000000000016) 22:52:48 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(r1, 0x2) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x40000001, &(0x7f00000000c0)={0x2}, 0x707000) 22:52:48 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x1d4) connect$inet6(r1, &(0x7f0000000140)={0xa}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f00000002c0), &(0x7f0000000300)=0x14) 22:52:48 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") shmctl$SHM_LOCK(0x0, 0xb) 22:52:48 executing program 4: r0 = socket$inet6(0xa, 0x3, 0x200000088) recvfrom$inet6(r0, &(0x7f0000000080)=""/4, 0xffffff28, 0x20, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r2 = socket$inet6(0xa, 0x8000000000000802, 0x88) sendmsg$inet_sctp(r2, &(0x7f0000a29000)={&(0x7f00005dafe4)=@in6={0xa, 0x4e23, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c, &(0x7f0000fc8000)}, 0x0) 22:52:48 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socket$key(0xf, 0x3, 0x2) socket$key(0xf, 0x3, 0x2) r1 = socket(0x0, 0x2, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x0, 0x0) sendfile(r1, r2, &(0x7f00000000c0)=0x39, 0x4000000000000003) 22:52:48 executing program 7: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(tea-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000005940)=[{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000001c0)="48107936edbbc8353b1bcef5de3280f2687c2620032770501ef8a908213c16f3b1", 0x21}], 0x1, &(0x7f0000000640)}], 0x1, 0x0) 22:52:48 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(r1, 0x2) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x40000001, &(0x7f00000000c0)={0x2}, 0x707000) 22:52:48 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xa, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) 22:52:48 executing program 7: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(tea-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000005940)=[{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000001c0)="48107936edbbc8353b1bcef5de3280f2687c2620032770501ef8a908213c16f3b1", 0x21}], 0x1, &(0x7f0000000640)}], 0x1, 0x0) 22:52:48 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x1d4) connect$inet6(r1, &(0x7f0000000140)={0xa}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f00000002c0), &(0x7f0000000300)=0x14) 22:52:48 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r1 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) write(r1, &(0x7f0000000040), 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xffff) r2 = gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(r1, r1, &(0x7f0000000000), 0xffffffff) tkill(r2, 0x1000000000016) 22:52:48 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) 22:52:48 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socket$key(0xf, 0x3, 0x2) socket$key(0xf, 0x3, 0x2) r1 = socket(0x10, 0x0, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x0, 0x0) sendfile(r1, r2, &(0x7f00000000c0)=0x39, 0x4000000000000003) [ 152.130846] binder: send failed reply for transaction 149 to 10077:10079 [ 152.141242] binder: undelivered TRANSACTION_COMPLETE [ 152.146443] binder: undelivered TRANSACTION_ERROR: 29189 [ 152.213686] binder: 10097:10098 unknown command 8413952 22:52:48 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r1 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) write(r1, &(0x7f0000000040), 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xffff) r2 = gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(r1, r1, &(0x7f0000000000), 0xffffffff) tkill(r2, 0x1000000000016) 22:52:48 executing program 7: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(tea-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000005940)=[{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000001c0)="48107936edbbc8353b1bcef5de3280f2687c2620032770501ef8a908213c16f3b1", 0x21}], 0x1, &(0x7f0000000640)}], 0x1, 0x0) [ 152.258452] binder: 10097:10098 ioctl c0306201 200003c0 returned -22 22:52:48 executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000080)='/dev/loop#\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") fdatasync(r0) 22:52:48 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xd, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) 22:52:48 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x1d4) connect$inet6(r1, &(0x7f0000000140)={0xa}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f00000002c0), &(0x7f0000000300)=0x14) 22:52:48 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socket$key(0xf, 0x3, 0x2) socket$key(0xf, 0x3, 0x2) r1 = socket(0x10, 0x2, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r2, &(0x7f00000000c0)=0x39, 0x4000000000000003) [ 152.358388] print_req_error: I/O error, dev loop0, sector 0 [ 152.418201] binder: 10123:10127 got transaction to invalid handle [ 152.424801] binder: 10123:10127 transaction failed 29201/-22, size 0-0 line 2852 [ 152.507604] binder: undelivered TRANSACTION_ERROR: 29201 22:52:49 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(r1, 0x2) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x40000001, &(0x7f00000000c0)={0x2}, 0x707000) 22:52:49 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r1 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) write(r1, &(0x7f0000000040), 0x0) sendfile(r1, r1, &(0x7f0000001000), 0xffff) r2 = gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(r1, r1, &(0x7f0000000000), 0xffffffff) tkill(r2, 0x1000000000016) 22:52:49 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r2, 0x0, 0x27, &(0x7f0000683ff4)={@multicast2=0xe0000002, @loopback=0x7f000001}, 0xc) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000000)={'lo\x00'}) 22:52:49 executing program 7: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(tea-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000005940)=[{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000001c0)="48107936edbbc8353b1bcef5de3280f2687c2620032770501ef8a908213c16f3b1", 0x21}], 0x1, &(0x7f0000000640)}], 0x1, 0x0) 22:52:49 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x1d4) connect$inet6(r1, &(0x7f0000000140)={0xa}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f00000002c0), &(0x7f0000000300)=0x14) 22:52:49 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socket$key(0xf, 0x3, 0x2) socket$key(0xf, 0x3, 0x2) r1 = socket(0x10, 0x2, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x0, 0x0) sendfile(r1, 0xffffffffffffffff, &(0x7f00000000c0)=0x39, 0x4000000000000003) 22:52:49 executing program 4: r0 = socket$inet6(0xa, 0x3, 0x200000088) recvfrom$inet6(r0, &(0x7f0000000080)=""/4, 0xffffff28, 0x20, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r2 = socket$inet6(0xa, 0x8000000000000802, 0x88) sendmsg$inet_sctp(r2, &(0x7f0000a29000)={&(0x7f00005dafe4)=@in6={0xa, 0x4e23, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c, &(0x7f0000fc8000)}, 0x0) 22:52:49 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xd, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) [ 152.938838] binder: 10137:10140 got transaction to invalid handle [ 152.945196] binder: 10137:10140 transaction failed 29201/-22, size 0-0 line 2852 [ 152.960625] device lo entered promiscuous mode [ 152.993592] device lo left promiscuous mode [ 153.045777] binder: undelivered TRANSACTION_ERROR: 29201 [ 153.237108] device lo entered promiscuous mode [ 153.276514] device lo left promiscuous mode 22:52:50 executing program 7: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(tea-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000005940)=[{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000001c0)="48107936edbbc8353b1bcef5de3280f2687c2620032770501ef8a908213c16f3b1", 0x21}], 0x1, &(0x7f0000000640)}], 0x1, 0x0) 22:52:50 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x1d4) connect$inet6(r1, &(0x7f0000000140)={0xa}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f00000002c0), &(0x7f0000000300)=0x14) 22:52:50 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r1 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) write(r1, &(0x7f0000000040)="16", 0x1) sendfile(0xffffffffffffffff, r1, &(0x7f0000001000), 0xffff) r2 = gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(r1, r1, &(0x7f0000000000), 0xffffffff) tkill(r2, 0x1000000000016) 22:52:50 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socket$key(0xf, 0x3, 0x2) socket$key(0xf, 0x3, 0x2) r1 = socket(0x10, 0x2, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x0, 0x0) sendfile(r1, r2, &(0x7f00000000c0), 0x4000000000000003) 22:52:50 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x40000001, &(0x7f00000000c0)={0x2}, 0x707000) 22:52:50 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xd, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) 22:52:50 executing program 4: r0 = socket$inet6(0xa, 0x3, 0x200000088) recvfrom$inet6(r0, &(0x7f0000000080)=""/4, 0xffffff28, 0x20, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x0, &(0x7f0000000000)="295ee1311f16f477671070") r2 = socket$inet6(0xa, 0x8000000000000802, 0x88) sendmsg$inet_sctp(r2, &(0x7f0000a29000)={&(0x7f00005dafe4)=@in6={0xa, 0x4e23, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c, &(0x7f0000fc8000)}, 0x0) 22:52:50 executing program 0: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(r0) utimensat(0xffffffffffffffff, &(0x7f0000000140)='./file1\x00', &(0x7f00000001c0)={{0x77359400}, {0x77359400}}, 0x0) lsetxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)=@known='user.syz\x00', &(0x7f0000000180)='user.syz\x00', 0x251, 0x0) 22:52:50 executing program 0: r0 = socket(0xa, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000100)=@filter={'filter\x00', 0xe, 0x1, 0x2f0, [0x0, 0x20000800, 0x20000830, 0x20000860], 0x0, &(0x7f00000000c0), &(0x7f0000000800)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000001500000000000000000073797a5f74756e00000000000000000079616d30000000000000000000000000626f6e645f736c6176655f310000000073697430000000000000000000000000aaaaaaaaaa000000000000000180c20000000000000000000000e001000018020000600200006c696d697400000000000000000000000000000000000000000000000000000020000000000000000000040001040000000000000000000000000000000000000000000000000000636f6d6d656e74000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006d61726b0000000000000000000000000000000000000000000000000000000010000000000000000000000000000000fdffffff000000005241544545535400000000000000000000000000000000000000000000000000200000000000000073797a3100000000000000000000000000000000000000000000000000000000"]}, 0x368) [ 153.842978] binder: 10168:10171 got transaction to invalid handle [ 153.849352] binder: 10168:10171 transaction failed 29201/-22, size 0-0 line 2852 22:52:50 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x40000001, &(0x7f00000000c0)={0x2}, 0x707000) 22:52:50 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x1d4) connect$inet6(r1, &(0x7f0000000140)={0xa}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f00000002c0), &(0x7f0000000300)=0x14) 22:52:50 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socket$key(0xf, 0x3, 0x2) socket$key(0xf, 0x3, 0x2) r1 = socket(0x10, 0x2, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x0, 0x0) sendfile(r1, r2, &(0x7f00000000c0), 0x4000000000000003) 22:52:50 executing program 7: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(tea-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000005940)=[{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000001c0)="48107936edbbc8353b1bcef5de3280f2687c2620032770501ef8a908213c16f3b1", 0x21}], 0x1, &(0x7f0000000640)}], 0x1, 0x0) 22:52:50 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xf, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) [ 153.977854] binder: undelivered TRANSACTION_ERROR: 29201 22:52:50 executing program 0: r0 = syz_open_dev$sndseq(&(0x7f0000000100)='/dev/snd/seq\x00', 0x0, 0x0) read(r0, &(0x7f0000000040)=""/140, 0x8c) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f0000000580)={{0x4000000080}, "706f7274300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000", 0x3b, 0xfffffffffffeffff}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000280)={0x2d8cb47d95373def}) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r0, 0xc05c5340, &(0x7f0000000180)={0x0, 0x6, 0x0, {0x77359400}}) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r0, 0xc058534b, &(0x7f0000000400)={0x0, 0x0, 0x0, {0x77359400}}) 22:52:50 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x40000001, &(0x7f00000000c0)={0x2}, 0x707000) 22:52:50 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x1d4) connect$inet6(r1, &(0x7f0000000140)={0xa}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f00000002c0), &(0x7f0000000300)=0x14) [ 154.051856] binder: 10198:10199 got transaction to invalid handle [ 154.058204] binder: 10198:10199 transaction failed 29201/-22, size 0-0 line 2852 [ 154.174342] binder: undelivered TRANSACTION_ERROR: 29201 22:52:51 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socket$key(0xf, 0x3, 0x2) socket$key(0xf, 0x3, 0x2) r1 = socket(0x10, 0x2, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x0, 0x0) sendfile(r1, r2, &(0x7f00000000c0), 0x4000000000000003) 22:52:51 executing program 7: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(tea-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000005940)=[{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000001c0)="48107936edbbc8353b1bcef5de3280f2687c2620032770501ef8a908213c16f3b1", 0x21}], 0x1, &(0x7f0000000640)}], 0x1, 0x0) 22:52:51 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x1d4) connect$inet6(r1, &(0x7f0000000140)={0xa}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f00000002c0), &(0x7f0000000300)=0x14) 22:52:51 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xf, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) 22:52:51 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) shutdown(r1, 0x2) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x40000001, &(0x7f00000000c0)={0x2}, 0x707000) 22:52:51 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r1 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) write(r1, &(0x7f0000000040)="16", 0x1) sendfile(0xffffffffffffffff, r1, &(0x7f0000001000), 0xffff) r2 = gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(r1, r1, &(0x7f0000000000), 0xffffffff) tkill(r2, 0x1000000000016) 22:52:51 executing program 0: r0 = syz_open_dev$sndtimer(&(0x7f0000000040)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000029fcc)={{0x0, 0x2}}) ioctl$SNDRV_TIMER_IOCTL_STATUS(r0, 0x80605414, &(0x7f0000000100)=""/91) 22:52:51 executing program 4: r0 = socket$inet6(0xa, 0x3, 0x200000088) recvfrom$inet6(r0, &(0x7f0000000080)=""/4, 0xffffff28, 0x20, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x0, &(0x7f0000000000)="295ee1311f16f477671070") r2 = socket$inet6(0xa, 0x8000000000000802, 0x88) sendmsg$inet_sctp(r2, &(0x7f0000a29000)={&(0x7f00005dafe4)=@in6={0xa, 0x4e23, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c, &(0x7f0000fc8000)}, 0x0) 22:52:51 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(r1, 0x2) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x40000001, &(0x7f00000000c0)={0x2}, 0x707000) [ 155.145981] binder: 10225:10227 got transaction to invalid handle [ 155.152345] binder: 10225:10227 transaction failed 29201/-22, size 0-0 line 2852 22:52:51 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f47767") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x1d4) connect$inet6(r1, &(0x7f0000000140)={0xa}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f00000002c0), &(0x7f0000000300)=0x14) 22:52:51 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xf, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00', @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, &(0x7f0000000340)}) 22:52:51 executing program 7: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(tea-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000005940)=[{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000001c0)="48107936edbbc8353b1bcef5de3280f2687c2620032770501ef8a908213c16f3b1", 0x21}], 0x1, &(0x7f0000000640)}], 0x1, 0x0) 22:52:51 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socket$key(0xf, 0x3, 0x2) socket$key(0xf, 0x3, 0x2) r1 = socket(0x10, 0x2, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x0, 0x0) sendfile(r1, r2, &(0x7f00000000c0)=0x39, 0x0) [ 155.230931] binder: undelivered TRANSACTION_ERROR: 29201 22:52:51 executing program 0: r0 = syz_open_dev$sndtimer(&(0x7f0000000040)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000029fcc)={{0x0, 0x2}}) ioctl$SNDRV_TIMER_IOCTL_STATUS(r0, 0x80605414, &(0x7f0000000100)=""/91) 22:52:51 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(0xffffffffffffffff, 0x2) recvfrom$inet(0xffffffffffffffff, &(0x7f0000000040)=""/75, 0x4b, 0x40000001, &(0x7f00000000c0)={0x2}, 0x707000) [ 155.307289] binder: 10251:10252 got transaction to invalid handle [ 155.313704] binder: 10251:10252 transaction failed 29201/-22, size 0-0 line 2852 22:52:51 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x1d4) connect$inet6(r1, &(0x7f0000000140)={0xa}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f00000002c0), &(0x7f0000000300)=0x14) 22:52:51 executing program 0: r0 = syz_open_dev$sndtimer(&(0x7f0000000040)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000029fcc)={{0x0, 0x2}}) ioctl$SNDRV_TIMER_IOCTL_STATUS(r0, 0x80605414, &(0x7f0000000100)=""/91) 22:52:51 executing program 7: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(tea-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000ff8000), 0x0) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000005940)=[{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000001c0)="48107936edbbc8353b1bcef5de3280f2687c2620032770501ef8a908213c16f3b1", 0x21}], 0x1, &(0x7f0000000640)}], 0x1, 0x0) 22:52:51 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socket$key(0xf, 0x3, 0x2) socket$key(0xf, 0x3, 0x2) r1 = socket(0x10, 0x2, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x0, 0x0) sendfile(r1, r2, &(0x7f00000000c0)=0x39, 0x0) 22:52:51 executing program 1: socket$inet6(0xa, 0x1, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r0, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(r0, 0x2) recvfrom$inet(r0, &(0x7f0000000040)=""/75, 0x4b, 0x40000001, &(0x7f00000000c0)={0x2}, 0x707000) 22:52:51 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x1d4) connect$inet6(r1, &(0x7f0000000140)={0xa}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f00000002c0), &(0x7f0000000300)=0x14) [ 155.514258] binder: undelivered TRANSACTION_ERROR: 29201 22:52:52 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000003980)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl(r2, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000340)}) 22:52:52 executing program 7: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(tea-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b005e381e5", 0x8) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000005940)=[{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000001c0)="48107936edbbc8353b1bcef5de3280f2687c2620032770501ef8a908213c16f3b1", 0x21}], 0x1, &(0x7f0000000640)}], 0x1, 0x0) 22:52:52 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") socket$key(0xf, 0x3, 0x2) socket$key(0xf, 0x3, 0x2) r1 = socket(0x10, 0x2, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x0, 0x0) sendfile(r1, r2, &(0x7f00000000c0)=0x39, 0x0) 22:52:52 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f4776710") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x1d4) connect$inet6(r1, &(0x7f0000000140)={0xa}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f00000002c0), &(0x7f0000000300)=0x14) 22:52:52 executing program 0: r0 = syz_open_dev$sndtimer(&(0x7f0000000040)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_STATUS(r0, 0x80605414, &(0x7f0000000100)=""/91) 22:52:52 executing program 1: socket$inet6(0xa, 0x1, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r0, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(r0, 0x2) recvfrom$inet(r0, &(0x7f0000000040)=""/75, 0x4b, 0x40000001, &(0x7f00000000c0)={0x2}, 0x707000) 22:52:52 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r1 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) write(r1, &(0x7f0000000040)="16", 0x1) sendfile(0xffffffffffffffff, r1, &(0x7f0000001000), 0xffff) r2 = gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(r1, r1, &(0x7f0000000000), 0xffffffff) tkill(r2, 0x1000000000016) 22:52:52 executing program 4: r0 = socket$inet6(0xa, 0x3, 0x200000088) recvfrom$inet6(r0, &(0x7f0000000080)=""/4, 0xffffff28, 0x20, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x0, &(0x7f0000000000)="295ee1311f16f477671070") r2 = socket$inet6(0xa, 0x8000000000000802, 0x88) sendmsg$inet_sctp(r2, &(0x7f0000a29000)={&(0x7f00005dafe4)=@in6={0xa, 0x4e23, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c, &(0x7f0000fc8000)}, 0x0) 22:52:52 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x1d4) connect$inet6(r1, &(0x7f0000000140)={0xa}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f00000002c0), &(0x7f0000000300)=0x14) [ 156.074644] binder: send failed reply for transaction 164 to 10292:10295 [ 156.100982] binder: undelivered TRANSACTION_COMPLETE [ 156.106217] binder: undelivered TRANSACTION_ERROR: 29189 22:52:53 executing program 1: socket$inet6(0xa, 0x1, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r0, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(r0, 0x2) recvfrom$inet(r0, &(0x7f0000000040)=""/75, 0x4b, 0x40000001, &(0x7f00000000c0)={0x2}, 0x707000) 22:52:53 executing program 2: 22:52:53 executing program 7: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(tea-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b005e381e5b3b60ced", 0xc) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000005940)=[{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000001c0)="48107936edbbc8353b1bcef5de3280f2687c2620032770501ef8a908213c16f3b1", 0x21}], 0x1, &(0x7f0000000640)}], 0x1, 0x0) 22:52:53 executing program 0: ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000029fcc)={{0x0, 0x2}}) ioctl$SNDRV_TIMER_IOCTL_STATUS(0xffffffffffffffff, 0x80605414, &(0x7f0000000100)=""/91) 22:52:53 executing program 5: r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) readv(r0, &(0x7f0000000580)=[{&(0x7f0000000140)=""/202, 0xca}, {&(0x7f00000000c0)=""/63, 0x3f}, {&(0x7f0000000fc0)=""/4096, 0x1000}, {&(0x7f0000000380)=""/104, 0x68}], 0x4) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000000f40)=@ethernet={0x0, @random}, 0x80, &(0x7f0000002380), 0x0, &(0x7f0000002400)=""/191, 0xbf}}, {{&(0x7f0000003440)=@l2, 0x80, &(0x7f0000003680), 0x0, &(0x7f00000036c0)=""/64, 0x40}}], 0xf, 0x0, &(0x7f0000003700)={0x77359400}) 22:52:53 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x0, &(0x7f00000000c0)=0x100000001, 0x1d4) connect$inet6(r1, &(0x7f0000000140)={0xa}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f00000002c0), &(0x7f0000000300)=0x14) 22:52:53 executing program 4: r0 = socket$inet6(0xa, 0x3, 0x200000088) recvfrom$inet6(r0, &(0x7f0000000080)=""/4, 0xffffff28, 0x20, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)) r2 = socket$inet6(0xa, 0x8000000000000802, 0x88) sendmsg$inet_sctp(r2, &(0x7f0000a29000)={&(0x7f00005dafe4)=@in6={0xa, 0x4e23, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c, &(0x7f0000fc8000)}, 0x0) 22:52:53 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r1 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) write(r1, &(0x7f0000000040)="16", 0x1) sendfile(r1, 0xffffffffffffffff, &(0x7f0000001000), 0xffff) r2 = gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(r1, r1, &(0x7f0000000000), 0xffffffff) tkill(r2, 0x1000000000016) 22:52:53 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(cipher_null)\x00'}, 0x6b) r2 = accept4(r1, 0x0, &(0x7f0000000100), 0x0) sendto$packet(r2, &(0x7f0000000000)='d', 0x1, 0xc000, &(0x7f0000000300)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}, 0x14) sendto$unix(r2, &(0x7f0000000000), 0xffffffffffffffb8, 0x8055, 0x0, 0x7b7f2c9808fdd417) 22:52:53 executing program 0: ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000029fcc)={{0x0, 0x2}}) ioctl$SNDRV_TIMER_IOCTL_STATUS(0xffffffffffffffff, 0x80605414, &(0x7f0000000100)=""/91) 22:52:53 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f00000000c0), 0x1d4) connect$inet6(r1, &(0x7f0000000140)={0xa}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f00000002c0), &(0x7f0000000300)=0x14) 22:52:53 executing program 7: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(tea-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b005e381e5b3b60ced5c54", 0xe) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000005940)=[{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000001c0)="48107936edbbc8353b1bcef5de3280f2687c2620032770501ef8a908213c16f3b1", 0x21}], 0x1, &(0x7f0000000640)}], 0x1, 0x0) 22:52:53 executing program 5: r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) readv(r0, &(0x7f0000000580)=[{&(0x7f0000000140)=""/202, 0xca}, {&(0x7f0000000fc0)=""/4096, 0x1000}, {&(0x7f0000000380)=""/104, 0x68}], 0x3) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000000f40)=@ethernet={0x0, @random}, 0x80, &(0x7f0000002380), 0x0, &(0x7f0000002400)=""/191, 0xbf}}, {{&(0x7f0000003440)=@l2, 0x80, &(0x7f0000003680), 0x0, &(0x7f00000036c0)=""/64, 0x40}}], 0xf, 0x0, &(0x7f0000003700)={0x77359400}) 22:52:53 executing program 1: ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r0, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(r0, 0x2) recvfrom$inet(r0, &(0x7f0000000040)=""/75, 0x4b, 0x40000001, &(0x7f00000000c0)={0x2}, 0x707000) 22:52:53 executing program 0: ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000029fcc)={{0x0, 0x2}}) ioctl$SNDRV_TIMER_IOCTL_STATUS(0xffffffffffffffff, 0x80605414, &(0x7f0000000100)=""/91) 22:52:53 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(cipher_null)\x00'}, 0x6b) r2 = accept4(r1, 0x0, &(0x7f0000000100), 0x0) sendto$packet(r2, &(0x7f0000000000)='d', 0x1, 0xc000, &(0x7f0000000300)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}, 0x14) sendto$unix(r2, &(0x7f0000000000), 0xffffffffffffffb8, 0x8055, 0x0, 0x7b7f2c9808fdd417) 22:52:53 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x1d4) connect$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f00000002c0), &(0x7f0000000300)=0x14) 22:52:53 executing program 7: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(tea-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b005e381e5b3b60ced5c54db", 0xf) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000005940)=[{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000001c0)="48107936edbbc8353b1bcef5de3280f2687c2620032770501ef8a908213c16f3b1", 0x21}], 0x1, &(0x7f0000000640)}], 0x1, 0x0) 22:52:53 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(cipher_null)\x00'}, 0x6b) r2 = accept4(r1, 0x0, &(0x7f0000000100), 0x0) sendto$packet(r2, &(0x7f0000000000)='d', 0x1, 0xc000, &(0x7f0000000300)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}, 0x14) sendto$unix(r2, &(0x7f0000000000), 0xffffffffffffffb8, 0x8055, 0x0, 0x7b7f2c9808fdd417) 22:52:53 executing program 0: r0 = syz_open_dev$sndtimer(&(0x7f0000000040)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000029fcc)={{0x0, 0x2}}) ioctl$SNDRV_TIMER_IOCTL_STATUS(r0, 0x80605414, &(0x7f0000000100)=""/91) 22:52:54 executing program 5: r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) readv(r0, &(0x7f0000000580)=[{&(0x7f0000000140)=""/202, 0xca}, {&(0x7f0000000fc0)=""/4096, 0x1000}, {&(0x7f0000000380)=""/104, 0x68}], 0x3) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000000f40)=@ethernet={0x0, @random}, 0x80, &(0x7f0000002380), 0x0, &(0x7f0000002400)=""/191, 0xbf}}, {{&(0x7f0000003440)=@l2, 0x80, &(0x7f0000003680), 0x0, &(0x7f00000036c0)=""/64, 0x40}}], 0xf, 0x0, &(0x7f0000003700)={0x77359400}) 22:52:54 executing program 1: ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r0, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(r0, 0x2) recvfrom$inet(r0, &(0x7f0000000040)=""/75, 0x4b, 0x40000001, &(0x7f00000000c0)={0x2}, 0x707000) 22:52:54 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x1d4) connect$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f00000002c0), &(0x7f0000000300)=0x14) 22:52:54 executing program 7: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(tea-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(0xffffffffffffffff, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000005940)=[{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000001c0)="48107936edbbc8353b1bcef5de3280f2687c2620032770501ef8a908213c16f3b1", 0x21}], 0x1, &(0x7f0000000640)}], 0x1, 0x0) 22:52:54 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(cipher_null)\x00'}, 0x6b) r2 = accept4(r1, 0x0, &(0x7f0000000100), 0x0) sendto$packet(r2, &(0x7f0000000000)='d', 0x1, 0xc000, &(0x7f0000000300)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}}, 0x14) sendto$unix(r2, &(0x7f0000000000), 0xffffffffffffffb8, 0x8055, 0x0, 0x7b7f2c9808fdd417) 22:52:54 executing program 0: r0 = syz_open_dev$sndtimer(&(0x7f0000000040)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000029fcc)) ioctl$SNDRV_TIMER_IOCTL_STATUS(r0, 0x80605414, &(0x7f0000000100)=""/91) 22:52:54 executing program 4: r0 = socket$inet6(0xa, 0x3, 0x200000088) recvfrom$inet6(r0, &(0x7f0000000080)=""/4, 0xffffff28, 0x20, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)) r2 = socket$inet6(0xa, 0x8000000000000802, 0x88) sendmsg$inet_sctp(r2, &(0x7f0000a29000)={&(0x7f00005dafe4)=@in6={0xa, 0x4e23, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c, &(0x7f0000fc8000)}, 0x0) 22:52:54 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r1 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) write(r1, &(0x7f0000000040)="16", 0x1) sendfile(r1, 0xffffffffffffffff, &(0x7f0000001000), 0xffff) r2 = gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(r1, r1, &(0x7f0000000000), 0xffffffff) tkill(r2, 0x1000000000016) 22:52:54 executing program 0: r0 = syz_open_dev$sndtimer(&(0x7f0000000040)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000029fcc)={{0x0, 0x2}}) ioctl$SNDRV_TIMER_IOCTL_STATUS(0xffffffffffffffff, 0x80605414, &(0x7f0000000100)=""/91) 22:52:54 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(cipher_null)\x00'}, 0x6b) r2 = accept4(r1, 0x0, &(0x7f0000000100), 0x0) sendto$unix(r2, &(0x7f0000000000), 0xffffffffffffffb8, 0x8055, 0x0, 0x7b7f2c9808fdd417) 22:52:54 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x1d4) connect$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f00000002c0), &(0x7f0000000300)=0x14) 22:52:54 executing program 7: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(tea-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000005940)=[{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000001c0)="48107936edbbc8353b1bcef5de3280f2687c2620032770501ef8a908213c16f3b1", 0x21}], 0x1, &(0x7f0000000640)}], 0x1, 0x0) 22:52:54 executing program 1: ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r0, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(r0, 0x2) recvfrom$inet(r0, &(0x7f0000000040)=""/75, 0x4b, 0x40000001, &(0x7f00000000c0)={0x2}, 0x707000) 22:52:54 executing program 5: r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) readv(r0, &(0x7f0000000580)=[{&(0x7f0000000140)=""/202, 0xca}, {&(0x7f0000000fc0)=""/4096, 0x1000}, {&(0x7f0000000380)=""/104, 0x68}], 0x3) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000000f40)=@ethernet={0x0, @random}, 0x80, &(0x7f0000002380), 0x0, &(0x7f0000002400)=""/191, 0xbf}}, {{&(0x7f0000003440)=@l2, 0x80, &(0x7f0000003680), 0x0, &(0x7f00000036c0)=""/64, 0x40}}], 0xf, 0x0, &(0x7f0000003700)={0x77359400}) 22:52:54 executing program 6: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) r1 = memfd_create(&(0x7f00000000c0)='dev ', 0x0) write(r1, &(0x7f0000000040)="16", 0x1) sendfile(r1, 0xffffffffffffffff, &(0x7f0000001000), 0xffff) r2 = gettid() timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000040000)) sendfile(r1, r1, &(0x7f0000000000), 0xffffffff) tkill(r2, 0x1000000000016) 22:52:54 executing program 7: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(tea-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000005940), 0x0, 0x0) 22:52:54 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(cipher_null)\x00'}, 0x6b) r2 = accept4(r1, 0x0, &(0x7f0000000100), 0x0) sendto$unix(r2, &(0x7f0000000000), 0xffffffffffffffb8, 0x8055, 0x0, 0x7b7f2c9808fdd417) 22:52:54 executing program 1: r0 = socket$inet6(0xa, 0x0, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(r1, 0x2) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x40000001, &(0x7f00000000c0)={0x2}, 0x707000) 22:52:54 executing program 5: r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) readv(r0, &(0x7f0000000580)=[{&(0x7f0000000140)=""/202, 0xca}, {&(0x7f0000000fc0)=""/4096, 0x1000}, {&(0x7f0000000380)=""/104, 0x68}], 0x3) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000000f40)=@ethernet={0x0, @random}, 0x80, &(0x7f0000002380), 0x0, &(0x7f0000002400)=""/191, 0xbf}}, {{&(0x7f0000003440)=@l2, 0x80, &(0x7f0000003680), 0x0, &(0x7f00000036c0)=""/64, 0x40}}], 0xf, 0x0, &(0x7f0000003700)={0x77359400}) 22:52:54 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x1d4) connect$inet6(r1, &(0x7f0000000140)={0xa}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f00000002c0), &(0x7f0000000300)=0x14) 22:52:54 executing program 4: r0 = socket$inet6(0xa, 0x3, 0x200000088) recvfrom$inet6(r0, &(0x7f0000000080)=""/4, 0xffffff28, 0x20, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000000)) r2 = socket$inet6(0xa, 0x8000000000000802, 0x88) sendmsg$inet_sctp(r2, &(0x7f0000a29000)={&(0x7f00005dafe4)=@in6={0xa, 0x4e23, 0x0, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c, &(0x7f0000fc8000)}, 0x0) 22:52:54 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") getsockopt$IP_VS_SO_GET_DAEMON(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000040), &(0x7f0000000080)=0x30) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000000), 0x0) 22:52:55 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000008000)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000010000)={0x8004, 0x1a, 0x0, 0xffffffffffffffff}) ioctl$DMA_BUF_IOCTL_SYNC(r1, 0x40086200, &(0x7f00000e7ff8)=0x3) perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(r1, 0x40086200, &(0x7f0000000040)=0x1) 22:52:55 executing program 7: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(tea-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000005940), 0x0, 0x0) 22:52:55 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(cipher_null)\x00'}, 0x6b) r2 = accept4(r1, 0x0, &(0x7f0000000100), 0x0) sendto$unix(r2, &(0x7f0000000000), 0xffffffffffffffb8, 0x8055, 0x0, 0x7b7f2c9808fdd417) 22:52:55 executing program 1: r0 = socket$inet6(0xa, 0x0, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1=0xe0000001}, 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000680)={&(0x7f0000000000)=@in={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000140)=' ', 0x1}], 0x1}, 0x20004001) shutdown(r1, 0x2) recvfrom$inet(r1, &(0x7f0000000040)=""/75, 0x4b, 0x40000001, &(0x7f00000000c0)={0x2}, 0x707000) 22:52:55 executing program 5: r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f0000000f40)=@ethernet={0x0, @random}, 0x80, &(0x7f0000002380), 0x0, &(0x7f0000002400)=""/191, 0xbf}}, {{&(0x7f0000003440)=@l2, 0x80, &(0x7f0000003680), 0x0, &(0x7f00000036c0)=""/64, 0x40}}], 0xf, 0x0, &(0x7f0000003700)={0x77359400}) 22:52:55 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x1d4) connect$inet6(r1, &(0x7f0000000140)={0xa}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f00000002c0), &(0x7f0000000300)=0x14) 22:52:55 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x1d4) connect$inet6(r1, &(0x7f0000000140)={0xa}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f00000002c0), &(0x7f0000000300)=0x14) 22:52:55 executing program 7: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(tea-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000ff8000)="0a0775b005e381e5b3b60ced5c54dbb7", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000005940), 0x0, 0x0) [ 158.961151] WARNING: CPU: 1 PID: 2084 at drivers/staging/android/ion/ion.c:117 ion_buffer_destroy+0xe3/0x1a0 [ 158.971148] Kernel panic - not syncing: panic_on_warn set ... [ 158.971148] [ 158.978515] CPU: 1 PID: 2084 Comm: ion_system_heap Not tainted 4.17.0+ #91 [ 158.985522] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 158.994867] Call Trace: [ 158.997462] dump_stack+0x1b9/0x294 [ 159.001103] ? dump_stack_print_info.cold.2+0x52/0x52 [ 159.006301] ? ion_buffer_destroy+0xe0/0x1a0 [ 159.010712] panic+0x22f/0x4de [ 159.013907] ? add_taint.cold.5+0x16/0x16 [ 159.018064] ? __warn.cold.8+0x148/0x1b3 [ 159.022126] ? __warn.cold.8+0x117/0x1b3 [ 159.026193] ? ion_buffer_destroy+0xe3/0x1a0 [ 159.030602] __warn.cold.8+0x163/0x1b3 [ 159.034493] ? ion_buffer_destroy+0xe3/0x1a0 [ 159.038902] report_bug+0x252/0x2d0 [ 159.042533] do_error_trap+0x1fc/0x4d0 [ 159.046427] ? math_error+0x3f0/0x3f0 [ 159.050231] ? find_held_lock+0x36/0x1c0 [ 159.054302] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 159.059147] do_invalid_op+0x1b/0x20 [ 159.062858] invalid_op+0x14/0x20 [ 159.066313] RIP: 0010:ion_buffer_destroy+0xe3/0x1a0 [ 159.071319] Code: 85 b9 00 00 00 49 8b 44 24 08 48 89 df e8 15 e9 00 02 48 89 df e8 0d 7f f7 fb 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 5d b6 ba fb <0f> 0b 48 b8 00 00 00 00 00 fc ff df 49 8d 7c 24 18 48 89 fa 48 c1 [ 159.090677] RSP: 0018:ffff8801ce0f7d30 EFLAGS: 00010293 [ 159.096039] RAX: ffff8801ce0e4200 RBX: ffff8801c5904700 RCX: ffffffff85bf86b4 [ 159.103305] RDX: 0000000000000000 RSI: ffffffff85bf8703 RDI: 0000000000000005 [ 159.110574] RBP: ffff8801ce0f7d58 R08: ffff8801ce0e4200 R09: ffffed0039cbd8b6 [ 159.117844] R10: ffffed0039cbd8b6 R11: ffff8801ce5ec5b3 R12: ffffffff897247a0 [ 159.125111] R13: ffff8801ce5ec500 R14: 0000000000000001 R15: ffff8801c5904720 [ 159.132397] ? ion_buffer_destroy+0x94/0x1a0 [ 159.136809] ? ion_buffer_destroy+0xe3/0x1a0 [ 159.142962] ion_heap_deferred_free+0x31e/0x670 [ 159.147637] ? ion_heap_sglist_zero+0x2a0/0x2a0 [ 159.152320] ? schedule+0xef/0x430 [ 159.155861] ? __schedule+0x1e30/0x1e30 [ 159.159837] ? kasan_check_read+0x11/0x20 [ 159.163987] ? do_raw_spin_unlock+0x9e/0x2e0 [ 159.168395] ? do_raw_spin_trylock+0x1b0/0x1b0 [ 159.172977] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 159.178513] ? __kthread_parkme+0x111/0x1d0 [ 159.182832] ? finish_wait+0x420/0x420 [ 159.186722] ? trace_hardirqs_on+0xd/0x10 [ 159.190869] kthread+0x345/0x410 [ 159.194233] ? ion_heap_sglist_zero+0x2a0/0x2a0 [ 159.198897] ? kthread_bind+0x40/0x40 [ 159.202703] ret_from_fork+0x3a/0x50 [ 159.207096] Dumping ftrace buffer: [ 159.210719] (ftrace buffer empty) [ 159.214426] Kernel Offset: disabled [ 159.218036] Rebooting in 86400 seconds..