x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d9", 0x1f}], 0x1}, 0x0) 14:14:35 executing program 1: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) listxattr(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) 14:14:35 executing program 4: open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) poll(&(0x7f00000005c0), 0x200000000000003d, 0x52) r0 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r0, 0x0, 0xfffffd3c, 0x0, 0x0, 0x800e00718) ppoll(&(0x7f00000000c0)=[{r0}, {}], 0x2, 0x0, 0x0, 0x0) shutdown(r0, 0x0) 14:14:35 executing program 5: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r1 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r1, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r1, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d9", 0x1f}], 0x1}, 0x0) 14:14:35 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000400)='/dev/loop#\x00', 0x3, 0x182) bpf$BPF_PROG_DETACH(0x9, 0x0, 0x18c) r1 = memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x46000) r2 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$KDGETKEYCODE(r2, 0x4b4c, &(0x7f0000000300)={0x0, 0x8}) clock_gettime(0x0, &(0x7f00000002c0)) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000040)="05", 0x1}], 0x1, 0x81805) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0xffffffffffffff7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) unshare(0xffffffd) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) ioctl$KDADDIO(r3, 0x4b34, 0x400) ioctl$FS_IOC_GETFSLABEL(0xffffffffffffffff, 0x81009431, &(0x7f00000001c0)) sendfile(r0, r0, 0x0, 0x2000005) ioctl$sock_SIOCGPGRP(r2, 0x8904, &(0x7f00000003c0)=0x0) perf_event_open(&(0x7f0000000080)={0x5, 0x70, 0xf31, 0x7, 0x4, 0x7fff, 0x0, 0x0, 0x810, 0x8, 0x7, 0x4, 0x8, 0x8, 0x100000001, 0x3, 0x1f, 0x8, 0x7, 0x4, 0x0, 0x2, 0x2, 0x0, 0x3ff, 0x6, 0x0, 0x2, 0x5, 0x7fff, 0xfff, 0x2a5, 0x2, 0x9, 0x5, 0x3, 0x0, 0x9, 0x0, 0x101, 0x1, @perf_bp={&(0x7f0000000000), 0x8}, 0x11480, 0x8, 0x7, 0xf, 0xffff, 0x8, 0x10001}, r4, 0x10, 0xffffffffffffffff, 0x8) 14:14:36 executing program 5: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r1 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r1, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r1, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f", 0x24}], 0x1}, 0x0) 14:14:36 executing program 5: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r1 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r1, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r1, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f", 0x24}], 0x1}, 0x0) 14:14:36 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = dup(r0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$sock_timeval(r2, 0xffff, 0x1006, &(0x7f0000000140)={0x5}, 0x10) shutdown(0xffffffffffffffff, 0x0) getsockopt$inet6_buf(r1, 0x29, 0x0, 0x0, 0x0) recvfrom$inet(r2, 0x0, 0xfffffdc4, 0x0, 0x0, 0x800e0051e) shutdown(r2, 0x0) [ 382.480748] print_req_error: I/O error, dev loop3, sector 0 [ 382.486566] print_req_error: I/O error, dev loop3, sector 1024 14:14:36 executing program 0: open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) poll(&(0x7f00000005c0), 0x200000000000003d, 0x52) r0 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r0, 0x0, 0xfffffd3c, 0x0, 0x0, 0x800e00718) ppoll(&(0x7f00000000c0)=[{r0}, {}, {r0, 0x2002}], 0x3, 0x0, 0x0, 0x0) shutdown(r0, 0x0) 14:14:36 executing program 2: poll(&(0x7f00000005c0)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x200000000000002c, 0x4e) r0 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r0, 0x0, 0xfffffd3c, 0x0, 0x0, 0x800e00718) ppoll(&(0x7f0000000000)=[{r0}], 0x1, 0x0, 0x0, 0x0) shutdown(r0, 0x0) 14:14:36 executing program 5: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r1 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r1, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r1, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f", 0x24}], 0x1}, 0x0) 14:14:36 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000400)='/dev/loop#\x00', 0x3, 0x182) bpf$BPF_PROG_DETACH(0x9, 0x0, 0x18c) r1 = memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x46000) r2 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$KDGETKEYCODE(r2, 0x4b4c, &(0x7f0000000300)={0x0, 0x8}) clock_gettime(0x0, &(0x7f00000002c0)) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000040)="05", 0x1}], 0x1, 0x81805) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0xffffffffffffff7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) unshare(0xffffffd) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) ioctl$KDADDIO(r3, 0x4b34, 0x400) ioctl$FS_IOC_GETFSLABEL(0xffffffffffffffff, 0x81009431, &(0x7f00000001c0)) sendfile(r0, r0, 0x0, 0x2000005) ioctl$sock_SIOCGPGRP(r2, 0x8904, &(0x7f00000003c0)=0x0) perf_event_open(&(0x7f0000000080)={0x5, 0x70, 0xf31, 0x7, 0x4, 0x7fff, 0x0, 0x0, 0x810, 0x8, 0x7, 0x4, 0x8, 0x8, 0x100000001, 0x3, 0x1f, 0x8, 0x7, 0x4, 0x0, 0x2, 0x2, 0x0, 0x3ff, 0x6, 0x0, 0x2, 0x5, 0x7fff, 0xfff, 0x2a5, 0x2, 0x9, 0x5, 0x3, 0x0, 0x9, 0x0, 0x101, 0x1, @perf_bp={&(0x7f0000000000), 0x8}, 0x11480, 0x8, 0x7, 0xf, 0xffff, 0x8, 0x10001}, r4, 0x10, 0xffffffffffffffff, 0x8) 14:14:36 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) readv(r0, &(0x7f0000001600)=[{&(0x7f00000001c0)=""/216, 0xd8}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x9) r1 = dup(r0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r2, 0x0, 0x73a0b1b, 0x0, 0x0, 0x800e00549) shutdown(r1, 0x0) r3 = dup(r2) semop(0x0, 0x0, 0xffffffffffffffa0) recvfrom$inet(r2, 0x0, 0xfffffeca, 0x0, 0x0, 0x800e0053f) shutdown(r3, 0x0) 14:14:36 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000240)=""/123, 0x7b}, {0x0}], 0x2}, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r1, 0x0, 0xfd1d, 0x0, 0x0, 0x800e00505) shutdown(r0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000640)=""/4096, 0x1000}, {0x0}], 0x2}, 0x40002) r3 = dup(r2) r4 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r4, 0x0, 0x2a80, 0x0, 0x0, 0x800e00506) shutdown(r3, 0x0) r5 = socket$inet_udplite(0x2, 0x2, 0x88) readv(r5, &(0x7f0000000380)=[{&(0x7f0000000240)=""/142, 0x8e}, {0x0}, {0x0}], 0x3) shutdown(r4, 0x0) shutdown(r1, 0x0) 14:14:36 executing program 4: 14:14:36 executing program 5: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r1 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r1, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r1, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6a", 0x27}], 0x1}, 0x0) 14:14:36 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000400)='/dev/loop#\x00', 0x3, 0x182) bpf$BPF_PROG_DETACH(0x9, 0x0, 0x18c) r1 = memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x46000) r2 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$KDGETKEYCODE(r2, 0x4b4c, &(0x7f0000000300)={0x0, 0x8}) clock_gettime(0x0, &(0x7f00000002c0)) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000040)="05", 0x1}], 0x1, 0x81805) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0xffffffffffffff7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) unshare(0xffffffd) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) ioctl$KDADDIO(r3, 0x4b34, 0x400) ioctl$FS_IOC_GETFSLABEL(0xffffffffffffffff, 0x81009431, &(0x7f00000001c0)) sendfile(r0, r0, 0x0, 0x2000005) ioctl$sock_SIOCGPGRP(r2, 0x8904, &(0x7f00000003c0)=0x0) perf_event_open(&(0x7f0000000080)={0x5, 0x70, 0xf31, 0x7, 0x4, 0x7fff, 0x0, 0x0, 0x810, 0x8, 0x7, 0x4, 0x8, 0x8, 0x100000001, 0x3, 0x1f, 0x8, 0x7, 0x4, 0x0, 0x2, 0x2, 0x0, 0x3ff, 0x6, 0x0, 0x2, 0x5, 0x7fff, 0xfff, 0x2a5, 0x2, 0x9, 0x5, 0x3, 0x0, 0x9, 0x0, 0x101, 0x1, @perf_bp={&(0x7f0000000000), 0x8}, 0x11480, 0x8, 0x7, 0xf, 0xffff, 0x8, 0x10001}, r4, 0x10, 0xffffffffffffffff, 0x8) 14:14:36 executing program 5: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r1 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r1, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r1, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6a", 0x27}], 0x1}, 0x0) 14:14:36 executing program 4: 14:14:36 executing program 1: 14:14:37 executing program 4: 14:14:37 executing program 2: 14:14:37 executing program 4: 14:14:37 executing program 5: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r1 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r1, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r1, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6a", 0x27}], 0x1}, 0x0) 14:14:37 executing program 1: r0 = creat(&(0x7f0000000680)='./file1\x00', 0x0) r1 = creat(&(0x7f0000000040)='./file1\x00', 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) move_pages(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, 0x0) ioctl(r2, 0x1000008912, &(0x7f0000000100)="11dca50d5e0bcfe47bf070") fallocate(r1, 0x0, 0x0, 0x4005ef0) fallocate(r0, 0x20, 0x0, 0x80000008000) 14:14:37 executing program 3: 14:14:37 executing program 0: 14:14:37 executing program 2: 14:14:37 executing program 0: 14:14:37 executing program 3: 14:14:37 executing program 4: 14:14:37 executing program 2: 14:14:37 executing program 5: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r1 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r1, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r1, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7", 0x28}], 0x1}, 0x0) 14:14:37 executing program 0: 14:14:37 executing program 1: 14:14:37 executing program 3: 14:14:37 executing program 2: 14:14:37 executing program 0: 14:14:37 executing program 5: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r1 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r1, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r1, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7", 0x28}], 0x1}, 0x0) 14:14:37 executing program 3: 14:14:37 executing program 4: 14:14:37 executing program 1: 14:14:37 executing program 2: 14:14:37 executing program 0: 14:14:37 executing program 5: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r1 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r1, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r1, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7", 0x28}], 0x1}, 0x0) 14:14:38 executing program 1: 14:14:38 executing program 4: 14:14:38 executing program 3: 14:14:38 executing program 2: 14:14:38 executing program 0: 14:14:38 executing program 1: 14:14:38 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r1 = socket$packet(0x11, 0x2000080800000002, 0x300) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4000000028, 0x0, 0x0, 0xfffff010}, {0x80000006}]}, 0x10) 14:14:38 executing program 4: 14:14:38 executing program 2: 14:14:38 executing program 0: 14:14:38 executing program 5: 14:14:38 executing program 1: 14:14:38 executing program 2: 14:14:38 executing program 4: 14:14:38 executing program 0: 14:14:38 executing program 1: 14:14:38 executing program 5: 14:14:38 executing program 2: 14:14:38 executing program 3: 14:14:38 executing program 5: 14:14:38 executing program 2: 14:14:38 executing program 0: 14:14:38 executing program 1: 14:14:38 executing program 4: 14:14:38 executing program 0: 14:14:38 executing program 3: 14:14:38 executing program 1: 14:14:38 executing program 4: 14:14:38 executing program 5: 14:14:38 executing program 2: 14:14:38 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_read_part_table(0x0, 0xaaaaaaaaaaaac04, &(0x7f0000000080)=[{&(0x7f0000000000)="02000500000a00000000ff07fffffff50000000000000000000000000000000000004200000000000000000000000000000000000000000000000000000055aa", 0x40, 0x1c0}]) 14:14:38 executing program 1: r0 = socket$kcm(0x2b, 0x8000000000001, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0xd, 0x4, &(0x7f00000033c0)=@framed={{}, [@alu={0x8000000201a7f19, 0x0, 0x6, 0x2, 0x1, 0x98}]}, &(0x7f0000000140)='GPL\x00', 0x1, 0xfb, &(0x7f0000000200)=""/251, 0x0, 0x0, [0x0, 0x0, 0x700000000000000]}, 0x48) 14:14:38 executing program 0: r0 = socket(0x10, 0x20000000003, 0x0) write(r0, &(0x7f0000000000)="2400000052001f0414f9f407000904000200071005000800fe0500ff0800010000000000", 0x24) 14:14:38 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_GET_REGS(r2, 0x8090ae81, &(0x7f00000001c0)) 14:14:38 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet(0x10, 0x2, 0x0) sendmsg(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000180)="24000000130007031dfffd946f610500070000001d00000077000000421ba3a20400ff7e280000001100ffffba16a0aa1c0900000000000013000000000000eff24d8238cfa47e", 0x47}], 0x1}, 0x0) 14:14:38 executing program 2: r0 = socket(0x10, 0x20000000003, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000040)={0x7ff}, 0x10) write(r0, &(0x7f0000000000)="2400000052001f0314f9f407000904000200071003000800fe0500ff0800010000000000", 0x24) 14:14:38 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x29, &(0x7f0000000100)=0xff, 0x4) sendto$inet6(r0, 0x0, 0x0, 0x0, 0x0, 0x0) 14:14:38 executing program 0: r0 = socket$kcm(0x2b, 0x8000000000001, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0xd, 0x4, &(0x7f00000033c0)=@framed={{}, [@alu={0x8000000201a7f19, 0x0, 0x6, 0x2, 0x1, 0x14}]}, &(0x7f0000000140)='GPL\x00', 0x1, 0xfb, &(0x7f0000000200)=""/251, 0x0, 0x0, [0x0, 0x0, 0x700000000000000]}, 0x48) 14:14:38 executing program 1: r0 = syz_open_dev$loop(&(0x7f00000004c0)='/dev/loop#\x00', 0x0, 0x105082) openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000012c0)={{{@in6, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@dev}}, &(0x7f00000013c0)=0xe8) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000001400)={0x0, 0x0}, &(0x7f0000001440)=0xc) setreuid(r2, r4) clone(0x4105, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = syz_open_procfs(r3, &(0x7f0000001280)='net/netfilter\x00') ioctl$EVIOCGREP(r5, 0x80084503, &(0x7f0000001480)=""/87) gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r6, &(0x7f00001edff0)={0x2, 0x10000004e20, @multicast1}, 0x10) connect$inet(r6, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) recvmmsg(r6, &(0x7f00000038c0)=[{{&(0x7f0000001a80)=@nfc_llcp, 0x80, &(0x7f00000020c0)=[{&(0x7f00000000c0)=""/4096, 0x1000}], 0x1, &(0x7f00000010c0)=""/164, 0xa4}}, {{&(0x7f0000002240)=@can, 0x80, &(0x7f0000002580), 0x0, &(0x7f0000001180)=""/246, 0xf6}}], 0x2ba, 0x40000002, 0x0) sendto$inet(r6, 0x0, 0x0, 0x0, &(0x7f000057bff0)={0x2, 0x4e20, @multicast1}, 0x10) ioctl$BLKDISCARD(r0, 0x40081271, &(0x7f0000000000)) 14:14:38 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r0, &(0x7f00000002c0)=[{&(0x7f0000000080), 0x156}], 0x1, 0x0) move_pages(0x0, 0x1, &(0x7f0000000300)=[&(0x7f0000005000/0x2000)=nil], &(0x7f0000000380)=[0x1], 0x0, 0x0) 14:14:39 executing program 5: r0 = socket$kcm(0x2b, 0x8000000000001, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0xd, 0x4, &(0x7f00000033c0)=@framed={{}, [@alu={0x8000000201a7f19, 0x0, 0x6, 0x2, 0x1, 0x90}]}, &(0x7f0000000140)='GPL\x00', 0x1, 0xfb, &(0x7f0000000200)=""/251, 0x0, 0x0, [0x0, 0x0, 0x700000000000000]}, 0x48) 14:14:39 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) unshare(0x8000400) r2 = eventfd(0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000180)={0x0, 0x0, 0x0, r2}) [ 385.380296] ldm_validate_privheads(): Disk read failed. [ 385.386146] Dev loop3: unable to read RDB block 1 [ 385.409647] loop3: unable to read partition table [ 385.448718] loop3: partition table beyond EOD, truncated [ 385.486558] loop_reread_partitions: partition scan of loop3 () failed (rc=-5) [ 385.651449] ldm_validate_privheads(): Disk read failed. [ 385.657226] Dev loop3: unable to read RDB block 1 [ 385.667970] loop3: unable to read partition table [ 385.673115] loop3: partition table beyond EOD, truncated [ 385.678603] loop_reread_partitions: partition scan of loop3 () failed (rc=-5) 14:14:39 executing program 3: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)={0x5, 0x8, 0x8000, 0x2000008000000001, 0x1}, 0x2c5) r1 = socket$kcm(0xa, 0x6, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000280)={r0, 0x6, 0x0, 0x0, &(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0, 0x0], 0x5}, 0x20) r2 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = bpf$OBJ_GET_PROG(0x7, &(0x7f00000000c0)={&(0x7f0000000040)='./file0\x00'}, 0x10) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000100)={0x0, r3, 0xc, 0x2}, 0x14) r4 = perf_event_open(0x0, 0x0, 0x10, r2, 0x3) sendmsg$kcm(r1, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000240)="33ad2bfcd4fca8b32b5f6daec5e470339708baa406c96f87443d8a0b6fa907b8520649efcc060288b88d9bff12121f5ab5b0f0704bc6", 0x36}, {&(0x7f00000002c0)="9f85279db449085bf24739bf5ddc5d94912f5fada3d0423dcea361d5faba1cb3b537d1277e35a377dc73403a03ed449ec8fc340f23c229ba7e095beee9aa19d79391d5852940282192f57598ea11f573258a41f8af", 0x55}, {&(0x7f0000000340)="54746c3d760caa6c86cba65ecababa936ff3a25150625c827a50c3650135d363a7c94846f4b6f117802b6664b6690e3c2b7c26718e8c65539f57ac4dd46de4a533bdffb2999ee5851b191fdaa5ea8c40d387d7cef6194abf25b2118ef2801e3b50406279e4fd21cb25d5d4ad1d8c3681c03785ff9e02e6bf5abd", 0x7a}, {&(0x7f0000000440)="88d0d86a2b0a3b371ea8920f27deb25b165980bb29e8b2492443e38024d38210e82e139ddbb27a920b2cdc8bf33644ee99561a58972a6d89f93da1c05694b96648a3a5d4d89e3b0d167f3954e5e636f2111a3fd0698dd1bf421937fcb8b6984a67acae6298422f3cd1d2a85543bc0c8b52a93ca6a621cf5f4246dc18b2865bd0ccb3d7ab27f25bc65c7c6edd70873438b148f821", 0x94}, {&(0x7f00000003c0)}, {&(0x7f0000000500)="9afd16fe22bcfd20be622c0392", 0xd}, {&(0x7f0000000540)="7171259467aae00f36fcf63bec062298636e60ae1090bba44fbbf3bd23cbead098609aa8c085b6d947a10c9a183a8548f92d84c5059c00fec41820fa57819c24c38292fd8ab3de974498fb84f77d317bd2c64d3ae7d7c57c79b3c46f9fde2e7ff547ede72dc5a78e164c186a7c4dc9c0dcbea79df9b9873ecb6509509b039177cba9b1d491ef7966c8718ec7974a61eec062a7858b77bf64d002484634ba3ee579713b16eba19d7c50d1d0ac9be3c142dea603aacaa726", 0xb7}], 0x7}, 0xc001) sendmsg$kcm(r1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20004010}, 0xfffffffffffffffc) sendmsg$kcm(r1, 0x0, 0x0) ioctl$PERF_EVENT_IOC_RESET(r4, 0x2403, 0x9) r5 = openat$cgroup(0xffffffffffffffff, 0x0, 0x200002, 0x0) recvmsg$kcm(r1, &(0x7f00000121c0)={&(0x7f000000fe00)=@xdp={0x2c, 0x0, 0x0}, 0x80, &(0x7f0000012100)=[{&(0x7f000000fe80)=""/160, 0xa0}, {&(0x7f000000ff40)=""/4096, 0x1000}, {&(0x7f0000010f40)=""/115, 0x73}, {&(0x7f0000010fc0)=""/87, 0x57}, {&(0x7f0000011040)=""/123, 0x7b}, {&(0x7f00000110c0)=""/4096, 0x1000}, {&(0x7f00000120c0)=""/33, 0x21}], 0x7, &(0x7f0000012180)=""/50, 0x32}, 0x141) r7 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000012200), 0x4) bpf$PROG_LOAD(0x5, &(0x7f00000122c0)={0x7, 0x2, &(0x7f00000009c0)=ANY=[@ANYBLOB="d339b250ed94120401b89cdc297c439af92a928b128b2ba8f797e4f18259ab5a185672f7f51b7b64ccf0bc6a6c17b546e2da858dcde97fea3a39241ea9fd3da0c0c5dd69e85c546d644926d6cfcd1f5e5148768ed8ec7f4c71895393c972cf74d6b778b71ad49b2844c238656fde9ec60b8a6ec14ad4ecbbe2d7b3182e2772dfe5c07bb687573fe3b1e43ad9d2b11a317a76fb359c5bab5259958be6fb8433bd8ff819f440076e334e00"/179], &(0x7f0000000880)='syzkaller\x00', 0xa4000000000, 0x2b, &(0x7f00000008c0)=""/43, 0x0, 0x7, [], r6, 0xa, r7, 0x8, &(0x7f0000012240)={0x1, 0x5}, 0x8, 0x10, &(0x7f0000012280)={0x4, 0xd, 0x3, 0xff}, 0x10}, 0x70) openat$cgroup_type(r5, &(0x7f0000000140)='cgroup.type\x00', 0x2, 0x0) bpf$OBJ_GET_MAP(0x7, 0x0, 0xfffffffffffffe6b) getpid() bpf$MAP_CREATE(0x2, &(0x7f0000000000)={0x3, 0x0, 0x73fffb, 0x0, 0x820000, 0x0}, 0x2c) 14:14:39 executing program 0: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0xff48) r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) sendmsg$kcm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000040)="2e0000001a008100a00f80ecdb4cb9040a4865160b000000d4126efb120003000200000040d819a9ffe200000000", 0x2e}], 0x1}, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, 0x0) 14:14:39 executing program 4: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r0, &(0x7f00000002c0)=[{&(0x7f0000000080), 0x156}], 0x1, 0x0) move_pages(0x0, 0x1, &(0x7f0000000300)=[&(0x7f0000005000/0x2000)=nil], &(0x7f0000000380)=[0x1], 0x0, 0x0) 14:14:39 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) unshare(0x8000400) r2 = eventfd(0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000180)={0x0, 0x0, 0x0, r2}) 14:14:39 executing program 5: socketpair(0x22, 0x7, 0xfffffffffffffffe, &(0x7f0000000080)={0x0, 0x0}) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4e, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getpid() ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x89a0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$kcm(r0, &(0x7f0000002d40)={&(0x7f00000015c0)=@rc={0x1f, {0x5, 0x7, 0x9, 0x7ff, 0x0, 0x8}, 0x1}, 0x80, &(0x7f0000002a40)=[{&(0x7f00000029c0)="4a453fa193c19cfe12bb05e6ec6524d77639b2abf083f9b3091a8228fb77023804ab65bc974f974a78bd2e8be1a9f7256c6d143212e61e938b8bfdafc3abe41cf3867b5385a9d46d72821b99aac2e2ec592e5faf09385c4cd5f8d338eab510d22b101851a349a7", 0x67}], 0x1}, 0x40) r2 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r3, 0x107, 0xf, &(0x7f0000001640), 0x4) recvmsg(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000001580)=[{&(0x7f0000000480)=""/4096, 0x1000}], 0x1}, 0x0) ioctl$PERF_EVENT_IOC_ID(r2, 0x80082407, &(0x7f0000000000)) sendmsg(r3, &(0x7f0000000440)={&(0x7f00000001c0)=@nfc={0x104, 0x2, 0x7811000000000000}, 0x80, &(0x7f0000000000), 0xdb, &(0x7f00000002c0), 0x0, 0xa011}, 0x2000000) 14:14:39 executing program 4: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r1 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r1, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r1, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d646", 0x2a}], 0x1}, 0x0) 14:14:39 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000640)={0x2, 0x2008004e20, @broadcast}, 0x10) sendto$inet(r0, 0x0, 0xfffffffffffffeeb, 0x20000000, &(0x7f00000000c0)={0x2, 0x4e20}, 0x10) sendto$inet(r0, &(0x7f0000000040)='z', 0x1, 0x8000204007ffd, 0x0, 0x0) write$binfmt_elf32(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="7f"], 0x1) recvfrom(r0, 0x0, 0xfeed, 0x0, 0x0, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r0, 0x541b, &(0x7f0000000000)) 14:14:39 executing program 2: r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0) bind$rose(r0, &(0x7f0000000000)=@full={0xb, @dev, @null, 0x0, [@null, @null, @netrom, @netrom, @default, @null]}, 0x1c) [ 385.913216] Dead loop on virtual device ip6_vti0, fix it urgently! 14:14:39 executing program 1: r0 = syz_open_dev$loop(&(0x7f00000004c0)='/dev/loop#\x00', 0x0, 0x105082) openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000012c0)={{{@in6, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@dev}}, &(0x7f00000013c0)=0xe8) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000001400)={0x0, 0x0}, &(0x7f0000001440)=0xc) setreuid(r2, r4) clone(0x4105, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = syz_open_procfs(r3, &(0x7f0000001280)='net/netfilter\x00') ioctl$EVIOCGREP(r5, 0x80084503, &(0x7f0000001480)=""/87) gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r6, &(0x7f00001edff0)={0x2, 0x10000004e20, @multicast1}, 0x10) connect$inet(r6, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) recvmmsg(r6, &(0x7f00000038c0)=[{{&(0x7f0000001a80)=@nfc_llcp, 0x80, &(0x7f00000020c0)=[{&(0x7f00000000c0)=""/4096, 0x1000}], 0x1, &(0x7f00000010c0)=""/164, 0xa4}}, {{&(0x7f0000002240)=@can, 0x80, &(0x7f0000002580), 0x0, &(0x7f0000001180)=""/246, 0xf6}}], 0x2ba, 0x40000002, 0x0) sendto$inet(r6, 0x0, 0x0, 0x0, &(0x7f000057bff0)={0x2, 0x4e20, @multicast1}, 0x10) ioctl$BLKDISCARD(r0, 0x40081271, &(0x7f0000000000)) 14:14:39 executing program 5: socketpair(0x22, 0x7, 0xfffffffffffffffe, &(0x7f0000000080)={0x0, 0x0}) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4e, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getpid() ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x89a0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$kcm(r0, &(0x7f0000002d40)={&(0x7f00000015c0)=@rc={0x1f, {0x5, 0x7, 0x9, 0x7ff, 0x0, 0x8}, 0x1}, 0x80, &(0x7f0000002a40)=[{&(0x7f00000029c0)="4a453fa193c19cfe12bb05e6ec6524d77639b2abf083f9b3091a8228fb77023804ab65bc974f974a78bd2e8be1a9f7256c6d143212e61e938b8bfdafc3abe41cf3867b5385a9d46d72821b99aac2e2ec592e5faf09385c4cd5f8d338eab510d22b101851a349a7", 0x67}], 0x1}, 0x40) r2 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r3, 0x107, 0xf, &(0x7f0000001640), 0x4) recvmsg(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000001580)=[{&(0x7f0000000480)=""/4096, 0x1000}], 0x1}, 0x0) ioctl$PERF_EVENT_IOC_ID(r2, 0x80082407, &(0x7f0000000000)) sendmsg(r3, &(0x7f0000000440)={&(0x7f00000001c0)=@nfc={0x104, 0x2, 0x7811000000000000}, 0x80, &(0x7f0000000000), 0xdb, &(0x7f00000002c0), 0x0, 0xa011}, 0x2000000) 14:14:39 executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(cast5)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000180)='\x00\x00\x00\x00\x00', 0x5) r1 = accept$alg(r0, 0x0, 0x0) write$binfmt_script(r1, &(0x7f0000000240)=ANY=[@ANYRES16], 0x2) recvmmsg(r1, &(0x7f0000002cc0)=[{{&(0x7f00000001c0)=@in={0x2, 0x0, @broadcast}, 0x80, 0x0}}, {{0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f00000004c0)=""/181, 0xb5}, {&(0x7f0000000580)}, {&(0x7f00000005c0)=""/4, 0x4}, {&(0x7f0000000600)=""/207, 0xcf}, {&(0x7f0000000700)=""/229, 0xe5}, {&(0x7f0000000800)=""/193, 0xc1}, {&(0x7f0000000900)=""/12, 0xc}, {&(0x7f0000000940)=""/170, 0xaa}], 0x8}}, {{&(0x7f0000000a80)=@in={0x2, 0x0, @empty}, 0x80, &(0x7f0000000d00)=[{&(0x7f0000000b00)=""/73, 0x49}, {&(0x7f0000000b80)=""/197, 0xc5}, {&(0x7f0000000c80)=""/127, 0x7f}], 0x3, &(0x7f0000000d40)=""/39, 0x27}}, {{&(0x7f0000000d80)=@hci, 0x80, &(0x7f00000013c0)=[{&(0x7f0000000e00)=""/230, 0xe6}, {&(0x7f0000000f00)=""/30, 0x1e}, {&(0x7f0000000f40)=""/211, 0xd3}, {&(0x7f0000001040)=""/41, 0x29}, {&(0x7f0000001080)=""/239, 0xef}, {&(0x7f0000001180)=""/55, 0x37}, {&(0x7f00000011c0)=""/202, 0xca}, {&(0x7f0000001380)=""/12, 0xc}], 0x8, &(0x7f0000001440)=""/114, 0x72}}, {{&(0x7f00000014c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @remote}}}, 0x80, &(0x7f0000002ac0)=[{&(0x7f0000001540)=""/4096, 0x1000}, {&(0x7f0000002540)=""/72, 0x48}, {&(0x7f00000025c0)=""/173, 0xad}, {&(0x7f0000002680)=""/54, 0x36}, {&(0x7f00000026c0)=""/42, 0x2a}, {&(0x7f0000002700)=""/175, 0xaf}, {&(0x7f00000027c0)=""/179, 0xb3}, {&(0x7f0000002880)=""/113, 0x71}, {&(0x7f0000002900)=""/151, 0x97}, {&(0x7f0000002e00)=""/226, 0xe2}], 0xa}}], 0x5, 0x0, 0x0) 14:14:39 executing program 4: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/sequencer2\x00', 0x10000003f7d, 0x0) write$sndseq(r0, &(0x7f0000000040)=[{0x81, 0x3, 0x0, 0x0, @time={0x0, 0x989680}, {}, {}, @queue}], 0x8) 14:14:39 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") syz_emit_ethernet(0x300500, &(0x7f0000000000)={@local, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x300049, 0x3c, 0x0, @ipv4={[], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff88, 0xd, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) 14:14:39 executing program 2: mq_open(&(0x7f00000002c0)='\\\xf7\xa0\xcc\x16H-o\x007\xe6\xb3\x1a\x8eiz\xdd06P\xd4\x88\x00s\xefu\xdfa\x01y\xde\xc26\xaa\x04\xe9F\x87y\xba\a\x00\x00\x00\x00\x00\x00\x005\x98U\xb4\x9b\x88\x9b\xb5\xe4\x9b5\x8ey:oz\xf5\'f\xd6\xfe\x93\xca\x06r\xac\x1b\x8a\x87\xcafw\xd5\"\x0f\xb7|\xb6\x13\xb3\xdb\x91\x04\xd1j\xa1\xcal\xc7jt\xe7\xbdK\xdcR&u{\x03\xf8[\x01\x03$Wl@\xc1\xc8e\\s\x9f\xc1\xa6\x8d\xf5\xe2\xbc\xb6\xe5\xedF\xc8(\x9eH\xeau\xe7\x85\xeb]d\x97\xcd#;\x10\xb9\x182\xcf^1v|\x1cA\x9dFF\xcd\x88?%', 0x843, 0x0, 0x0) 14:14:39 executing program 2: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair(0x8000000000001e, 0x5, 0x0, &(0x7f000000dff8)={0xffffffffffffffff, 0xffffffffffffffff}) writev(r0, &(0x7f0000000240)=[{&(0x7f0000000140)="a3", 0x1}], 0x1) write(r0, 0x0, 0x0) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000785000), 0x34a) writev(r0, &(0x7f000063e000)=[{&(0x7f00000000c0)="da", 0x1}], 0x1) sendmmsg$alg(r1, &(0x7f0000236fc8)=[{0x8000000, 0x0, &(0x7f00000fff80), 0xc, &(0x7f00001e1e78)}], 0x4924924924926c8, 0xf0ff7f) 14:14:39 executing program 4: r0 = socket$alg(0x26, 0x5, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000180)="ab553fec94248c32e27d04000000288a", 0x10) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 14:14:39 executing program 3: symlink(&(0x7f0000000300)='..', &(0x7f00000003c0)='./file0\x00') mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0) open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) 14:14:39 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000080)={0x0, 0xffffffffffffff7c, &(0x7f00000bfff0)={&(0x7f0000006440)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2, [0x10]}, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 14:14:39 executing program 5: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f0000000040)="240000005e001f021007f4f900ff0f000a04f333674cc2f5110800feff01010002080003", 0x24) readv(r1, &(0x7f0000001540)=[{&(0x7f0000000140)=""/4096, 0x1000}], 0x1) 14:14:40 executing program 5: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) move_pages(0x0, 0x0, 0x0, 0x0, 0x0, 0x90abd686b9ddbc9f) 14:14:40 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0xfffffffffffffd62, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="400000001400090500040000000000000a000000", @ANYRES32=r1, @ANYBLOB="140006000000000000000040000000000000000014000200fe8000000000000000000000000000aa"], 0x40}}, 0x0) 14:14:40 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={0x2, 0x3, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x18, 0x0, 0x0, 0x0, @in={0x2, 0x0, @multicast1}}]}, 0x28}}, 0x0) 14:14:40 executing program 4: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) getsockopt$IP_VS_SO_GET_INFO(0xffffffffffffffff, 0x0, 0x481, &(0x7f0000000000), 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000000)='/dev/snd/midiC#D#\x00', 0x2, 0x101000) read(r0, 0x0, 0x0) r1 = openat$ashmem(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ashmem\x00', 0x0, 0x0) getresgid(0x0, 0x0, 0x0) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x2, 0x0) dup2(r1, r2) 14:14:40 executing program 0: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000000)=0xfc, 0x13e) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'syz_tun\x00', 0x0}) bind$packet(r0, &(0x7f0000000a00)={0x11, 0x0, r1}, 0x14) sendto$inet6(r0, &(0x7f0000000040)="0303000003004c0000001100fff55b4202938207d9fb3780398d5375000000007929301ee616d5c01843e06590080053a6e385472da7222a2bb401000000c3b50035110f118d0000f5cfe606f6925cbf34658ea132797b1abc5dc62600009b000000fbffffff0000", 0xffd4, 0x24000000, 0x0, 0x853c96fc2de75844) setsockopt$packet_fanout_data(r0, 0x107, 0x16, 0x0, 0x0) 14:14:40 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000000)=0x0) wait4(r0, &(0x7f00000000c0), 0x20000006, &(0x7f0000000100)) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x2102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() clone(0x3000000a0160101, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x200000000000011) wait4(0x0, 0x0, 0x0, 0x0) [ 387.135234] ptrace attach of "/root/syz-executor.5"[13231] was attempted by "/root/syz-executor.5"[13234] 14:14:40 executing program 1: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000000)) wait4(0x0, &(0x7f00000000c0), 0x20000006, &(0x7f0000000100)) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x2102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() clone(0x3000000a0160101, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x200000000000011) wait4(0x0, 0x0, 0x0, 0x0) 14:14:42 executing program 2: 14:14:42 executing program 4: sendmsg(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$null(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = memfd_create(&(0x7f0000000380)='\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00v\x8e\x05\xf7\xc1U\xad}\xc6\x94|W>Zi$Nv8,\n\xa6=W^\xa3Y\x7f\x8b\x17(\'~\xf7k0TM{\xa9-\xcf\x97\x8f\x1f\x81\xdc\x1b\x7f\x8f{4Q\xda\xda\x02\xec\xb4\xf1\xdd\xcc\x8bRA\xda\x89Efn\x00s\xc2Zb\x01\x00M\xbe\xa3z\xab\xd3\xeb\x98\x88\xc4\xc6)A\x9fP\x93zhH\xe0\xd2\x81\xdb\xeeV\x8cM\xe9\xa06\xc2o\x19\"\xf6Iq\xd4\xdf\x97\xfb\xab\x04\xe8\xceI8\xb3\x1d\xcf%\x9bK\xc6\t\x01\xe1\x86a\xfa\xb8\xfb)\x88\xcd+\xc2`\xc2\xf5r5>k\xb0\xa0\x02\xfc\x16MO\x18\x9b\x06\x80b\xd1\x01\x00\x00\x00\x00\x00\x00\x00@\f\fL\xa5{Tk\x940\x17.\xa56.\xe0\x14\x1b=\xf0j\xd25\xe8\x15\xd8\x9e\xea\xd3\xd9G4\t\xc0\x9c.\'\xa9R3z$\xf2\x01\x88\xc0\x13\x12<\xc01j3\xd8\xb4CE7s\xe4\xa0\x9e\xdd\x801\x12M\xee\x13\xce\x9cu(\x8f.\xc83\xc7\xe6j\xf5\xb1\x9a\x00\x00\x00\x00\x00\x00\x00', 0x0) pwritev(r0, &(0x7f0000000340)=[{&(0x7f00000001c0)='\'', 0x1}], 0x1, 0x81806) r1 = dup(r0) finit_module(r1, 0x0, 0x0) 14:14:42 executing program 1: r0 = syz_open_dev$loop(&(0x7f00000004c0)='/dev/loop#\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x36b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) readahead(r0, 0x0, 0x0) 14:14:42 executing program 5: 14:14:42 executing program 3: 14:14:42 executing program 0: 14:14:43 executing program 1: r0 = syz_open_dev$loop(&(0x7f00000004c0)='/dev/loop#\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x36b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) readahead(r0, 0x0, 0x0) 14:14:43 executing program 3: 14:14:43 executing program 0: 14:14:43 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = socket$inet6(0xa, 0x400000000001, 0x0) r2 = dup(r1) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r2, 0x0, 0x0, 0x20000008, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$inet_tcp_int(r2, 0x6, 0x2000000000000013, &(0x7f0000000180)=0x1, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000380)=0x1, 0x4) r3 = open(&(0x7f0000000280)='./file0\x00', 0x110000141042, 0x0) write$P9_RREADDIR(r2, &(0x7f00000000c0)=ANY=[@ANYBLOB="ac"], 0x1) ftruncate(r3, 0x10099b7) sendfile(r1, r3, 0x0, 0x88000fc000000) ioctl(r0, 0x8001000008912, &(0x7f0000000040)="0800b5055e0bcfe87b0071") 14:14:43 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) mmap(&(0x7f0000077000/0x4000)=nil, 0x4000, 0x0, 0x12, r0, 0x0) sendmsg$NET_DM_CMD_START(0xffffffffffffffff, &(0x7f0000000040)={&(0x7f0000000000), 0xc, 0x0}, 0x0) r1 = memfd_create(&(0x7f0000000180)='}\x00N\x06\x94\xe2\xe0\xe3\xab\xe1\x03\x1e\xc8\x8a\x17\x88\';g\xdd\x04r\x0e\x8d\xff{+\a/\xd2\x93\xa7\xcc=6\x15.f\xf4\xa2\x93\x91d&\x17\xc7\x82\x89\xe8\x95\"\xa9W\xbd\x91\x96\xd7=]\x9e\xe6\xf1I\v\x91z\xfa\xeb\xd1\x81\xc2j\x10 v\x93\xc7\xc9+\xc7\x8ds\x8f\x15\x8aR\xc3j\x80\xc3H\xf3%\'4\x11\x85a\xc6\x96\xd0gf*P\xfa\x1aET\x01\x05Y\xcaY\xc0!\xcf\xae\xb1\x9f{\xc0\x14F^\x8f\x8ej\xa17\x02\xdb\xd62\xdc\xadn\t\xa6z\xad\x9b\xbcf\x96\n\x81*\xcf0\x11\xaf\xbd\xd5\v\x1f\x10fuY\xc4\xd3\xf6V8\xc67\x85\xe8\xdfZ4Y\x9c\xdb^\xf9\xe3uv\xc9\xc6s\xde3E\x9c\fE\xd2\xce\xf5\x06\xc0\x8b\x86\xe0h\xae\xce\xb4\x16\x0f\xd4XRr\xcb0{R\"\xf6}\xb1s\xac\x7f\x80\xff{bM\x93\x90\xae\x1d1@G\"n3:5\xba\xbc[6 C\xad\x13\xb6;\xbfHZa\x81h\x91(\xb2\x13\xd6\xbe\xb2u.\xd4J\x9d\x1c\xd7\x8d+\v<]\xb0\xb6a\xe6A\x93\x1c\x98/\xdb\x11\xf7\xd9)\xe9?\xb8\xd1\xfe\x912\x8041\x82\x89\xad\x12v\x12\b%\xd1>\xb8\x99p\xd731\xae`!\xab3\nI\xfc\x03*\xc7\xd1x\xe6\xc3\xf4 d\xa4\xb0\xb2?\xf1\xd7\x81\xb7\xc2\x15\xbd\x8f\xf3\xa6;\br\f4\xfd\xce\x8b\x90\xf6\xf7\x95\xc7\x1f\xe2~\x14\xdf6+P\x10\xb5\x83,\xf6,\x82@b!\xb5N\xfd\xe0\xeek\xe3\x1a\rJjT\xa5\x1cYt2L\x02\x1a.v\xd6\x01\x7fd\xf3*~\b,}\xc3m}\xf8\xe4\xec', 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x6) mmap(&(0x7f00002e4000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) name_to_handle_at(r1, &(0x7f00002e4000)='./file\xff\xff', &(0x7f0000000000)=ANY=[], &(0x7f0000001ffc), 0x1400) [ 389.416623] audit: type=1400 audit(1564496083.013:64): avc: denied { module_load } for pid=13258 comm="syz-executor.4" path=2F6D656D66643A202864656C6574656429 dev="tmpfs" ino=50494 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:tmpfs_t:s0 tclass=system permissive=1 14:14:43 executing program 4: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup\x00\f#\x9f\xd0\x85\xac\xc4\x9b\x81-\xb3\xd7=C\xea\x1d0\x97>\xceD\\\x8b\xc3\x94p\xa6\xd3xE\x12$\xbd5\x92:\x00\xe5aU\xe4c\x13d\xb8~\x1d\a\xa9F\xe85U\xf5*', 0x200002, 0x0) fchdir(r0) r1 = open(&(0x7f0000000240)='.\x00', 0x0, 0x0) getdents64(r1, 0x0, 0xfffffffffffffe70) r2 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r2) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) getdents64(r1, &(0x7f0000000140)=""/54, 0x36) 14:14:43 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000010c0)="0800b5055e0bcfe87b0071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r2 = socket$nl_route(0x10, 0x3, 0x0) pread64(r1, &(0x7f0000000000)=""/39, 0x74, 0x0) dup2(r0, r1) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x28}}, 0x0) 14:14:43 executing program 0: r0 = syz_open_dev$ndb(&(0x7f0000000100)='/dev/nbd#\x00', 0x0, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f00000000c0)="0800a1695e0bcfe87b0071") socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r2, r0) 14:14:43 executing program 1: r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000700)='/dev/ashmem\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x218, &(0x7f0000000180)=0x9) syz_open_procfs$namespace(0x0, 0x0) ioctl$TIOCLINUX4(0xffffffffffffffff, 0x541c, 0x0) fcntl$getown(0xffffffffffffffff, 0x9) openat$zero(0xffffffffffffff9c, 0x0, 0x0, 0x0) write$selinux_attr(0xffffffffffffffff, 0x0, 0x0) request_key(0x0, 0x0, 0x0, 0xfffffffffffffffe) getsockopt$IP_VS_SO_GET_INFO(0xffffffffffffffff, 0x0, 0x481, 0x0, 0x0) read(r0, 0x0, 0x0) 14:14:43 executing program 2: poll(0x0, 0x0, 0x42) r0 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r0, 0x0, 0xfd1d, 0x0, 0x0, 0x800e00509) r1 = dup(r0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) dup2(r1, r2) ppoll(&(0x7f0000000040)=[{}], 0x1, 0x0, 0x0, 0x0) shutdown(r2, 0x0) [ 389.587478] audit: type=1400 audit(1564496083.193:65): avc: denied { map } for pid=13276 comm="syz-executor.2" path="socket:[50028]" dev="sockfs" ino=50028 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=tcp_socket permissive=1 14:14:43 executing program 0: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0x0, 0x0, 0x0) getsockopt$sock_timeval(r0, 0xffff, 0x1005, 0x0, &(0x7f0000000240)) recvfrom$inet(r0, 0x0, 0x0, 0x0, 0x0, 0x800e00807) 14:14:43 executing program 1: r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) poll(&(0x7f00000005c0), 0x200000000000003d, 0x52) r1 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r1, 0x0, 0xfffffd3c, 0x0, 0x0, 0x800e00718) ppoll(&(0x7f0000000080)=[{r1}, {r0}, {}, {}, {}, {r1}], 0x6, 0x0, 0x0, 0x0) shutdown(r1, 0x0) [ 389.743693] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 389.750516] audit: type=1400 audit(1564496083.353:66): avc: denied { ioctl } for pid=13292 comm="syz-executor.4" path="socket:[50561]" dev="sockfs" ino=50561 ioctlcmd=0x8912 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 [ 389.754935] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 14:14:43 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = dup(r0) recvfrom(r0, &(0x7f00000000c0)=""/65, 0x41, 0x0, 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r2, 0x0, 0x73a0b1b, 0x0, 0x0, 0x800e00549) shutdown(r1, 0x0) dup(0xffffffffffffffff) shutdown(0xffffffffffffffff, 0x0) readv(r2, &(0x7f0000000080)=[{&(0x7f0000000000)=""/53, 0x35}], 0x1) shutdown(r2, 0x0) [ 389.793271] IPv6: ADDRCONF(NETDEV_UP): vxcan0: link is not ready [ 389.812759] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 389.819772] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 389.903302] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 389.911666] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 389.918405] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready 14:14:43 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000010c0)="0800b5055e0bcfe87b0071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r2 = socket$nl_route(0x10, 0x3, 0x0) pread64(r1, &(0x7f0000000000)=""/39, 0x74, 0x0) dup2(r0, r1) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x28}}, 0x0) [ 390.072293] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 390.079880] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 390.087104] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready 14:14:43 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000010c0)="0800b5055e0bcfe87b0071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r2 = socket$nl_route(0x10, 0x3, 0x0) pread64(r1, &(0x7f0000000000)=""/39, 0x74, 0x0) dup2(r0, r1) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x28}}, 0x0) [ 390.269061] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 390.277299] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 390.284595] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready 14:14:44 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = socket$inet_udplite(0x2, 0x2, 0x88) shutdown(0xffffffffffffffff, 0x0) setsockopt$sock_linger(r0, 0xffff, 0x80, &(0x7f0000000080), 0x8) recvfrom$inet(r1, 0x0, 0xff4c, 0x0, 0x0, 0x800e00615) shutdown(r1, 0x0) 14:14:44 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) poll(&(0x7f0000000080)=[{r0}], 0x1, 0x42) r1 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r1, 0x0, 0xfd1d, 0x0, 0x0, 0x800e00509) r2 = dup(r1) r3 = socket$inet_udplite(0x2, 0x2, 0x88) dup2(r2, r3) ppoll(&(0x7f0000000040)=[{}], 0x1, 0x0, 0x0, 0x0) shutdown(r3, 0x0) 14:14:44 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000010c0)="0800b5055e0bcfe87b0071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r2 = socket$nl_route(0x10, 0x3, 0x0) pread64(r1, &(0x7f0000000000)=""/39, 0x74, 0x0) dup2(r0, r1) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x28}}, 0x0) 14:14:44 executing program 0: openat$audio(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000080)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0xfd91) mmap(&(0x7f0000ff0000/0x10000)=nil, 0x10000, 0x0, 0x11011, r0, 0x0) 14:14:44 executing program 1: openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x40000000806, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000080)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0xfd91) mmap(&(0x7f0000ff0000/0x10000)=nil, 0x10000, 0x0, 0x11011, r0, 0x0) mremap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x3000, 0x3, &(0x7f0000ff7000/0x3000)=nil) [ 390.549988] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 390.557785] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 390.564841] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready 14:14:44 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca50d5e0bcfe47bf070") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000003c0)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000400)={0x2c, r2, 0x1, 0x0, 0x0, {{}, 0x0, 0x4102, 0x0, {0x10, 0x13, @udp='udp:syz1\x00'}}}, 0x2c}}, 0x0) 14:14:44 executing program 2: r0 = creat(&(0x7f0000000680)='./file1\x00', 0x0) r1 = creat(&(0x7f0000000040)='./file1\x00', 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) write$USERIO_CMD_SET_PORT_TYPE(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = getpid() move_pages(r3, 0x1, &(0x7f0000000180)=[&(0x7f0000c3e000/0x1000)=nil], 0x0, 0x0, 0x6) r4 = openat$ion(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ion\x00', 0x0, 0x0) request_key(0x0, 0x0, 0x0, 0xfffffffffffffffb) r5 = socket$kcm(0x29, 0x0, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, 0x0) getsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000300), 0x10) ioctl$ION_IOC_ALLOC(r4, 0xc0184900, &(0x7f00000004c0)={0x1000000a, 0xfffbffffffffffff, 0x1, 0xffffffffffffffff}) ioctl$ASHMEM_PURGE_ALL_CACHES(0xffffffffffffffff, 0x770a, 0x0) ioctl$sock_inet_SIOCGIFDSTADDR(r5, 0x8917, &(0x7f0000000100)={'bcsf0\x00', {0x2, 0x4e24, @broadcast}}) mmap(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x0, 0x811, r6, 0x0) eventfd2(0x0, 0x0) socket(0x0, 0x4, 0x6db6) r7 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000040)={0x7, 0x0}) getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f00000000c0), &(0x7f00000001c0)=0xc) ioctl$DRM_IOCTL_SG_ALLOC(r7, 0xc0106438, &(0x7f0000000080)={0x3, r8}) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r5, 0xc0305615, 0x0) ioctl(r2, 0x1000008912, &(0x7f0000000100)="11dca50d5e0bcfe47bf070") fallocate(r1, 0x0, 0x0, 0x4005ef0) fallocate(r0, 0x20, 0x0, 0x80000008000) 14:14:44 executing program 0: openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x40000000806, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000080)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0xfd91) mmap(&(0x7f0000ff0000/0x10000)=nil, 0x10000, 0x0, 0x11011, r0, 0x0) mprotect(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x6) mprotect(&(0x7f0000ff8000/0x4000)=nil, 0x4000, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, 0x0}}, 0x20) 14:14:44 executing program 5: perf_event_open(&(0x7f0000000180)={0x400000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000340)='tls\x00', 0x4) close(r0) 14:14:44 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000010c0)="0800b5055e0bcfe87b0071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r2 = socket$nl_route(0x10, 0x3, 0x0) pread64(r1, &(0x7f0000000000)=""/39, 0x74, 0x0) dup2(r0, r1) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x28}}, 0x0) 14:14:44 executing program 1: openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x40000000806, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000080)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0xfd91) mmap(&(0x7f0000ff0000/0x10000)=nil, 0x10000, 0x0, 0x11011, r0, 0x0) mremap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x3000, 0x3, &(0x7f0000ff7000/0x3000)=nil) 14:14:44 executing program 5: perf_event_open(&(0x7f0000000180)={0x400000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/\x02roup.stap\x00', 0x2761, 0x0) ioctl$TUNSETTXFILTER(0xffffffffffffffff, 0x400454d1, &(0x7f0000000080)=ANY=[@ANYBLOB="00ffffffff"]) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0xc0c0583b, 0x20000001) openat$cgroup_type(0xffffffffffffffff, 0x0, 0x2, 0x0) 14:14:44 executing program 0: mkdir(&(0x7f0000000200)='./file0\x00', 0x0) r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) chown(&(0x7f00000001c0)='./file0\x00', r1, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000380)={{}, {}, [{0x2, 0x0, r1}], {}, [], {0x10, 0x2}}, 0x2c, 0x0) chdir(&(0x7f0000000340)='./file0\x00') [ 390.883450] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 390.933009] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 390.958623] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready 14:14:44 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) clock_gettime(0x7, &(0x7f0000000000)={0x0}) setsockopt$sock_timeval(r0, 0x1, 0x42, &(0x7f0000000080)={r1}, 0x10) listen(r0, 0x5) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r3 = socket$inet6_sctp(0xa, 0x5, 0x84) accept4(r0, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r3, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) 14:14:44 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$rxrpc(0x21, 0x2, 0xa) setsockopt$RXRPC_SECURITY_KEYRING(r0, 0x110, 0x2, &(0x7f0000000000)=')\x00', 0x2) 14:14:44 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000000)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x73, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 14:14:44 executing program 5: perf_event_open(&(0x7f0000000180)={0x400000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/\x02roup.stap\x00', 0x2761, 0x0) ioctl$TUNSETTXFILTER(0xffffffffffffffff, 0x400454d1, &(0x7f0000000080)=ANY=[@ANYBLOB="00ffffffff"]) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0xc0c0583b, 0x20000001) openat$cgroup_type(0xffffffffffffffff, 0x0, 0x2, 0x0) 14:14:44 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000010c0)="0800b5055e0bcfe87b0071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) socket$nl_route(0x10, 0x3, 0x0) pread64(r1, &(0x7f0000000000)=""/39, 0x74, 0x0) dup2(r0, r1) [ 391.451642] kvm: emulating exchange as write 14:14:45 executing program 2: pipe(0x0) write(0xffffffffffffffff, &(0x7f00000001c0), 0xfffffef3) read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0x50c7e3e3) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x6}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 14:14:45 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$rxrpc(0x21, 0x2, 0xa) setsockopt$RXRPC_SECURITY_KEYRING(r0, 0x110, 0x2, &(0x7f0000000000)=')\x00', 0x2) 14:14:45 executing program 1: ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) syz_open_procfs(0x0, &(0x7f0000000540)='net/igmp\x00') pipe(0x0) setxattr$security_evm(&(0x7f0000000080)='./file0\x00', &(0x7f0000000340)='security.evm\x00', &(0x7f00000004c0)=@sha1={0x1, "595d3b2c5b48d8b2ae9febb8bb2048f04b226133"}, 0x15, 0x3) ioctl$EVIOCSCLOCKID(0xffffffffffffffff, 0x400445a0, 0x0) ioctl$EVIOCSCLOCKID(0xffffffffffffffff, 0x400445a0, 0x0) read(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x6}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) 14:14:45 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair(0x8000000000001e, 0x5, 0x0, &(0x7f000000dff8)={0xffffffffffffffff, 0xffffffffffffffff}) writev(r0, &(0x7f0000000240)=[{&(0x7f0000000140)="a3", 0x1}], 0x1) write(r0, 0x0, 0x0) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000785000), 0x34a) writev(r0, &(0x7f000063e000)=[{&(0x7f00000000c0)="da", 0x1}], 0x1) sendmmsg$alg(r1, &(0x7f0000236fc8)=[{0x8000000, 0x0, &(0x7f00000fff80), 0xc, &(0x7f00001e1e78)}], 0x4924924924926c8, 0xf0ff7f) 14:14:45 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000040)='/dev/loop#\x00', 0x0, 0x1100082) r1 = memfd_create(&(0x7f0000000200)='/\xd2\a\xaa(\t0\xedj\\\x14E\x80VfM\'\x80\xb1\xce\x86Wp#\x00\xc2\xf8\x03\xb5\a\x9e\x83X\x8e?yE\xec\xeb2-\xbb\vO\xf9P\xd7\xd7\xf5\xa8\xaeW\x8e\xe5Q\xd9\x9ew\x8e}\x868\x9f2\xf9\x17\xf5\xf8;\xd5g\bQ\xf1a\x0e$9[k@\x0fj\x83\x9d\xb1\xd5\xd7\xa5\xc1\x05ox\xe4\xdc6\x04\xc1n\xf6\xf8\x1c\xf2\xa9\xbb\xbc\x12u\xfd\xeb0bK\xb8A\x93\xb3\x8co\a\xe1}R\xa6x\xde\xb5;\xea\xa0', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f00000001c0)='\'', 0x1}], 0x1, 0x1081806) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) pwritev(r0, &(0x7f0000000900)=[{&(0x7f0000000140)="81", 0x1}], 0x1, 0x0) 14:14:45 executing program 0: pipe(&(0x7f0000000300)={0xffffffffffffffff}) write(0xffffffffffffffff, 0x0, 0x0) setxattr$security_evm(0x0, &(0x7f0000000340)='security.evm\x00', &(0x7f00000004c0)=@sha1={0x1, "595d3b2c5b48d8b2ae9febb8bb2048f04b226133"}, 0x15, 0x0) ioctl$EVIOCSCLOCKID(0xffffffffffffffff, 0x400445a0, 0x0) read(r0, &(0x7f0000000200)=""/250, 0x50c7e3e3) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x6}, 0x1c) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0x0) 14:14:45 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$nl_generic(0x10, 0x3, 0x10) recvmsg(r1, &(0x7f0000000500)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="140000001000010700000000000000001f000000e1775390ccc57b41d122c4f7f492a62fc51c9a59d4c663a832b3c9e34bb246dfb98684d7afe692dae3bd61582855650542341c8b40ebc746ba8fa5117e1e3a40db79aa0c7bcd21e27cc0e103f0d88a65dc199f3c4b4d86f78b111637a567"], 0x14}}, 0x0) 14:14:45 executing program 4: r0 = openat$md(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/md0\x00', 0x0, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r0) 14:14:45 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x60f8, 0x80000001, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.stat\x00', 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000059c0)={0x0, 0xd, &(0x7f0000000380)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x8}, [@map={0x18, 0x0, 0x1, 0x0, r1}, @map={0x18, 0xa}, @call, @jmp={0x5, 0x8, 0xe}, @ldst={0x0, 0x2, 0x0, 0xb, 0xf}, @alu={0x0, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffff3}, @ldst={0x2, 0x0, 0x7, 0xf}, @exit]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000005940)={0x0, 0x2}, 0x8, 0x10, 0x0}, 0x70) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000002c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)}, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(r2, 0x4030582a, &(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r3 = gettid() r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000300)='./cgroup.net/syz0\x00', 0x200002, 0x0) r5 = openat$cgroup_ro(r4, &(0x7f0000000380)='cpuacct.usage_user\x00', 0x0, 0x0) perf_event_open$cgroup(0x0, r5, 0x10, 0xffffffffffffffff, 0x3) perf_event_open(0x0, r3, 0x0, 0xffffffffffffffff, 0x0) 14:14:45 executing program 1: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x10, 0x800000000002, 0x0) recvmsg$kcm(r0, &(0x7f0000002c00)={&(0x7f00000017c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, 0x80, &(0x7f0000002b80)=[{&(0x7f0000001900)=""/210, 0x4260966a}], 0x1, 0x0, 0x20d}, 0x0) recvmsg(r0, &(0x7f0000000c40)={0x0, 0x0, 0x0}, 0x0) sendmsg$kcm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="160000001a0081aee4050c00000f00fe078bc36f1600", 0x16}], 0x1}, 0x0) 14:14:45 executing program 4: r0 = socket$kcm(0x11, 0x5, 0x300) ioctl$sock_kcm_SIOCKCMUNATTACH(r0, 0x5452, &(0x7f00000004c0)={r0}) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmsg$kcm(r0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x12, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x41f00, 0x2, [], 0x0, 0xd, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) openat$cgroup_int(r2, &(0x7f0000000480)='io.max\x00', 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x40082406, &(0x7f0000000040)='-\x00') ioctl$PERF_EVENT_IOC_PERIOD(0xffffffffffffffff, 0x40082404, 0x0) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(0xffffffffffffffff, 0x4008240b, 0x0) r3 = openat$cgroup_subtree(0xffffffffffffff9c, &(0x7f0000000100)='cgroup.subtree_control\x00', 0x2, 0x0) write$cgroup_subtree(r3, &(0x7f0000000340)={[{0x2b, 'memory'}]}, 0x8) socket$kcm(0x29, 0x0, 0x0) socket$kcm(0x29, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x8, 0x0, 0x0, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x1, [], 0x0, 0x8, 0xffffffffffffffff, 0x8, &(0x7f0000000140)={0x5, 0x4}, 0x8, 0x10, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x6}, 0x10}, 0x70) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x26e1, 0x0) r5 = socket$kcm(0x2, 0x2, 0x0) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000000)=r4, 0x4) r6 = openat$cgroup_ro(r2, &(0x7f0000000640)='memory.swap.current\x00', 0x0, 0x0) setsockopt$sock_attach_bpf(r5, 0x1, 0x3e, &(0x7f00000002c0)=r4, 0x161) ioctl$TUNSETCARRIER(r6, 0x400454e2, &(0x7f0000000680)) sendmsg$kcm(r5, &(0x7f0000003d00)={&(0x7f0000000380)=@in={0x2, 0x4e23, @multicast1}, 0x80, 0x0}, 0xfd00) write$cgroup_subtree(r5, &(0x7f0000000280)={[{0x67dc0904, 'memory'}]}, 0xfdef) r7 = perf_event_open(&(0x7f0000001740)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r7, 0x40082406, &(0x7f0000000500)='\x00\xaa\xbc \xb8uXt\xf4\x00\xcb)5\xbf\xe2\xeb\xcaKxm\x82jL\xdcZ\x02\xa0O\xa3K\xf9\xd2|\xf1\xe9\xf9K\xa7.[\x89\xb0\xf5\xc4\xfd\xc8#\x0f\aY\xcb\xd8\xb8\x0f\xe6m\xd4\xff\x8fm\xcbFc\x86\xca?\xae\b\xf0\xff\x17\xfc\xf3\xb6K\xf1\xaa\xae\t\xcc\x7f\xa7\xe4)V!\xa5\xd3\xceeu(?:\xab\x92\xfb\x1d\x93\xbc\xd0\xa0\x88\xcc\x13\xee\xc2}h\xf2\xa1\x86\x83Qg\xb6&\xfa\xb7;\xbfr\x94\x89\xc5\xfa\x1a\xd8\xab\xf3\'*;\xd7RL>GT\xe12!\xae&\x1a\b\x12\xb4\xb0\x9c,\x89\x8a\xc9o\x8c\xb8\v\r\x97\x86>\xcc\x92\x82\xa2\x17\x92\x8fZ40?\x93\xa7^@\x1f\xeb\xf2\xe2v<\td\v\xae\xccy\x81\xa3\xcf\x80\rX$n~\xd5?\xa3hL\xe6\x15\xb1\xa9\vU|\x9bh\x18$\xeb\x9d\a%\xfev\xad=@\xeb\xe3\xa2\xd0\xb6\x87\x10\xcb-[\x11\xef\xc2\x8bY\x88\xe0\xe4\xcf\x99G(n\xc9\x14\xec/\x03\x98K\xa8\xf3*%\xb6\xddh\xdf\x8f5\x8e\'X\xb6l\xc2\xc4ET\xc93qc\xe8\xef\xca\xf2\xcb\x14l\xfb\xb6\xf1\xeb\x80\x13;}H\x817\x86\x10\x83\xe64\x8dg\x8b\x948') 14:14:45 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000010c0)="0800b5055e0bcfe87b0071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) socket$nl_route(0x10, 0x3, 0x0) pread64(r1, &(0x7f0000000000)=""/39, 0x74, 0x0) dup2(r0, r1) 14:14:45 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x60f8, 0x80000001, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.stat\x00', 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000059c0)={0x0, 0xd, &(0x7f0000000380)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x8}, [@map={0x18, 0x0, 0x1, 0x0, r1}, @map={0x18, 0xa}, @call, @jmp={0x5, 0x8, 0xe}, @ldst={0x0, 0x2, 0x0, 0xb, 0xf}, @alu={0x0, 0x0, 0x2, 0x0, 0x0, 0xfffffffffffffff3}, @ldst={0x2, 0x0, 0x7, 0xf}, @exit]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000005940)={0x0, 0x2}, 0x8, 0x10, 0x0}, 0x70) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000002c0)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)}, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(r2, 0x4030582a, &(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r3 = gettid() r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000300)='./cgroup.net/syz0\x00', 0x200002, 0x0) r5 = openat$cgroup_ro(r4, &(0x7f0000000380)='cpuacct.usage_user\x00', 0x0, 0x0) perf_event_open$cgroup(0x0, r5, 0x10, 0xffffffffffffffff, 0x3) perf_event_open(0x0, r3, 0x0, 0xffffffffffffffff, 0x0) 14:14:45 executing program 1: r0 = socket$kcm(0x10, 0x800000000002, 0x0) sendmsg$kcm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000940)=[{&(0x7f0000000100)="2e000000120081aee4050cecdb4cb90425485e510befccd77f3e9cf0758ef9000600b0eba06ac400060003000000", 0x2e}], 0x1}, 0x0) recvmsg$kcm(r0, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) recvmsg$kcm(r0, &(0x7f000000bd80)={0x0, 0x0, 0x0}, 0x0) recvmsg$kcm(r0, &(0x7f00000004c0)={0x0, 0x0, 0x0}, 0x0) r1 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) recvmsg(r0, &(0x7f0000000900)={0x0, 0x0, 0x0}, 0x0) recvmsg(r0, &(0x7f0000000500)={0x0, 0x0, 0x0}, 0x0) 14:14:46 executing program 1: r0 = socket$kcm(0x2b, 0x8000000000001, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x12, 0x4, &(0x7f00000033c0)=@framed={{}, [@alu={0x8000000201a7f19, 0x0, 0x6, 0x2, 0x1, 0x8}]}, &(0x7f0000000140)='GPL\x00', 0x1, 0xfb, &(0x7f0000000200)=""/251, 0x0, 0x0, [0x0, 0x0, 0x700000000000000], 0x0, 0xf}, 0x48) 14:14:48 executing program 1: 14:14:48 executing program 2: r0 = creat(&(0x7f0000000000)='./file0\x00', 0x0) write$P9_RREADLINK(r0, 0x0, 0x0) write$cgroup_type(r0, &(0x7f00000009c0)='threaded\x00', 0xe8a5958792bfd6e6) unlink(&(0x7f0000000200)='./file0\x00') creat(&(0x7f0000000040)='./file1\x00', 0x0) clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() lsetxattr$trusted_overlay_redirect(&(0x7f0000000100)='./file1\x00', &(0x7f0000000140)='trusted.overlay.redirect\x00', 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x3a) ftruncate(r0, 0x0) 14:14:48 executing program 4: 14:14:48 executing program 0: 14:14:48 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000010c0)="0800b5055e0bcfe87b0071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) socket$nl_route(0x10, 0x3, 0x0) pread64(r1, &(0x7f0000000000)=""/39, 0x74, 0x0) dup2(r0, r1) 14:14:48 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair(0x8000000000001e, 0x5, 0x0, &(0x7f000000dff8)={0xffffffffffffffff, 0xffffffffffffffff}) writev(r0, &(0x7f0000000240)=[{&(0x7f0000000140)="a3", 0x1}], 0x1) write(r0, 0x0, 0x0) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000785000), 0x34a) writev(r0, &(0x7f000063e000)=[{&(0x7f00000000c0)="da", 0x1}], 0x1) sendmmsg$alg(r1, &(0x7f0000236fc8)=[{0x8000000, 0x0, &(0x7f00000fff80), 0xc, &(0x7f00001e1e78)}], 0x4924924924926c8, 0xf0ff7f) 14:14:48 executing program 4: 14:14:48 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x8001, &(0x7f0000000000)={0xa, 0x4e21, 0x0, @mcast2}, 0x1c) 14:14:48 executing program 0: syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local, @link_local, [], {@arp={0x806, @ether_ipv4={0x1, 0x800, 0x6, 0x4, 0x1, @remote, @empty, @broadcast, @local}}}}, 0x0) 14:14:48 executing program 2: 14:14:48 executing program 4: 14:14:48 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = dup(r0) readv(r1, &(0x7f00000000c0)=[{&(0x7f0000000040)=""/58, 0x3a}, {0x0}], 0x2) r2 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r2, 0x0, 0x73a0b1b, 0x0, 0x0, 0x800e00549) shutdown(r1, 0x0) r3 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000005c0)=""/50, 0x32}, {0x0}, {0x0}, {0x0}], 0x4}, 0x2) r4 = dup(r3) r5 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r5, 0x0, 0xccf3, 0x0, 0x0, 0x800e00551) shutdown(r4, 0x0) r6 = socket$inet6_sctp(0x1c, 0x4000000000003, 0x84) readv(r6, &(0x7f0000001700)=[{&(0x7f0000000080)=""/27, 0x1b}, {0x0}, {0x0}], 0x3) shutdown(r5, 0x0) shutdown(r2, 0x0) 14:14:48 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = dup(r0) readv(r1, &(0x7f00000000c0)=[{&(0x7f0000000040)=""/58, 0x3a}], 0x1) r2 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r2, 0x0, 0x73a0b1b, 0x0, 0x0, 0x800e00549) shutdown(r1, 0x0) r3 = socket$inet_udplite(0x2, 0x2, 0x88) recvmsg(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000005c0)=""/50, 0x32}, {0x0}, {0x0}, {0x0}], 0x4}, 0x2) r4 = dup(r3) r5 = socket$inet_udplite(0x2, 0x2, 0x88) recvfrom$inet(r5, 0x0, 0xccf3, 0x0, 0x0, 0x800e00551) shutdown(r4, 0x0) r6 = socket$inet6_sctp(0x1c, 0x4000000000003, 0x84) readv(r6, &(0x7f0000001700)=[{&(0x7f0000000080)=""/27, 0x1b}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x7) shutdown(r5, 0x0) shutdown(r2, 0x0) 14:14:48 executing program 0: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) creat(&(0x7f0000000000)='./file0\x00', 0x0) mknod(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x200000, 0x0) fstat(r1, &(0x7f00000001c0)) renameat(r0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) recvmmsg(0xffffffffffffff9c, &(0x7f00000031c0)=[{{0x0, 0x0, &(0x7f0000000e00)=[{&(0x7f0000000c40)=""/23, 0x17}], 0x1, 0x0, 0x0, 0x8}}], 0x1, 0x0, 0x0) sched_setaffinity(0x0, 0x181, &(0x7f0000000180)=0x9) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xeb26, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x101}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$EVIOCSABS3F(r0, 0x401845ff, &(0x7f0000000040)={0x9, 0x0, 0x2, 0x6d1d, 0x5}) r2 = syz_open_procfs(0x0, &(0x7f0000000280)='net/route\x00') preadv(r2, &(0x7f0000000480), 0x100000000000022c, 0x6c00000000000000) getsockopt$IP_VS_SO_GET_DAEMON(0xffffffffffffffff, 0x0, 0x487, &(0x7f00000000c0), &(0x7f00000002c0)=0x30) preadv(r0, &(0x7f00000006c0)=[{0x0}, {&(0x7f0000000240)=""/23, 0x17}, {&(0x7f0000000600)=""/189, 0xbd}], 0x3, 0x0) open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) 14:14:48 executing program 4: r0 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'ip_vti0\x00', 0x0}) bind$packet(r0, &(0x7f0000000000)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @random="65ed59501ed8"}, 0x14) sendmmsg(r0, &(0x7f0000000d00), 0x7ffffffffffffa3, 0x0) [ 395.077822] audit: type=1804 audit(1564496088.683:67): pid=13524 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op="invalid_pcr" cause="open_writers" comm="syz-executor.0" name="/root/syzkaller-testdir533145058/syzkaller.lLNLIY/281/file0" dev="sda1" ino=17683 res=1 14:14:51 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair(0x8000000000001e, 0x5, 0x0, &(0x7f000000dff8)={0xffffffffffffffff, 0xffffffffffffffff}) writev(r0, &(0x7f0000000240)=[{&(0x7f0000000140)="a3", 0x1}], 0x1) write(r0, 0x0, 0x0) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000785000), 0x34a) writev(r0, &(0x7f000063e000)=[{&(0x7f00000000c0)="da", 0x1}], 0x1) sendmmsg$alg(r1, &(0x7f0000236fc8)=[{0x8000000, 0x0, &(0x7f00000fff80), 0xc, &(0x7f00001e1e78)}], 0x4924924924926c8, 0xf0ff7f) 14:14:51 executing program 0: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000880)={'syz1\x00'}, 0x45c) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) readv(r0, &(0x7f0000000000)=[{&(0x7f00000001c0)=""/166, 0xa6}], 0x1) ioctl$UI_DEV_DESTROY(r0, 0x5502) timer_create(0x0, &(0x7f0000000180)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f00000002c0)) gettid() timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(0x0, 0x15) 14:14:51 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x4020aea5, &(0x7f0000000500)={0x0, 0x0, @ioapic}) 14:14:51 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) poll(&(0x7f0000000080)=[{r0}], 0x1, 0x0) 14:14:51 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = dup(r0) recvfrom$inet6(r1, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) bind$bt_rfcomm(r2, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x3}}, 0xa) write$P9_RXATTRWALK(0xffffffffffffffff, &(0x7f0000000180)={0xf, 0x9}, 0xf) 14:14:51 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000010c0)="0800b5055e0bcfe87b0071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r2 = socket$nl_route(0x10, 0x3, 0x0) pread64(r1, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x28}}, 0x0) 14:14:51 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) [ 397.843351] input: syz1 as /devices/virtual/input/input86 14:14:51 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x2, 0x0) write$uinput_user_dev(r0, &(0x7f0000000880)={'syz1\x00'}, 0x45c) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) readv(r0, &(0x7f0000000000)=[{&(0x7f00000001c0)=""/166, 0xa6}], 0x1) ioctl$UI_DEV_DESTROY(r0, 0x5502) r1 = gettid() timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r1, 0x15) [ 397.926418] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 397.973113] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 397.985571] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 397.996621] binder: 13558:13567 unknown command 0 [ 398.002909] binder: 13558:13567 ioctl c0306201 20000180 returned -22 14:14:51 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) [ 398.024763] input: syz1 as /devices/virtual/input/input87 14:14:51 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000010c0)="0800b5055e0bcfe87b0071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) pread64(r1, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x28}}, 0x0) 14:14:51 executing program 2: socket$inet_icmp_raw(0x2, 0x3, 0x1) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x802102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x2b}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x9, r0, 0x0, 0x0) [ 398.119681] binder: 13572:13573 unknown command 0 [ 398.125817] binder: 13572:13573 ioctl c0306201 20000180 returned -22 14:14:52 executing program 0: clone(0x2102407ff3, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='\x00\x00\x00\x00ck{f)%;\x98v\x89\xd6w3N\xf7\xa7)\xae\a\x7fNB\xc7\xaa^\xcfq\x03\xe6Y\xa6\xa0\xa0\x14\x8e\x85\xd3\x86\xf8\rA=)\xb5wzS@\xa9\xc1yM\x1a\x0f\x93\xd6\xa0\x94m9 \x9av\x85*\xadz\xd1iH/z\x1ac\x1a\xfa\v\x0e\xae\xb6\xc2\xcb\x98EZ\xa5\xf1/\x8b\x8e\x00\x9eU\xc3\xdfL3\x16\xdc\xca\xf5\xe8m\x15K\xf9\x1b\xf3') exit(0x0) wait4(0x0, 0x0, 0x0, 0x0) renameat(r0, &(0x7f0000000140)='./file0\x00', 0xffffffffffffffff, 0x0) 14:14:54 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair(0x8000000000001e, 0x5, 0x0, &(0x7f000000dff8)={0xffffffffffffffff, 0xffffffffffffffff}) writev(r0, &(0x7f0000000240)=[{&(0x7f0000000140)="a3", 0x1}], 0x1) write(r0, 0x0, 0x0) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000785000), 0x34a) writev(r0, &(0x7f000063e000)=[{&(0x7f00000000c0)="da", 0x1}], 0x1) sendmmsg$alg(r1, &(0x7f0000236fc8)=[{0x8000000, 0x0, &(0x7f00000fff80), 0xc, &(0x7f00001e1e78)}], 0x4924924924926c8, 0xf0ff7f) 14:14:54 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x800000000000f) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r0, 0x10e, 0x8, &(0x7f0000000240)=0x4, 0x4) bind$netlink(r0, &(0x7f0000514ff4), 0xc) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000340)={'rsse0\x00\x00e\x00\x00\x00\x00\x0e\x00', 0x2}) 14:14:54 executing program 0: setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(0xffffffffffffffff, 0x10e, 0x8, &(0x7f0000000240)=0x4, 0x4) bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000340)={'rsse0\x00\x00e\x00\x00\x00\x00\x0e\x00', 0x2}) 14:14:54 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000010c0)="0800b5055e0bcfe87b0071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) pread64(r1, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x28}}, 0x0) 14:14:54 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) 14:14:54 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x800000000000f) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000340)={'rsse0\x00\x00e\x00\x00\x00\x00\x0e\x00', 0x2}) 14:14:54 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:14:54 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) [ 400.992134] binder: 13600:13603 unknown command 0 [ 400.998157] binder: 13600:13603 ioctl c0306201 20000180 returned -22 14:14:54 executing program 0 (fault-call:5 fault-nth:0): socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r1 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r1, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r1, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) 14:14:54 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) [ 401.041940] binder: 13607:13608 unknown command 0 [ 401.046934] binder: 13607:13608 ioctl c0306201 20000180 returned -22 [ 401.056415] binder: 13605:13606 unknown command 0 [ 401.062467] binder: 13605:13606 ioctl c0306201 20000180 returned -22 [ 401.127159] FAULT_INJECTION: forcing a failure. [ 401.127159] name failslab, interval 1, probability 0, space 0, times 1 [ 401.136638] binder: 13614:13615 unknown command 0 [ 401.143519] binder: 13614:13615 ioctl c0306201 20000180 returned -22 [ 401.150733] CPU: 1 PID: 13612 Comm: syz-executor.0 Not tainted 4.14.134 #30 [ 401.158299] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 401.167728] Call Trace: [ 401.170398] dump_stack+0x138/0x19c [ 401.174047] should_fail.cold+0x10f/0x159 [ 401.178266] ? is_bpf_text_address+0x7f/0x120 [ 401.182805] should_failslab+0xdb/0x130 [ 401.186783] kmem_cache_alloc+0x47/0x780 [ 401.190897] ? ip6_pol_route+0x152d/0x1f50 [ 401.195136] ? find_held_lock+0x35/0x130 [ 401.199275] dst_alloc+0xf3/0x1a0 [ 401.202775] __ip6_dst_alloc+0x34/0x60 [ 401.206686] ip6_rt_cache_alloc+0x111/0x650 [ 401.211013] ip6_pol_route+0x153e/0x1f50 [ 401.215082] ? ip6_pol_route_lookup+0x9c0/0x9c0 [ 401.219809] ? l3mdev_link_scope_lookup+0x19f/0x310 [ 401.224833] ? find_held_lock+0x35/0x130 [ 401.228896] ip6_pol_route_output+0x4c/0x60 [ 401.233289] fib6_rule_lookup+0x1a1/0x420 [ 401.237464] ? ip6_pol_route_input+0x70/0x70 [ 401.241876] ? fib6_rules_seq_read+0x20/0x20 [ 401.246286] ip6_route_output_flags+0x268/0x2f0 [ 401.250960] ip6_dst_lookup_tail+0xdb6/0x1770 [ 401.255464] ? ip6_flush_pending_frames+0xb0/0xb0 [ 401.260365] ? rawv6_sendmsg+0x68c/0x2d70 [ 401.264512] ? find_held_lock+0x35/0x130 [ 401.268566] ? rawv6_sendmsg+0x68c/0x2d70 [ 401.272716] ip6_dst_lookup_flow+0x9c/0x1f0 [ 401.277032] ? ip6_dst_lookup+0x70/0x70 [ 401.281029] ? selinux_sk_getsecid+0x77/0xc0 [ 401.285438] rawv6_sendmsg+0x931/0x2d70 [ 401.289413] ? rawv6_bind+0x850/0x850 [ 401.293216] ? avc_has_perm_noaudit+0x420/0x420 [ 401.297897] ? kasan_check_write+0x14/0x20 [ 401.302133] ? _copy_from_user+0x99/0x110 [ 401.306287] ? rw_copy_check_uvector+0x1f1/0x290 [ 401.311047] ? sock_has_perm+0x1ed/0x280 [ 401.315109] ? selinux_tun_dev_create+0xc0/0xc0 [ 401.319876] ? copy_msghdr_from_user+0x292/0x3f0 [ 401.324716] inet_sendmsg+0x122/0x500 [ 401.328779] ? inet_sendmsg+0x122/0x500 [ 401.332752] ? inet_recvmsg+0x500/0x500 [ 401.336719] sock_sendmsg+0xce/0x110 [ 401.340439] ___sys_sendmsg+0x70a/0x840 [ 401.344424] ? copy_msghdr_from_user+0x3f0/0x3f0 [ 401.349194] ? __fget+0x210/0x370 [ 401.352918] ? find_held_lock+0x35/0x130 [ 401.357048] ? __fget+0x210/0x370 [ 401.360521] ? lock_downgrade+0x6e0/0x6e0 [ 401.364697] ? __fget+0x237/0x370 [ 401.368160] ? __fdget+0x1b/0x20 [ 401.371546] ? sockfd_lookup_light+0xb4/0x160 [ 401.376156] __sys_sendmsg+0xb9/0x140 [ 401.379975] ? SyS_shutdown+0x170/0x170 [ 401.383979] SyS_sendmsg+0x2d/0x50 [ 401.387516] ? __sys_sendmsg+0x140/0x140 [ 401.391585] do_syscall_64+0x1e8/0x640 [ 401.395470] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 401.400379] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 401.405578] RIP: 0033:0x459829 [ 401.408760] RSP: 002b:00007f9a3987ac78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 401.416494] RAX: ffffffffffffffda RBX: 00007f9a3987ac90 RCX: 0000000000459829 [ 401.423781] RDX: 0000000000000000 RSI: 0000000020000000 RDI: 0000000000000005 [ 401.431049] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 401.438324] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f9a3987b6d4 [ 401.445604] R13: 00000000004c76d0 R14: 00000000004dcde0 R15: 0000000000000006 14:14:55 executing program 2 (fault-call:3 fault-nth:0): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) 14:14:55 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) [ 401.469935] Dead loop on virtual device ip6_vti0, fix it urgently! [ 401.542826] binder: 13618:13623 unknown command 0 [ 401.553518] binder: 13618:13623 ioctl c0306201 20000180 returned -22 14:14:57 executing program 5 (fault-call:5 fault-nth:0): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) 14:14:57 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:14:57 executing program 0 (fault-call:5 fault-nth:1): socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r1 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r1, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r1, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) 14:14:57 executing program 2: bind$bt_rfcomm(0xffffffffffffffff, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$P9_RXATTRWALK(0xffffffffffffffff, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) 14:14:57 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:14:57 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000010c0)="0800b5055e0bcfe87b0071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) pread64(r1, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x28}}, 0x0) [ 403.867251] binder: 13627:13629 unknown command 0 [ 403.887535] binder: 13627:13629 ioctl c0306201 20000180 returned -22 [ 403.905622] FAULT_INJECTION: forcing a failure. [ 403.905622] name failslab, interval 1, probability 0, space 0, times 0 [ 403.920796] binder: 13630:13636 unknown command 0 [ 403.925862] binder: 13630:13636 ioctl c0306201 20000180 returned -22 14:14:57 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x800000000000, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) r2 = accept4$inet(r1, &(0x7f0000000080)={0x2, 0x0, @multicast2}, &(0x7f00000000c0)=0x10, 0x0) setsockopt$RXRPC_UPGRADEABLE_SERVICE(r1, 0x110, 0x5, &(0x7f0000000100)=[0x2, 0x3ff], 0x2) pwrite64(r2, &(0x7f0000000140)="4960ee38ba1ce6d17f33", 0xa, 0x0) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000001c0)={0x0, 0x1000}) setsockopt$inet_dccp_int(r1, 0x21, 0xa, &(0x7f0000000040)=0xff, 0x4) [ 403.935160] CPU: 1 PID: 13634 Comm: syz-executor.0 Not tainted 4.14.134 #30 [ 403.942277] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 403.942283] Call Trace: [ 403.942301] dump_stack+0x138/0x19c [ 403.942323] should_fail.cold+0x10f/0x159 [ 403.966672] should_failslab+0xdb/0x130 [ 403.970660] kmem_cache_alloc_node+0x287/0x780 [ 403.975254] ? ip6_dst_lookup_tail+0xb67/0x1770 [ 403.979928] ? find_held_lock+0x35/0x130 [ 403.984002] __alloc_skb+0x9c/0x500 [ 403.987627] ? skb_scrub_packet+0x4b0/0x4b0 [ 403.991946] ? __local_bh_enable_ip+0x99/0x1a0 [ 403.996525] alloc_skb_with_frags+0x86/0x4b0 [ 404.000932] ? trace_hardirqs_on+0x10/0x10 [ 404.005168] sock_alloc_send_pskb+0x5db/0x740 [ 404.009750] ? ip6_dst_hoplimit+0x1c9/0x360 [ 404.014070] ? find_held_lock+0x35/0x130 [ 404.018637] ? sock_wmalloc+0xf0/0xf0 [ 404.022439] ? lock_downgrade+0x6e0/0x6e0 [ 404.026594] sock_alloc_send_skb+0x32/0x40 [ 404.030826] rawv6_sendmsg+0x13ad/0x2d70 [ 404.034890] ? rawv6_bind+0x850/0x850 [ 404.038955] ? avc_has_perm_noaudit+0x420/0x420 [ 404.043640] ? kasan_check_write+0x14/0x20 [ 404.047885] ? _copy_from_user+0x99/0x110 [ 404.052039] ? rw_copy_check_uvector+0x1f1/0x290 [ 404.056804] ? sock_has_perm+0x1ed/0x280 [ 404.060957] ? selinux_tun_dev_create+0xc0/0xc0 [ 404.065637] ? copy_msghdr_from_user+0x292/0x3f0 [ 404.070400] inet_sendmsg+0x122/0x500 [ 404.074194] ? inet_sendmsg+0x122/0x500 [ 404.078165] ? inet_recvmsg+0x500/0x500 [ 404.082138] sock_sendmsg+0xce/0x110 [ 404.085862] ___sys_sendmsg+0x70a/0x840 [ 404.089834] ? copy_msghdr_from_user+0x3f0/0x3f0 [ 404.094968] ? __fget+0x210/0x370 [ 404.098418] ? find_held_lock+0x35/0x130 [ 404.102482] ? __fget+0x210/0x370 [ 404.105936] ? lock_downgrade+0x6e0/0x6e0 [ 404.110083] ? __fget+0x237/0x370 [ 404.113544] ? __fdget+0x1b/0x20 [ 404.116943] ? sockfd_lookup_light+0xb4/0x160 [ 404.121441] __sys_sendmsg+0xb9/0x140 [ 404.125239] ? SyS_shutdown+0x170/0x170 [ 404.129227] SyS_sendmsg+0x2d/0x50 [ 404.132779] ? __sys_sendmsg+0x140/0x140 [ 404.136838] do_syscall_64+0x1e8/0x640 [ 404.140909] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 404.145758] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 404.150941] RIP: 0033:0x459829 [ 404.154150] RSP: 002b:00007f9a3987ac78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 404.161856] RAX: ffffffffffffffda RBX: 00007f9a3987ac90 RCX: 0000000000459829 [ 404.169137] RDX: 0000000000000000 RSI: 0000000020000000 RDI: 0000000000000005 [ 404.176422] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 14:14:57 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) [ 404.183693] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f9a3987b6d4 [ 404.190958] R13: 00000000004c76d0 R14: 00000000004dcde0 R15: 0000000000000006 [ 404.201815] FAULT_INJECTION: forcing a failure. [ 404.201815] name failslab, interval 1, probability 0, space 0, times 0 [ 404.215401] CPU: 0 PID: 13642 Comm: syz-executor.5 Not tainted 4.14.134 #30 [ 404.222525] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 404.231882] Call Trace: [ 404.234479] dump_stack+0x138/0x19c [ 404.238126] should_fail.cold+0x10f/0x159 [ 404.242312] should_failslab+0xdb/0x130 [ 404.246314] kmem_cache_alloc_node+0x56/0x780 [ 404.250809] ? find_held_lock+0x35/0x130 [ 404.254874] ? lock_sock_nested+0x9e/0x110 [ 404.259113] __alloc_skb+0x9c/0x500 [ 404.262747] ? skb_scrub_packet+0x4b0/0x4b0 [ 404.267074] ? trace_hardirqs_on_caller+0x400/0x590 [ 404.272093] ? lock_sock_nested+0x8c/0x110 [ 404.276420] create_monitor_ctrl_close+0xaf/0x460 [ 404.281358] ? lock_sock_nested+0xd4/0x110 [ 404.285856] hci_sock_bind+0x601/0xe50 [ 404.289745] ? hci_sock_ioctl+0x650/0x650 [ 404.293911] ? security_socket_bind+0x89/0xb0 [ 404.298413] SYSC_bind+0x1d3/0x220 [ 404.301950] ? move_addr_to_kernel.part.0+0x100/0x100 [ 404.307144] ? fput+0xd4/0x150 [ 404.310330] ? SyS_write+0x15e/0x230 [ 404.314052] SyS_bind+0x24/0x30 [ 404.317325] ? SyS_socketpair+0x4d0/0x4d0 [ 404.321488] do_syscall_64+0x1e8/0x640 [ 404.325368] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 404.330224] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 404.335408] RIP: 0033:0x459829 14:14:58 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:14:58 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000040)={r0}) setsockopt$inet_sctp6_SCTP_INITMSG(r1, 0x84, 0x2, &(0x7f0000000080)={0x8, 0x6, 0x8, 0x1}, 0x8) ioctl$sock_SIOCBRADDBR(r1, 0x89a0, &(0x7f00000000c0)='hwsim0\x00') r2 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r2, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$P9_RXATTRWALK(r2, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) [ 404.338587] RSP: 002b:00007f8708d2ec78 EFLAGS: 00000246 ORIG_RAX: 0000000000000031 [ 404.346286] RAX: ffffffffffffffda RBX: 00007f8708d2ec90 RCX: 0000000000459829 [ 404.353566] RDX: 000000000000000a RSI: 0000000020000000 RDI: 0000000000000005 [ 404.360921] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 404.368191] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8708d2f6d4 [ 404.375458] R13: 00000000004bf96a R14: 00000000004d13e0 R15: 0000000000000007 14:14:58 executing program 5 (fault-call:5 fault-nth:1): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) [ 404.413647] binder: 13646:13648 unknown command 0 [ 404.432730] binder: 13646:13648 ioctl c0306201 20000180 returned -22 [ 404.451910] binder: 13650:13654 unknown command 0 14:14:58 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x101000, 0x0) ioctl$KVM_GET_CLOCK(r1, 0x8030ae7c, &(0x7f00000000c0)) ioctl$KVM_TRANSLATE(r1, 0xc018ae85, &(0x7f0000000080)={0xf000, 0x4001, 0x0, 0x9, 0x5}) r2 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r2, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$P9_RXATTRWALK(r2, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) 14:14:58 executing program 0 (fault-call:5 fault-nth:2): socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r1 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r1, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r1, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) [ 404.474623] binder: 13650:13654 ioctl c0306201 20000180 returned -22 14:14:58 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:14:58 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) [ 404.522646] FAULT_INJECTION: forcing a failure. [ 404.522646] name failslab, interval 1, probability 0, space 0, times 0 [ 404.583928] FAULT_INJECTION: forcing a failure. [ 404.583928] name failslab, interval 1, probability 0, space 0, times 0 [ 404.597571] binder: 13667:13668 unknown command 0 [ 404.604276] CPU: 0 PID: 13657 Comm: syz-executor.5 Not tainted 4.14.134 #30 [ 404.611431] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 404.620877] Call Trace: [ 404.623481] dump_stack+0x138/0x19c [ 404.627125] should_fail.cold+0x10f/0x159 [ 404.631285] should_failslab+0xdb/0x130 [ 404.635262] kmem_cache_alloc_node_trace+0x5a/0x770 [ 404.640285] ? rcu_lockdep_current_cpu_online+0xf2/0x140 [ 404.645755] __kmalloc_node_track_caller+0x3d/0x80 [ 404.650787] __kmalloc_reserve.isra.0+0x40/0xe0 [ 404.655937] __alloc_skb+0xcf/0x500 [ 404.659566] ? skb_scrub_packet+0x4b0/0x4b0 [ 404.663907] ? trace_hardirqs_on_caller+0x400/0x590 [ 404.668934] ? lock_sock_nested+0x8c/0x110 [ 404.673183] create_monitor_ctrl_close+0xaf/0x460 [ 404.678038] ? lock_sock_nested+0xd4/0x110 [ 404.682285] hci_sock_bind+0x601/0xe50 [ 404.686179] ? hci_sock_ioctl+0x650/0x650 [ 404.690342] ? security_socket_bind+0x89/0xb0 [ 404.694839] SYSC_bind+0x1d3/0x220 [ 404.698382] ? move_addr_to_kernel.part.0+0x100/0x100 [ 404.703607] ? fput+0xd4/0x150 [ 404.706802] ? SyS_write+0x15e/0x230 [ 404.710524] SyS_bind+0x24/0x30 [ 404.713801] ? SyS_socketpair+0x4d0/0x4d0 [ 404.717951] do_syscall_64+0x1e8/0x640 [ 404.721841] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 404.726695] entry_SYSCALL_64_after_hwframe+0x42/0xb7 14:14:58 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) 14:14:58 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xf, 0x9, 0x1, 0xffffffffffffffff}, 0xf) getrandom(&(0x7f00000001c0)=""/4096, 0x1000, 0x3) [ 404.732098] RIP: 0033:0x459829 [ 404.735289] RSP: 002b:00007f8708d4fc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000031 [ 404.736504] binder: 13667:13668 ioctl c0306201 20000180 returned -22 [ 404.743018] RAX: ffffffffffffffda RBX: 00007f8708d4fc90 RCX: 0000000000459829 [ 404.743029] RDX: 000000000000000a RSI: 0000000020000000 RDI: 0000000000000005 [ 404.743034] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 404.743039] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8708d506d4 [ 404.743044] R13: 00000000004bf96a R14: 00000000004d13e0 R15: 0000000000000007 [ 404.776640] binder: 13671:13673 unknown command 0 [ 404.795701] CPU: 1 PID: 13663 Comm: syz-executor.0 Not tainted 4.14.134 #30 [ 404.802824] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 404.802829] Call Trace: [ 404.802846] dump_stack+0x138/0x19c [ 404.802863] should_fail.cold+0x10f/0x159 [ 404.802879] should_failslab+0xdb/0x130 [ 404.802893] kmem_cache_alloc_node_trace+0x280/0x770 [ 404.802908] ? rcu_lockdep_current_cpu_online+0xf2/0x140 [ 404.802922] __kmalloc_node_track_caller+0x3d/0x80 [ 404.802935] __kmalloc_reserve.isra.0+0x40/0xe0 [ 404.802946] __alloc_skb+0xcf/0x500 [ 404.802956] ? skb_scrub_packet+0x4b0/0x4b0 [ 404.802965] ? __local_bh_enable_ip+0x99/0x1a0 [ 404.802977] alloc_skb_with_frags+0x86/0x4b0 [ 404.802992] ? trace_hardirqs_on+0x10/0x10 [ 404.803005] sock_alloc_send_pskb+0x5db/0x740 [ 404.803021] ? ip6_dst_hoplimit+0x1c9/0x360 [ 404.803031] ? find_held_lock+0x35/0x130 [ 404.803042] ? sock_wmalloc+0xf0/0xf0 [ 404.803057] ? lock_downgrade+0x6e0/0x6e0 [ 404.803071] sock_alloc_send_skb+0x32/0x40 [ 404.803082] rawv6_sendmsg+0x13ad/0x2d70 [ 404.803098] ? rawv6_bind+0x850/0x850 [ 404.803114] ? avc_has_perm_noaudit+0x420/0x420 [ 404.812991] binder: 13671:13673 ioctl c0306201 20000180 returned -22 [ 404.815070] ? kasan_check_write+0x14/0x20 [ 404.815083] ? _copy_from_user+0x99/0x110 [ 404.815098] ? rw_copy_check_uvector+0x1f1/0x290 [ 404.815113] ? sock_has_perm+0x1ed/0x280 [ 404.815125] ? selinux_tun_dev_create+0xc0/0xc0 [ 404.815146] ? copy_msghdr_from_user+0x292/0x3f0 [ 404.815160] inet_sendmsg+0x122/0x500 [ 404.942955] ? inet_sendmsg+0x122/0x500 [ 404.947116] ? inet_recvmsg+0x500/0x500 [ 404.951089] sock_sendmsg+0xce/0x110 [ 404.954802] ___sys_sendmsg+0x70a/0x840 [ 404.958867] ? copy_msghdr_from_user+0x3f0/0x3f0 [ 404.963627] ? __fget+0x210/0x370 [ 404.967080] ? find_held_lock+0x35/0x130 [ 404.971164] ? __fget+0x210/0x370 [ 404.975145] ? lock_downgrade+0x6e0/0x6e0 [ 404.979304] ? __fget+0x237/0x370 [ 404.982771] ? __fdget+0x1b/0x20 [ 404.986139] ? sockfd_lookup_light+0xb4/0x160 [ 404.990641] __sys_sendmsg+0xb9/0x140 [ 404.994441] ? SyS_shutdown+0x170/0x170 [ 404.998453] SyS_sendmsg+0x2d/0x50 [ 405.001989] ? __sys_sendmsg+0x140/0x140 [ 405.006053] do_syscall_64+0x1e8/0x640 [ 405.009938] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 405.014786] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 405.020445] RIP: 0033:0x459829 [ 405.023628] RSP: 002b:00007f9a3987ac78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 405.031361] RAX: ffffffffffffffda RBX: 00007f9a3987ac90 RCX: 0000000000459829 [ 405.038644] RDX: 0000000000000000 RSI: 0000000020000000 RDI: 0000000000000005 [ 405.046200] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 405.053561] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f9a3987b6d4 [ 405.060840] R13: 00000000004c76d0 R14: 00000000004dcde0 R15: 0000000000000006 14:14:58 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000010c0)="0800b5055e0bcfe87b0071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) pread64(r1, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x28}}, 0x0) 14:14:58 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) 14:14:58 executing program 5 (fault-call:5 fault-nth:2): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) 14:14:58 executing program 2: r0 = socket$inet6(0xa, 0x80000, 0x100000001) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000040)={0x0, @in6={{0xa, 0x4e23, 0x0, @loopback, 0x2}}, 0x2, 0x2, 0x2, 0xf3b, 0x19}, &(0x7f0000000100)=0x98) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000000140)={r1, 0x3}, &(0x7f00000001c0)=0x8) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r3 = fcntl$dupfd(r2, 0x0, r2) bind$bt_rfcomm(r3, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$P9_RXATTRWALK(r3, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) ioctl$PERF_EVENT_IOC_DISABLE(r3, 0x2401, 0x7ff) [ 405.157314] binder: 13681:13684 unknown command 0 [ 405.166337] FAULT_INJECTION: forcing a failure. [ 405.166337] name failslab, interval 1, probability 0, space 0, times 0 [ 405.169132] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 405.180648] binder: 13681:13684 ioctl c0306201 20000180 returned -22 [ 405.191342] CPU: 0 PID: 13685 Comm: syz-executor.5 Not tainted 4.14.134 #30 [ 405.198498] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 405.207946] Call Trace: [ 405.210551] dump_stack+0x138/0x19c [ 405.211168] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 405.214193] should_fail.cold+0x10f/0x159 [ 405.214211] should_failslab+0xdb/0x130 [ 405.214224] kmem_cache_alloc_node+0x56/0x780 [ 405.214239] ? selinux_ipv4_output+0x50/0x50 [ 405.225918] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 405.229144] __alloc_skb+0x9c/0x500 [ 405.229155] ? skb_scrub_packet+0x4b0/0x4b0 [ 405.229165] ? kfree_skbmem+0xac/0x120 [ 405.229184] create_monitor_ctrl_open+0x144/0x7d0 [ 405.229196] ? security_capable+0x8e/0xc0 [ 405.229208] ? send_monitor_note+0x420/0x420 [ 405.270762] ? ns_capable_common+0x12c/0x160 [ 405.275186] hci_sock_bind+0x673/0xe50 [ 405.279183] ? hci_sock_ioctl+0x650/0x650 [ 405.283695] ? security_socket_bind+0x89/0xb0 [ 405.288241] SYSC_bind+0x1d3/0x220 [ 405.291800] ? move_addr_to_kernel.part.0+0x100/0x100 [ 405.297012] ? fput+0xd4/0x150 [ 405.300208] ? SyS_write+0x15e/0x230 [ 405.303928] SyS_bind+0x24/0x30 [ 405.307209] ? SyS_socketpair+0x4d0/0x4d0 [ 405.311457] do_syscall_64+0x1e8/0x640 [ 405.316133] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 405.320999] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 405.326302] RIP: 0033:0x459829 [ 405.329587] RSP: 002b:00007f8708d4fc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000031 [ 405.337342] RAX: ffffffffffffffda RBX: 00007f8708d4fc90 RCX: 0000000000459829 [ 405.344662] RDX: 000000000000000a RSI: 0000000020000000 RDI: 0000000000000005 14:14:59 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000340)={0x0, 0x20000000000}, &(0x7f0000000380)=0x8) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f00000003c0)={r2, 0x1, 0x10}, &(0x7f0000000400)=0xc) setsockopt$RXRPC_SECURITY_KEY(r1, 0x110, 0x1, &(0x7f0000000040)='trusted.posix_acl_access\x00', 0x19) r3 = request_key(&(0x7f0000000080)='dns_resolver\x00', &(0x7f00000000c0)={'syz', 0x0}, &(0x7f0000000100)='trusted.posix_acl_access\x00', 0xfffffffffffffffe) keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f0000000140)={r3, 0x47, 0x80}, &(0x7f00000001c0)=ANY=[@ANYBLOB="656e633d706b63733120686173683d736861332d3232342d63650000000000000000000000000000000000000000000000000000000000000000000000000000ecffffff00"/79], &(0x7f0000000240)="859ae2e7f2dc549a06d916a2041d6679cb2cebc1283256245beac39b78f8a5d9690ecced291baf49bce9c5d9a50760692dff4c4754f7031a96e55ab58a107c292f944821bbd2e4", &(0x7f00000002c0)=""/128) 14:14:59 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) 14:14:59 executing program 0 (fault-call:5 fault-nth:3): socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r1 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r1, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r1, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) 14:14:59 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000010c0)="0800b5055e0bcfe87b0071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) pread64(r1, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x28}}, 0x0) [ 405.351931] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 405.359294] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8708d506d4 [ 405.366753] R13: 00000000004bf96a R14: 00000000004d13e0 R15: 0000000000000007 14:14:59 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:14:59 executing program 5 (fault-call:5 fault-nth:3): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) [ 405.461769] binder: 13699:13704 unknown command 0 [ 405.479566] binder: 13699:13704 ioctl c0306201 20000180 returned -22 [ 405.486518] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 405.495984] binder: 13711:13713 unknown command 0 14:14:59 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) syz_open_dev$sndmidi(&(0x7f0000000100)='/dev/snd/midiC#D#\x00', 0x1f, 0x40) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x400, 0x2, 0xfffffffffffffffc}}, 0x2) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r1, 0x84, 0x66, &(0x7f0000000040)={0x0, 0x10000}, &(0x7f0000000080)=0x8) fsetxattr$trusted_overlay_nlink(r0, &(0x7f0000000140)='trusted.overlay.nlink\x00', &(0x7f00000001c0)={'L-', 0x20}, 0x28, 0x2) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f00000000c0)={r2, 0x654}, 0x8) 14:14:59 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) [ 405.506160] binder: 13711:13713 ioctl c0306201 20000180 returned -22 [ 405.522758] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 405.541560] FAULT_INJECTION: forcing a failure. [ 405.541560] name failslab, interval 1, probability 0, space 0, times 0 [ 405.553174] CPU: 1 PID: 13715 Comm: syz-executor.0 Not tainted 4.14.134 #30 [ 405.560282] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 405.560312] Call Trace: [ 405.560331] dump_stack+0x138/0x19c [ 405.560351] should_fail.cold+0x10f/0x159 [ 405.560367] should_failslab+0xdb/0x130 [ 405.573598] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 405.576013] kmem_cache_alloc_node+0x56/0x780 [ 405.576031] ? __lock_acquire+0x5f9/0x45e0 [ 405.599413] ? ip6_pol_route+0xa8f/0x1f50 [ 405.603566] __alloc_skb+0x9c/0x500 [ 405.607195] ? skb_scrub_packet+0x4b0/0x4b0 [ 405.611514] alloc_skb_with_frags+0x86/0x4b0 [ 405.615936] ? save_trace+0x290/0x290 [ 405.619755] sock_alloc_send_pskb+0x5db/0x740 [ 405.624527] ? sock_wmalloc+0xf0/0xf0 [ 405.628335] ? trace_hardirqs_on+0x10/0x10 [ 405.632594] sock_alloc_send_skb+0x32/0x40 [ 405.636840] __ip6_append_data.isra.0+0x17b6/0x2ac0 [ 405.641884] ? ip6_setup_cork+0x12a0/0x12a0 [ 405.646204] ? ip6_mtu+0x141/0x410 [ 405.649835] ? ip6_setup_cork+0xcac/0x12a0 [ 405.654074] ip6_append_data+0x1b8/0x2f0 [ 405.658157] ? copy_overflow+0x39/0x39 [ 405.662063] ? copy_overflow+0x39/0x39 [ 405.665948] icmp6_send+0x1415/0x1ea0 [ 405.669938] ? icmpv6_push_pending_frames+0x530/0x530 [ 405.675140] ? trace_hardirqs_on+0x10/0x10 [ 405.679378] ? is_bpf_text_address+0x7f/0x120 [ 405.683898] ? down_killable+0x1a/0x90 [ 405.687864] ? __xfrm_decode_session+0x7c/0x110 [ 405.692916] ? icmpv6_push_pending_frames+0x530/0x530 [ 405.698117] ? icmpv6_push_pending_frames+0x530/0x530 [ 405.703485] icmpv6_send+0xac/0x1b0 [ 405.707109] ? icmpv6_send+0xac/0x1b0 [ 405.710925] ip6_link_failure+0x29/0x420 [ 405.714979] ? ip6_redirect_no_header+0x370/0x370 [ 405.719820] vti6_tnl_xmit+0x645/0x1893 [ 405.723789] ? trace_hardirqs_on+0x10/0x10 [ 405.728110] ? vti6_rcv+0x820/0x820 [ 405.731740] ? rcu_lockdep_current_cpu_online+0xf2/0x140 [ 405.737565] dev_hard_start_xmit+0x18c/0x8b0 [ 405.741988] __dev_queue_xmit+0x1d95/0x25e0 [ 405.746918] ? trace_hardirqs_on+0x10/0x10 [ 405.751154] ? netdev_pick_tx+0x300/0x300 [ 405.755302] ? kmem_cache_alloc_node_trace+0x379/0x770 [ 405.760594] ? check_preemption_disabled+0x3c/0x250 [ 405.765954] ? check_preemption_disabled+0x3c/0x250 [ 405.770973] dev_queue_xmit+0x18/0x20 [ 405.774775] ? dev_queue_xmit+0x18/0x20 [ 405.778746] neigh_direct_output+0x16/0x20 [ 405.782990] ip6_finish_output2+0x9ab/0x21b0 [ 405.787394] ? find_held_lock+0x35/0x130 [ 405.791470] ? ip6_forward_finish+0x480/0x480 [ 405.795970] ? lock_downgrade+0x6e0/0x6e0 [ 405.800118] ip6_finish_output+0x4f4/0xb50 [ 405.804348] ? ip6_finish_output+0x4f4/0xb50 [ 405.808755] ip6_output+0x20f/0x6d0 [ 405.812376] ? ip6_finish_output+0xb50/0xb50 [ 405.816779] ? ip6_fragment+0x32c0/0x32c0 [ 405.820927] rawv6_sendmsg+0x19cc/0x2d70 [ 405.824987] ? rawv6_bind+0x850/0x850 [ 405.828789] ? avc_has_perm_noaudit+0x420/0x420 [ 405.833630] ? kasan_check_write+0x14/0x20 [ 405.837861] ? _copy_from_user+0x99/0x110 [ 405.842009] ? rawv6_recvmsg+0xb90/0xb90 [ 405.846064] ? sock_has_perm+0x1ed/0x280 [ 405.850115] ? selinux_tun_dev_create+0xc0/0xc0 [ 405.854786] ? copy_msghdr_from_user+0x292/0x3f0 [ 405.859535] inet_sendmsg+0x122/0x500 [ 405.863422] ? inet_sendmsg+0x122/0x500 [ 405.867385] ? inet_recvmsg+0x500/0x500 [ 405.871348] sock_sendmsg+0xce/0x110 [ 405.875053] ___sys_sendmsg+0x70a/0x840 [ 405.879018] ? copy_msghdr_from_user+0x3f0/0x3f0 [ 405.883764] ? __fget+0x210/0x370 [ 405.888118] ? find_held_lock+0x35/0x130 [ 405.892172] ? __fget+0x210/0x370 [ 405.895627] ? lock_downgrade+0x6e0/0x6e0 [ 405.899777] ? __fget+0x237/0x370 [ 405.903237] ? __fdget+0x1b/0x20 [ 405.906682] ? sockfd_lookup_light+0xb4/0x160 [ 405.911172] __sys_sendmsg+0xb9/0x140 [ 405.914977] ? SyS_shutdown+0x170/0x170 [ 405.918999] SyS_sendmsg+0x2d/0x50 [ 405.922537] ? __sys_sendmsg+0x140/0x140 [ 405.926615] do_syscall_64+0x1e8/0x640 [ 405.930523] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 405.935374] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 405.946050] RIP: 0033:0x459829 [ 405.949232] RSP: 002b:00007f9a39859c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 405.956953] RAX: ffffffffffffffda RBX: 00007f9a39859c90 RCX: 0000000000459829 14:14:59 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) [ 405.964403] RDX: 0000000000000000 RSI: 0000000020000000 RDI: 0000000000000005 [ 405.971667] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 405.978942] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f9a3985a6d4 [ 405.986205] R13: 00000000004c76d0 R14: 00000000004dcde0 R15: 0000000000000006 14:14:59 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) fcntl$notify(r0, 0x402, 0x20) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = fcntl$dupfd(r1, 0x0, r1) bind$bt_rfcomm(r2, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$P9_RXATTRWALK(r2, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) [ 406.015176] FAULT_INJECTION: forcing a failure. [ 406.015176] name failslab, interval 1, probability 0, space 0, times 0 [ 406.061336] binder: 13718:13726 unknown command 0 [ 406.063754] CPU: 1 PID: 13721 Comm: syz-executor.5 Not tainted 4.14.134 #30 [ 406.066408] binder: 13724:13727 unknown command 0 [ 406.073408] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 406.073414] Call Trace: [ 406.073433] dump_stack+0x138/0x19c [ 406.073450] should_fail.cold+0x10f/0x159 [ 406.073462] ? avc_has_perm_noaudit+0x2b2/0x420 [ 406.073475] should_failslab+0xdb/0x130 [ 406.073487] kmem_cache_alloc_node_trace+0x5a/0x770 [ 406.073500] ? rcu_lockdep_current_cpu_online+0xf2/0x140 [ 406.073514] __kmalloc_node_track_caller+0x3d/0x80 [ 406.073528] __kmalloc_reserve.isra.0+0x40/0xe0 [ 406.073537] __alloc_skb+0xcf/0x500 [ 406.073546] ? skb_scrub_packet+0x4b0/0x4b0 [ 406.073555] ? kfree_skbmem+0xac/0x120 [ 406.073579] create_monitor_ctrl_open+0x144/0x7d0 [ 406.073589] ? security_capable+0x8e/0xc0 [ 406.073599] ? send_monitor_note+0x420/0x420 [ 406.073612] ? ns_capable_common+0x12c/0x160 [ 406.089785] binder: 13718:13726 ioctl c0306201 20000180 returned -22 [ 406.090388] hci_sock_bind+0x673/0xe50 [ 406.090399] ? hci_sock_ioctl+0x650/0x650 [ 406.090417] ? security_socket_bind+0x89/0xb0 [ 406.096433] binder: 13724:13727 ioctl c0306201 20000180 returned -22 [ 406.098183] SYSC_bind+0x1d3/0x220 [ 406.098196] ? move_addr_to_kernel.part.0+0x100/0x100 [ 406.098216] ? fput+0xd4/0x150 [ 406.098228] ? SyS_write+0x15e/0x230 [ 406.203746] SyS_bind+0x24/0x30 [ 406.207030] ? SyS_socketpair+0x4d0/0x4d0 [ 406.211178] do_syscall_64+0x1e8/0x640 [ 406.215068] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 406.220012] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 406.225223] RIP: 0033:0x459829 [ 406.228414] RSP: 002b:00007f8708d2ec78 EFLAGS: 00000246 ORIG_RAX: 0000000000000031 [ 406.236492] RAX: ffffffffffffffda RBX: 00007f8708d2ec90 RCX: 0000000000459829 [ 406.243766] RDX: 000000000000000a RSI: 0000000020000000 RDI: 0000000000000005 [ 406.251820] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 14:14:59 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:14:59 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) 14:14:59 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000010c0)="0800b5055e0bcfe87b0071") r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) pread64(r1, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x28}}, 0x0) [ 406.259704] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8708d2f6d4 [ 406.266981] R13: 00000000004bf96a R14: 00000000004d13e0 R15: 0000000000000007 14:14:59 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) [ 406.308957] binder: 13729:13733 unknown command 0 [ 406.315570] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 406.325305] binder: 13729:13733 ioctl c0306201 20000180 returned -22 [ 406.330743] binder: 13735:13736 unknown command 0 [ 406.338563] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 406.350873] binder: 13735:13736 ioctl c0306201 20000180 returned -22 14:15:00 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/autofs\x00', 0x0, 0x0) ioctl$DRM_IOCTL_GET_MAP(r1, 0xc0286404, &(0x7f0000000140)={&(0x7f0000ffb000/0x4000)=nil, 0x1, 0x2, 0x20, &(0x7f0000ffa000/0x3000)=nil, 0x7f}) r2 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r2, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r2, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) [ 406.359470] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready 14:15:00 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000010c0)="0800b5055e0bcfe87b0071") ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(0xffffffffffffffff, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x28}}, 0x0) [ 406.408867] binder: 13738:13739 unknown command 0 14:15:00 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) [ 406.435622] binder: 13738:13739 ioctl c0306201 20000180 returned -22 [ 406.448105] Dead loop on virtual device ip6_vti0, fix it urgently! [ 406.490553] binder: 13747:13749 unknown command 0 [ 406.493756] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 406.497863] binder: 13747:13749 ioctl c0306201 20000180 returned -22 [ 406.535361] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 406.545293] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready 14:15:00 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x3, r0) ioctl$sock_inet_SIOCGIFBRDADDR(r1, 0x8919, &(0x7f0000000040)={'\x00', {0x2, 0x4e20, @remote}}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) connect$llc(r1, &(0x7f0000000080)={0x1a, 0x30b, 0x1, 0xfffffffffffffe00, 0x9, 0x47}, 0x10) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) 14:15:00 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) fsetxattr$security_smack_entry(r0, &(0x7f0000000040)='security.SMACK64MMAP\x00', &(0x7f0000000080)='+\x00', 0x2, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dlm-control\x00', 0x288240, 0x0) 14:15:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) 14:15:00 executing program 4: syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:15:00 executing program 0: ioperm(0x8000, 0x6, 0x0) socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r1 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r1, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r1, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) 14:15:00 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000010c0)="0800b5055e0bcfe87b0071") ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(0xffffffffffffffff, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x28}}, 0x0) 14:15:00 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = shmget$private(0x0, 0x3000, 0x140, &(0x7f0000ffb000/0x3000)=nil) shmat(r1, &(0x7f0000ffc000/0x1000)=nil, 0x4000) r2 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r2, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}, 0xfffffffffffffffd}, 0xa) write$P9_RXATTRWALK(r2, &(0x7f0000000180)={0xf, 0x9, 0x5}, 0xf) rt_sigreturn() [ 406.640692] Dead loop on virtual device ip6_vti0, fix it urgently! [ 406.651237] binder: 13755:13764 unknown command 0 [ 406.662166] binder: 13756:13765 unknown command 0 [ 406.675402] binder: 13755:13764 ioctl c0306201 20000180 returned -22 [ 406.677406] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 14:15:00 executing program 5: r0 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r0, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bind$bt_rfcomm(r0, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) 14:15:00 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0xfffffffffffffffc, r0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r1, 0x6, 0x15, &(0x7f00000001c0)=0x1, 0x4) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) ioctl$RTC_EPOCH_SET(r1, 0x4008700e, 0xd430) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0x100000520, 0x9, 0x0, 0x8000}, 0xf) setsockopt$llc_int(r1, 0x10c, 0x3, &(0x7f0000000140)=0x3, 0x4) fsetxattr$trusted_overlay_upper(r1, &(0x7f0000000080)='trusted.overlay.upper\x00', &(0x7f00000000c0)=ANY=[@ANYBLOB="eee5676dd3fa0e5a76850000000000000000"], 0x15, 0x3) ioctl$sock_inet6_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000100)) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x3, 0x100000000, 0x1f}) [ 406.695695] binder: 13756:13765 ioctl c0306201 20000180 returned -22 14:15:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) 14:15:00 executing program 4: syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:15:00 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) fstatfs(r1, &(0x7f0000000040)=""/156) [ 406.753838] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 406.807995] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 406.824652] binder_alloc: 13780: binder_alloc_buf, no vma 14:15:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) 14:15:00 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x406, r0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000001240)={{{@in6, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in=@dev}}, &(0x7f0000001340)=0xe8) sendmmsg$inet(r1, &(0x7f0000001500)=[{{&(0x7f0000000040)={0x2, 0x4e24, @multicast2}, 0x10, &(0x7f0000001200)=[{&(0x7f0000000080)="f1c1983100130ceb37744a46304f90869e0ad8479b8422a37bcd667e41664db32026968320b5812cc958cd759116c9c3f8b820b92bcf3f2db313740d82d3a206fb01744194a018eb0ef5104b9a0593fb47f8c56e67e473fb15d9f1cf1b45a4cb8a6cac7a44fe163c83c58e8885dd0da412235395d7162ea08d439d2547cff6a7f3fe6a14e290cfe5dc2ac65a08b3b93bbf0b7bb0669cea50483861d4717336c2ab1dfcaee6db63f250bcefcc93312b0d2c586a947582c90e574f3a565d3d56229b4f56346b137b16c2367e67dadf34cf4132808e6fea12ae5a69a18892e6de60f7902c798a2e95359e79e83def782900125dc55484774b2393fffef478270cf98a4dbc014567a2b71560c33f311811904c44e45c97a4d4be55807e5ec0f20237c35496ef72dcc583e9941026e22057f01b3d3c4933c4a63d65dba57973f23e24343200105c64df4ad945c61e73fe5974ca438c2b77aa71c1a8eacdf23683c2bbdcfe1a0ca1b8a4788a1e1acc6670b7add247b5dd643064f507a2426e47a69c2ef09c2a442a93b4a5762994dd0817ec0e94084ee0a9c26326ce8880829aec8bf9c6fd86d30437eff99f19b7b943b770b11836c08b5b446bef5592a6aca640ddaf546c71e0926dc8eba18e83c6d3b40dc514e50fee2976f30b7f21a2d1375457bd26ad01a45007a9b2e212452c1c039227ab40576a4cc9baddd8d13c315fc7755c6dd85205363b32626991994d51bda26fdbd5dd2cae1770ffcbc68fb74c4c6239dcee8304f3b39ae407c881ec2cdbc4ba2cb939e0abbb1db048c27e2a1d98aa564d1eba80a090abf31865a17c0c070781de633355b653f0f200311f201592644b3563748c3f8495a836f231fd41c60960c6b445b591c35b2046f09c5c32b423d7d368cad593e65c2d4dd517d484106a95e7115656136ac067b9eb3616b0ab1de80f094ae380c2ad711cdfd41a882ee8d3f28c6bedb8773304d291e8d2ffe882fa1ec4b0058a7281efb5e31a2b8ab4e4efd2a80249f7c10e552e3eb3ca96ca5c00c47ff9f27ff95bd035457baa84f08f17c9a15e67413b57f2ea43e7b69f52c63e45a7ee3e45afbc0b9ac79dd0628ad4a2b5d86cc888ff4a8ab1a4e7f78ba8e03ebe320a493f2a2d32354a2d6a97811ca46b5c7df3ee0561f44da95113d20b3bbc4a5833c40e41f0bc2930006da34698bdb312733ef7ecb33ef2165a19a3180092ce9a6578bd580a0652c47150382722b18f19bf0c311342ea28b450f2f044feccb55ca4b791564644b457167e7c8aa43e1510b1fd9a3923c209f24e8bc7c3349fc8e721b2baf2b49aac8009a9150a1fe82b9b34c28df283555cead10b9e4beac5d10c980ca65df0bd23ed5d4f42b6955541d3a21435ee678992f75261d127e3d58cfdec2cdcab67857ec31bbce282d8f1091260a2b4e21f2a59b5c8169710ea56144f75629f3134f70ba2fd2a6e0f04de7405334a82b19e119d407444113f3a290f26b9ff3651eaeb18356abaab986ef423ce2033c03335ad53d71b64bfef3f42516d01cdfa98b8430793d56d166533e7fca1c37f8ec91ec88d66615f3419a306950618a97a2a4e1dcf8c64abd74687db68acc6138f2d58d6cce27bbd9d9b60ffa0131eb2bfccf84ab3a9a17dcdb5fe2a86ef3d5073af068f073282331727e0f15dcf90528e452d3c27aa6f5b92ce441203fb3dd706abe4b5cccca01f3b7a55554b9f287446239ab9478ee813d1a8abb07a16c229d0027d37adbf499003668d68be0ca935fa911bb45ea9cbd7723bbccae6e353ff979d122070b5dacc68006ae7fa54f5e06461543c092ed0504480e3dce3803d2ddad2350688f474fc12f00a22a3240bbdbc03a154f5b86bfef8f62f0cd11170b0c044a61929cc000185089932741cc19f2d1b046af3ce82a0554e0608e4afd44309528ba386ee4a75c0dca3788feae0092e4ad5b8902b37c3ea09bb58de02cea1a9c4b400c1b783f054b784460e72f5063dbd5f8d20f94d133eb93fcc5c1d060db820c146f304bd738809714983b9b34c91646c30bf07a0267ab0e49404d10e873e4284205382c31273926012ad6873fa3010b137793d1cd9475e2be56e0bac5988890ec36e9880d857cf75600d1ece53801747328fc43ec61aa7a5a3796f0a446f1e5325a7ad34939ba7da84b208960ef24b38bfa07a5eefd688e895832f1683d3e8b7b026db396f9b2e45b5e97c8de38acb8f58f4e643b7b3a8464cf6453940ac238c334b471a3c25dbccbb09bd3e4c5b27c925dc4588e2835df9a344d4be75824d465e20bbe51ab03fa51b58591273743d4997458319b885c5ba177ec33562bbcd5c73f9046f49032432ca7f980104f294b0cd352c722f88c2aba7152ea6b539726bb3653b5e0c027efb91395eeb00a57064c8d9c872d3d8bbf06deb46384216af2cf9972167d53f1db77a9a1d7b89b28d6053acb82e9b58fb6ec8bf747b032788e77d19f4fbba74a75dccf88cbd6c2680d3c16d0f154e8e56f9fb4f4b6e420387a64e6411f856edfb9802730ac299899d5b7bcf1608c761dfbade80f0df9cb9d600048b419a9a692cdd3435aca35ca76da2fe3e0eee0b1747debfccaba65de608033c183e76461e40110458a07b34d1c8d8eadd171f8d78e2a6b29f5dbdd5ea6d483adab612f1e2ed45f4f73ab423d7d6894f8cf10c299a941c889c9686ed45aa44d28bb9802ba98fe75e3c8981f1665d21512b6403683f323104dcef48c24999aeda99352df73722f420c4d6ced3d13edd5e82e8dcb35b0986e0410ea1f4533113eab6233d33b07c348058cb50678ceb68bd25cfe551dffa76967c69be254e668d220b2fa88252dd417c3bb47ab9c18716077766083a73b374baeafe99758de7c6c6c62b829d57009f7db4039700a66fb7655505377207d28f9cd4829100dc0dbdaefe93297b5ac1f26746f3ea10ad6a0e7a41a81ae1f895114c3fe1062be5b5311096bfe745da8ca8ecde9aff26742d3a9201570490eec3e48a7463e4eb5225ed7f9712aaba34536759ba356caf21222ce8b439a6e979cb82c9230dbe880b8e87b02ac660a858e04a05042a7a11b8d50239b8cf7133d4efdcdea375ca2d15f2906d9946a129440bed3bc11b3ca3e912be8b1f2218b15431c539f4834c5020179cfe1967028cf30025df39548215329dc8586ecfdbc2f86b94b3438d2d0c34e95f62c29518e87611c5f52e7e6eb1b9fe34c34f7d5e3145fe8556abe16ab32b2c3b7b43d6730ab86f45ad18d5ff3fe6f1af9f8f38fe5b59486d8ac4ed45aeafd3694f87bcdb768fbe4c2aba4f0b448d3d6169672c2e8277c88ab1dcc2f7129894e8276e3d628f88566109d8fc4d2cabb8779f1fac0d769bd487f8374cdc03ad1b7b9fa4f9adf28c86c6579436fc6e88ada1bc96a0d90c9aef31e7499ad225862226b82a4ed30f1556ffb775c66965f5ae8dc6bf18d178ef369f16b1aa886019bc121b772e159074e5f3357e1fa99cf5eddd6e85b9d31a0beabe8d997ff02611314d99423213fa9e9a25bc73a9a62327a96729ef26919c210f89c175c041c7c0776f5312eefb8452dfc9d03dc47f9369563a8ac6c5fd571aa716a1e57640b74a68d8cdf97d749653391e492d7ab53cf1098abd631f8ace143e4f86bcb9ca5370f9db65c3cc6bafd88dc8c6551454d29a18908e1e6c0eba710554c99478745aab1b5f6c990faf815fb845c566567bb999ae9c5f8e7777d543fd114b087272db13717f3ecaa24964763a513cfcce4c83736580d1a4db6bb4c51c239ad92637d87b455c9f50bf1b33ce8c5777db33aa7f90949c6860442fcca426a23e997bf14f1b27be2485a65eab0598237db1b1d0fd8d534e13727cbf035358706798620afcc1e26d75803073086d724378c3052e12493e1a01d2e81b8dc6216348ca3231b2b2ae5a92ef50cee97d6b158debefd1fa9dc2b027228421cf742ebe6d4607f19486fac4d4d068ef416308e3d8bc211a2aca09f3f8ef112ec9c7197312cd79cbd5548e08a42566ac7dcf391d88da3ecffdf0395149359f8f641a6c400b54832089bbf97a5223365484cc36fb8347022a2e58dfdeafeaf841f47fe50ff1a7d00aa7e5d42adf3601822f4588ab292107b258ccc2110e76c9fea2ace4c51529427dfc56dcb4088d7f52fb731146dde9e56bc515ddafc3cb7e4293fc583e3339d245431378bc0ba5c3d4b82306307b3be7a79d0893c7ded0921df9808d915aca8db47e1808f2f20c206e4b8a19af049e94d092aa639f04155a3c0df79e5a8d13952ab5356ff64550a6f731e4c5d9d80f34972760407419aac1c9be1f1c81c738744febb6afde2755381495b568633c8cf0a3e7826468498da482fa2b21957c57ad482b5b17a2362a030ccd64edd6e7bb739df27fbbb7f8cbb603cd8d58fb93491c068f745f8c64373023e244e33d7ed0d31789e0f6844118218e6f2ce2d8e0fa88b9749631acd72c5f8e952d9e2e3d6b5c0dfcb070928effc0d0966d940e67e3ec5a2352a728d4dbe278d63075aa1b2a7e141715e66ad2749c3ac400c8dbdb565e3f16e0754a48d37b00a24b421ea589b48cdff1afd84a821d9917b6345238eeaec2bb0f87d191801af79334d1c98d29171027e399d997ce78d43367aeb4892bd56d4cd80702f0c4318d0a9a4e1635c0bd15ba49d1d8578980739c58870473540083b34e1f64f9c0096cce57439a32780971dd3e04c250a3153c67ed25cffc9f97ed65caefdae87900acf06d6f9a588186c091697618741e4690d2efc735a019ec264fa1d94da6489a9f8039a2e6e6821a16a3522486afe85900981002518485c2689e84a4ca54aa0762f27710ba950214b2837d8a299ce85b2856aea1b0fcb63731618ab815b7f4ac3ea0cf8b1de9a6b3e94b5ca3f15e736b4692437181ff9e4a07d01090398e09c92106fafb4b23dd808c98f5bf243441146f7f875b34c576935c71b41c8f0e4c054cde9f615e7340a1078e7d2096485b7fbca477fae7f3cfa614670498a1671721734745ae8c9e6e969a832987cbce6f06c48a63d98150080600283205dd7e1a5e3996a289033f5afc9e8c4616fd358cdd03ed5be89d64c02d8789e531f7cf701161c7819d2a6e90702998c86af4ef43b60ea48fc7fcaeeeac3bf50160bb691a16787497c8a044d5b114878f15f2f8671158bf9dbb691e5bd206cd52314bdce8fceeb500743ede7429a9eb02eced57f92c028e140d8c11424b400e9a1fc154a0f5298c4384886c70532ab11c41b0e06df77acbf8ca1e6605ac435daae908298f974d8a7681ef51d3b6d4e7c694d252af98394ee8d2dc45ab97f523c9a2965193cfa99c1db6999f21838f0ce246ab8fce1d9bba73aec841609bc55936a6f5712ad356ed1922151171e4be294e6f6b160351e57410208ae3fcaeac7bf873d09f496fa810cd817e0b0594e5f2d80b50609bb375efcbf4c1f1ee1db7ae1317a87d4f837137be2475c67cd1556b22bfc8c5484545c87636265543febd029fcb5ab820d1c0a9f2a5fcbd6b036685c7dab845e98eb3d0fb9c3cf445586462a6f40fb201d4e0b00237eee227ccaf44d21581eff22564dcdad070de75628e74dbdcd56758a61d6ffeae650e9702ddaa85b394e09b30c718547925a25996a3cb8a6ae8f97a0c77b36edfb1a1811c5095823199f0828f305e8dc80574133c54588b91e97c5a128ab05ea267df5a5e1b73aef23f7fadbc26583eceb24fd753e419c5f8fe9f3b0dbd6b4590986ef549e721fc280469dc7166995e9a21b45c79b4cfba87fd74e02557df705b4367", 0x1000}, {&(0x7f0000001080)="a23a1da811b3b8ee2f6c0146f49e61069a0f68199c65e792155029680293f5ab35ceaa5f03fd0c28e832a618446c90385903c427e0e6bc8d8b7702d495ecde82e78a6a9ac9be", 0x46}, {&(0x7f0000001100)="8374f604c46c2c998aa458d2a322245659ffdc96f1e4e4aa79a42a9c9004c23b989f9c", 0x23}, {&(0x7f0000001140)="569576c9e5f20153ece679043e014f9ffa57dfcfcc181d664aac36fb5c54bad3f8de0a401caff713a55fe1f4bdfa536d1e33e17d62500bd3cc146ed7fd0c7387e9a3c6ce0e82ed704530d3cca67a9ebd27574579e8e3a95ca09ebeebb3aa2a9a6cb6936f47df74d64969ddc63a22a30104015b76d96b97b5d8b53664f79d1b38a7910b055193012afcdd1b4decf56a31607b648cdaad0d19733fb24da1efff59ad0f45d16f3be15d550ce605a16877", 0xaf}], 0x4, &(0x7f0000001380)=[@ip_tos_u8={{0x11, 0x0, 0x1, 0xff}}, @ip_retopts={{0xd0, 0x0, 0x7, {[@lsrr={0x83, 0xf, 0x4, [@loopback, @rand_addr=0x7, @remote]}, @cipso={0x86, 0x2d, 0xfc, [{0x6, 0x2}, {0x6, 0x7, "e5d1449959"}, {0x0, 0x6, "67f528a5"}, {0x5, 0x4, "db04"}, {0x7, 0x5, "f8c221"}, {0x7, 0xf, "5f0d651880651a78543e8f2d38"}]}, @noop, @timestamp={0x44, 0x18, 0x5000000000000000, 0x3, 0xff, [{[@dev={0xac, 0x14, 0x14, 0x23}], 0x101}, {[], 0x8}, {[], 0x81}, {[], 0x7f5}]}, @noop, @cipso={0x86, 0x67, 0x3, [{0x2, 0x8, "02331ae14089"}, {0x1, 0x12, "4bad0745f169274fe20f3cee9de20268"}, {0x1, 0xe, "447054780f684694e80579ba"}, {0x5, 0xe, "d323318889a520c20031be8a"}, {0x0, 0xc, "97cad1e11a2cfb4d1acc"}, {0x2, 0x2}, {0x0, 0xb, "78bb5c4834e0de5a33"}, {0x0, 0x12, "886012857a4b0ae02ef8fc3ded58dc2d"}]}]}}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x3}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x533}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r2, @rand_addr=0x11, @local}}}, @ip_ttl={{0x14, 0x0, 0x2, 0x1}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x5}}, @ip_ttl={{0x14, 0x0, 0x2, 0xffffffffffff8698}}], 0x180}}], 0x1, 0x844) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) 14:15:00 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f00000016c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000280)='/dev/hwrng\x00', 0x400000, 0x0) ioctl$PPPIOCGNPMODE(r1, 0xc008744c, &(0x7f00000002c0)={0x29, 0x3}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r2 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r2, 0x29, 0x24, &(0x7f0000001480), 0x4) r3 = syz_open_dev$vbi(&(0x7f00000000c0)='/dev/vbi#\x00', 0x2, 0x2) sendmsg$alg(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000003c0)="5780cca6380cd8b899709e20b64b9290018ada5c8ad52127843a7bbf9641bd8b4ca590a10ca297bb7af477f68bb0b180d25edfc89ae5a403eb2878441b4d54012ffdf0d8f150ee5ba27ce886cd3374937d343ab7d8d5ed4a7d96105e3e8488ac1d2101a12a33129e528cd07a286cf145798504128dc392bf0b973992b24b8d249ade23fa107ad160bba001239658de09e5b981860c512868d69bce3e07f600347476204c0149c5210cfb5dd62a4c7fe381d4237fda44835a31d80e27a8d9cef5a853700c5f195badb693c7222a6c04a2834d0bbd0f508f837143eea946fd210e94c66867400fdf9ceace3c940fb9964a3ff4c6ef817249ebd4cba24c589ece350a9307b216ae083a25434a468dd281339c48c0ed63dfc9a42c91dc15fc525cdb706bfd400cc1b16b144822e5eb1a69395423d61de8ac696ce2a348a7543a366a74dbc6544e699df8737fcb8069a5e7213fd40271812517acf4894a7b9257ebedec5b962989ab6ce68e62e6bef663534ab8540e957754c00f0653e6f08c06bb952848700a43b958fda10449f151c7976890bf0d1ef95ea9983afb72ccc963ec2c6060644a89324fda3743e7bdcebfa8f22468eb38cd57bf6c658f1acb37e4d43b9778fcbc830e0ff93b96ab2902b6bd53fe7db921b95ee5b26a5d41bb1addc2327f0cdc4d42be28dafb765f7aabe459b3ad005dbd52014061a2f722d4eb3fe410fb55b8637649a1c5a33cb2f83e4ef6d77d98d187e1b54762d0fcd31732b25c33f0fd6a39c4d537ff0b5bb0536dc3b95c7992ed7657646819376e9f2c7ca07dfea3c16f57784a20b03555f3097635f5c8070d813e5b4931087a008093d924213ea20b7b3b7d5adeb01c92a900c724e7ed77c7b721ffabd3f1200a227cffb3ef9ff049f61b370e103b047d4a71a03d878ef308110af0e8bc44261949643fa5c8c7658198fe6fe8ba4b14228140003ef769619b183d20777ccd7047a12541576cc6142609156ce0f612f9360a433829294dc19c8b8a7f15ce1b9075285d7590da58322277c99b8abfa0536c81d713f9e7a7eb0192e99f6a26ff76cab56670ac19ce29cd4c5f0718224c5cffcd4d216a2365e51ed493a8faa3d29db2635ad20c449e2aeda531a03d62fef6981ffd833655df80fcba79895358a943fa05f6518fd14d23e1f92e85360053e77403aee612ebbdf269b0f1c9c136f57cd7a24ca8446bff5c0fbf97ed6384564cc5470d655a57be8762f9df1b47ff0b42f9a8a653240058587508c4e3b117e73943ef0e9668ed43c3c766dec7a07bf2de4c249eabd7a8fb69ba5c5f748ee030c3f299b20926c6089b68f319248695aed55e9e1498eb2ce4c5f7c5a2e98c5e0a305606978994a2241b22bb806a2df0fc66df26964af4be529631a7cf43d8136f20da6679240df86b18404071284522f99cc6384a3bff254807504b1c1bef445d425d878325189f3d3614051ab7c78587dc77cb0531f5a6bbdee1db58a2b8f3df6949dc6611905f421ce30e5e9086f0cd5b375339da4668d4ec5d4afd37b22d541fa274b0dbab427e4d819f4c2fc697a34a0a48eeeeca23e612abcd263a6a87d9312ed0e09b9e1ce8982d97a14d35c655531fdc79c0c28d48bbf19cbdb552470a67f24d15690c8079ea46eb5f294cca4e56d8706bae14679004321edf29e851b048d2569ad3a09faf09eaf9b7a9a5965b30438672d62b65681317a371740337b2417f5f653980d9a3ab7d19c54dbc7e7e1553d3054a7934936d113df28f7b69f47ab051c7d4d182b25aa73c97b7001c3a89693ea61fedd45eedb03eaf5ae290371c1d063889326986e4208d6b9397bcb5a5e383c9db91dfb364402a72faadda7fbee6bb032f5b4267576a6b5a6e70d3845491a651f6ebe8926493ada9e94f274339dc0f6633c2ed54d57f46e9685eb1a31ed408e45cf47a6b4b99e0a7655112f4a31857695812300805e73e7521dd3d258b9589a2ecdf3d47d53d5f38dfaf33bced721c60af15a20e44766a26110efc8a056ce99ea53a59a45be37571952a9fb2c25987567e99d159fab523e8a05fdecd88ea1efedf3ea0fcbfc982e61b2dfbe2207751eccd2ee9eccb0df6bfb9730e79abea25b28a39d83119b342fc7664a3b7c20461696e38bcf75ad4f005930a6d48419f4efc9e7ccdeb6db706b0259731df2c221b48cce5f570c7e0ca6336ef916696ba319f24b5162e7ea9c277f8f1a2ed0bab7b0c5d7eb6fad51fc1959feaaa405ee57d05f7eeadd999fe39af3282e0f45ebb0bcb5eef5701d2a505d6ef0b48c30972274a65580af5a4219c61d8acbbf301a6582efdfb32b07f51b4986eead9ee6b6e1d885effcd0feae040e02d14bda66e68fb9a334c21592be39befbecf7d8ff340acf7a618ea8f6b8f73a2d93e621b2d791cc44ae7b9a725fa30a4372dcee9bc0b477621a280e405c7dc5d5328390ffc58cab99cfc273829566bd01be2824e02fdf111ae5b76a4dd68caab12007e756bf8008fbe0bb3c27805136b4841b3fa903270107dd6c8c12979b319eee5bbb61a9739229d3e2cd6d6666eaf55bcf36223b395f273314e09876a523f666da1d3e6f5206b1ffd59c2ac976e10337670b740dfb1c6869111240b1311501009de24f0b0ac51d779a10880d596f1b04ebc6a5d9d612ab8334d44b210555fb8804365e110abb07dcfdfee16328c30f9956261d7846f34c0dcae96f1a9c4ae46486998d526724de4a1672479563baf510199113814b9f2861cde86edd88d843ee512b66c03a6dfb9946cc00eb278db008ae281f0365e79b9c452054106a195f64a2171011474a08852aa85cc443dfd3b904dc5a486fbb699da43fc75898e4a7f4f9e6fc11e5da1275069bb1a488fdbb90e8b83e25597a5ca18af0ea6ed76a996e7f376531889eeaa4f2fc2764d615479ccb243a0399619613d3aeca0594d8add509f13da749f63205c1e1a167d2a0bb375e64cbd0ba7aba4f72f7376ee93e574d72e33bba24820fe42896cf9fc18a55b7e5120c33fac4bcea4650ebf8785bb89e12ee98c79e62e10aea315257d748b4e4ae6d92013afcf6693fe5d98d8a984229b836e0d5291cdb276d684b5b23e6499f088c87d522c693b927a0022b3056d3132f5f8cd44e018e1dd1db02cf2ae7c9087a91c28944d0c38c48911e1ab145188bc7ee42848645c74ec75d256f59e107fd0398de01f9cd3a0556195660c256a12f837bb2da0202e03ba336edf11784d19fcde92b06e1604b911dfd54a8eea681a1c2ab8fdfe1ae18c83bfd409d692aed664d0b0819b8fab912a34358a53abb57cb2dcaf9b6af33315887564420b29686c5f9fa111cb864dbe9701fb83e1293c0c31eb5245bd9b66b658b9a778895adb2628d1be662bb2c6f6c703b2e5ad15068a16346cb7fd624a89fb7b3c752e37da787c43519c226b59605fb72a7f78bcdaf8f01dccce417ececdbf55aaf406e9ddfb9352c44dbf18175ec39be297c7024f6d7714797829a303e3dc9afbd5b8a4b6bcee9c53962f6f984c2f22d0c1815167fcd4ed8a2cd345cbdb17b2a0436edb0de7eb1e5669977c24392383667c1aa3e558e9680eb4526c8175077adaeba1bc776bab0a6fd0e793a74ae14120476c95b7332cb34b95564ed09926d2ee88c36aebf3fd9d1aef5c78d3a6df8800dbab6b88f8f8d6d2c4f63c17fd3bb00079c750e645ca77803597218c0d5984ebedd155a9b70bcf61c06e6cad9e28531c4412bce24b98b5cda7dc62657e65676095ef32f0c3199e25d7f01a5c16268a7a0047028fd33c59d4a54d17c387c4e71c96c2b9142b188f1dc63c858cb67e79cea8aa837050df3ddbd876ec22c5fd32cc9888eb5db429c60d6696e0175ae72f94deb06c5ecdbe97d8b9257572a849ea59835a742d97ead829cc7c5d7f47ef44484d360ca0b2e3ad0d9ddba3ab5ed9754b78edf3fea86b592ba9fa642e9b0fa73919bb7f3cd5e1b2e560e0bba713ef079c8ef10feda961a3d8b3b0ff748468926d13f5e8263fdc48dcdfe36386942337b4999c15f3a872e1c56253b8ecc01cb1dff579bbeb583185b6f161cadd6d5ed0160d9e3162df7c85a52156c5254740c764fc661e6fa6969d7fcfd77326be7efd9dab2e7bd7ff7550b3ccc2beefe93e3a7036279d085594ca20c1669bab864a5c14cdabfc7f41afecf53f99812d4cfd292927c02a2574cbb9a0e94c894324b87afdafd1e78fa13b32829873dca27b7fa5aa55f364128686e82c39185cd7de5e9a1542f4b7f674012b4fd51b6fff6d23865f88ba35edaadb3c744c38d6bddfff1ac4c00a100591d0af7b4e1baa716ab484695161caee91fa2fa6ebc212c3f237f23f001c0aecb4ea5b2a0f04e49f83adebdd5532a7cbdc46b4390722494ba4a73854ee655de5fa2c6774af24ae3e9e47c37b2275a9fddec7c84a5dde78f11043832dfa995f14d5c04039085de23fe4e739bcb8c9159d0deaec558cb4fd100689610ed0921e529b5ae132d61ea70c4c916d8561151a6ed49c8f3f0f449564ce723e151ba2b096012b668e17fe7e99e7374bd5db1d924249b930218c61258e86d1e916fb7d6ae231442c7a0f56f9286b77d5be0f6cb432275708d95ffbd95b08e2e03b9a87e3272c24abbf1d547473fe68d89b5c44838a33ced6d09deddff7c3553f1c2241ce61053af903b1d1c58d3b59cdc26f437a61e4ceab88f23a3e706f9c801df23dbf7f185708953ccbd96dab22ccd1f06d7ad8ab4cc3145084778ce86e076e38ca603fb6b46f80b664a2903be9ef868afb0510c8a73a055053cf0d1813923b681573516837f37145c20d1401b87c9ce979d635f687a6a11ac405f52fec84c7adc7b7bfffb1c3a0058b29827899f67404b9b95d2fe336c01639a43c2f834507217608c3e1b662f293c83056808051348fd68e08c886e158efe1dbebf8b84e58740d8071bece5e517852866dcf4e35e57d1aec1078cec4fc51837cb8a7691580ed8a43b3a8780ad49b1debc29942521662389038bcf6456d26b800fbbd5a7da64659c3c53a20c315691e1a2bf4ec7f67dd4c67432cbfdbe34f3b15e945b5567d9456d31c9c165144fccfddb9f01447d61056504505008442ae99a2b8cb46370ec5a764efdad69c992fbf83e5b06fce8f296eb80a1af229bcb98c21828f55aeaf909b0097e078238821fac539c29c7de49d3304044b98dede335886004cf4f77db8f3668b1f51b1b5a6ff6489a21acad9fa54939305b3ebcac34fd7cd29b1ede5d9629fb38a9658e6e4c4784384f2fe687cca73e78aa901c0d10cba419904ae4cceeeeb63c908c0eab6d120bfd2317406228aab8e5cab24ea0675628cf6305d06779b6c886a59019a1af990c84a14ef769508f9185038b81a183181b934d8586db912ce926423845c6ba452e832083058c4d89b0d7f6a4250768fada1fcdd037ae5472e9887593aea39496381611a7465e94989fb73a5f0b040d62ae59bd04fe25ef47e7c6ab1c0a197230ca120a4e19453493298bdb0a639860eb7473af08bf0d0f8cfbd4514f6da8d7e195ddb5d181df30afce5668c0016c35f6b34d642b970225db21c5c542d1aaa0dc5312218c5e8eb33cb11d7e26502391d8b4cf8aa8902a45a9449487534a12f65df13b7193778e1df72675bc49ca839b4d19057172e677ef01cdc1e7e1b4682df21bcf916a097c6a523e1ea6faadbaebbc750ac56f921ced949ab401f4b2a762ff8da26eca561c030f99b6ca11917d4bf36c04c8f1b11ed9ecbdacfb32a4ce24987023a860de744471b9719457b743d478f4aa08061a4", 0x1000}, {&(0x7f00000001c0)="59dbddbcbaa2fcfc7cef32c38194d258a6664b568c6eb5020aeb769a61f02dfd31747e798cce2b98c428eee7b21aef2d3a72b01ee65a971ec9fb9d4a27ed160e6cb880c61058a03aac33", 0x4a}], 0x2, 0x0, 0x0, 0x4004811}, 0x4004080) sendmsg$kcm(r2, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) recvmsg$kcm(r1, &(0x7f0000001600)={&(0x7f0000000300)=@ax25={{0x3, @rose}, [@rose, @rose, @netrom, @default, @rose, @null, @netrom, @null]}, 0x80, &(0x7f00000015c0)=[{&(0x7f00000014c0)=""/232, 0xe8}, {&(0x7f00000013c0)=""/101, 0x65}, {&(0x7f0000001440)=""/19, 0x13}], 0x3}, 0x10000) [ 406.848325] binder: 13780:13787 unknown command 0 [ 406.854839] binder: 13784:13788 unknown command 0 [ 406.857258] binder: 13780:13787 ioctl c0306201 20000180 returned -22 [ 406.869407] Dead loop on virtual device ip6_vti0, fix it urgently! [ 406.876449] binder: 13784:13788 ioctl c0306201 20000180 returned -22 14:15:00 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000010c0)="0800b5055e0bcfe87b0071") ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(0xffffffffffffffff, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x28}}, 0x0) 14:15:00 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vsock\x00', 0x303000, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(r1, 0x6, 0xe, &(0x7f00000001c0)={@in={{0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x1b}}}, 0x0, 0x9, 0x0, "5b5a913e28f5de42dee2f7c04cb426a91e79881200bbef0dfebfd28391a6d8f9304f2c912d6dfad34e79afa491b9b89cd9ab69ef01a7d7cd1cc37bf838d7a12a544fe7f6edfa1d6d70cc15d44b81a6a0"}, 0xd8) r2 = fcntl$dupfd(r0, 0x0, r0) ioctl$VIDIOC_QUERY_DV_TIMINGS(r2, 0x80845663, &(0x7f0000000080)={0x0, @reserved}) bind$bt_rfcomm(r2, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) mkdirat$cgroup(r2, &(0x7f0000000040)='syz1\x00', 0x1ff) write$P9_RXATTRWALK(r2, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) [ 406.971057] binder_alloc: 13793: binder_alloc_buf, no vma [ 406.999931] binder: 13793:13798 unknown command 0 [ 407.013078] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 14:15:00 executing program 4: syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:15:00 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) recvfrom$llc(r1, &(0x7f00000001c0)=""/4096, 0x1000, 0x20, &(0x7f0000000040)={0x1a, 0x1b, 0xfffffffffffffff7, 0x4, 0x9, 0x9, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}, 0x10) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) [ 407.021399] binder: 13793:13798 ioctl c0306201 20000180 returned -22 [ 407.042951] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready 14:15:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) 14:15:00 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000200)='/dev/sequencer2\x00', 0x101000, 0x0) r1 = syz_open_dev$sndpcmp(&(0x7f0000000240)='/dev/snd/pcmC#D#p\x00', 0x4, 0x400000) r2 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000280)='/dev/dlm-control\x00', 0x0, 0x0) r3 = add_key$keyring(&(0x7f0000000340)='keyring\x00', &(0x7f00000003c0)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffa) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r3, &(0x7f0000000440)='big_key\x00', 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0xffff) getsockopt$bt_hci(r1, 0x0, 0x3, &(0x7f00000002c0)=""/45, &(0x7f0000000300)=0x2d) r4 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x40000, 0x0) ioctl$SG_SET_TIMEOUT(r4, 0x2201, &(0x7f0000000180)=0x100) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) fchmodat(r0, &(0x7f00000001c0)='./file0\x00', 0x80) r5 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r5, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r5, &(0x7f0000000000)={&(0x7f0000000040)=@alg={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-avx\x00'}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) 14:15:00 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$VT_RESIZEX(r1, 0x560a, &(0x7f0000000040)={0x6, 0xfffffffffffff00a, 0xffffffffffffffff, 0xffffffffffffffff, 0x3, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) [ 407.083238] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 407.117821] binder: 13811:13812 unknown command 0 14:15:00 executing program 3: socket$inet_udplite(0x2, 0x2, 0x88) r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x28}}, 0x0) [ 407.142824] binder_alloc: 13815: binder_alloc_buf, no vma [ 407.143063] binder: 13811:13812 ioctl c0306201 20000180 returned -22 [ 407.166917] binder: 13815:13819 unknown command 0 [ 407.179649] binder: 13815:13819 ioctl c0306201 20000180 returned -22 14:15:00 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x800) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) 14:15:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r1 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r1}], 0x0, 0x0, 0x0}) 14:15:00 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r1 = socket$kcm(0xa, 0x122000000003, 0x11) r2 = openat$full(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/full\x00', 0x0, 0x0) ioctl$KDGKBSENT(r2, 0x4b48, &(0x7f0000000140)={0x6f, 0x126d, 0x7}) setsockopt$sock_attach_bpf(r1, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r1, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) 14:15:00 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:15:00 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$TIOCSLCKTRMIOS(r1, 0x5457, &(0x7f0000000200)) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = mmap$binder(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000040)=[@free_buffer={0x40086303, r3}], 0x55, 0x0, &(0x7f0000000080)="4c9b60bd5816cf66f431b291603688bc95c55796b9d15fca4963c5f24171935a15bbf879bf5ea4abb94af1e8ce2da24b8ef9a398ba1785505b742f22f91b08a5c922664563585d00e973f1d4c3c85eee9ade69a208"}) getpeername$unix(r1, &(0x7f0000000140), &(0x7f00000001c0)=0x6e) setsockopt$inet_opts(r1, 0x0, 0x4, &(0x7f0000000240)="017bfd623f888c17a750421a637d954bc27adfbafd4e860ea03cadc86ea7953044d12793885fbe68061b433a524b5991a268837930246a8bccaec1a568862ad3018b2feea80c8115cb73056ff754667ec145065d71a54b58ed1cddb810c5365373cfd57765a013b98c14f0da5797ed7ca35073d29ca29f3d33ba67ab137034d9b7ce9acd60c8ddb5d1ce349188629f0068788df05a4aea4835ba785dff84acb6e1725fdbab3b86192b7301e1df5496c3a9743f464fcae81b0ec3005115c18a5107b30f66e4da2a452f9860ab82c02968c95425cf5065ac091d33899f95aa", 0xde) 14:15:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r1 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r1}], 0x0, 0x0, 0x0}) [ 407.313917] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 14:15:01 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r1 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r1}], 0x0, 0x0, 0x0}) [ 407.357948] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 407.368082] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 407.383680] Dead loop on virtual device ip6_vti0, fix it urgently! [ 407.401050] binder: 13840:13852 unknown command 0 [ 407.413960] binder: 13840:13852 ioctl c0306201 20000180 returned -22 [ 407.426506] audit: type=1400 audit(1564496101.033:68): avc: denied { map } for pid=13847 comm="syz-executor.5" path="socket:[52592]" dev="sockfs" ino=52592 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=socket permissive=1 14:15:01 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) ioctl$SNDRV_SEQ_IOCTL_PVERSION(r1, 0x80045300, &(0x7f0000000040)) 14:15:01 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r2 = socket$kcm(0xa, 0x122000000003, 0x11) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000140)={&(0x7f00000000c0)='./file0\x00', 0x0, 0x18}, 0x10) setsockopt$sock_attach_bpf(r2, 0x29, 0x24, &(0x7f0000000280)=r0, 0x4) sendmsg$kcm(r2, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) accept4(r1, &(0x7f00000001c0)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}}}, &(0x7f0000000240)=0x80, 0x800) 14:15:01 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:15:01 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) chdir(&(0x7f0000000040)='./file0\x00') 14:15:01 executing program 1: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r1 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r1}], 0x0, 0x0, 0x0}) 14:15:01 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x28}}, 0x0) 14:15:01 executing program 1: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r1 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r1}], 0x0, 0x0, 0x0}) 14:15:01 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_int(r0, 0x29, 0x2, 0x0, &(0x7f0000000040)) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = fcntl$dupfd(r1, 0x0, r1) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) bind$bt_rfcomm(r2, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) r4 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x1, 0x2) getpeername$packet(r4, &(0x7f0000000240)={0x11, 0x0, 0x0}, &(0x7f0000000280)=0x14) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000002c0)={'veth1_to_team\x00', r5}) setsockopt$bt_BT_CHANNEL_POLICY(r1, 0x112, 0xa, &(0x7f0000000080)=0x3, 0x4) 14:15:01 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm_plock\x00', 0x8100, 0x0) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f00000000c0)={0x0, @in={{0x2, 0x4e24, @multicast1}}, 0x581c, 0x6}, &(0x7f00000001c0)=0x90) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r1, 0x84, 0x73, &(0x7f0000000200)={r2, 0x8, 0x30, 0x4e, 0xe1}, &(0x7f0000000240)=0x18) r3 = fcntl$dupfd(r0, 0x0, r0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000040)='/dev/btrfs-control\x00', 0x2040, 0x0) bind$bt_rfcomm(r3, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$P9_RXATTRWALK(r3, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) [ 407.959091] binder: 13866:13875 unknown command 0 [ 407.962058] Dead loop on virtual device ip6_vti0, fix it urgently! [ 407.968395] binder: 13866:13875 ioctl c0306201 20000180 returned -22 14:15:01 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:15:01 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = open(&(0x7f0000000140)='./file0\x00', 0x8000, 0x40) connect$llc(r1, &(0x7f00000001c0)={0x1a, 0x335, 0x100000000000007, 0x7, 0x4, 0x8, @random="9f17f6db7959"}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r2 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r2, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r2, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) 14:15:01 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$VIDIOC_SUBDEV_DV_TIMINGS_CAP(r1, 0xc0905664, &(0x7f0000000040)={0x0, 0x0, [], @bt={0x5, 0x3, 0x2, 0x6, 0x5, 0x7ef, 0x11, 0x4}}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) [ 408.046415] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 408.084845] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready 14:15:01 executing program 1: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r1 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r1}], 0x0, 0x0, 0x0}) 14:15:01 executing program 2: clone(0x40000, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc) r0 = inotify_init1(0x0) fcntl$setown(r0, 0x8, 0xffffffffffffffff) ioctl$SNDRV_TIMER_IOCTL_PVERSION(0xffffffffffffffff, 0x80045400, &(0x7f0000000040)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SNDRV_TIMER_IOCTL_INFO(0xffffffffffffffff, 0x80e85411, &(0x7f0000000140)=""/163) fcntl$getownex(r0, 0x10, &(0x7f00000000c0)={0x0, 0x0}) process_vm_readv(r1, &(0x7f0000000380)=[{&(0x7f0000000340)=""/61, 0x3d}], 0x1, &(0x7f0000002540)=[{&(0x7f00000003c0)=""/63, 0x7ffff002}], 0x1, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_rfcomm(0xffffffffffffffff, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, &(0x7f0000000140)={0x1, 0x0, &(0x7f0000000040)=""/32, &(0x7f0000000080)=""/137, &(0x7f00000001c0)=""/220, 0x6000}) write$P9_RXATTRWALK(0xffffffffffffffff, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) [ 408.124792] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 408.164370] binder: 13888:13903 unknown command 0 14:15:01 executing program 1: r0 = syz_open_dev$binder(0x0, 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) [ 408.179046] binder: 13888:13903 ioctl c0306201 20000180 returned -22 [ 408.187355] Dead loop on virtual device ip6_vti0, fix it urgently! 14:15:01 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:15:01 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) ioctl$KVM_GET_PIT(r1, 0xc048ae65, &(0x7f0000000040)) 14:15:01 executing program 3: r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x28}}, 0x0) 14:15:01 executing program 1: r0 = syz_open_dev$binder(0x0, 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) 14:15:01 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)) r0 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x8, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x8) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) ioctl$SIOCRSSL2CALL(r0, 0x89e2, &(0x7f0000000140)=@default) r1 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r1, 0x29, 0x24, &(0x7f0000001480), 0x4) socket$kcm(0x29, 0x2, 0x0) accept4$packet(r0, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14, 0x80800) ioctl$sock_inet6_SIOCDIFADDR(r0, 0x8936, &(0x7f0000000280)={@mcast1, 0x7b, r2}) sendmsg$kcm(r1, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) [ 408.287204] ptrace attach of "/root/syz-executor.2"[7049] was attempted by "/root/syz-executor.2"[13910] [ 408.343541] binder_alloc: 13912: binder_alloc_buf, no vma [ 408.365292] binder: 13912:13918 unknown command 0 [ 408.377147] ptrace attach of "/root/syz-executor.2"[7049] was attempted by "/root/syz-executor.2"[13914] 14:15:02 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$EVIOCSFF(r1, 0x40304580, &(0x7f0000000040)={0x57, 0x0, 0x5, {0x0, 0xad0}, {0x6, 0x1c5}, @rumble={0x0, 0x2d48cacd}}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) 14:15:02 executing program 1: r0 = syz_open_dev$binder(0x0, 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) [ 408.389110] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 408.389629] binder: 13912:13918 ioctl c0306201 20000180 returned -22 [ 408.405934] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 408.408977] Dead loop on virtual device ip6_vti0, fix it urgently! 14:15:02 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x408, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) ioctl$KVM_ASSIGN_PCI_DEVICE(r1, 0x8040ae69, &(0x7f0000000040)={0x8001, 0x8, 0x26e8, 0x5, 0x1}) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) 14:15:02 executing program 5: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000680)='/dev/snapshot\x00', 0x200220, 0x0) getsockopt$ARPT_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x0, 0x63, &(0x7f0000000600)={'TPROXY\x00'}, &(0x7f0000000640)=0x1e) socket$packet(0x11, 0x0, 0x300) ioctl$VIDIOC_ENUM_FREQ_BANDS(0xffffffffffffffff, 0xc0405665, &(0x7f00000005c0)={0x7d89f8ba, 0x6, 0x7f, 0x44, 0x5, 0x33, 0x8}) pipe2(0x0, 0x0) r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000440)='/proc/sys/net/ipv4/vs/snat_reroute\x00', 0x2, 0x0) r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000004c0)='TIPC\x00') sendmsg$TIPC_CMD_GET_MAX_PORTS(r0, &(0x7f0000000580)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x8020}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x1c, r1, 0x8, 0x70bd2c, 0x25dfdbfb}, 0x1c}}, 0x40) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(0xffffffffffffffff, 0x111, 0x3, 0x0, 0x4) ioctl$VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000180)={0x0, 0x6}) unlink(&(0x7f0000000280)='./bus\x00') r2 = socket$inet6_udp(0xa, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x349, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x1, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r2, 0x89a1, &(0x7f00000000c0)={@local={0xfe, 0x80, [0x1600, 0x3ef, 0x2000000, 0x3f00000000000000, 0x100000000000600, 0x0, 0x1103, 0x0, 0x0, 0x0, 0x0, 0x6]}}) prctl$PR_GET_FP_MODE(0x2e) ioctl$sock_inet6_SIOCADDRT(r2, 0x89a0, &(0x7f0000000040)={@local={0xfe, 0x80, [0x0, 0xfeff0000]}, @local, @local}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) ftruncate(0xffffffffffffffff, 0x0) write(0xffffffffffffffff, &(0x7f00000002c0)="60b7fdfefe5f021ce1eef846f2e3402518b4878718dba7bc53eaaec76281255a6d32f40eb26b15108f75cf531c785ec46fd4eca035aa274e01456277d142de586e0300f3046a957353d67c0266a97601e4a538a6cb7463b32137efa8bc601828341d945dfff47e0ade421675a0c3076bbd039ec4060f05965c5035356f520e2899008659e1fcbaca361da5c7ca5faa66b64f541c581a474eb2dec05831a3fc5c10535733ab4534bac96e6d46729211453ca25db42097a9ac0713ba", 0xbb) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x3f, &(0x7f0000000000), 0x4) openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000140)='/dev/dlm_plock\x00', 0x800, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/sequencer\x00', 0x200000, 0x0) ioctl$sock_FIOGETOWN(r2, 0x8903, &(0x7f0000000380)=0x0) setpgid(0x0, r3) syz_open_dev$sndpcmc(&(0x7f0000000200)='/dev/snd/pcmC#D#c\x00', 0xffffffffffffcd4b, 0x204006) openat$vfio(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vfio/vfio\x00', 0x1, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000400)='/dev/dlm-monitor\x00', 0x121080, 0x0) lchown(0x0, 0x0, 0x0) 14:15:02 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) [ 408.469427] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready 14:15:02 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) getsockopt$IP6T_SO_GET_INFO(r1, 0x29, 0x40, &(0x7f00000000c0)={'nat\x00'}, &(0x7f0000000040)=0x54) write$P9_RXATTRWALK(r1, &(0x7f0000000080)={0xf, 0x9, 0x1}, 0xf) 14:15:02 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:15:02 executing program 3: r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x28}}, 0x0) [ 408.568612] Dead loop on virtual device ip6_vti0, fix it urgently! 14:15:02 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) mlockall(0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r1 = socket$kcm(0xa, 0x122000000003, 0x11) r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x1000000000040000, 0x0) ioctl$GIO_UNIMAP(r2, 0x4b66, &(0x7f00000001c0)={0x4, &(0x7f0000000140)=[{}, {}, {}, {}]}) setsockopt$sock_attach_bpf(r1, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r1, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) setsockopt$inet_sctp_SCTP_EVENTS(r2, 0x84, 0xb, &(0x7f0000000200)={0x6, 0x6, 0x5, 0x0, 0x100, 0x6, 0x8, 0x1f, 0xe0, 0x940, 0x10001}, 0xb) 14:15:02 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) fsetxattr$trusted_overlay_origin(r1, &(0x7f0000000040)='trusted.overlay.origin\x00', &(0x7f0000000080)='y\x00', 0x2, 0x3) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) [ 408.636094] binder_alloc: 13949: binder_alloc_buf, no vma [ 408.654500] binder_alloc: 13948: binder_alloc_buf, no vma [ 408.669005] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 14:15:02 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) fcntl$getflags(r1, 0x0) 14:15:02 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) [ 408.682637] binder: 13949:13955 unknown command 0 [ 408.688232] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 408.705215] binder: 13949:13955 ioctl c0306201 20000180 returned -22 [ 408.710776] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready 14:15:02 executing program 3: r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x28}}, 0x0) [ 408.764650] Dead loop on virtual device ip6_vti0, fix it urgently! [ 408.773338] binder: 13948:13968 unknown command 0 [ 408.789385] binder: 13948:13968 ioctl c0306201 20000180 returned -22 [ 408.803323] binder_alloc: 13971: binder_alloc_buf, no vma 14:15:02 executing program 2: openat$smack_thread_current(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/thread-self/attr/current\x00', 0x2, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_open_dev$radio(&(0x7f0000000300)='/dev/radio#\x00', 0x0, 0x2) getsockopt$netrom_NETROM_T4(r1, 0x103, 0x6, &(0x7f0000000340)=0xfffffffffffff13f, &(0x7f0000000380)=0x4) r2 = fcntl$dupfd(r0, 0x0, r0) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x40062, &(0x7f00000000c0)=0x42090, 0x4) bind$x25(r2, &(0x7f0000000040)={0x9, @null=' \x00'}, 0x12) bind$bt_rfcomm(r2, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, &(0x7f0000000100)={0x7, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f0000000140)=0x20) sendmsg$key(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)={0x2, 0x10, 0x9, 0x6, 0x2, 0x0, 0x70bd27, 0x25dfdbff}, 0x10}}, 0x40000) ioctl$sock_SIOCADDDLCI(r0, 0x8980, &(0x7f0000000080)={'veth0_to_bond\x00', 0xd04}) write$P9_RXATTRWALK(r2, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) ioctl$GIO_FONT(r2, 0x4b60, &(0x7f00000001c0)=""/19) [ 408.813831] binder: 13971:13976 unknown command 0 14:15:02 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) [ 408.848149] binder: 13971:13976 ioctl c0306201 20000180 returned -22 [ 408.905612] binder_alloc: 13984: binder_alloc_buf, no vma [ 408.918022] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 408.946992] binder: 13984:13985 unknown command 0 [ 408.956070] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 408.963280] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 408.967426] binder: 13984:13985 ioctl c0306201 20000180 returned -22 [ 408.976522] Dead loop on virtual device ip6_vti0, fix it urgently! 14:15:02 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f0000000040)={'vxcan1\x00', 0x200}) ioctl$EVIOCGSND(r1, 0x8040451a, &(0x7f0000000080)=""/193) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$SIOCX25SSUBSCRIP(r1, 0x89e1, &(0x7f00000001c0)={'team_slave_0\x00', 0x6976, 0xbf6c}) setsockopt$netrom_NETROM_N2(r1, 0x103, 0x3, &(0x7f0000000180)=0x200, 0x4) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x100004001fb) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) 14:15:02 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:15:02 executing program 2: perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000180)={0x26, 'hash\x00', 0x0, 0x0, 'crc32-generic\x00'}, 0x58) r0 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x0, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x100000001}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket(0x1e, 0x4, 0x0) setsockopt$RDS_CONG_MONITOR(r2, 0x114, 0x6, &(0x7f0000000000), 0x4) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, &(0x7f00000000c0)=@req={0x30a, 0x0, 0x0, 0x7}, 0x10) unshare(0x40401fc) r3 = fcntl$getown(r2, 0x9) getpgid(r3) read(r1, &(0x7f0000000200)=""/168, 0xa8) r4 = mq_open(&(0x7f0000000300)='\x04\x00\x00\x00\x92\r\x00\x00\x10\x00.\x16\xe8\xc2p\x12v\xc5\x92\xbf\xbd\xca\x19\x1bw|E\xb7m\xd2', 0x6eb3ebbbcc0884f2, 0x0, 0x0) mq_notify(r4, &(0x7f00000001c0)) syz_genetlink_get_family_id$tipc(&(0x7f0000000080)='TIPC\x00') sendmsg$TIPC_CMD_GET_NETID(0xffffffffffffffff, 0x0, 0x4000) mq_timedsend(r4, 0x0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmmsg(r2, &(0x7f00000110c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0x6d, &(0x7f0000000600)=ANY=[@ANYBLOB="5999b0b614571632d5078ae6f5c9e93e3315daa14046baf3b87c9c33ac22b2126c89ea765ee763a68b9e9f9bdd2c4c9a5e87c578e59ca86efaee914777e273b8b4719bbb076feba99f7abcacd88f2f13a8ee8c5936ac000012370000000000000000010000355b7a20e0aa4c3acdd0ea7abba706748e3da0f1fe2924e37b5154d374797134d56fb8ddd27b0ff704f24ffdb8ac1f1170daaa20d693b8cf903f9a03552249000000001a00000000000000000000000000000000000000007f91b558b6922215ec0438eed7bd8c11e347cbb04f0983e6a4699360b2df5fbefc875193b3eeccc2cc1b93926194ee6476867a860381e9851afe89a54970a0440f17d367eec5a205b6a5be81b621718e6fc29172a3fc9ac17129a49794a65755a26516d2ed0d5df442c92bfe0c3e3866ff55d75437c4a94b3c797a973f0bcaaee37d96aca4457e21f3e0c3f25dceef159b951d55ff88fefad296d9bea626b5fb"], 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000002a40)={0x0, 0x0, &(0x7f0000002a00)}, &(0x7f0000002a80)=0xc) syz_extract_tcp_res(&(0x7f0000000340), 0x9, 0x3f) sendmsg$kcm(r0, 0x0, 0x3ffe) mq_notify(r4, &(0x7f0000002940)={0x0, 0x3f, 0x1, @thr={&(0x7f0000002800)="af66bfe98e95b8cc6a3dced16eb4f5f7e6490cfed992463a3a03faeae42fd6c34280bb44a5e1e56ec8fa0c59ad9a3baa971b39a11fd6c410d7b51bec30ca0523dbebed287de315c9ffb166a5aba7ade4d4df4f26cdeeda59bd7da10798a29832f9de04b603b3c1421976ca57f56ac67df7d67bf9e5da6560ed2ee1132032", 0x0}}) setsockopt$inet_udp_encap(r2, 0x11, 0x64, 0x0, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/qat_adf_ctl\x00', 0x400, 0x0) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f00000002c0)="5e8a4b8ec7834e71702e", 0xa) openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) 14:15:02 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x28}}, 0x0) 14:15:02 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r1 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r1, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r1, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) r2 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/mls\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r2, 0xc0145401, &(0x7f0000000140)={0xffffffffffffffff, 0x1, 0x1, 0x0, 0x8}) 14:15:02 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) [ 409.097228] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 409.104457] binder_alloc: 13992: binder_alloc_buf, no vma [ 409.116404] binder_alloc: 13998: binder_alloc_buf, no vma [ 409.126434] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 409.134444] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready 14:15:02 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) fstat(r2, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0}) getresgid(&(0x7f00000000c0), &(0x7f0000000100)=0x0, &(0x7f0000000140)) write$FUSE_DIRENTPLUS(r1, &(0x7f0000000180)={0xa8, 0xfffffffffffffffe, 0x5, [{{0x2, 0x0, 0x5d55, 0x15040, 0xfdf, 0x7349, {0x6, 0x8, 0x555d, 0x4, 0x10000, 0x2, 0x1, 0x1c00000000000, 0xffffffff, 0x0, 0x100000000, r3, r4, 0x8, 0x2}}, {0x2, 0x80000001, 0x0, 0x20}}]}, 0xa8) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) 14:15:02 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x28}}, 0x0) [ 409.146562] binder: 13992:14000 unknown command 0 [ 409.152262] binder: 13998:14004 unknown command 0 [ 409.152296] binder: 13992:14000 ioctl c0306201 20000180 returned -22 [ 409.168157] binder: 13998:14004 ioctl c0306201 20000180 returned -22 [ 409.168161] Dead loop on virtual device ip6_vti0, fix it urgently! 14:15:02 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:15:02 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r1 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r1, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r1, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) accept4$bt_l2cap(r2, 0x0, &(0x7f0000000140), 0x800) [ 409.266522] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 14:15:02 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) 14:15:02 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) [ 409.315943] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 409.330864] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready 14:15:03 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r1 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r1, 0x29, 0x24, &(0x7f0000001480), 0x4) r2 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mISDNtimer\x00', 0x20200, 0x0) write(r2, &(0x7f0000000080)="7c733459b6ff6f27f1e6003356e477c3902f7da288d5c96acb129ff41dc97864dda3eb2d44517237439964b24a37872339702fffb31103e87cdc58cb124f89456f5c157a8e8163b470059a31593f0be514af6f2ac1616112aa924ed6ec08db889e1f488d6b26f34494e7affec3b08a37eb9715e2676d507fdb6d9bb6817d8b4208290b4926d52bb58e53b329a5d0d921aece63bb59532a4b5f7d1b74b5ee421920964b9cbf5daf5db26b8655a5a820f36518ef75ecd89999d11d54b9384b1a39bb6c804f498d6103b964dbcfd808f6516f8c0ea3beb6b76280", 0xd9) 14:15:03 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x28}}, 0x0) 14:15:03 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f00000000c0)={{{@in6=@mcast2, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in=@remote}}, &(0x7f0000000000)=0xe8) ioprio_set$uid(0x3, r3, 0x5) bind$bt_rfcomm(r1, &(0x7f0000000080)={0x1f, {0xffffffffffffffff, 0x1ff, 0xfffffffffffffffd, 0x0, 0x0, 0xfffffffffffffffd}}, 0x8) 14:15:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) [ 409.412826] binder_alloc: 14023: binder_alloc_buf, no vma [ 409.438950] binder: 14023:14029 unknown command 0 14:15:03 executing program 2: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$P9_RSTATFS(0xffffffffffffffff, &(0x7f0000000040)={0x43, 0x9, 0x1, {0x5, 0xa0e6, 0xfffffffffffff7e0, 0x9, 0x1ff, 0xaa, 0xfffffffffffffffd, 0x4, 0x7}}, 0x43) bind$bt_rfcomm(0xffffffffffffffff, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$P9_RXATTRWALK(0xffffffffffffffff, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) 14:15:03 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) [ 409.474271] binder: 14023:14029 ioctl c0306201 20000180 returned -22 [ 409.483099] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 409.495633] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready 14:15:03 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = open(0x0, 0x0, 0x10000000) pwritev(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000340)={{&(0x7f0000ffb000/0x1000)=nil, 0x1000}, 0x2}) ioctl(0xffffffffffffffff, 0x0, 0x0) connect$ax25(0xffffffffffffffff, 0x0, 0x0) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, 0x0) syz_open_dev$loop(0x0, 0x0, 0x0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000140)='TIPC\x00') sendmsg$TIPC_CMD_ENABLE_BEARER(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)={0x34, r2, 0xe00, 0x70bd28, 0x25dfdbfc, {{}, 0x0, 0x4101, 0x0, {0x18, 0x17, {0x1c, 0x0, @l2={'ib', 0x3a, 'erspan0\x00'}}}}}, 0x34}, 0x1, 0x0, 0x0, 0x841}, 0x4004080) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) msync(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000081, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup\x00', 0x200002, 0x0) fchdir(r3) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f00000004c0)='./file0\x00', 0xe000, 0x1, &(0x7f0000000040)=[{&(0x7f0000000100)="eb3c906d6b66732e666174000204010002000270f7f8", 0x16}], 0x0, 0x0) umount2(&(0x7f0000000400)='./file0\x00', 0x4) syz_emit_ethernet(0x3e, &(0x7f0000000080)={@broadcast, @local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @remote={0xac, 0x223}, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0xc, 0x4, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4002, 0x0, @local={0xac, 0x223}, @dev}}}}}}, 0x0) setsockopt$bt_hci_HCI_FILTER(r0, 0x0, 0x2, &(0x7f0000000040)={0x5, 0x9, 0x0, 0xf4}, 0x10) r4 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r4, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$P9_RXATTRWALK(r4, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) [ 409.526475] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 409.566035] binder_alloc: 14050: binder_alloc_buf, no vma 14:15:03 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x28}}, 0x0) 14:15:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:15:03 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) 14:15:03 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) write$FUSE_DIRENT(r1, &(0x7f0000000480)=ANY=[@ANYBLOB="100100000000000001000000000000000400000000000000ff7fffffffffffff00000000557f33300500000000000000ff0f000000000000000000000000000000000000000000000100008000000000000000000104000002000000000000000400000000000000010000006c65000029000000000000000600000000000000010000000000000001000000d60700002400000000005b80ce87f823684c0000030000000000000000000000010100060000000000000000010000000000000014000000040000002c766d6e65743073797374656d3a2470707031270000000006000000000000000100000000000000160000006600000076626f786e657431776c616e312473797374656d4600000002754abb5ce1fa2a46396f885145cc0166dd61a8f6682fd2ba41fd4bfca624b82092e3de57e01f34a159e6550d210814679f1195391f8a162255b661a4315e0e729564b9431abc1c276f816d8cc2521047b78622c0ec7852aba3f3b27f8602b54d1e2926c42081109f56ade3a19af1486a8413f21577997f7d7f38dc8c1c612bb6d41a4e979306f84d002d6d0177cf121eee43adacb50ac1eed4cbfd35e465d3997f1c3c97eef96ae4e28de0b3f5954c4c818f7b93f47d3881064d62d86fbba8632e750f14a5d59f251cf39a607f54bf35b6cffb7c83f01cd2f8fd4dbdf1dff4262e299474f72b10cf098b162533cd54c453aec3fac398dbac350e3468d065d6913fd29f6919ba3bf468ff285a3eec11415a65ca9c338d5691b30536bd2472c2047db509ec4c7a469a7ffca9206642d0d092937752b2a9cf24"], 0x110) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000040)=0x0) capset(&(0x7f0000000080)={0x19980330, r3}, &(0x7f00000000c0)={0x80000001, 0x0, 0x800, 0x6, 0x4, 0x20}) bind$bt_rfcomm(r1, &(0x7f0000000180)={0x1f, {0xffffffffffffffff, 0x1ff, 0x0, 0x0, 0xfffffffffffffffe}, 0x400000}, 0xbf) [ 409.584585] binder: 14050:14055 unknown command 0 [ 409.594847] binder: 14050:14055 ioctl c0306201 20000180 returned -22 14:15:03 executing program 0: r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f00000000c0)={0x0, @empty, @local}, &(0x7f0000000140)=0xc) setsockopt$TIPC_DEST_DROPPABLE(r0, 0x10f, 0x81, &(0x7f0000000200)=0xfffffffffffffffb, 0x4) ioctl$sock_inet6_SIOCSIFADDR(r0, 0x8916, &(0x7f00000001c0)={@local, 0x2, r1}) socketpair$unix(0x1, 0x7fffffffffffe, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r3 = socket$kcm(0xa, 0x2, 0x11) setsockopt$sock_attach_bpf(r3, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r3, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) [ 409.683258] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 409.719377] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready 14:15:03 executing program 4: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:15:03 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) [ 409.735239] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 409.744949] binder: 14063:14072 unknown command 0 [ 409.763295] capability: warning: `syz-executor.5' uses 32-bit capabilities (legacy support in use) [ 409.775404] binder: 14063:14072 ioctl c0306201 20000180 returned -22 14:15:03 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x28}}, 0x0) 14:15:03 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r1 = socket$kcm(0xa, 0x5, 0x11) setsockopt$sock_attach_bpf(r1, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r1, &(0x7f0000000240)={&(0x7f0000000280)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x10084, &(0x7f0000000180)=[{&(0x7f00000003c0)="205db86376863af568fe8000000000000042087de3c53b9f2e7382b890e82c078c45ca9d7f6e6a6ac7d6", 0xfffffffffffffec7}], 0x1, 0x0, 0x1}, 0x0) r2 = accept4(r0, &(0x7f00000001c0)=@nfc, &(0x7f00000000c0)=0x80, 0x800) connect$vsock_stream(r2, &(0x7f0000000140)={0x28, 0x0, 0xffffffff, @reserved}, 0x10) [ 409.834157] binder: 14083:14084 unknown command 0 [ 409.840876] binder: 14083:14084 ioctl c0306201 20000180 returned -22 14:15:03 executing program 5: openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000040)='/proc/thread-self/attr/current\x00', 0x2, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) 14:15:03 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) 14:15:03 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='veth0_to_team\x00', 0x10) [ 409.919011] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 409.947014] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 409.979957] binder: 14101:14103 unknown command 0 14:15:03 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) ioctl$SIOCX25SFACILITIES(r1, 0x89e3, &(0x7f0000000040)={0x5f, 0x1, 0xb, 0x8, 0x5dc2, 0x81}) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) 14:15:03 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) [ 410.001496] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 410.005851] binder: 14101:14103 ioctl c0306201 20000180 returned -22 14:15:03 executing program 4: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:15:03 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r1 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r1, 0x29, 0x24, &(0x7f00000000c0), 0x4) sendmsg$kcm(r1, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f0000000140)='cpuset.effective_cpus\x00', 0x0, 0x0) bind$tipc(r2, &(0x7f00000001c0)=@id={0x1e, 0x3, 0x0, {0x4e20, 0x4}}, 0x10) 14:15:03 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x28}}, 0x0) 14:15:03 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300)='/dev/sequencer\x00', 0x2, 0x0) ioctl$KVM_INTERRUPT(r1, 0x4004ae86, &(0x7f00000000c0)=0x5d) r2 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r2, 0xc0404309, 0x0) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r1, 0x84, 0x6d, &(0x7f0000000100)={0x0, 0xe6, "4854188be6847b241861356150cbbf95ec4f44948dd235650afe2ed941d33435df3492881b063498324114bdf8d299d9bd1a7be88b6f379dffb6e03c9ca7894e166a001f35d50c8b0e7ebbbb59de350286bf2daf738892d321571a774971cd117d49b27310076546cc9f517aa2a7967166a1122d249ff8beebf039270b7591340cffb1e9d23ad8170ac8d02686c9718c5e0f7fba0912cc751ca47401f1a2e9e81762123f4254884c82eafca7789f5593e557445807e9052898c1bacbffabda1dfa07a7b2ea6af00275928c8bc26363f8a50ffe86428a27233ad6cecdc9be747f4a6f8d373ad8"}, &(0x7f0000000200)=0xee) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, &(0x7f0000000240)={r4, 0x63, "bf8769762bd566c7216767c8a49c996ed1c81d3d1f7a07f9b1f273cd029c61435ba5c367e27a0e5412d02845fcf2774a2c6838e75ec68d3a4f72018e49057828ed7286ed883ef7cd085d8651eb9a6bcbc130fa90c09243a1fc09c93f64ccea4b3770b8"}, &(0x7f00000002c0)=0x6b) ioctl$VHOST_NET_SET_BACKEND(r2, 0x4008af30, &(0x7f0000000040)={0x1, r2}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x2) bind$bt_rfcomm(r2, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) [ 410.121742] binder: 14116:14121 unknown command 0 14:15:03 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) fsetxattr$trusted_overlay_upper(r0, &(0x7f00000000c0)='trusted.overlay.upper\x00', &(0x7f0000000100)={0x0, 0xfb, 0x42, 0x7, 0x1, "a8e7dba4954ef654e8c86ec1a0687093", "842904c72a09ba27771f2942ba7146510df4707842deaf9c3a33fa412dab072d24c9a92db912b1f73b195786cd"}, 0x42, 0x3) r1 = fcntl$dupfd(r0, 0x0, r0) write$binfmt_elf32(r1, &(0x7f00000001c0)={{0x7f, 0x45, 0x4c, 0x46, 0x5, 0x6, 0x8001, 0x8, 0x80000001, 0x3, 0x3e, 0x10001, 0x7c, 0x38, 0x292, 0x41a5, 0x81000000000000, 0x20, 0x2, 0x5, 0x100000000, 0x1}, [{0x7, 0x0, 0x100000001, 0x0, 0x100000001, 0xc4, 0x3, 0xac4}, {0x70000005, 0x7f, 0x0, 0xba, 0x4, 0xfffffffffffffff7, 0x1, 0x9}], "0c47de504083e49bf7335cd2eb1bb8e38ae33d63b419b19025b712739ffac888e3107a95b182cf02302a33c81f1d9737cc3ff6da8a573e9d5646b2666f", [[], [], [], [], [], [], [], [], [], []]}, 0xab5) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) setsockopt$packet_fanout_data(r1, 0x107, 0x16, &(0x7f0000000080)={0x1, &(0x7f0000000040)=[{0x40, 0x8000, 0x6, 0x1}]}, 0x10) [ 410.166987] binder: 14116:14121 ioctl c0306201 20000180 returned -22 14:15:03 executing program 4: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) [ 410.218102] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 14:15:03 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$VIDIOC_SUBSCRIBE_EVENT(r1, 0x4020565a, &(0x7f0000000040)={0x3, 0xbf0, 0x3}) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) 14:15:03 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) 14:15:03 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x80000, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) [ 410.266745] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready 14:15:03 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) setsockopt$RXRPC_SECURITY_KEYRING(r1, 0x110, 0x2, &(0x7f0000000040)='\x00', 0x1) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000080)={0x2}) write$P9_RXATTRWALK(r1, &(0x7f00000000c0)={0x100000101, 0x9, 0x4000000000000, 0x80000000bc7e}, 0x13d) 14:15:03 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) [ 410.322428] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 410.323509] binder: 14146:14149 unknown command 0 [ 410.341184] binder: 14146:14149 ioctl c0306201 20000180 returned -22 14:15:04 executing program 4: r0 = syz_open_dev$binder(0x0, 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:15:04 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r1, 0xc0145401, &(0x7f0000000040)={0xffffffffffffffff, 0x3, 0x4, 0x1, 0x9}) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) [ 410.418545] binder: 14157:14161 unknown command 0 [ 410.424888] binder: 14157:14161 ioctl c0306201 20000180 returned -22 14:15:04 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r2 = syz_open_dev$vbi(&(0x7f00000002c0)='/dev/vbi#\x00', 0x1, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000340)={'vcan0\x00', 0x0}) sendmsg$kcm(r2, &(0x7f0000000980)={&(0x7f00000004c0)=@ll={0x11, 0x3, r3, 0x1, 0x80, 0x6, @link_local}, 0x80, &(0x7f0000000900)=[{&(0x7f0000000540)="68cfb6c80e88991349fd0cd90f5ebd63736931252afdba798335d374a60f5358d311203eba37174a1bdc044a595c74447662e082394172cadd3ebfbc7ae8216c65b2095bace2006531e25b128c09bfe3a3e9bd8e10dc9667e2e8ae2efa6585382761fe7aec189df14c0028de19dacc2003f83fc45c6fc84341aaefc3e6df85f79c39c44ff736123a403c52b807bca9029adef77be02fb87458cde7273d66a1de1aff524d39ed24fc01e18484f50e3d23b9222e8ef486086fcdbae5dfcf431f1ef328f9f44fe53128649c80ef8b6ff779ffbcb07773aeb7", 0xd7}, {&(0x7f0000000640)="7db7837f4b35b2af54d95791dd90f8b87f69cbcc53b1a8e1085a6289489510a036e9cd724214074b2c8b6a9695aa9e67a97885887ddb28dff7c13579d487d362ff201eeb7feaff0541e590503138daed3765fa5f8578b26717d915e77089023a2e1db1389abdbde0f7b08273", 0x6c}, {&(0x7f00000006c0)="0091", 0x2}, {&(0x7f0000000700)="6e552980f6861130e0aaaac094fa56f61c40175da86ed69ec1cab29788849f291d2a2f8122753aaaff918ae7460d252397f8d512e873dfb3dd84d76230ec8022150be0499620182eae16bf4bb5d4409d1b65e2fbc857370585878be62b5a28f33b4c178007016ac5f8953f0819920c61369c13d9ebc0c92149b6389dd05bf17d281950f34d96a6f047394b07462176125b3649459cc4d20178db5642dc8b89810056276da1a5e92706158858f7d64d9897068c078de06378b1af663fd43fa108", 0xc0}, {&(0x7f00000007c0)="24814dd3b9e5f3affbb1c117de401d28cffcc7ed954939640868d9cefc99bd6a54cf65b33432d1368ba0c75a83d16079dcd426893e8335095d1736ed7a9764b742145e7e735276238a8915a5c697d624df48040eaa4329a8b699a45814598faa4883d36c90174400850b2e94f281f03b4fc0ddad51f51a6e8f32", 0x7a}, {&(0x7f0000000840)="670e5bb69421b4517dbbc3961fabd4a28e7abee9a542021894e0f81b5e42de0080bf4ea08ad833ce6c686f391425c0ad2c63ad16faf41a07b6449668e6336cd8823994539d483091658a612860b73b7675c552154345ccb92b87769dc04edd2015f61541c07df48b76d1a83d6919f22a5f1b567abbdb920e2308f70dddede58bbb5028ba9681676ce77e6a4b1ea483c12730597418d13204e249", 0x9a}], 0x6, &(0x7f0000002880)=ANY=[@ANYBLOB="78000000000000001f01000000000000a6e2c0ec591a324c6cbf2e26f690c42b8ab6f56b94ae347941823636b0d1d493d64046e4a82f8f9eafe3cd7ef4141df1decd030e9d22a2c0b61ba07d7ee331168ca7d7b790d7fe5894ec2d13249ec9f23137ea068d196b34585329d6c41edaf8559c0000000000009800000000000000120100000000010080bc55f4d16b42f7b7fab470b673e3c23ea08d15b438fa41971df70f6077f4981efff7beb34eddd85be4d08c359f1999412cdd750b5604d1574b7dc67dfb0e163dec9114e1d95082560ee8355c737acfebd32b7201ebf985f7f1dd98f882791201b7d398920d2d76779b5d7b25a08aa46310109fe94f1b27cf2a147b5fa3b0221f1b3aa60f000000d8000000000000003a00000007000000793e2d51d65162508b46a185769c1971ef80bba4826d496d59705ab90e64174dfda54c84828d43042bb4c181ce629aaf61803ad3aa7fe8ede5610ac33131a138da07cded908e1beddd3fca90b3e38e13c81c961ff481a5b32a9569ad6452e047576fff7ed2ff45895f79e4102d7ab3144853e4556cd39a5e70680f6702b1e48ae8c4a90a456a999703191b9743b87e61b60d6bf439316ec9918aebe0a0ca7bf18f3998a30b2652a6d0ce14aba4ad3986943407d05e7ddfa6be122c0ddf9f7bcf79c90000000000001010000000000000ff010000050000005bc706316d51016cb8d4987bb6cbc6eee1823bccf9583f3991248d9652952d57cf3acbf6440ac2d155bc22c75dabf1083a84477cf2e18697712d8d67ecd779ed01b4cb11242f8265825be246f490a4e7c028f90e9c5f73cd74c6d474e9f62671059d5a616f72cec07bdd7b174fca0796dfeb86f24e03a91415bb7edc0263a61a2397fdd8cdbe2a451d1aa2d7225933782ac378dfe0dac0e6760128db8a48700c82fab6733e93f4bed8bb6647642a84e8dc29249c517ccaed0f18f33581a6f8a8d9a3760e5408bc3ac3d03738c1376293cd9913cbf0c146c8ea1ed80db3ee1aba816bd08e11b46b11042767d57b7258618c89a47d4257e4fee4007f74f634c954f9852ec8dca82c7a1fc5f4b06b9e1c3745fb541ce6a64b4304d5cba7dc2ec05f0ce179f9804736179576f419cbf1afc698fb1841029b109329a039e94559ba074626155c5dcb3208ed8016c3c3605248d8d4e03e121028085d73397a3e770ab7e978fc92a0a98dea440f244f9a8980cad516aef94abf8ef58fa6f2f777f27a29b6fb262c0171af838d3a62899cc4dde447756e4f3a1d4a70e6a3903ff19449b334ce45e5284e3430402f0f8df3d8461659067c43b642bea97f5989c9e2138c0523afd4a4843e612bf7d24924d6b9800075c633052941e5fc0453831ac6d4ff7e2aec8e9471a4ecdb3297822aeefb4689ba003dd0d39b13e5f61554e1888fbbac46e2f57717a0c74d0e4b033159811c8dfd04cb986274ab4695b608ad2fcd552aa23a34868aaf38d52fe4759623cdbdf9f8b0eca04b2618052b401ba2535185e3ce695a9620a95923c03780d86514d283e01b325245e033fc482d3441fc3867ad10df064e8f147de1dcf6eff0450466eb392444f5ebdfe21e0ed2a576e5c7e15005a00df2060d90e3b2b26d4fa368fbb4adfe78180e880821b11aa14f6015b2df981286937ebd83cccbc8e985cf957b09dc2ddde1459c1ca9f714a4f883194a4bb4b368ecb684023a87fb71d993e9aa6bf0a9a123a82d5377e776af4c887dd3a498739f01c353870316a62ba674f94d2942a2cc6f6f318a62dd5a730d735e07c88470737c64c859eca05d5db90c0c7897d66a7e47f3e28ed665018185d85229f630741220a01fae6f16cdeecae4916022c4b5052548d07823f407f129853d883f64c93efe54b7381d2c93169615abb3126c73e69ced05a73d2440ab770d2e69cc090fe30ffb715a53c13dde9fe01870ada865fbecf4da5781b6a89dcb1e066472ccb21ec43d22f7789403ec7168948e794b1ee1108d17a0b984eb9bb3a85d7042dbc35ad5e34090f6a1c7de65afb25d8bb4795099a3a7c5e140054227fcd94c6582d8c07d8bd28661b81c643e8204e41f6262adb3ac457a92e079f2e8cb0e13616716d5a39458b1e0b149ff4b1166611b1906c2da1e0ec36da6a7e51c3abdad81f88788f5bda462ca91ece867e6b97561cf01b42abe2371d8452a2740cd98129b47aa0e0285550d85a9af26583e58529fbd64793c62861bb3c399e8b59fe3108a0f524a76c934acaabb7732e025cbc7423fa2991299689d2e3281749e25d058f9f462eafe3cb452b589277204f829bb66d0d5a84684a7b7f00acaea0d6d364313e7ddeb859c2cb086652c3fc199dcff5c23b95369eb552723b9afa640c3ee775ce2a6b402b9e73a61f004c401c77be1515d0e16a0b6173dd924d508da9e17606e6abac7e0ad2089a2d730f5882c62c58689c7ceab5d6ef195335e9349066454eabf6f55b3c03c292c444ec99651c7c3c15fdf2fe42b9d7962fb53996061c345fa2ea0994197a2da8f358f2cb5b2b6c78aafd569cd91d94d59df35f8d4b603bb2977040344e9ceb72fd9ccf4fc58fbaed512fdeb125c653d90e98a3159ee405dafec0d522ddbc1baa8549689052e84a53e2c944bb3b31efedaf2543e8c903a81ab9d682e6373a9dee0ca8bb8b60bac4a562220ecdbe3f549653316cebef995cf9ecd5807c8ed023456144fa48e5756c5fe211b642561b7a821237253b6cf45bbec7600e4d0c942a10760255ea29c7bd12f3047ea60401e1112116aff160275e9f30ec409d365a6bbba05a2404b74fb148e90d59239a78c0bcd55e6859920d0fbdd94dda008a17fe2ca60f6ad18e00171f3c1099f84b9b51325bc941a29dab94813bf4ff9737e3a3de95d831a9478b7298fff1b49626f52f4a0183a067643746870654f678bc1ea9ab02a543f72c69fcfc93dd86b1a1a8d620fe0ba7d3efca40d14372d17f1d536844b535631d93f0b7a1a5c6e05dab5d07f5e0a1f2876ed956a5eb48d634d68dedd214ccb9968b3d00819bd38b0d872752f33ee503468dd63eba3a9c1dd50542057d080e6d968a6ae34b3ae58685a1364cc6803be0a1bc0377b90c5635a06bf735010be52a5d52b6d6b8b446ff546bbc87f565a15af8614a074fbea9718bf0987a2b8c90174ca0110e21f3621ace6bfeb42e86a8b076d8b3594f08eecf84c8c117761f4789f353f6093e955f1c047bca339ca05c2e7b2dce1c9edd41266ad9b5a6b2a6395b9ef32b4575f732db9b33a5fe85e73005a4b8a01e38c5585a511311ab06391ae6e65098d7accc4500ed7e074aad7da56988d3b5cf0968cfe384b49feb9008842b6d1d75c05d15a315bb78b16ce2625e38cc106f4bd30e2e61dda43836259ab64ff5e5b58169b63dda29a3cd38e9e7f449f506c6ef97f1ec17d99a62aa50900e34d8d648c39fda194d339b592b0405bb23fc8a8045d21c00185441bcd0c21ff8cc339a06576a82511160e24bd4e4364fddf3510ac1908f472d368f099a84ae112ccba325ff7961bd772fcb453ecd5cf98c06d5fd0aeb0783eea99e9f34256380f195fc35034b60bf2125a0334339bd4482e6f7afa4d09ea39c18a8a5eab99ef6464832eae10fa35be73a7cbad6c7c9562abbc651ba866247d011f5af619ed00b34ccf469e8f7462e8be4d9d3ce8054916478f35046a0faa6559b057c33f0bcd876f798fac50b2a02b82f2005c247594a26c908a206fc42054a5daf2c8002ca9407805782f84bc4c2c498c2d38237a94b1da43d2c4c97ceacb696385d684b8f3beb666f03b38375889db9727093985c37e21493171a1702bb886a87039dd04978c8c7fd3221eba8fc5db3b149b2c17402703b0cf0bc42a36885f7eec01de9a0ffe65920518c6d741a44b46de20cd979b157baa1e1e02a157f927c71c0c236dbca800671c94835d08e098fefeb65c4515432ada963ee1fa1966f8d1cd5444f2ee791d59dde6869179df807c5209b405af9eea7924a2aafb914d7e7d2f6e65367e092dadcc473bde88d063c00a9cde84790720d705db8f1e615b344a5f159edc7de94c87f0c8edc0006bac1653908e45ceb53a4c5b599a24c406d91e4c6b87880b4d929e45e27fe3f2d907e039da26732d048b02065cbcd941f13d7ba7dd9cb4280316e3d04d918dcdf9a24ad830ae5e0f8b4cf1c3e0d1c53591d52596e009c2c87a4ff9a53742fba2877011bf3e6003e7234d9273905301a1ad9f1ebe76f4d77b40855e09e6a62808d8239b527aa05edeaf4fd101ff98e498be3ef2708329ce7ae8a3df36571ca4352b32dd59cc4d7e20fc71a86b79b5445e8e25b4cb0bd75bd2d87cca3f0de7060c30741d8f1c98a9efcdaf2e06f6ef7a034d487016fb5495187c591dd81b39c6d2044a32d01b4435ce3e778c7d7bf7b41c736a4cb44df317939366e32839919a1073b5387f92b17225ac59c6823dd1d8f9c2f53674fe2a7da9323868fb6c53cfe338aea5cbb8e71cebb709f7baed48a460f3f862d653c8262679d4d2a196d01ec1003fdbb88fe2e5cb70924be83b5c3bf326a9f90e183c7be57e05dc9e139271f0b883d581bb569e64340ad91915fc624f476262dac06a0a436029c5c2f84da02deb3acd57e2f1898956835823d26390f3713ca972d633931d95163f0d3a36f16e745665fbaa09ed4c9c31d550d7c8475cbcd4a21736d0e40aac7b45cb8a34450a39ca394ff8221883d5894cd504381d8f6baf611f6db6a8a75560b546cccd311f4f942790e493efab9326773bdbbc90bffacc663ff38900decea6942001d80095b57169031093085abe6dfd220a34ab010945838cc4849fec430536ad08ce4bb8793f48402904da1c94ac5c0ba568e51c61b5dd1330ee66261864d63ff5cbd174c4b303ffb5d8412e4751d9ae30b4317af54b9ef0566c60cf17f78214d6fb5da6a03dfc8a9c5d0a3020ca613638385778cad6d041084362ecf7d34fbc99f9ee3c57279c3c0033980ecf632f217ed18f926a66e1aaf3971a8ca03a53a5b460308a96bc15d92034421f6a87da1fdeff6c824399ec46056cd2679b96d60c92d36acfccce94e1773ab808583eefd61e8bd5f2a95888b044cf9e58093493327c2c40f6b20701dbbfcc9558f62662b4deb066ef5d4105abbab20dd74f725ccf587ff2bcf2d725338c72a9fc4f76110ed646378fba693d74da6c66e1d788ad0a0a1040dc7626d49f256d736d9b710c2d9c83d29901e9564394bf1c5675b28478446c3aea669485f95765bda49ea5e25137aae844df116851f2cc6bd4952a7a1340cbc5a42f2dca30a1c8920c28de79bfe5aef41f9cd7b2fbb419073c6988c5cd8a071c8f276fa18829242e19f5ef8d3c043d5ae134b9feef05275a11e2a204c5f19d928fd1451e718dd9638a1eec228e01ef54573390ca2d159c1ac0254726edb250ef2406191aa79da3d1077275afec08f522b2312fa8544c817d18311e00e723beb8c02c77b06ba2cd59f5db615865950d20b2325b79d80e53ea2b6f36339cebd01fda45c33cafb4a7feaa0824c334979fdcae9095ee5c04717d557794419b421b507159f4b83597f2f03c6b235eb143279fac8bd7454255ce15c8ce50b8d8fbcda2212d287a3ad6836ab07dedee6034d52c35b6cdd4798257438b4b32c6e32a383f9db6481479e4fb272942924d8447ebcdcee9b3ba8eb541b5d5125f8b818d31666e5fe418dbff8e369be9c5946b3570247e450582d2778f4b467dcb2e8308d6b21e9538b8b3c74655a163bc503579231788da6f3674deeea97a81a100f98a5e96f494301a668b1fcc3a8b867d5f2609c9bafad65a23eaff8fc8dac23149e5f6317ad9cd6ca988e4904d7b603f7fb8b35123270e21a402bc5af92f2e070cc6c697b76e47359a0d517355b24955129b585262733209421c870f9a40de305507026fa97d24766697bc79d594666a6027170efacae2a4fd05354bf971fe56dbdd831d52b48db3050eeb260cef3105978961bdff6232d335ece45aba22dabc46df27921e0cdc0160ec2b5493025c409c2961c7fa06f3bdeee54bddfeb2ef9d579488c744f4bd52e0fc29af50471e8c280560ca6758b528ac9a1ce5ab4d6d3ed8d8705a8b12cafeda383434e9eb601d652ef11b922ffd89ab7f331bebccddd090013ec747b6a5a0d83d70fbd159fa60e6a87f7e32cc462ccf80925c36c3515408674299f1299c5f8348181985b768fe36863fd86633d8bd71d1e2f673ef8026311c4b422269457faf7d654679e652bd09fc1a1dcb4739754a362812999cd93707638b7c587b8ed9a7e6ed8e8110f0cb394b2ab4a0d82579c3e714d5abf3944d8e1fe0d83a717a4d46ca5e2b265bc964ebe8fe3650ad2e65c259f916954223cdf167a83b03c39fe288ddeb8f62dee60e54e5bcd622b4fb3905d16980cb2844f882b77ad320eebf2954e1d687482211a0e07f3435531b3affa8ae11f27da1fff787f5a781f790d310000000000000000d0100000300000090000000000000000a010000b3000000c07f1bb243479d6d8ed1db44766ea7a65d5d7d1a61177ccf0db1fa71335619f2460d30e57cee170eedde16e4222c5db62d45fb57bd89788bc0def6ac6ed612935f9651e6ec070c395e6d9eec8b85b82684592f3fb6a05434d41d92a0ba5e9d27e0c71ae64c4867920fb2fc61a0006a02639e1f1a385d112d46772fd60000000044cf01a77862500c331406417003ff49921f500324585b5562d62ab17fb5a597e3c87313cd4ec8de97366949ba0aaf35cce1ff0fec85cf410f3b1556556553472a61d0c14b3f143292a5209ac5749d0392bc2e8a2ccff84778ec7e649d86e9e1cf400e93d51de1aea79680e8b2a7e32a6408dce38bbfef3c5581ad994023b2ee5a4730ac860fc3dc5b4e6da9656795c598335cb984a5104c1b72f6a04413026f4d52307fc9438d2cbd0d814ee27646933e91bc4842627bb3393096fad317d3a8f587a70b477c4bf66e4c1af828cb8d6a28980bb9d3125136ffd0b8de1c7b8bc33378f8ce98f83ac17bccf4c700"/4996], 0x1298}, 0x80) ioctl$VIDIOC_TRY_FMT(r2, 0xc0d05640, &(0x7f00000003c0)={0x1, @pix={0x401, 0x9, 0x31364d59, 0x8, 0x80000001, 0xe80, 0xc, 0xd0, 0x1, 0x7, 0x3}}) r4 = socket$kcm(0xa, 0x122000000003, 0x11) ioctl$sock_inet_SIOCGIFNETMASK(r0, 0x891b, &(0x7f0000000280)={'ifb0\x00', {0x2, 0x10004e21, @initdev={0xac, 0x1e, 0x1, 0x0}}}) r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vga_arbiter\x00', 0x200080, 0x0) ioctl$DRM_IOCTL_RES_CTX(0xffffffffffffffff, 0xc0106426, &(0x7f00000001c0)={0x2, &(0x7f0000000140)=[{}, {0x0}]}) ioctl$DRM_IOCTL_LOCK(r5, 0x4008642a, &(0x7f0000000200)={r6, 0x20}) setsockopt$sock_attach_bpf(r4, 0x29, 0x24, &(0x7f0000001480), 0x4) clock_gettime(0x7, &(0x7f0000000300)) ioctl$int_in(r0, 0x5452, &(0x7f0000000240)=0xe6b) sendmsg$kcm(r4, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) 14:15:04 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) 14:15:04 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00'}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x28}}, 0x0) 14:15:04 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) write$P9_RLCREATE(r1, &(0x7f0000000040)={0x18, 0xf, 0x2, {{0x62, 0x0, 0x7}, 0xe1}}, 0x18) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) 14:15:04 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000040)={0x1f, {0xffffffffffffffff, 0x3, 0xe3, 0x0, 0x0, 0x100000}, 0xfffffffffffffffd}, 0xa) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) ioctl$LOOP_CHANGE_FD(r1, 0x4c06, r0) 14:15:04 executing program 4: r0 = syz_open_dev$binder(0x0, 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) [ 410.539732] binder: 14170:14178 ioctl c0306201 0 returned -14 [ 410.565765] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 410.584013] binder: 14170:14178 unknown command 0 14:15:04 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000100)='TIPC\x00') sendmsg$TIPC_CMD_GET_NODES(r1, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x1c, r2, 0x8, 0x70bd26, 0x25dfdbfe, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x4) bind$unix(r1, &(0x7f0000000040)=@file={0x0, './file0\x00'}, 0x6e) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000300)={r1, &(0x7f0000000240)="c553d149c0d15416983fd65c28bdcf563de0d4c7646f820ebfebbed7a6d68803079a244844ce70fb873b86934ca4a851c491b6caf11719a3f3a33c338accdbfb95d4b55f0c2767b352a6f8f431c5d7d15e4d623ec8a0c93570665d02cdac61961e977e9e36de51e7db546d33484d31f2ecaa", &(0x7f00000002c0)=""/17}, 0x18) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) 14:15:04 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) [ 410.595759] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 410.605820] binder: 14170:14178 ioctl c0306201 20000180 returned -22 [ 410.617447] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready 14:15:04 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e23, 0xff, @loopback, 0x401}, 0x1c) 14:15:04 executing program 4: r0 = syz_open_dev$binder(0x0, 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:15:04 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00'}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x28}}, 0x0) 14:15:04 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/hwrng\x00', 0x141000, 0x0) perf_event_open$cgroup(&(0x7f00000001c0)={0x4, 0x70, 0x8, 0x100000000, 0x200, 0x101, 0x0, 0x3, 0x4810, 0x2, 0x0, 0xffffffff7fffffff, 0xa4, 0x5, 0x9, 0x9, 0x6, 0x32, 0x3, 0x6c, 0x3ff, 0x1, 0xfff, 0x500000, 0x7, 0x81, 0x3, 0x2, 0x9, 0x414142a, 0x755b, 0x10001, 0x6, 0x5, 0x0, 0xfffffffffffffffa, 0x8, 0x4, 0x0, 0x5, 0x0, @perf_config_ext={0x2, 0x6}, 0x281, 0xa52, 0x8000, 0xf, 0x3, 0x96f, 0xffffffffffffffc1}, 0xffffffffffffffff, 0xc, 0xffffffffffffffff, 0x8) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ubi_ctrl\x00', 0x701300, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r1, 0x84, 0x66, &(0x7f0000000240)={0x0, 0xffff}, &(0x7f0000000280)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r0, 0x84, 0x17, &(0x7f00000003c0)=ANY=[@ANYRES32=r2, @ANYBLOB="0010d700f9bd7903e39a648248c295c147e70367be866235047349781aa1dcace610a88e98d5165432408517dfbaa666567237650cfcd14d4230ad1160ffbccfc3aa0310f92165d94285caacf478cc5c1a89e8121d7741023914400e6c618eb1bf78fe7d7d8ad65e53f58d23a40900d1b3046b2160214d8104e150382e461ebf52d3cb021d2340338fa2f34ca85e4fef1dbf3f053d51c457267eabdd8eb8919aee3cc44f27085b2ea2d3e72dbfb8c67afb581a52d89dd13a3cc06fae43f86e4235310ba32a70b30a884dbba1d942adc5dce0000000000000000000"], 0xdf) r3 = socket$kcm(0xa, 0x122000000003, 0x11) sendmsg$kcm(r3, &(0x7f0000000600)={&(0x7f00000002c0)=@nfc_llcp={0x27, 0x1, 0x0, 0x5, 0x0, 0x3, "33ad99b836ccefd8e6c871b812bad457264a25bebbfa6a1be59f2f1f9245dd55cccd41146097d5dba9cbba11f9ab2df99b40e2013df5989f0bb20d3c6bf159", 0x37}, 0x80, &(0x7f0000000340)=[{&(0x7f00000004c0)="99ab2d952dfbbfa5e3e9fc7ce5d6bf9117853442be58712721cd526c3b3712580727943b1fda2bfa9f98b6819700fc2a1cb751936b9777d25290dbd54573ae2c1a6f92911f486ba7cfb98d28c92aabba50687aa2142ff72c30e888a08115dc58149ab27635f2411b8dde9853b3f01f825c4e3c7aa28688718b61caa76caec1429daf81736926c633aec69da458ae5ce118e30b1fe6f0109cd6f1d87f07f296c51e77616b6fa361f8c3a576e5fbc7d5352278eb3188669a3fd6b3fcf66881f243a7b0", 0xc2}], 0x1, &(0x7f00000005c0)=ANY=[@ANYBLOB="100000000000000004a0dddf54915300"], 0x10}, 0x800) setsockopt$sock_attach_bpf(r3, 0x29, 0x24, &(0x7f0000001480)=r1, 0x4) sendmsg$kcm(r3, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) setsockopt$IP_VS_SO_SET_ZERO(r0, 0x0, 0x48f, &(0x7f0000000640)={0x7f, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e21, 0x4, 'fo\x00', 0x4, 0xf9f, 0x12}, 0x2c) write$vnet(r0, &(0x7f00000007c0)={0x1, {&(0x7f0000000680)=""/93, 0x5d, &(0x7f0000000700)=""/161, 0x1, 0x7}}, 0x68) 14:15:04 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = getpgid(0xffffffffffffffff) write$P9_RGETLOCK(r0, &(0x7f0000000100)={0x35, 0x37, 0x2, {0x2, 0xa4d2, 0xe1e, r1, 0x17, 'trusted.overlay.origin\x00'}}, 0x35) r2 = syz_open_dev$dmmidi(&(0x7f0000000240)='/dev/dmmidi#\x00', 0xfffffffffffffffd, 0x2000) perf_event_open(&(0x7f00000001c0)={0x7, 0x70, 0x3a, 0x49b, 0x3, 0x8, 0x0, 0x4, 0x10000, 0x4, 0x4, 0x4, 0x8001, 0x7, 0x40, 0xed, 0x4, 0x20, 0x4, 0xfffffffffffffffc, 0x5, 0x3ff, 0x100000001, 0x1000, 0x6, 0x3, 0x1, 0x1, 0x2, 0x0, 0x8000, 0xb8, 0x8, 0xc88, 0x9730, 0xffffffffffffff00, 0x9, 0x4, 0x0, 0x81, 0x1, @perf_bp={&(0x7f0000000140), 0x2}, 0x4000, 0x162a7078, 0x7fffffff, 0x9, 0x2, 0x1, 0xfff}, 0xffffffffffffffff, 0x7, r2, 0x8) r3 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r3, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xffffff93) write$P9_RXATTRWALK(r3, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) lsetxattr$trusted_overlay_origin(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='trusted.overlay.origin\x00', &(0x7f00000000c0)='y\x00', 0x2, 0x2) [ 410.735099] binder: 14195:14198 ioctl c0306201 0 returned -14 [ 410.767555] binder: 14195:14198 unknown command 0 14:15:04 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) [ 410.799457] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 410.810935] binder: 14195:14198 ioctl c0306201 20000180 returned -22 14:15:04 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vsock\x00', 0x2, 0x0) write$P9_RXATTRWALK(r1, &(0x7f0000000200)={0xf, 0x1f, 0x2, 0x4}, 0xf) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r1, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x14220028}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x2c, r2, 0x0, 0x70bd2d, 0x25dfdbff, {{}, 0x0, 0x4102, 0x0, {0x10, 0x13, @udp='udp:syz0\x00'}}, ["", "", "", ""]}, 0x2c}, 0x1, 0x0, 0x0, 0x800}, 0x0) r3 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r3, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$P9_RXATTRWALK(r3, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) 14:15:04 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) 14:15:04 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) [ 410.843976] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 410.863245] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 410.873342] binder_alloc: 14217: binder_alloc_buf, no vma [ 410.917750] binder: 14217:14218 unknown command 0 14:15:04 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00'}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x28}}, 0x0) 14:15:04 executing program 0: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r1 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r1, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r1, &(0x7f00000000c0)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) [ 410.946238] binder: 14222:14227 ioctl c0306201 0 returned -14 [ 410.969438] binder: 14217:14218 ioctl c0306201 20000180 returned -22 [ 410.982341] binder: 14222:14227 unknown command 0 14:15:04 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:15:04 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x0, 0x0, 0x0, 0x3}}, 0xa) 14:15:04 executing program 2: r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x8000, 0x0) ioctl$UI_BEGIN_FF_ERASE(r0, 0xc00c55ca, &(0x7f0000000080)={0x5, 0x80000000, 0xa117}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = fcntl$dupfd(r1, 0x0, r1) bind$bt_rfcomm(r2, &(0x7f0000000000)={0x1f, {0x0, 0x1ff, 0x2}}, 0xa) write$P9_RXATTRWALK(r2, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) [ 411.013663] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 411.018182] binder: 14222:14227 ioctl c0306201 20000180 returned -22 [ 411.039645] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready 14:15:04 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) [ 411.084341] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 411.099458] binder_alloc: 14238: binder_alloc_buf, no vma [ 411.129445] binder: 14238:14243 unknown command 0 14:15:04 executing program 2: r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/status\x00', 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r0, 0xae03, 0x3) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = fcntl$dupfd(r1, 0x0, r1) bind$bt_rfcomm(r2, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$P9_RXATTRWALK(r2, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) 14:15:04 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x3, 0x0, 0x20000000000000}}, 0x2eb) 14:15:04 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(0xffffffffffffffff, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x28}}, 0x0) [ 411.157143] binder: 14238:14243 ioctl c0306201 20000180 returned -22 [ 411.167351] binder: 14247:14251 unknown command 0 [ 411.175822] binder: 14247:14251 ioctl c0306201 20000180 returned -22 14:15:04 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendfile(r0, r0, &(0x7f0000000200), 0x4) r2 = open(&(0x7f0000000140)='./file0\x00', 0x101000, 0x8) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000001c0)={r2, 0x0, 0x0, 0x7}, 0x100000326) r3 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r3, 0x29, 0x24, &(0x7f0000001480)=r2, 0x4) ioctl$EXT4_IOC_SETFLAGS(r3, 0x40086602, &(0x7f0000000240)=0x80000) sendmsg$kcm(r3, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) 14:15:04 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:15:04 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ubi_ctrl\x00', 0x4a0000, 0x0) ioctl$SIOCAX25CTLCON(r1, 0x89e8, &(0x7f0000000080)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @null, @default, 0x67, 0x4, 0x0, [@default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @bcast]}) r2 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r2, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) ioctl$KVM_IRQ_LINE_STATUS(r2, 0xc008ae67, &(0x7f0000000100)={0x7f, 0x371}) write$P9_RXATTRWALK(r2, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) 14:15:04 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) getsockopt$inet6_mreq(r1, 0x29, 0x1c, &(0x7f0000000040)={@loopback, 0x0}, &(0x7f0000000080)=0x14) ioctl$sock_inet6_SIOCDIFADDR(r1, 0x8936, &(0x7f00000000c0)={@local, 0x31, r2}) ioctl$TIOCOUTQ(r1, 0x5411, &(0x7f0000000100)) arch_prctl$ARCH_MAP_VDSO_64(0x2003, 0xa0) 14:15:04 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) 14:15:04 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r2 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r2, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r2, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f00000000c0)={@local, @initdev, 0x0}, &(0x7f0000000140)=0xc) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'nlmon0\x00', r3}) [ 411.336555] binder_alloc: 14267: binder_alloc_buf, no vma [ 411.359955] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 14:15:05 executing program 5: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000380)='/proc/sys/net/ipv4/vs/conn_reuse_mode\x00', 0x2, 0x0) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT(r0, 0x28, 0x6, &(0x7f00000003c0)={0x77359400}, 0x10) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x80000, 0x0) getsockopt$inet_sctp_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f00000001c0)={0x0, 0x3e36, 0xffffffffffffffa4, 0x7, 0xa44, 0x2, 0xff, 0x2, {0x0, @in={{0x2, 0x4e24, @remote}}, 0x5, 0x6, 0xd327, 0x5, 0x6000000000000}}, &(0x7f0000000280)=0xb0) getsockopt$inet_sctp_SCTP_ASSOCINFO(r1, 0x84, 0x1, &(0x7f00000002c0)={r2, 0x0, 0x8, 0x808000000000, 0x1, 0x9}, &(0x7f0000000300)=0x14) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = fcntl$dupfd(r3, 0x0, r3) accept4$vsock_stream(r4, &(0x7f0000000340)={0x28, 0x0, 0x2710, @hyper}, 0x10, 0x800) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r4, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) openat$mixer(0xffffffffffffff9c, &(0x7f0000000400)='/dev/mixer\x00', 0x0, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000100)={&(0x7f0000ffa000/0x3000)=nil, &(0x7f0000a00000/0x600000)=nil, &(0x7f0000c50000/0x3000)=nil, &(0x7f0000df3000/0x1000)=nil, &(0x7f0000c3c000/0x3000)=nil, &(0x7f0000b6a000/0x3000)=nil, &(0x7f0000dd3000/0x4000)=nil, &(0x7f0000e98000/0x4000)=nil, &(0x7f0000bcb000/0x1000)=nil, &(0x7f0000d26000/0x1000)=nil, &(0x7f0000ebe000/0x3000)=nil, &(0x7f0000000040)="a0970a073c0eeebefa980efcd70c0e680c5b042e03878060ad371922635b1b8dfc01eeead8bbb79d2b5da2c714057691a96b712f380808054a4c743520094413ddd6db022f9f0f62a33fa7a1f081ce02f57c7d9b6262eec236f6f8fbd66e4bb280dfc4da7d21ce835393f781c75543ecb14c91fcd7a739eb9a733b39a5bab656d8100e657c25396d6f4c9daeefaaa755d00be45c51", 0x95, r5}, 0x68) 14:15:05 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$P9_RRENAMEAT(r1, &(0x7f0000000040)={0x7, 0x4b, 0x1}, 0x7) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) [ 411.386802] binder: 14272:14280 unknown command 0 [ 411.397442] binder: 14272:14280 ioctl c0306201 20000180 returned -22 [ 411.417975] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready 14:15:05 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) [ 411.432779] binder: 14267:14284 unknown command 0 [ 411.447348] binder: 14267:14284 ioctl c0306201 20000180 returned -22 [ 411.457725] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready 14:15:05 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) open(&(0x7f0000000040)='./file0\x00', 0x0, 0x2) 14:15:05 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) [ 411.519159] binder: 14293:14295 unknown command 0 [ 411.526416] binder: 14293:14295 ioctl c0306201 20000180 returned -22 14:15:05 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(0xffffffffffffffff, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x28}}, 0x0) 14:15:05 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) futimesat(r1, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)) 14:15:05 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) openat$dsp(0xffffffffffffff9c, &(0x7f0000000140)='/dev/dsp\x00', 0x200000, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/mls\x00', 0x0, 0x0) syz_open_dev$usb(&(0x7f0000000200)='/dev/bus/usb/00#/00#\x00', 0x4, 0x101800) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)={0xc, 0x3, 0x34, 0x5ca49b93, 0x21, 0x1, 0xffffffffffffffe0, [], 0x0, 0xffffffffffffffff, 0x5, 0x5}, 0x3c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000300)={r1, 0x0, 0x0, 0x9d8fa0b79926a93d}, 0xfffffffffffffda0) r2 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r2, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r2, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) [ 411.565616] binder_alloc: 14299: binder_alloc_buf, no vma [ 411.609619] binder: 14299:14302 unknown command 0 14:15:05 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080)='TIPCv2\x00') sendmsg$TIPC_NL_MON_PEER_GET(r1, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000001c0)={&(0x7f00000000c0)={0x94, r2, 0x800, 0x70bd27, 0x25dfdbfe, {}, [@TIPC_NLA_LINK={0x70, 0x4, [@TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x24, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7fff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x572c}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0xc, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}]}, @TIPC_NLA_SOCK={0x10, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x4d27}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x10}, 0x800) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) 14:15:05 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) [ 411.638668] binder: 14299:14302 ioctl c0306201 20000180 returned -22 14:15:05 executing program 0: pipe2(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80800) getsockopt$inet6_dccp_int(r0, 0x21, 0x7, &(0x7f0000000140), &(0x7f00000001c0)=0x4) socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r2 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r2, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r2, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) 14:15:05 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) [ 411.691797] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 411.716430] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 411.716542] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready 14:15:05 executing program 2: r0 = syz_open_dev$midi(&(0x7f0000000040)='/dev/midi#\x00', 0x8, 0x8000) write$UHID_INPUT2(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="0c000000d700692be7035686acd1a575194885a8968babc3e63ad70627e399844962cb3ed928e839bb566bbe4dfcd2896a6a0bd6152aa9f6975d2f80fba6c8d95da7da16d210ce023ae16137f37cae7dfe3a421a295a04e3e6705956e37bdffb9de05596466a8cb8b21338f0708d27e5dba107e4c5e4148f32f313803b9ef461a6f7b781384f54e468522066e509bc8488c49d615e494bdd0333d8326b00ec7eba5f433f4aaacad80e5eb6fad5aadccd4a3927c7a8e3119dec0a7f150c1664c2285913354108cad15125ed8d741d0106fe7cc3197170069b86ac366d0cded3c15a01e75d7b91436a4b90a56467a896a893c6a7adb9dd2518ca9af2050f41681c293b116682eb3dc177ef09d7d22db16722fda6490ef303bd4ebfa7d268f49d0ef7e3a1b7c832f70400000039d8bd2827139a8d8fa278d9f84afc51287b663befbb7924ef949f2ba6796a053a74b57a22116b28935b66e0c8de3ffd9d48f592a5f548a1a140e1db5d0b30313fb166a930e57c3cf25d7354e59cffead98356c64bc73e5821bdba824a8e0f33609e05d6ced539239392810353fcc32e4fca6161ee7330b9f0af524358af0dfcc4ca8f6e550910c687e35f2502d0eb6f0b9b17814782396f50176ec7ba74c041717d9cacaebe7bd2ab4b9bbb86f91659170fd4265c321c65166ccda4fe779276d84722fa98ef83f1b28dc0bc69ff869ce0bd5d8bcc0262aaaf67155cfdf658b2d69af305301cf789e06f3f5ec9f6fb39286499d86de8180dbecf6468eb0d4e7294b785125e42adc816d181fbaa4c40104294c818db93e5711204e6221b86f2cfaba21f33de971c8f91f4213a2ace3cc818"], 0xdd) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = fcntl$dupfd(r1, 0x0, r1) r3 = getpgrp(0x0) r4 = getpgrp(0xffffffffffffffff) kcmp(r3, r4, 0x3, r0, r0) bind$bt_rfcomm(r2, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$P9_RXATTRWALK(r2, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) 14:15:05 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, &(0x7f0000000040)={0x0, 0xa39}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r1, 0x84, 0x13, &(0x7f00000000c0)={r3, 0x8468}, &(0x7f0000000100)=0x8) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xfffffffffffffffc, 0x1ff}}, 0xa) [ 411.747164] binder: 14316:14319 unknown command 0 [ 411.791993] binder: 14316:14319 ioctl c0306201 20000180 returned -22 [ 411.803358] binder_alloc: 14321: binder_alloc_buf, no vma 14:15:05 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(0xffffffffffffffff, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x28}}, 0x0) 14:15:05 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PPPIOCGMRU(r1, 0x80047453, &(0x7f0000000040)) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000080)={0x42, 0x0, 0x1}, 0x10) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) [ 411.836021] net_ratelimit: 11 callbacks suppressed [ 411.836035] Dead loop on virtual device ip6_vti0, fix it urgently! [ 411.841528] binder: 14321:14328 unknown command 0 14:15:05 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) 14:15:05 executing program 2: r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x80000, 0x0) write$P9_RMKNOD(r0, &(0x7f0000000080)={0x14, 0x13, 0x1, {0x20, 0x0, 0x4}}, 0xffffff27) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = fcntl$dupfd(r1, 0x0, r1) bind$bt_rfcomm(r2, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$P9_RXATTRWALK(r2, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) 14:15:05 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r1 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r1, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r1, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) write$binfmt_elf32(r0, &(0x7f00000003c0)={{0x7f, 0x45, 0x4c, 0x46, 0x4, 0x100, 0x3f, 0xec, 0x0, 0x3, 0x0, 0x6, 0x387, 0x38, 0x7, 0x1ff, 0x5, 0x20, 0x1, 0xff, 0x81, 0x1ff}, [{0x60000000, 0x7, 0x0, 0xffffffffffff8001, 0x8, 0x6, 0x9, 0x20}], "db923d8821f63bba60d34f6cd3aa6910d69916d9e508097d0f7b2870935ad0fc18f490858b4923a700b443aea210c4e1e07b2adff19a874734c53179c60af45eb51d75b231adc830875435731be1d920f2f5ba25ccbd6ebcdd5c8c2273ac198e723064d0af6dbccc38866e243591913a96e9dea7d74d08f475037aa8e3e2ac5ccd1292a8e8250aceeb28ae05e8e224d7e7802c6740d4676f4c3664f50aa184f50fb9c6e6db50731b8da865e07dbeffa0899a5aa8ad4076771859252515aca3f08393212e8007c93d5e4b0ecac2eb16f738765d8d9ddaebd213ab", [[], [], [], [], [], [], [], [], []]}, 0xa32) [ 411.936897] binder: 14321:14328 ioctl c0306201 20000180 returned -22 [ 411.967177] binder: 14340:14348 unknown command 0 14:15:05 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:15:05 executing program 2: openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x220000, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) setsockopt$bt_BT_CHANNEL_POLICY(r1, 0x112, 0xa, &(0x7f0000000040)=0x6, 0x4) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) [ 411.988192] binder: 14340:14348 ioctl c0306201 20000180 returned -22 [ 411.997868] Dead loop on virtual device ip6_vti0, fix it urgently! [ 412.014897] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 14:15:05 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) [ 412.040880] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 412.058090] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 412.067048] binder_alloc: 14354: binder_alloc_buf, no vma 14:15:05 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = semget$private(0x0, 0x4, 0x104) semctl$SETALL(r3, 0x0, 0x11, &(0x7f0000000080)=[0x1ff]) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) ioctl$CAPI_NCCI_GETUNIT(r1, 0x80044327, &(0x7f0000000040)=0x7fffffff) [ 412.104104] binder: 14354:14357 unknown command 0 [ 412.112077] binder: 14354:14357 ioctl c0306201 20000180 returned -22 [ 412.116232] binder: 14359:14362 unknown command 0 [ 412.126816] Dead loop on virtual device ip6_vti0, fix it urgently! 14:15:05 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:15:05 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r1 = socket$kcm(0xa, 0x1, 0x11) setsockopt$sock_attach_bpf(r1, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r1, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) 14:15:05 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, 0x0, 0x0, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x28}}, 0x0) 14:15:05 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001600)={{{@in=@multicast1, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@broadcast}}, &(0x7f0000000500)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000001700)={{{@in=@loopback, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in6=@remote}}, &(0x7f0000000540)=0xe8) syz_mount_image$f2fs(&(0x7f0000000100)='f2fs\x00', &(0x7f0000000140)='./file0\x00', 0x401, 0x5, &(0x7f0000000480)=[{&(0x7f00000001c0)="67c9bd05375634fae2ba368697f5f5ed8e9788cd4abbd0042d5d", 0x1a, 0x81}, {&(0x7f0000000600)="33d69aff5bf11d8fdbb0e0c023491a7a23ac3f1811c5efa7932dd18990ca9dbd4340b54e44182d3cde9ea5dd819e3feff8869230320d70f4914ab228be03b2bc116bf7766120153fddab1b7f5a29b38a1553e8e1f29a28b7788aa752a14b15944046ed14ccf6452048d51a5cbfdc6ce2074682a06ace92a80dda43480a50ea3fcccc937c0ec2328ea791ec09ff4652035975774c7933bff260f599736fb9884677b1f7aef77ed8b5eedbddfd4382c8fe095f1469c7a83ffb4cd4bc6973ebd0cdd16d200f9f1b3bf5172885c6351d40fb0024f514e3b38ff9341a42c063c6ef51778cde545561c6ab7176ffc34053d619d473fe10a9ba232cb42243a4b3686143d4680641ca1b8775b2a4f754929c80b861007a9977ee67f5d7fdab79afa73bcd07e469a8179861d065f0b99e8bf3754c24599db3449dca03d6d2a4d6fa78271f5e38e45b262d4698582a232011d610718c75d4e384b092aaf762bd79c107f2ca5b964e932d32aa6b4c40a382e587bc28982668089abec6f0c26708f9f4db6cfdd72880ac6ea796ab6468c8bee48d89970f1c1a1804befe64cf2ea119e69202927ba87e6cf1eae004488a1c7e4c143e550f9ce84ec9724d43ca102605ef0277a358166f7b1ca8d8da41f79517c10dc355bfac3b0166cfb79cb0e275666f07913a355a41b580f0768594a9867e60a7fe7d813efda24330cb4cc223f243331da07babf4ac971c4468f2124ec0f552eda74c618f0a5d4d70684e998b66e4db9ded516a1e35202bac57f1ca425861a17a3b69855a68de00b76dc04ee0add30554b07a837b8e9795ffd4509accc791649100f56a1a08e88984d016694f8ba33bb3cc434727742fd4a23f6e5bd723e0c3dc8215779bae60581dd93e981dc9334d834400684e74ad20c7faa48f6845899734ca64836959b2b9df9b27f6179186c196499a0207937b391afedb0febaefc439a1c17e5648971061aa1588fefddbdca62a87f9cfcb0b4450f929518e56de5e25ce57ee9dab6da49ae51e6b4843f9f68ab4d9022522949c4985d5f2d9cec75acc10beab0aca6bae83fe3d77b2e1cf638e9ed752f79edf5211be5ba28a02035c6fc1baadabf5d743f5b3fb4c7cfb734e122bb79ba829fa978896680771f519b021c99ee765f3318d4baa58b0b0d03bc2891ccb3f664aebe40c762de364ea4ee27db6e84ee828b3751b92b8873de717bf9c5d5d45d705bd20411f982ba60a41e3fbb6b2d44c2c0eb1e3b97176c0651d387ffa98afae044c6f8baed3e2e51bb5426c3cf695a0601b94bebcad177343e3f01bf54299c68c57fe00077f3521937a25cd207d60fd7ea182bccc4f53ecc656f04356478ae34f7b7a3b185ee983272c345878a40a605054b730c0055fd21df62c04e59bca76a872581e059b54e7c43242cf1425cac3c6b2e07c2fc2d8dcfb5d207af5486932e1998a5c9442c6297ad690a763ffd1217c8b7676e5fb0ca4ea610383d9f73c0493a7a1d173580ab5ce67841a5787a26f584057930251662ed85c1a29356ce48b714b3094b403a35928b6463260f4ef2f306f1ee0b1325012992d70cc75619789b19a87bb9ac3ed734d4c369a112366468cea9426c60930d20447fbc2d0dd54c79e3eb98762d6159c468f34dc3682fe462be447e667a3c1fdc25c1a9d73d53e5e89d97b81f3c659e3fc5a3d102b4be43a5514f04b016e043debc725528164ffd8407beba6b3a1fcd61ad284c864bdb135d9550d47def1d0b6166c0468a87f38e1bb226126eb190bd42aa76968bb2dd25001c41041c084fcddf0305ba768b45633fb8a548069e0c183cccf96c24c73aeb1c9f1fb24621d31b3f5577ccb2f5dbfac2cc0ec6fa0477953833886c1ebc884e762384286ffdea05ebfb4f248e359acd503f489dd78f52b34e623282ae7e067bef72fdf3ed22bc685288c34d519c3ec8e0e9270dd4c63bc6225f58d4277231d8d6105903bb6e730e8f68b6e5251bcdb803124732a8edd7b25fbb479c551b83347f92b7a63d02396e5d8090841a775e939221fe0be144b08bc3ca4c9c175b2cd67020ef50e4a7b0440fbabf68a6d7122f9f775560fe33d141e7fcfb2dc1565b12bd7025fa5182a7261f343528f51045bb57248e0ac2bb1d6fc7b68d8316f4e2fa90d4fe11dd4028c4fc82ac36eab54f45ea80fd417b0f5a6904815fd8c24c9b1c4e58e3710dfcdcd87eabd02ed09c766fe3d443d13835b9058e029afe57f29ce1ff0d401ac74f0199749af3d7c6da64f2d59ca56582254b66490f284067ebe2d6397e470b9a041d2269216ae2d7351135958717c63719845316bb933a8d4eae56919850966c8490896c339896739b327a13502d70393c1acff508a95b5d9f41c33c098b7757bf4fc438215edaf224643b49339b03e77837cbfac1e4b793696a529a840f0a1e0646da1d9bd614f330d4c8ef199ca9fd227fe418d224617bdd3b7afe48bac2c09141f18667b8293b96a3d4f6a9089b27b3dc6b8e1282f89024f4a87a9ba2f484fedbfa94895f64c169d9cb97278c1d4e43de67899f53aeeba9f9f4973985ae585c53382577d788ee124a20240d124fac2dca3e86a7f75779abb0d30433a8c0c056411b6b4e4825864b81b7932520aecb570d4443eb307f89a4ff640f16a0c16dd2f22b694eca9eccad4f228edec74da9a61d59ee628d8faa11202ed5b43a5ee70a35c3a98d874530694871229f5f4b9ae41ac9bcf5a0b653fce9a99e98799c6e234106cb442c3890f86d910285a66307aa729e276aa30d59f9a053ad46268925a3e18954be0f3553d2314b3bc292e4d05acc6939766ffe862509abd8491c571770310e4cceb7497c48963f8d457b62af9844a1adcd030e44becb2367ae50469e602239ec1f979d70efb887c979a6833935899ec5e12676c0ed3f4aeb867870c5fe87ed224908fa85fdd8986bec9a83e1299d3b3521a598df49240791490764d25353e973bbcfed67bf6707f8923e6a7cdec508d1f8d15e196845128b9237fdeef41b09c6f0221b34d9eaeae50d581cd1c83bf7acc9278deb68ca9e7a724fd54a867f9b05bf905e2c2080030218857293a110c3c6448cdf38cc4a477f62ba269a9c7d8f63b0cc6790b7efbf4544fdfcc1ba8a8a15f385932472cea6104991406724ccdbbf914d7b426a2e35dbc50c5da2aaf6f745e7f99c830228c2e38c58fe6961e3399cd10de299b8a01cfc06b9569331402616f62915e9bd0cd34818bcd221fe5d7cc20ba8f632a9f9145603b137bfd52c1dfbd0d62a06da41520cd984c58a7f0fa73a9bf519a794b52f63872f759344e29fbf46aa84d7c178d6e125ae5b15231b23a2ed4ae02f821e1bb19ae52f17aebee1fcf6b460115c67e1a39b86c26958d85a91315d92c8f233dc3918af8541cc5ba5a91a9f0ec42dcd81246abbb1782500616e8452159f3589eeab8cc1fc0214c50542fd160a0adcf48437aad946c9d4bd7b120f69122aba83de6da011867da8e0c17b9330560b901bffd6e6056bcfb4e5f4d9e092514073945d84d8973be7857ebb3d4d20f78c639804e91623f468d76ea084cd2d2a06cc744a6242d7f3e3832aa02f3d8761df83623eb475a32879d5370b6a422eba0d564f0e58ef7cc37c949d84e7661801efd2fda75b7c8cd7daa05f81dc0b052afd38267c159ebd552057e9481ea99a7b3eb0408e787fdf46e6c5522f6e779026cd6e01051c5c885df359c4c8f0a6fb8e9ffaa586c901e183903ae8ab019394244fcae4315b4a1fc0f8f3f69d3bb7a81d80083c1f63b2897583c8ba7eeeb215250b9cc6396dbfed9ddb16603682131c325fc43d1a37b3f0944f55fe38c012ea7ec971e4ec17751556248fdd8e74e46d827a6fcc0f70a49e007a99b2a7b29eae642ff57b010c2f02d7330bab92be006e7eba0a120ed0d4ade1c16621837aceab4c170d679b1d6f89b795789b34e410ac65f65014f3ad1c68728f60138e51fba41818cf43a882b27265e203604dfff0d5522cdcfc5f57e92fe3e849705d1635e15b6b1d07d86c67da2e81d197a469d5a8892d25fb09086e9d26b70491861a2c8b3434decc3c9432d5737826eb6825988d79e4d941491ed92faa5c50d686d4999c2e37980ffc897b38a059bd57e47bd7be9aff901df10adf10a93f089b303930d14fb235389fa792281cb9666879c59936ede78473a85f1c1a02c0f63a0323ccf34bb47ee0eeb41ce308430e37fa2f7472fcdb315387879e387faefde96fc0d1773674ae4b06271f29dfccd63f5bc251ac7292fd76a06bc8e07bfc346c191610160eb343f9bd9b91d0aff6876b648191d9b5290c929e45f6b5528c52f4ae434d23d6207a2e8193bfa2e61a6f228f218152b0a834ce198e881d4119c7f8392e914116c6c13a8137ee2416696604adaa372c6ebe0421f1ef905c4306ef711c7297ffae55a1705d4be06180aae1a4c0c3a18d6bb7961d81b1375a4f48b03256ab53529bd033e799389a9dac3efad5beedec9a8b0034406a7915521340b83e34ef8102bbd3250d328fc73430012951b9dad3ac10fff2c3b11f86d90ee20c95d6f155bf035be88a9004e8790e5c84bf2aa91f5b92465a04a9ef96a073432cb9388dc399c1c6bf62aed2a65e3072a59a252768eef73fb1cdafb8b094ada787542e0ed777b70f5937e45f5865bb925c6aef2d334276d3f05d30718c261f04f4c02c766b10a2260df8a9145b4cdae169e16892b1d09e45ec899e2531bf1c80cc17d42dd0e682a52435db489160514cc45ab63a9c0ffb21d8cf0a55e4d0e67d8bea7f7c5584447b259f3e617847f2bba224552d1efdf6fe6a951e7ab452f1e1be70f6bc68baa53afb3ea034239c3d53a8fe314681a67e77cd933e83687e85f5af57ebf3ce4806a9080dacd25443d3e4d85da809970a2fe0ce2e16a02deeeb3492af6be66608e0efcc2e58e3f5f95234cd75ba6e7ecfa3dc9c31a8693392d65e330b93c3464d932b55578d252836f9319b1034104b5e9852e3b06c8de2509e380dd6d355f9b7a12d77507441e0cd4e140f0119c744c45e3c830197007a5b25b2cc608ebb207ef7f5b3de124d5494692d3ceeefa1e968ebd4799580474cdbfad7cbd9a13a0ae8454c91f2b1be4e108cf3c028d926d94379801cc4a0a3290c5c85b8de71c751abc33f1a966b9c2594c66ee8f06b10550aad500dc4e53517cbd344b05068a350f51d712ceb28dd1d9b6c60044d92780e1862da0914cd295265b5054be22cc388976d3fb24eca2da87fe8ecfa5d0122203c060acbfafc3d2e974ac356f4cf3f094660d0502c7af602ad99cdd953720d73d1c0760d4ee08f3e4442026723200ec019a0d7c4366a4306dfd1d034f1f8805ed24ec86cc0d0a3773b76b170cf00b6120631bd5f164034c21251c789c7b0a70109b793f12870fb1befaf5aaae6f26f87482046c614057f7a88b8aa72f709ad17b3c452f95dcea8edc8d895e7747cb33aaa2fab36286727a67c4da071f0000a290127f61a40ab6153fcb81347ee36b19d9153d2b70023f908e49fb9f0a70ba40ac77eb49c4b07f7c24599ba2e1566d720f831bb48b7d84182f1ac3d2618e31973ef3b09fbcb105a9c3a1c3978d87a625e90be860fe45d5e89a3b17a5f021dc9d384b9460fbca3affd8ffc73d679d956a664b82caa0a5b75842053ece8ac22ee3cff44ca656ea72f48f38f573dcf0fdbc7190bbbb5ae83042c7c98ea00986aa1b53f916d6a03b9d2c28cd580271fe5c7c8647b56d6199224e64a1f4f0f18d898c041e700ec76b76d22ae47e476f4ae16afe2f984c249", 0x1000, 0x2}, {&(0x7f0000000200)="6555713f2b25bc776f7d391250e7ebb505bb50fbaadf1aa98782f6dfe7f973a51c84c711d2fd135ca3b5497744b55b764546f9c1ca2e9e478f828c2fa210c81460b67b76fbcdd7d34f019d542e976b197e632c2202bd3193af985c8c2b72d5a91eb6503f0cccab50c9ff241c7dc97816c853ed02b83ccdfcac8a5f6b282ddc6251ff54a6d810db4bb088866be6296a58d0c96e7496c3d3dc7a58c944c3fde463418a2f6154b4c5f0904073405865033d504f73e4597071b58e4cc4cab55493a4cf471df42af315cf82d7d569e281e3", 0xcf, 0x1}, {&(0x7f0000000300)="35306251aa78cfdd28420503cf6f4751d356c1bb310e7643df58e1de2111382d676cb91bbb7b2037e90221e86f5906d2a2d94baa37708ba0ef73168bdf02e9f2e2b28419e4211bddae86192249734bda7a2af93156986a42a6d296ce43905c299cd7785cc90b3f2326ed4803795d20c7b78a9e7cdefcbaae06d03dc3964193ebd9cf7b260dd80962232c7bdfe754b68e6158862464c05a4a25d1f0fa6eb703d3b7f0a5a16a1d3a6816d27cef29ae560ea80edd5b243b74cb99039ce5", 0xbc}, {&(0x7f00000003c0)="6a0a9f19126474d336f24a601fe4721b0edd7e2bf9ca18ab27920ffd7cc8d1c264ed958c1c216ac2621f636b3dc6e9e8ffe6efcc6c1f32a6aeb2b102f92ce061791b5de0e6eaf72f76f2688e005fe52ef14e1e4e48b77fe869bbfb1a51ad48dae10f1df62265cd94e122eb77a7d496b5adaa13b9ef47c4c93af42b0eb556a705c7422271240b9128551c4d6cecacb574", 0x90, 0x1d4d}], 0x40000, &(0x7f0000001800)={[{@quota='quota'}, {@inline_xattr='inline_xattr'}, {@prjquota={'prjquota', 0x3d, 'eth1/'}}, {@disable_roll_forward='disable_roll_forward'}, {@resuid={'resuid', 0x3d, r2}}, {@alloc_mode_reuse='alloc_mode=reuse'}, {@noheap='noheap'}], [{@obj_role={'obj_role'}}, {@fsname={'fsname', 0x3d, 'ppp1ppp0'}}, {@fowner_lt={'fowner<', r3}}, {@smackfstransmute={'smackfstransmute', 0x3d, '\x93{^]'}}, {@fsuuid={'fsuuid', 0x3d, {[0x3e, 0x0, 0x66, 0x39, 0x77, 0x65, 0x3b, 0x7e], 0x2d, [0x66, 0x77, 0x65, 0x37], 0x2d, [0x77, 0x73, 0x3f, 0x32], 0x2d, [0x64, 0x77, 0x31, 0x7f], 0x2d, [0x39, 0x0, 0x72, 0x38, 0x66, 0x7d, 0x37, 0x65]}}}, {@fsname={'fsname', 0x3d, 'ppp0%@-'}}]}) r4 = perf_event_open(&(0x7f0000000580)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r5 = openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) fstat(r4, &(0x7f0000000080)) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) recvfrom(0xffffffffffffffff, 0x0, 0x0, 0x40012040, 0x0, 0x0) ioctl$PPPIOCSCOMPRESS(0xffffffffffffffff, 0x4010744d) bind$bt_sco(0xffffffffffffffff, &(0x7f0000000040)={0x1f, {0x0, 0x0, 0x0, 0x0, 0x9}}, 0x8) getresgid(0x0, 0x0, 0x0) fcntl$getown(r5, 0x9) prlimit64(0x0, 0xf, &(0x7f0000000180)={0x100000001}, 0x0) mount$bpf(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(0xffffffffffffffff, 0xae03, 0x858) socket$rxrpc(0x21, 0x2, 0xa) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xf, 0x9, 0x0, 0xfffffffffeffffff}, 0xf) [ 412.157995] binder: 14359:14362 ioctl c0306201 20000180 returned -22 14:15:05 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) [ 412.247891] binder: 14372:14377 unknown command 0 14:15:05 executing program 5: r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/qat_adf_ctl\x00', 0x40, 0x0) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000100)={0x0, 0x4c, &(0x7f0000000080)=[@in6={0xa, 0x4e20, 0x8000, @local, 0x20}, @in={0x2, 0x4e22, @local}, @in={0x2, 0x4e23, @multicast1}, @in={0x2, 0x4e20, @rand_addr=0x8aa}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000180)={r1, @in={{0x2, 0x4e24, @remote}}}, &(0x7f0000000240)=0x84) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r3 = fcntl$dupfd(r2, 0x0, r2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r3, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) bind$bt_rfcomm(r3, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) [ 412.277980] binder: 14372:14377 ioctl c0306201 20000180 returned -22 [ 412.314637] binder: 14383:14387 unknown command 0 14:15:05 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:15:06 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) setsockopt$bt_l2cap_L2CAP_CONNINFO(r1, 0x6, 0x2, &(0x7f0000000040)={0x81, 0xffff, 0x40, 0x9}, 0x6) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x7f, 0x0, 0x0, 0x4}}, 0xa) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r1, 0x6, 0x15, &(0x7f0000000080)=0xa256, 0x4) [ 412.349754] binder: 14383:14387 ioctl c0306201 20000180 returned -22 [ 412.362165] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 412.386058] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready 14:15:06 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) [ 412.429176] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready 14:15:06 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) openat$vimc0(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/video0\x00', 0x2, 0x0) r1 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) r4 = syz_open_dev$swradio(&(0x7f0000000580)='/dev/swradio#\x00', 0x1, 0x2) setsockopt$inet_sctp_SCTP_NODELAY(r4, 0x84, 0x3, &(0x7f00000005c0)=0x10001, 0x4) utimensat(r4, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000280), 0x3) r5 = gettid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) unshare(0x20603) syz_emit_ethernet(0xa, &(0x7f00000004c0)=ANY=[@ANYPTR=&(0x7f00000002c0)=ANY=[@ANYRESDEC, @ANYRES32=r3, @ANYRESOCT=r5, @ANYPTR64=&(0x7f0000000140)=ANY=[@ANYPTR], @ANYRESOCT=r2, @ANYPTR64=&(0x7f0000000180)=ANY=[@ANYPTR], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYRES32=r3]], @ANYRESDEC=r3, @ANYRESDEC=r2, @ANYRESDEC=0x0, @ANYPTR=&(0x7f0000000340)=ANY=[@ANYRESHEX=r2, @ANYBLOB="14b0a9f79071acb3a03219572c4b82484ae4d1c3602e9948ad9ab2e7b696d273b1d0", @ANYRESDEC=r5, @ANYRES32, @ANYRESHEX=r3, @ANYRES16=r3, @ANYRES16, @ANYRESOCT], @ANYRES64=r5, @ANYRESOCT, @ANYPTR=&(0x7f00000003c0)=ANY=[@ANYBLOB="6d269b4cb4cf05f76ca887231561cb3d2374860c794d827337faab75ed5b275c96733542644022ef5778c283b9d29c15807bcd7d5bf2cb9720e2912ea51bf2c8228676862d2e8aab2f701ae66e7dcfae9a2dd32a877d591b5ba0803014939b"], @ANYRESOCT, @ANYRESDEC=r3], 0x0) r6 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000200)='/dev/loop-control\x00', 0x0, 0x0) fcntl$getown(r1, 0x9) ioctl$LOOP_CTL_ADD(r6, 0x4c80, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl$FS_IOC_FIEMAP(0xffffffffffffffff, 0xc020660b, &(0x7f0000000440)={0x1, 0x7ff, 0x2, 0x953, 0x1, [{0xfffffffffffffff8, 0xdf1, 0x7fffffff}]}) r7 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x6b, 0x240800) setsockopt$nfc_llcp_NFC_LLCP_RW(r4, 0x118, 0x0, &(0x7f0000000640)=0xffffffff, 0x4) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r7, 0x6, 0x1d, &(0x7f0000000080), &(0x7f0000000100)=0x14) ustat(0x0, &(0x7f0000000000)) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r8 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r8, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r8, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) timer_create(0x7, &(0x7f0000000600)={0x0, 0x35, 0x0, @thr={&(0x7f0000000680)="455d62ec2edccb4ab500584c1c7eb8008d81f5ca0bc9ea6b4e1e6297df3857b691a5f20189698e991e5e570457615d40ef87e675b9585fcfc29d672895bd120226f1fa331fbb90a66909040ed2cec8aac4c7847ce3d4996e84aab876a8cfc610051ca406ebf2d2979f", &(0x7f0000000700)="924fd142614fd0bfe990a6d70ebc5e9c170cd55829ae61f590c60556541d29c9b79c9d608db25fb026b575f6cb0f18ce536b30219c4ff75e17cc55653333ee190616ba813104210ac60598e6a49087ff580c772e19ffeff1098eb1e9bc3fc97bb4e0a793711cb3776328b17f8d69ac49538ac1c2399728cd6b060098a5b0e3ce2c260888a61f2adf24a7fa44186d0fa41e3b449153"}}, &(0x7f00000007c0)) 14:15:06 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) r3 = syz_genetlink_get_family_id$team(&(0x7f0000000180)='team\x00') getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000300)={0x0, @rand_addr, @dev}, &(0x7f0000000340)=0xc) getpeername(r0, &(0x7f0000000380)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000400)=0x80) ioctl$KDGKBLED(r1, 0x4b64, &(0x7f0000000200)) getpeername$packet(r1, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000480)=0x14) ioctl$DRM_IOCTL_WAIT_VBLANK(r1, 0xc018643a, &(0x7f00000001c0)={0x4400003e, 0x7fffffff, 0x39}) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000006c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000680)={&(0x7f00000004c0)={0x188, r3, 0x300, 0x70bd2c, 0x25dfdbfe, {}, [{{0x8, 0x1, r4}, {0x4}}, {{0x8, 0x1, r5}, {0x160, 0x2, [{0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x10001}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x1f}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x3}}, {0x8}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x4}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x1}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r6}}}]}}]}, 0x188}, 0x1, 0x0, 0x0, 0x800}, 0x1) ioctl$PPPIOCGL2TPSTATS(r1, 0x80487436, &(0x7f0000000040)="00fd55f3741e82dedc9469ac31dd1a2436a0a805398ae96a14b3d92f40eaa2a97a78a87442e676328c09657525c8d69292505ec948c65ec29acd646e2b2b90e6bddb181ccb3362217c52bfbb976b722d58df9f87617473827695879c99dd7b684c224c4c45eb57fa9e4756de7133684a35ff63230bd494274452aa5b17bcb0a98ed9feb645acdb10fa638d10d8a0cb2a74259c44e4044545e0dc727384ae03d1451bec5b9132cc12572a88952235b165bf680e69e411b01254affd9ae28c8c63cccb55d06bd42ad735d8eeb70e6785b8636f8addc1ac582ee5a57cb0eda2898d1aacc7c053c1061b8cf263d2f8b2") [ 412.480832] binder: 14403:14406 unknown command 0 [ 412.485897] binder: 14403:14406 ioctl c0306201 20000180 returned -22 14:15:06 executing program 2: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x0, 0x0) connect$tipc(r0, &(0x7f00000011c0)=@name={0x1e, 0x2, 0x3, {{0x41}}}, 0x10) setsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(r0, 0x84, 0x7, &(0x7f0000000080)={0x3}, 0x4) ioctl$VIDIOC_G_TUNER(r0, 0xc054561d, &(0x7f0000000100)={0x7, "bc981a25838f5e1199e5297b743707701a2d4da87e0e724c1cfeb47c548476c8", 0x7, 0x10, 0x100, 0x3, 0x18, 0x2, 0x0, 0x7ff}) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) setsockopt$bt_hci_HCI_FILTER(r1, 0x0, 0x2, &(0x7f00000000c0)={0x40, 0xff, 0x100, 0x5}, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000001240)='TIPC\x00') sendmsg$TIPC_CMD_RESET_LINK_STATS(r1, &(0x7f0000001300)={&(0x7f0000001200)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000012c0)={&(0x7f0000001280)={0x28, r2, 0x114, 0x70bd27, 0x25dfdbfb, {{}, 0x0, 0x410c, 0x0, {0xc, 0x14, 'syz0\x00'}}, ["", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x20008004) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) ioctl$EVIOCGABS3F(r1, 0x8018457f, &(0x7f00000001c0)=""/4096) 14:15:06 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, 0x0, 0x0, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x28}}, 0x0) [ 412.537240] binder: 14410:14416 unknown command 0 14:15:06 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) [ 412.583867] binder: 14410:14416 ioctl c0306201 20000180 returned -22 [ 412.632700] Dead loop on virtual device ip6_vti0, fix it urgently! [ 412.668116] binder: 14424:14431 unknown command 0 [ 412.674868] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 14:15:06 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) 14:15:06 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$ASHMEM_GET_PIN_STATUS(r1, 0x7709, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_INSTALLED(r1, 0x80024322) ioctl$PPPIOCGFLAGS(r1, 0x8004745a, &(0x7f0000000040)) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) 14:15:06 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000000c0)=ANY=[@ANYBLOB="080000000000000003000000000508000000000000000000", @ANYRES32=r0, @ANYBLOB="00000000f9ffffffffffffff00"/28]) r2 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r2, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r2, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) 14:15:06 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) fsetxattr$security_evm(r1, &(0x7f0000000040)='security.evm\x00', &(0x7f0000000080)=@v2={0x5, 0x2, 0xd, 0x3, 0x19, "1f0be51ef0e97dd2bb311d5d20db8b3d6325ee669d7611ff9b"}, 0x23, 0x1) [ 412.683179] binder: 14424:14431 ioctl c0306201 20000180 returned -22 [ 412.717982] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 412.733476] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready 14:15:06 executing program 4: syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) [ 412.782316] binder: 14438:14443 unknown command 0 14:15:06 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) 14:15:06 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socket$nl_xfrm(0x10, 0x3, 0x6) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) [ 412.814413] Dead loop on virtual device ip6_vti0, fix it urgently! [ 412.815457] binder: 14438:14443 ioctl c0306201 20000180 returned -22 [ 412.841712] Dead loop on virtual device ip6_vti0, fix it urgently! 14:15:06 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r1 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x2, 0x20000) getsockopt$inet_sctp_SCTP_RECVNXTINFO(r1, 0x84, 0x21, &(0x7f0000000140), &(0x7f00000001c0)=0x4) r2 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r2, 0x29, 0x24, &(0x7f0000001480), 0x4) ioctl$SNDRV_CTL_IOCTL_ELEM_LIST(r1, 0xc0505510, &(0x7f0000000280)={0x5, 0x2, 0xfffffffffffffff7, 0x53d, &(0x7f0000000200)=[{}, {}]}) sendmsg$kcm(r2, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) 14:15:06 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x2, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c'], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) 14:15:06 executing program 4: syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) [ 412.888467] binder: 14449:14450 unknown command 0 [ 412.894048] binder: 14449:14450 ioctl c0306201 20000180 returned -22 14:15:06 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, 0x0, 0x0, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x28}}, 0x0) 14:15:06 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000001c0)=0x0) sched_getaffinity(r1, 0x8, &(0x7f0000000200)) r2 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_procfs(0x0, &(0x7f0000000040)='net/llc\x00') getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(r2, 0x84, 0x6c, &(0x7f0000000080)=ANY=[@ANYRES32=0x0, @ANYBLOB="b2000000398941f36b0af68512aec87188ddc10f28e8191b41b3d6eb262ac4e62577ef5f22d0856fa87a745b4d6a0dc167b82b91037e0910cf3b19274575fa03617944ba90f01019bda7a5dacfb9e9990e5981d7f6809d205bebb8f8ee11e79124b73a2ea5b4a8a155b2c24afcebb6adb9ca9a61b8555846e2cd45a43754bee8c06b146db81e5bd1445e9b59d55e523b5fcfb5d10c4445f8586d975c8f27dd2760215f41afa30c4195bded5f8b80d6fbcb42aefa73"], &(0x7f0000000140)=0xba) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000180)={0x3, 0x0, 0x9, 0x8000, 0x800000000, 0x6, 0x4, 0x9, r5}, 0x20) ioctl$CAPI_GET_PROFILE(r2, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) bind$bt_rfcomm(r2, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) [ 412.956881] binder: 14459:14462 unknown command 25344 14:15:06 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r1 = socket$kcm(0xa, 0x122000000003, 0x11) r2 = socket(0x6, 0x6, 0x7fffffff) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f00000000c0)=0x1f, 0x4) r3 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000140)='/dev/video35\x00', 0x2, 0x0) ioctl$VIDIOC_G_STD(0xffffffffffffffff, 0x80085617, &(0x7f00000001c0)=0x0) ioctl$VIDIOC_S_STD(r3, 0x40085618, &(0x7f0000000200)=r4) setsockopt$sock_attach_bpf(r1, 0x29, 0x24, &(0x7f0000001480), 0x4) socket$netlink(0x10, 0x3, 0x5) sendmsg$kcm(r1, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) 14:15:06 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$FS_IOC_GETFSLABEL(r0, 0x81009431, &(0x7f0000000040)) fcntl$dupfd(r0, 0x0, r0) uselib(&(0x7f0000000140)='./file0\x00') [ 413.001998] binder: 14459:14462 ioctl c0306201 20000040 returned -22 [ 413.025426] binder: 14459:14471 unknown command 0 14:15:06 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) 14:15:06 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x2, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c'], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) [ 413.070437] binder: 14468:14474 unknown command 0 [ 413.076296] binder: 14459:14471 ioctl c0306201 20000180 returned -22 [ 413.077600] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 413.099019] binder: 14468:14474 ioctl c0306201 20000180 returned -22 14:15:06 executing program 4: syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) [ 413.145644] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 413.166036] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 413.192596] Dead loop on virtual device ip6_vti0, fix it urgently! [ 413.202872] binder: 14486:14490 unknown command 25344 [ 413.217748] binder: 14486:14490 ioctl c0306201 20000040 returned -22 [ 413.227327] binder: 14493:14497 unknown command 0 14:15:06 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) socket$bt_rfcomm(0x1f, 0x1, 0x3) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) connect$unix(r2, &(0x7f0000000080)=@abs={0x0, 0x0, 0x4e22}, 0x6e) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, 0x0}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r1, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)=@mpls_delroute={0xb0, 0x19, 0x0, 0x70bd29, 0x25dfdbff, {0x1c, 0x34, 0x20, 0x7f, 0xfe, 0x3, 0xfe, 0x5, 0x2000}, [@RTA_DST={0x8, 0x1, {0x9, 0x0, 0xfffffffffffffffb}}, @RTA_OIF={0x8, 0x4, r4}, @RTA_NEWDST={0x84, 0x13, [{0x1, 0x0, 0x40000000}, {0xfff, 0x0, 0x2}, {0x7, 0x0, 0x1}, {0x0, 0x0, 0x514}, {0x800, 0x0, 0x2acf}, {0x3, 0x0, 0x7}, {0x5, 0x0, 0x82a4}, {0x1000, 0x0, 0x3}, {0x3, 0x0, 0x4}, {0x5, 0x0, 0x3}, {0x4, 0x0, 0x7fff}, {}, {0x8, 0x0, 0xd9}, {0x8, 0x0, 0x515959df}, {0x10000, 0x0, 0x1000}, {0x0, 0x0, 0x1e5c}, {0x7ff, 0x0, 0xfffffffffffffff8}, {0x3, 0x0, 0x800}, {0x401, 0x0, 0x6}, {0xffffffff, 0x0, 0x1}, {0x81, 0x0, 0x1b6a}, {0x8, 0x0, 0x7ff}, {0x4}, {0x9, 0x0, 0x9}, {0x2, 0x0, 0x3}, {0x235ef6e2, 0x0, 0x7}, {0xfffffffffffffffc, 0x0, 0x9}, {0x8, 0x0, 0xffffffffffffff81}, {0x8, 0x0, 0x80000000}, {0x7f, 0x0, 0x3}, {0x2, 0x0, 0x100000000}, {0x100000000, 0x0, 0x7}]}]}, 0xb0}, 0x1, 0x0, 0x0, 0x4008800}, 0x0) 14:15:06 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) ioctl$DRM_IOCTL_MODE_SETCRTC(r1, 0xc06864a2, &(0x7f0000000080)={&(0x7f0000000040)=[0x2, 0x6, 0x15, 0x3, 0x10, 0x6, 0x9, 0x6], 0x8, 0x2, 0x8262, 0x0, 0x0, 0x3, {0x7, 0x8, 0x4, 0xe8b, 0x3, 0xfffffffffffeffff, 0x10000, 0x3, 0x8, 0x81, 0x9, 0x6, 0x5, 0x8, "b77d7506dabad2a39493a92fff149a8f1168da62b22ce55cb03b5ba252cf212e"}}) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) 14:15:06 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r1 = socket$kcm(0xa, 0x7, 0x11) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r5 = syz_open_dev$mice(&(0x7f00000000c0)='/dev/input/mice\x00', 0x0, 0x1) write$FUSE_DIRENT(r5, &(0x7f0000000100)={0xe8, 0x0, 0x4, [{0x0, 0x3f, 0x9, 0x0, '/dev/kvm\x00'}, {0x5, 0x5333, 0x0, 0x4}, {0x4, 0x4, 0xb, 0x10000, '/dev/adsp#\x00'}, {0x1, 0x1, 0x6, 0x10000, '.\teth1'}, {0x1, 0xf8, 0xb, 0x0, '/dev/adsp#\x00'}, {0x2, 0x0, 0xb, 0x3ce, '/dev/adsp#\x00'}]}, 0xe8) r6 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r7 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x81, 0x200) setsockopt$inet_group_source_req(r7, 0x0, 0x0, &(0x7f00000002c0)={0x0, {{0x2, 0x0, @multicast2}}, {{0x2, 0x4e21, @local}}}, 0x108) r8 = dup2(r2, r6) getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000000540)={0x0}, &(0x7f0000000580)=0xc) ptrace$setregs(0xf, r9, 0x9, &(0x7f00000014c0)="f47a90f4505850ffa4269a869be8fda0277421d56dcaedb7bb0b1b254952aa4162b93d9b56915ce952ef89d76c8246f24351925b5fa4e217eeb40b206b6cc257b3572b74ff140f70efd4c97452dda656bdf78ab54d152ab7b01309048b158ff0035157ad48d572884214d73b815e8af47a131e0ac6d900f2e1dfd843926af4e5726bd5b9ea882ccc79d7b40913bc994a3ce14b32278906735ff2151865872daa1c74b9b37713790cc91c8cf7bb750c930f09510357c3519277e1070c2ee965e0c2d5f2863557a67bef6a3601163662f50f263a12e2bfa10d428327936d5503858f1348cf7b7b6f0e3eaec836e46c7629b119776a03ac9a8eb0f7b025d399afdae0f330f0902bbc5ae8f6a02fd7cd3604a7d80b6549541e7d59bb3d20be9a8bfdad5111ab2f494b9e1ea65dfdbe8bc96ad110ce43cfecdcef4fbfc13a3e246ea47a33e51f3e9de69ddfaffdfd6d380b2c081caf868210f13ee7d45045c89d6d23df38123c81370443494171464c7ebabb0de1cbf6d59b7d2dc7db5f2c36efd93af624553cc1bb707410c44e7464e479ba3a563ce13553162fd21088d0f8f10393c72c306416e548ec30af1dd54d7a0e54336154761098cb00eea6477ca8066f8cf5586b5a948116def764d900d81f05b10ab17ea125f205db2cd7f317d2061e4520bda8d089fe019b523fdb3f54115f9da2f030a95b8d0df1328575513a444d1e62154f75e01af3c3676de95ee51edef8d13ece0213dabf075c62707970656971d111098f0dac40fb70fab1ae93af6ea210d1e0a3955e599feef4482310402dab05b12993a10b9650dd9ee4c0d858bb3cbd05fdad55f80aa8cb2f567bd2b97300a6981000ded2109564825beb2dc63e9598010d80066fefc04e6466ba98f7c01d744b7d22873285d01c50b3ccaf7ce21d8c887fb5e1a3d25f281ce5b9e1263c2c1166cb3cf645c405039b84dbad9f48c08a51e27e79409cf9ff39b3a9eadc6a11a58b0e9d4c82210e15c6e2c9db32fbe99f136231349474f8bdd0a86c6bcc04771de06b692952bf7fb2e0e107d36b505a276cf0cf5a8f72608d675740c782bb7c125ba4a7bcd499d60dbe7d31c746d75d27b418a63831ac6aa46f7918474bffa1cdc4c4045ab955ae71926487b0d25b79970b23eb4faeba827f988e1f049634fdb659a15b1f046c974db72b2c908669dfc57d1b2c403b9a46478ec4b85a88339b2feef58dd91153f39e6b5e2d4809be1bd8b2fe5a55fd506950a1a31985b9c4ebe6a9ad3dca520d0d66ab6224466262912d438e4c0e6421d490de8af1f01e215c5072a8be53c741b10f261952f2ec524449c0ed4d4ce783abda53e14d781ac328f99d8d63b67e83e53a707f0027a49778f37181e339c9b0e8ea75f218b8b46df10ef54f24eca50884bc0c450c51e5863fcd5ac1a1bc3f81918f3bb1daf9d6ff188758d106b5a37ca210ab3da4bad5d6efdd66d2b54087d5877d553b253837d3ccb5930ead284f0fa4ce7e6f51374cfc09534c65eaf75f95828665a9368dce187c363fdcacea514a0cc15ad7e3306334d7eee602fce82cf59f1cc3086570dea4ccf514f3fb4733ff01b330ecaad6388004d9fef009689818af560ee4ce93b27b902ce1410b0695f9c164025036c9f45cd4bdc64d429b23f2fb02afcf7264730e684356d72f58a4b4ff73749e634aab5adf624d1ffdb65e6f0ce065a1eb0c66edf9dd5ac1cb1f5c7de82e353f0f13b6af5b2a071e94d3a53ed24aa02a18f8e8c20cc371930915be99cd399d41a1959ad1fa7a8eab30c8be0431a0a1c626338d1198a69996b8e68045852d14165e7942978a6969d74a46519c7bdbc454278125e77b7aeb041f376196ea4d5f1e1658332172e018c443419c47cd7477ebdb1e3cc41ae9beb58f3cb6df4762686c7da2de2940e9270f373c5cb1d774189b9e65ecdf4633928ebfd18203035d99f4d0ac483bcc800ebb2b2cf39ea3702d4834f5d5da4ec89e024bc2be478a42ba9594a1ef2b139c4fcd91b9c1187859f22254cdfdf1132d5f226c4708ba3fb22ddb60f9ce53d3e55e83186bf2ebfc8d382cf8eb7d4789cd58dbf80f0a510e783e93eaf4cb81c5abdbb416c96fc6ce89d14fc4c8d7a29505d744e8e7e0b3a57eacc5717b5b7aef5051bda16d37932aabc48e32bfb7f7216c224dfef809701358baf4b91386d25b5993e6e2a06a2c1fd90e628e783d6b9027f7cd8dc9ca37d7eb5bc57ccc199ddaecfbcf3ee8e84a805f4077d7cbc5252f682f3cb1e84a2103dab9833cc0a57c9174ab5f71cebe486f8214426653a1f6b199ba2dc4dab8fec283b1bd56743bdbbcad0647ce46a60a805999be2c077f15f1608fbbe37b3c986d22e07f8080f2df2d9a2e88f9ab5740ceefecf12263ba6b625378fcb8e204cdd9d331d652b801d5e0fa305c0a983da7d603bb924c3e9e9a48e7d859cb4c6af49e2c7ae203316c822187be61439127baa71c5c0d269c6f5cada7ede6bbacc2312ad1da0818b825ac605c5219e00bd9dcb5544e1f29e589c3bd46288116462237079e4927d8de1a96596f8c1f035c68165079f9a5011f007fb0b51a5f063f1d525a54181e754428989597458ca033089d81771674bd658e25604b8004e5fc82b5841da1e10d729dc09fbd1460046fec7cc1a5a1e0b7cad23d222b0a6346f2134475839972bca8ea2c5f1a700574167634da87d8d93e7b5bb656a8b1257f30dd9157e078b0166028f2f50924d2fc7fc2090ce40dbc9dbc440cc9eb4fbdc5b08a9fa3365c6993018dfa548962b0381494db41f26ed03b3f9847087288ef2d8d9c400570f78c3f957a6b1b56a20486bfea0e64cc75aed7d90bba4abf8a0a2301d9b2fc62b2f1ae16c783f8fc757ea07cc43b8a1df32fd516aa38dabf7ebe61e8c6198ee230ae19f8385ca91bca41ed08311ec43fca42135625a364b14a842e0eae768e8f0ce49acda1c62a8b6a31287606ecdc2ca3dce74de7be9e6cdb2e7381e6ad1b2e3d88ef18df7e76b20922721c90ac6048acd3a1c469bf2dc10a13590ddf00d47b9a5af33d9d2d97b611ed03b11e331d84e527ebf9147b5357e8fdce3e4d4e1f364c55a6571836a35277f00e677b5df097584f7bdc85585b2545d5bb47a0c6e4c668497d4338d680744bc18c84f8f922b779c3bd35f73e930fb6278af113565ff2afc544761b55f50fb95736d4971c9a9e2e2494bfaa6bcbaa11867fc2575830454bf62fcab83854794883b57b42a7a2e954d555688129d671f92d61a44a9e0ebcf346e8d6eb8a330a1c89579e909d1c4a757cecb79380448175958d57fcd04b3f22ce737fd8462b23138e1656c85693eb9d33800a294e6d177226ddeba731bdb734bb950cfa471af086bc3a4d5d9c01694e676d78dc9cc59f331f689553974baa7085b2bb5bc32eb9e10e6fc224307acd219b7af4bd4de3b115182d2103798735a25b6c1492a91299e38931d6dbcfc636aa0aba347d798224575cec911cff7a927965c1189d24166f864945a7c3626c85a61f144f805b018bd892b3a0c86e7dbb29356ca861575903142a3e0125edde37cbee409f2d71fda73438881365effc124f4585bdb29f75f07d0e0642cc643c3d01e9b273d68124a4360d343f1be5defe53e7d6e263d6b238213141f5808b907d8c2f85801ef4fdbbfa4a16f4df950d14d6b5126723aed7e786fb547866619cc1edf9a77f392306b62d3790ef09c4b945dc4b49488d224be29613a3a126324fb0e60ad14045d40799afe7a40166ec7f3118675fa5d585b78fe0202899b318d716ec84dbd75fbf74793e101c1e38b2c086b2bb691bbae8d84de23e8e330de0a52a128aa953d23015eec8560a1883f7fe03be9a2399b3f42b8b46ca797d3d7c4826651b292bd8cae62082df5724a897de06df9a5db17d17111379dc43d2d3e6f362e2152f8023b5ae4101e2698c4f45242a8c714559d5d1c4749743a0037056875461ca220a150dc5bbc53856a708b12aa4877e2ceb4a57f67065c3922c393d9c57c2111dcd20f6e56960ab22544ce07e4042d1a6a1d51303b613301eae1079343c396a74bcd2ee59e96d06beabd096a6e8b71cc45fb88e9c4e39e2b2d297abae0d1b31b4cb726393440ff7b8ed3f35ee42f7cee1bdcb78df23220785359e8336f5ae051ef32619072c256d78256aff58f9e46003b31e8be388075467e475cc9e5dba33c6926a28ff4a73bf293565ca97dae6a796a49bed209caa02a467b485614c6a2c13ff3578935fabae5fcd158927b9ac18d784ee0683c72ff2a17c55226500a25a8f1afe61c9262ba6fe464b5a1b96be4f29c129364f91cb32b9455b157cce3446a6c3d358f51bd184d4bc03ebe801ba23e3bf2f2b7c4b050be0190a7536d1c49bcead464ce3ce0219635b9bb6f8c68d2eba7f247afaf9939ead48422a174a2f8370d412d3bb38ef9c44849d0d8b8381be27265c48ded6f873488b0f0cd4a7d26a909ae1dd32d35c6e22cdb775aa02f5f11317a1259cb57651ec3879d0b27b727d4fffb1c834d96d39fb65cbab980caac06c41a2fe018e2879e5de8606c145f38be03dd6244110bf974470a92e127aa9047b53b4b50b965e16614f68b47b7ee4b8e8db78a286d0844f030a5334b779b3c9d1e885ed08747fd44813e6ec9f143d87ef3744637fc1d84c11da2f15a918bb0b764a02d6aeac64bada0b27f1852d2068a3fbf13f2517e8d54a3d3c5a183a6958df5ab7fee33ce54a0112394c124e1ce34ebc8a154cff2a5d3088b1e87b166b214c4bc558605cab45eb36418e19dbdbbcaede35d3bbfbdcfd2afc8d6655a3bb75dd46a5d647527b90a0b4db2462ed4ea4c83c342103a40e4e1b513c3ab15b26ff56dbf2d74d9896ee9a5c0b54cc6c1313bf340e878ffc6099a63918f710f54c181e2513b57f47098ce80cdeffe7d1771f7d3f30fbe76e94e725b5742def7862b7eb99cc73737bf37269db1c583b2dac5ecfeeb748fa1b8e1604a08557f7734dc575b35457c6a9d70984a28e8a29667fd2bdf8028d1a2de1f8f9b2123ee58375413b0ec227eb87163f3086a7cd73644b829ee0720221226b8ef03fd6becb6bd5b60c3ee912dbcf1a8c3dffc39ea682667c5715d34b5d8feb4418169b6005be66f4683dc20ddd7bf1ccd985ab17e81e70fb3c4aac8f7f8c02a98c37915c24d82b047ed7148464872e95428611093589ea6238b09e9bf219d6504ca3a0c4251c113264f868b06c08afee6825c6720b75f7f4ad9c27d5a64fb2fa4a3512041a5a9acd92e4ae0881239b0de1e86330413f78bdec31f8ceee6fe44e1185196a83698f9e46d9870fd1dfe2dc7235c249d5c1e3f352cc76ff46cfe9163f2151c65a301fc075711453fd706c7a4f7d7138d269f19cc5277c883134e3d26e4f4d2696d426eb145ff6031b42a7c7d680b9d384d90e557f12320338aa1e5bb0dab4b9471c68c7d552967e997f39cdde58f3523daf23bd9284e16fe25f1f1e9691337a185a4c3865dd02dcbfdd633357fe033a754346562baca042cfb5c702a7089b552fa429e6453e215b3be446dcb5b328168a4440ce007016399c4c5c79d37fe12a449fe2cabdf0ae82d8d764d86286f0b212420060eeee0db4b09765df77190d42887797444073f5883152949d308bc32cdff51749abc8b76a045d20c60a6e4fb8d4fdb55504920840216aff8402ecaa7c57d20e58db7afa8bb3e02dfe2eae6f74a4fbc039ce44a4c397ddbe84724b751e336d43def484f8a3505e0913b46874812d1f810fc1d8ddfcd03bc0cbdf4d4f35f70df3a32a455add72") r10 = fcntl$dupfd(r4, 0x406, 0xffffffffffffffff) getsockopt$bt_BT_SECURITY(r10, 0x112, 0x4, &(0x7f00000004c0), 0x2) r11 = accept4$x25(r7, &(0x7f0000000040)={0x9, @remote}, &(0x7f0000000080)=0x12, 0x800) ioctl$KVM_CREATE_IRQCHIP(r11, 0xae60) ioctl$PPPIOCGFLAGS(r8, 0x8004745a, &(0x7f0000000500)) dup2(r8, r3) r12 = syz_open_dev$admmidi(&(0x7f0000000600)='/dev/admmidi#\x00', 0x567, 0x4601) r13 = syz_genetlink_get_family_id$SEG6(&(0x7f00000001c0)='SEG6\x00') setsockopt$CAIFSO_REQ_PARAM(r12, 0x116, 0x80, &(0x7f00000003c0)="e986df2e5a795f41a563a70f37dc8aebe73d520683c1d6af9a11c048261765c66386a17a3472df315061b86de391d55504c62d5916168638fea3000c299c8a5adb81b066ea51e1984277bf8fad150633954b93666dd1b166b7ec5e87ef938ce33d41bbc8c149f14ccd9e6ab069585a0d11dc2e76e57b7c544a907d897b1bb2cbeaef1891905e3d48f2a42b1dde7a9e2852a8bb3e984a54fa6d7aaf01aa421eb7f497741ee26f9c20510ec555e4d10c7b688e020596b11befde46", 0xba) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) sendmsg$SEG6_CMD_SET_TUNSRC(r12, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x48, r13, 0x108, 0x70bd28, 0x25dfdbff, {}, [@SEG6_ATTR_SECRETLEN={0x8, 0x5, 0x4}, @SEG6_ATTR_DST={0x14, 0x1, @mcast1}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x7}, @SEG6_ATTR_ALGID={0x8, 0x6, 0x40}, @SEG6_ATTR_SECRET={0x8, 0x4, [0x101]}]}, 0x48}, 0x1, 0x0, 0x0, 0x40040d4}, 0x20000004) setsockopt$sock_attach_bpf(r1, 0x29, 0x24, &(0x7f0000001480), 0x4) ioctl$KVM_DEASSIGN_PCI_DEVICE(r12, 0x4040ae72, &(0x7f0000000480)={0x2, 0x316, 0x6, 0x6}) sendmsg$kcm(r1, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) [ 413.243109] binder: 14486:14490 unknown command 0 [ 413.258049] binder: 14493:14497 ioctl c0306201 20000180 returned -22 [ 413.265943] binder: 14486:14490 ioctl c0306201 20000180 returned -22 14:15:06 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x28}}, 0x0) 14:15:06 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x2, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c'], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) 14:15:06 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:15:07 executing program 2: r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x240, 0xc) getsockopt$IPT_SO_GET_INFO(r0, 0x0, 0x40, &(0x7f0000000080)={'mangle\x00'}, &(0x7f0000000100)=0x54) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = fcntl$dupfd(r1, 0x0, r1) bind$bt_rfcomm(r2, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$P9_RXATTRWALK(r2, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) 14:15:07 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$VHOST_NET_SET_BACKEND(r1, 0x4008af30, &(0x7f00000007c0)={0x3, r1}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000740)=@nat={'nat\x00', 0x19, 0x4, 0x690, [0x20000080, 0x0, 0x0, 0x20000186, 0x200003dc], 0x0, &(0x7f0000000040), &(0x7f0000000080)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0100000005000000120003000000697036746e6c3000000000000000000076657468305f746f5f626f6e64000000726f736530000000000000000000000076657468305f746f5f62726964676500aaaaaaaaaabbffffffff0000aaaaaaaaaaaaff00ffff00ff9e0000009e000000d600000063707500000000000000000000000000000000000000000000000000000000000800000000000000990f000000000000736e6174000000000000000000000000000000000000000000000000000000001000000000000000ffffffffffff0000fcffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000001000000ffffffff0100000000000000300000006607697036741835c0e18d274ed00000000074756e6c30000000000000000000000079616d3000000000000000000000000073797a6b616c6c657231000000000000ffffffffffff000000ffffffffffffffffffffffffffffff3e010000ee01000026020000617270000000000000000000000000000000000000000000000000000000000038000000000000002000000d000b0000ac1414aaffffffff00000001000000fffa5914f96627a50000ffffff4a29edde1548ff00ffffffff800800000000000072617465657374000000000000000000000000000000000000000000000000004800000000000000626373663000000000000000000000006272696467653000000000000000000000000300050000000600000000000000070000000000000001000080000000001f000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000de3fe4401f5a0000ffffffff000000004e464c4f4700000000000000000000000000000000000000000000000000000050000000000000000080000007000100010000009d83a567bce36a0f0ee77e422bbf49b93c248afcad7779f033dc1632afffd19080c0869fbb1607656f55619c7c15eef44fd37dd3a206713d380f7d6ab9be806200000000736e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000fcffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ffffffff010000000f0000004100000002016e7230000000000000000000000000007369743000000000000000000000000073797a6b616c6c6572310000000000007663616e300000000000000000000000ffffffffffffffff00000000aaaaaaaaaabbffffff000000260100005e010000960100006d61726b5f6d0000000000000000000000000000000000000000000000000000180000000000000006000000000000000000000000000000020300000000000069703600000000000000000000000000000000000000000000000000000000005000000000000000ff020000000000000000000000000001ff020000000000000000000000000001ffffffffffffff00ffffff00ffffffffff00000000023f40104e234e204e244e2200000000736e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa000010000000000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000003000000ffffffff01000000030000002000000000006272696467655f736c6176655f31000065727370616e3000000000000000000069705f7674693000000000000000000076657468315f746f5f626f6e640000000180c200000200ffff00ff000180c200000effffff000000ce000000060100003e010000766c616e000000000000000000000000000000000000000000000000000000000800000000000000030003000a17010063707500000000000000000000000000000000000000000000000000000000000800000000000000ffffff7f000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000000000000000000fcffffff00000000736e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa190000ffffffff00000000"]}, 0x6fd) [ 413.434211] binder: 14516:14522 unknown command 25344 [ 413.455300] binder: 14517:14526 ioctl c0306201 0 returned -14 [ 413.467158] binder: 14516:14522 ioctl c0306201 20000040 returned -22 [ 413.493401] binder: 14516:14534 unknown command 0 14:15:07 executing program 2: r0 = accept4$x25(0xffffffffffffffff, &(0x7f0000000040), &(0x7f0000000080)=0x12, 0x800) ioctl$sock_inet_SIOCGIFNETMASK(r0, 0x891b, &(0x7f00000000c0)={'irlan0\x00', {0x2, 0x4e24, @remote}}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = fcntl$dupfd(r1, 0x0, r1) bind$bt_rfcomm(r2, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$P9_RXATTRWALK(r2, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) 14:15:07 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f0000000080)={0x4, &(0x7f0000000040)=[{}, {}, {}, {}]}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) [ 413.501885] binder: 14517:14526 unknown command 0 [ 413.523680] binder: 14516:14534 ioctl c0306201 20000180 returned -22 [ 413.538613] binder: 14517:14526 ioctl c0306201 20000180 returned -22 14:15:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@'], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) 14:15:07 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r1 = socket$kcm(0xa, 0x122000000003, 0x11) r2 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x5a, 0x10000) setsockopt$inet_sctp_SCTP_RECVNXTINFO(r2, 0x84, 0x21, &(0x7f0000000140)=0x4, 0x4) setsockopt$sock_attach_bpf(r1, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r1, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) 14:15:07 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:15:07 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) r2 = geteuid() getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000080)={0x0, 0x0, 0x0}, &(0x7f00000000c0)=0xc) write$FUSE_CREATE_OPEN(r1, &(0x7f00000001c0)={0xa0, 0x0, 0x6, {{0x5, 0x1, 0x6, 0x401, 0x7, 0x8, {0x4, 0xd9, 0xc000000000000000, 0x3, 0x3f, 0x1, 0x770, 0x1, 0xae9, 0x8f, 0x2ad, r2, r3, 0x0, 0x9}}, {0x0, 0x12}}}, 0xa0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) ioctl$SG_SET_FORCE_PACK_ID(r1, 0x227b, &(0x7f0000000040)=0x1) 14:15:07 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) r4 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/qat_adf_ctl\x00', 0x4000, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$CAPI_GET_MANUFACTURER(r1, 0xc0044306, &(0x7f0000000040)=0x6) getsockopt$inet_pktinfo(r4, 0x0, 0x8, &(0x7f0000000340)={0x0, @remote, @initdev}, &(0x7f0000000380)=0xc) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000003c0)={'lo\x00', r5}) ioctl$SNDRV_SEQ_IOCTL_DELETE_QUEUE(r4, 0x408c5333, &(0x7f0000000280)={0x5, 0xffffffffffffffff, 0x0, 'queue0\x00', 0x401}) ioctl$FS_IOC_GETFSLABEL(r0, 0x81009431, &(0x7f0000000180)) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0x30b) [ 413.687162] binder: 14544:14547 unknown command 4219648 [ 413.692908] binder: 14544:14547 ioctl c0306201 20000040 returned -22 [ 413.732294] binder: 14544:14547 unknown command 0 [ 413.744801] binder: 14544:14547 ioctl c0306201 20000180 returned -22 [ 413.746793] binder: 14554:14557 ioctl c0306201 0 returned -14 [ 413.773851] binder: 14554:14557 unknown command 0 [ 413.802448] binder: 14554:14557 ioctl c0306201 20000180 returned -22 14:15:07 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x28}}, 0x0) 14:15:07 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_dev$media(&(0x7f0000000280)='/dev/media#\x00', 0x45d3, 0x200201) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r3 = socket$kcm(0xa, 0x122000000003, 0x11) r4 = syz_open_dev$cec(&(0x7f00000000c0)='/dev/cec#\x00', 0x3, 0x2) ioctl$DRM_IOCTL_RES_CTX(r0, 0xc0106426, &(0x7f00000001c0)={0x6, &(0x7f0000000140)=[{}, {}, {}, {0x0}, {}, {}]}) ioctl$DRM_IOCTL_GET_SAREA_CTX(r4, 0xc010641d, &(0x7f0000000240)={r5, &(0x7f0000000200)=""/13}) setsockopt$sock_attach_bpf(r3, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r3, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) 14:15:07 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$FS_IOC_MEASURE_VERITY(r1, 0xc0046686, &(0x7f0000000040)={0x3, 0x9c, "802911b6bb47cb741597e1186d93aba3b9cd1ffd6163178ac5756e688c878b7fee94c479327846c3a36396f5d299034f973df540f8eb5ca2c4d1fa9a0e0e9d8a6d4ec3ea6a8e489acc05184bbaac17fac6b289531730e5841f7de08b0f28985bdcb9a716e0e10527070abba810faab43f85e62fd24d7dcab98aabdb00e2ff7aa849b6819dfbd5a5ac0bc9846e277f1058d63eb8173476f9274108ff2"}) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) 14:15:07 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) ioctl$UI_BEGIN_FF_ERASE(r1, 0xc00c55ca, &(0x7f0000000040)={0xb, 0x1, 0x28000}) 14:15:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@'], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) 14:15:07 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) [ 414.245660] binder: 14566:14573 ioctl c0306201 0 returned -14 [ 414.258397] binder: 14569:14576 unknown command 4219648 [ 414.267632] binder: 14566:14573 unknown command 0 [ 414.273014] binder: 14569:14576 ioctl c0306201 20000040 returned -22 [ 414.279640] binder: 14566:14573 ioctl c0306201 20000180 returned -22 [ 414.287781] binder: 14569:14576 unknown command 0 14:15:07 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xfff, 0x0, 0x2, 0xfffffffffffffffc, 0xffffffffffffffd8, 0x3}, 0x100000000000}, 0xa) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) write$P9_RLOCK(r1, &(0x7f0000000040)={0x8, 0x35, 0x1}, 0x8) getsockopt(r0, 0x800, 0x3de5b9a, &(0x7f00000001c0)=""/101, &(0x7f0000000140)=0x65) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000080), 0x106, 0xf}}, 0x20) ioctl$NBD_SET_BLKSIZE(r1, 0xab01, 0xb0) ioctl$sock_rose_SIOCRSCLRRT(r1, 0x89e4) 14:15:07 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:15:07 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)) openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/kvm\x00', 0x80, 0x0) r0 = openat$cachefiles(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/cachefiles\x00', 0x24800, 0x0) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vsock\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x1000000400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r2 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r2, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r2, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) fallocate(r0, 0x10, 0x3, 0x6f6) 14:15:07 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) [ 414.296131] binder: 14569:14576 ioctl c0306201 20000180 returned -22 14:15:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@'], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) 14:15:08 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) mq_notify(r1, &(0x7f0000000100)={0x0, 0x1e, 0x4, @thr={&(0x7f0000000040)="a2c90214ea499daed1b245b1402e668843a38631399885806fbed9fece086c14fcec53d3173badd753cfde8935a3b81a0a0212bf7ef66a622d211945e575307dd076d4ab302d528cc57edeee48480fdbee0cec561ffb405b1756d1e956a187faf4759487f16ba4bb2e8011f797a206a8ae30e82552cdd5331dbf856d521480bdb5b9ee6f474df6cc73d5ac0e", &(0x7f00000001c0)="66528bea45ce878853fc8054bec6b0be991c1fb90692a9c9d05b31b90837e9e541a176f76ff4237e2d1e79824a49bbce3e21d8ab30c033e2a42a084c6034f428d7f06fc990ca770a6546a0fb9dcb0c196c608e1e057a7326b1c88d136cb56bb158defaaf4c6cf07ee85c85113ca475a23a83171342ac8df92318b791141bde447e647f759abfa7f9abdec85cc94da84745459efe47edd1df68f760c46761ba8adf5b6b7ec8e4a62da272a4003921e699fa1f5d4bd81ec133ffc4ef5f51e038b160e7d54378e057"}}) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) [ 414.386495] Unknown ioctl 35090 [ 414.406033] binder: 14584:14594 unknown command 0 [ 414.408650] Dead loop on virtual device ip6_vti0, fix it urgently! [ 414.438816] binder: 14584:14594 ioctl c0306201 20000180 returned -22 [ 414.449298] binder: 14590:14596 unknown command 4219648 [ 414.450606] Unknown ioctl 35090 [ 414.474307] Dead loop on virtual device ip6_vti0, fix it urgently! [ 414.475835] binder: 14590:14596 ioctl c0306201 20000040 returned -22 [ 414.505145] binder: 14590:14596 unknown command 0 [ 414.526192] binder: 14590:14596 ioctl c0306201 20000180 returned -22 14:15:08 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x28}}, 0x0) 14:15:08 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) getsockopt$inet6_dccp_buf(r1, 0x21, 0xf, &(0x7f0000000040)=""/114, &(0x7f00000000c0)=0x72) 14:15:08 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) setsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f0000000040)=0x20, 0x4) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) ioctl$PPPIOCGFLAGS1(r1, 0x8004745a, &(0x7f0000000080)) 14:15:08 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:15:08 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r1 = socket$kcm(0xa, 0x122000000003, 0x11) sendmsg$kcm(r1, &(0x7f0000000140)={&(0x7f00000001c0)=@vsock={0x28, 0x0, 0x2711}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000240)="6ceafc1898b6c1a6dc6e40b9a7cb6bb489d250f8b7d39f87ac3a7db1542cbd558c9b024094836a2fdae3c5654bcc7668425ca987938d2105b4f0aac9e0980106a2e5bbdf9b8253b7273ac0ee6f0edcfc8dd8f30e4bb23107824168276b855fb168acdea03ec1c2cb3f049397f10c36e840a5d33d071d2b2341fc1a5e36dac3b774508f0fdeafa4a61d8ed1ee59655228d66f2bad1035e2f9e38017e26cfaea75f7737bf2385c39b7d062153df4cba1f8a40b470079609b8ae0b812b0483d585a10b1d4fed8722c44d9fb0637fae9684eadc7e22e46bc2425881dddb42606d1becf1dd21855c31299c8f3605e", 0xec}, {&(0x7f00000003c0)="f94246af3136aaf382e030e1cb7e4b9da8e708947db12f858f17e69e7a0e92d7e6b276594bd16cb376fbe10049fac8366b388cbefb750fa5ade087b4783d080cea53ba4a72b4397f2b69a8276a28e2a935ecb4a71ea6c6fa64e4a875a26d30f60b19564d3061c8a1d5c6e9129dea40499dc86c25424443bf25abac86c305de34887ee5f78c498aa853c52e50183e703853707772062dee11a65bf789b5efcf0159f5e2b43ffaa53a193f8f75ae96721fbbcc9795470bf1cc0f0214e881fe769bc0d3dddeb8dbf546bf38354fe9c9beb196f12d591d0f33dac252a77054f4c6e5ca912d3d46f25ad22791e6e4892903a141e9275dffb6f367405f68ad18c1", 0xfe}], 0x2}, 0x8000) setsockopt$sock_attach_bpf(r1, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r1, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) 14:15:08 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) 14:15:08 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) 14:15:08 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) [ 415.152461] binder: 14609:14615 unknown command 0 [ 415.161561] binder: 14611:14614 unknown command 0 [ 415.163194] Dead loop on virtual device ip6_vti0, fix it urgently! [ 415.173365] binder: 14611:14614 ioctl c0306201 20000180 returned -22 [ 415.176670] binder: 14609:14615 ioctl c0306201 20000180 returned -22 14:15:08 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write(r0, &(0x7f0000000040)="87ccb68c4cee8ce9bc50a1a77379a891d5ece1446d3b5d484d10c7c84675bfbb83398cc1af871261d940841327b9dca424dd0529476fe4ec3a62ad110b9bdf5c8ee027241b8447446eba6bcbb23b1e31252c7d4b78286f07a1f4f17b065b5671b0d67d959283343cca0f47cafe0c600b55cbdcce5a7e4b90635df6ebb642f5da23ed72c1d6803d0f96b103d41228ad73d06b022036de0008baed212914b81454098ac63f781f5cb29a2cd54c68f37d2ae8af1af90e310455f01413ac2003cd6041daec12f4c9433aea6e1564e9df2ef51e259b1d2fe655dbc02747d797db061b0a61efcd4e68a616da865f5b1c61785493cca307", 0xf4) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) 14:15:08 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) 14:15:08 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r1 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r1, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r0, &(0x7f0000000000)={&(0x7f00000001c0)=@rc={0x1f, {0xe00, 0xfffffffffffffffa, 0xcdc3, 0x4, 0x9, 0x81}, 0x9}, 0x80, &(0x7f00000000c0), 0x20e, 0x0, 0xfffffffffffffced}, 0x20000) 14:15:08 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, &(0x7f0000000040)={0x0, 0x200}, &(0x7f00000000c0)=0x8) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(r1, 0x84, 0x6c, &(0x7f0000000100)={r2, 0x6, "391d843d9aa5"}, &(0x7f0000000140)=0xe) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$P9_RXATTRWALK(r1, &(0x7f0000000080)={0xf, 0x9}, 0xf) ioctl$KDADDIO(r1, 0x4b34, 0x4) [ 415.289441] binder: 14627:14632 unknown command 0 [ 415.327076] binder: 14634:14639 unknown command 0 [ 415.335163] binder: 14627:14632 ioctl c0306201 20000180 returned -22 [ 415.372592] binder: 14634:14639 ioctl c0306201 20000180 returned -22 14:15:09 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, 0x0, 0x0) 14:15:09 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/policy\x00', 0x0, 0x0) r3 = syz_open_dev$dspn(&(0x7f0000000080)='/dev/dsp#\x00', 0x8, 0x109001) ioctl$sock_inet6_tcp_SIOCOUTQNSD(r3, 0x894b, &(0x7f00000000c0)) 14:15:09 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:15:09 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x9}, 0x20) r1 = socket$kcm(0xa, 0xfff, 0x11) setsockopt$sock_attach_bpf(r1, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r1, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) 14:15:09 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x2, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}, 0x4}, 0xa) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) getsockopt$inet6_tcp_buf(r1, 0x6, 0x3d, &(0x7f00000001c0)=""/105, &(0x7f0000000240)=0x69) ioctl$EVIOCGMASK(r1, 0x80104592, &(0x7f0000000140)={0x17, 0xfb, &(0x7f0000000040)="fae358a53078f10a16e0fd1d0e46a5f84f7a8dca7f125922e4ed55819d64a6c5a2689f0b885b8ebbbcdb1a58d28ecec57b87ace65aff1e2831de3f4ddfacda9839c55429e9ea2dc17e0676540ae76742a73bcb0cd452405b01989155ea2ac31909d190aa948b4a1b9db1a58ebd13cd14033c8a6194ea9a7221683b73be5125f9aa919bb60b6c50a3bfc74bcd2fbd31468665bfa19ddb4a68f2c80d5248cd06941f333cc65892bcfbecea5b7b51e69f76396a5ab7a760c682722dd6061ac8bf3c9acaffc726eb676ae708e3c1fd561b575180f3722f2875adb09302ba7243034a6343fd8c6a571b8e80ad97de7f1f2fc839d74a87bcf76e89e13ca6"}) 14:15:09 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) 14:15:09 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) r2 = geteuid() getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f00000001c0)={{{@in=@multicast2, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in6=@mcast1}}, &(0x7f00000000c0)=0xe8) r4 = getegid() r5 = getegid() getresgid(&(0x7f0000000100), &(0x7f0000000140), &(0x7f00000002c0)=0x0) setxattr$system_posix_acl(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='system.posix_acl_default\x00', &(0x7f0000000300)={{}, {0x1, 0x4}, [{0x2, 0x7, r2}, {0x2, 0x1, r3}], {0x4, 0x2}, [{0x8, 0x1, r4}, {0x8, 0xb4937531c7afa423, r5}, {0x8, 0x5, r6}], {0x10, 0x2}, {0x20, 0x2}}, 0x4c, 0x2) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) 14:15:09 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) [ 416.055911] binder: 14656:14659 unknown command 0 [ 416.070471] binder: 14656:14659 ioctl c0306201 20000180 returned -22 [ 416.091485] binder: 14655:14662 unknown command 0 [ 416.096366] binder: 14655:14662 ioctl c0306201 20000180 returned -22 14:15:09 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) 14:15:09 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r2 = socket$kcm(0xa, 0x122000000003, 0x11) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x90400, 0x0) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f0000000140)={0x0, 0x3a08, 0x4}, &(0x7f00000001c0)=0x8) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r3, 0x84, 0x70, &(0x7f0000000200)={r4, @in={{0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}}, [0x6, 0x0, 0x0, 0xffff, 0x101, 0x2a4, 0x10000, 0x8, 0x80, 0x7, 0x2, 0x9, 0xffffffffffffffff, 0x1, 0x7]}, &(0x7f0000000300)=0x100) setsockopt$sock_attach_bpf(r2, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r2, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) 14:15:09 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) r3 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r3, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f00000000c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'lrw-twofish-3way\x00'}, 0x58) open$dir(0x0, 0x0, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000500)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[]) perf_event_open(&(0x7f0000000240)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = socket$vsock_stream(0x28, 0x1, 0x0) set_mempolicy(0x8003, &(0x7f00000002c0)=0x1003, 0x4) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_THP_DISABLE(0x29, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) timer_create(0x7, &(0x7f0000000140)={0x0, 0x31, 0x1}, &(0x7f00000001c0)=0x0) timer_gettime(r8, &(0x7f0000000200)) ioctl$VIDIOC_S_PARM(r1, 0xc0cc5616, &(0x7f0000000300)={0xc, @raw_data="1b9cb81d88a9198ff528be6bf7311630d46588849c6216627bcfdff54d7b8856ea5b509fa8df958b9f8aca2ddac3ac052925803301be7acf1769775996c6fb177ab8c704d1df07408e62df553bbe39c3d011a85594fb362f56331c209537efa0758d465cf96bd4bc20d198f43316a9e7e1f8d3a978bb3676b40011b5f10b3c57948e19d86af3d89689f356546e7eecddf1d621e8922a5552acf1df1a14c1c01bf7b40f6c18bd59418fd7104620e885786ae910015ae248aa8d35d6043dab8603c9dc4d9104a894d0"}) socket$netlink(0x10, 0x3, 0x1) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r5, 0x28, 0x1, &(0x7f0000000040), 0x8) dup2(r3, r4) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) 14:15:09 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r1, 0xc1205531, &(0x7f0000000040)={0x9, 0xfffffffffffffff8, 0xfff, 0x20, [], [], [], 0x7, 0x7, 0x4bb3, 0xffffffffffff7fff, "6a65db3d92b4070857fa9f4bbb7bee86"}) [ 416.213606] binder: 14672:14681 unknown command 0 [ 416.248160] binder: 14672:14681 ioctl c0306201 20000180 returned -22 14:15:10 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, 0x0, 0x0) 14:15:10 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) 14:15:10 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r1 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r1, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r1, &(0x7f00000000c0)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x8000) r2 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x7, 0x400) syncfs(r0) setsockopt$RDS_RECVERR(r2, 0x114, 0x5, &(0x7f0000000140)=0x1, 0x4) 14:15:10 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) chdir(&(0x7f0000000040)='./file0\x00') write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) 14:15:10 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:15:10 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) accept4(r1, 0x0, &(0x7f0000000040), 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$KVM_GET_PIT(r1, 0xc048ae65, &(0x7f0000000080)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$TUNSETLINK(r1, 0x400454cd, 0x313) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400204) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) 14:15:10 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) 14:15:10 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) 14:15:10 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$MON_IOCQ_RING_SIZE(r1, 0x9205) vmsplice(r0, &(0x7f0000000140)=[{&(0x7f0000000040)="eb317053fd7491fd8bcbfe250a16b56e95e8826f4e99abdbb352bb937e6d2ba4cd3c6a09f65ccdda735eafbb87", 0x2d}, {&(0x7f0000000080)="2038d607a890f1d9729fe3629cd91b37aacb2b", 0x13}, {&(0x7f00000000c0)="d8a66ef0c29b355d5a4c908ec0b5b846f38557cb848a16b7017c643e240090eb2d57bf162ee542f4b557b7182bcd6398f6d85dbcb03b5ae4b6e8cb953a3ae56e0cd6ada76b23ff34625b2746caaec0b697695d86a52099fb8732e9ba57fa1cdec4640a727394b787088044532048f33887f8e1d635fc", 0x76}], 0x3, 0x2) r2 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r2, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$P9_RXATTRWALK(r2, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) [ 416.986016] binder: 14704:14714 unknown command 0 [ 416.997863] net_ratelimit: 3 callbacks suppressed [ 416.997870] Dead loop on virtual device ip6_vti0, fix it urgently! [ 417.003090] binder: 14704:14714 ioctl c0306201 20000180 returned -22 14:15:10 executing program 0: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r0 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r0, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r0, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) 14:15:10 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:15:10 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) [ 417.168422] Dead loop on virtual device ip6_vti0, fix it urgently! [ 417.198637] binder: 14732:14737 ioctl c0306201 0 returned -14 [ 417.207447] binder: 14733:14738 unknown command 0 [ 417.214116] Dead loop on virtual device ip6_vti0, fix it urgently! [ 417.220907] binder: 14733:14738 ioctl c0306201 20000180 returned -22 14:15:11 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, 0x0, 0x0) 14:15:11 executing program 2: pipe(&(0x7f0000000040)) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) 14:15:11 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) bind$bt_rfcomm(r1, &(0x7f0000000040)={0x1f, {0x200, 0x9, 0xfffffffe0, 0x5, 0x80000001, 0x81}, 0x547d}, 0xa) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) 14:15:11 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 14:15:11 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:15:11 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$vcsa(&(0x7f00000000c0)='/dev/vcsa#\x00', 0x1, 0x40000) write$FUSE_NOTIFY_STORE(r1, &(0x7f0000000140)={0x2b, 0x4, 0x0, {0x3, 0x80000000, 0x3, 0x0, [0x0, 0x0, 0x0]}}, 0x2b) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r2 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r2, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r2, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) 14:15:11 executing program 2: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x10001, 0x0) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000240)={r0, &(0x7f00000001c0)="9887060e7cc682a91912ae8ffef45c36fed2a1aaa85c6b8ddd4e1425e4198af314946ffdcc1b90f9a43cdc565fa09709dd4064319f86093187bab6", &(0x7f0000000200)=""/55}, 0x18) getsockopt$inet6_tcp_int(r0, 0x6, 0x17, &(0x7f0000000100), &(0x7f0000000140)=0x4) fsync(r0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = fcntl$dupfd(r1, 0x2000000000000, r1) write$P9_RREMOVE(r2, &(0x7f0000000040)={0x7, 0x7b, 0x1}, 0x7) fcntl$F_SET_RW_HINT(r0, 0x40c, &(0x7f0000000280)=0x7) bind$bt_rfcomm(r2, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$P9_RXATTRWALK(r2, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) ioctl$UFFDIO_WAKE(r2, 0x8010aa02, &(0x7f0000000080)={&(0x7f0000ffc000/0x3000)=nil, 0x3000}) 14:15:11 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$l2tp_PPPOL2TP_SO_LNSMODE(r1, 0x111, 0x4, 0x1, 0x4) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xf7ffffffffffffff, 0x8000, 0x0, 0x0, 0x5}, 0xffffffffffffffe1}, 0xa) 14:15:11 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/vcs\x00', 0x1, 0x0) ioctl$VIDIOC_S_TUNER(r2, 0x4054561e, &(0x7f0000000400)={0x6, "63cba0aaf9ab0f276c6a4ee7c461c4ef80ba0ec461b7a7f2046872c74587e268", 0x2, 0x10, 0x8, 0x5, 0x4, 0x2, 0xffffffffffffff2e, 0x3c}) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r3 = socket$kcm(0xa, 0x122000000003, 0x11) r4 = syz_open_dev$amidi(&(0x7f00000002c0)='/dev/amidi#\x00', 0x67, 0x4000) ioctl$KVM_ASSIGN_SET_MSIX_NR(r4, 0x4008ae73, &(0x7f0000000300)={0x3, 0x8}) fcntl$F_SET_RW_HINT(r0, 0x40c, &(0x7f0000000140)=0x1) setsockopt$sock_attach_bpf(r3, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r3, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) r5 = openat$selinux_status(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/status\x00', 0x0, 0x0) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000340)={0x8, 0x2, 0x2, 0xf1, 0xffffffffffffffc0, 0x8}) ioctl$VIDIOC_G_FMT(r5, 0xc0d05604, &(0x7f00000001c0)={0xb, @raw_data="94f31acfd94f613f529a996b5f45519d829fc22d5e2e14daecbb91aaf314a09be2fcad877b6ff2dac68fdf232b5ef5bc7e8ee9c6305739a5cc8eb3d86e0ca82e9a44fceffa8ce122186324234c659d682505103719ba02ea23b962a3fbd72e40323ce6a6e9643ec7a722f186b514e40ab22f531769aeca98504de2b2134923f5753011733ccf6037c231af407f2b106cb00e37f80e465cdf5f01a8ee5fa9f84991ae6c819e406e8c485c07b642fb026c57d882114ec79eb8161b86742b8ebc142d07637ebd88e4ad"}) [ 417.896510] Dead loop on virtual device ip6_vti0, fix it urgently! [ 417.907641] binder: 14747:14752 unknown command 0 [ 417.923329] binder: 14746:14756 ioctl c0306201 0 returned -14 [ 417.938970] binder: 14747:14752 ioctl c0306201 20000180 returned -22 14:15:11 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 14:15:11 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socket$pptp(0x18, 0x1, 0x2) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0x8, 0x1ff, 0x2, 0x10000}}, 0xa) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) 14:15:11 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) [ 418.093682] binder: 14774:14777 ioctl c0306201 0 returned -14 [ 418.135331] binder: 14778:14782 unknown command 0 [ 418.140374] binder: 14778:14782 ioctl c0306201 20000180 returned -22 14:15:12 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) 14:15:12 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) getsockopt$IP_VS_SO_GET_INFO(r2, 0x0, 0x481, &(0x7f0000000080), &(0x7f00000000c0)=0xc) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400201) clock_gettime(0x6, &(0x7f0000000040)) setitimer(0x2, &(0x7f0000000100)={{0x0, 0x2710}}, &(0x7f0000000140)) ioctl$NBD_SET_TIMEOUT(r1, 0xab09, 0x9) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) 14:15:12 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) r1 = syz_open_dev$adsp(&(0x7f00000002c0)='/dev/adsp#\x00', 0xe9f, 0x101000) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000280)={r1, 0x0, 0x0, 0x1}, 0xfffffffffffffef0) r2 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./file0\x00', 0x4200, 0x48) ioctl$DRM_IOCTL_AGP_ACQUIRE(r2, 0x6430) r3 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r3, 0x29, 0x24, &(0x7f0000001480), 0x4) ioctl$VIDIOC_S_JPEGCOMP(r1, 0x408c563e, &(0x7f00000003c0)={0x10000, 0x1, 0x1d, "9bb5a8ce5190fd44ae298c31de40248eaaa903d39e050713d0be91a604316b82ae5d37fcfc5da611f3c29a529ef46ee92efcddbf98fa9055741c720e", 0x31, "4266a8c561dff242ad7c8da3a5804736af655884d35f9819d66cf5951ab0ed797a19eab7de5a85d08607052f58a851da5b6a0f80ec9a1d818660024d", 0x8}) ioctl$PPPIOCGDEBUG(r2, 0x80047441, &(0x7f0000000140)) ioctl$DRM_IOCTL_AGP_ACQUIRE(r3, 0x6430) sendmsg$kcm(r3, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) 14:15:12 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$P9_RLINK(r1, &(0x7f0000000040)={0x7, 0x47, 0x7}, 0x7) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) 14:15:12 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 14:15:12 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x2, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) [ 418.837466] binder: 14790:14794 unknown command 25344 14:15:12 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r1 = socket$kcm(0xa, 0x5, 0x11) sendmsg$kcm(r1, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) 14:15:12 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 14:15:12 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) setsockopt$RDS_GET_MR_FOR_DEST(r1, 0x114, 0x7, &(0x7f00000000c0)={@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @empty}, 0x1, 0x2, 0x1, 0x3}}, {&(0x7f0000000040)=""/32, 0x20}, &(0x7f0000000080), 0x20}, 0xa0) 14:15:12 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet_MCAST_JOIN_GROUP(r1, 0x0, 0x2a, &(0x7f0000000040)={0xff, {{0x2, 0x4e22, @loopback}}}, 0x88) ioctl$sock_inet_SIOCGIFPFLAGS(r2, 0x8935, &(0x7f00000001c0)={'team0\x00', 0x2}) ioctl$VT_DISALLOCATE(r1, 0x5608) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) getsockopt$bt_l2cap_L2CAP_OPTIONS(r1, 0x6, 0x1, &(0x7f0000000100), &(0x7f0000000140)=0xc) write$selinux_context(r1, &(0x7f0000000180)='system_u:object_r:devicekit_var_run_t:s0\x00', 0x29) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x9) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) [ 418.866869] binder: 14790:14794 ioctl c0306201 20000040 returned -22 [ 418.882576] binder: 14790:14794 unknown command 0 [ 418.898091] binder: 14790:14794 ioctl c0306201 20000180 returned -22 14:15:12 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 14:15:12 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x2, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) [ 419.068154] binder: 14819:14829 unknown command 25344 [ 419.092736] binder: 14819:14829 ioctl c0306201 20000040 returned -22 [ 419.111283] binder: 14819:14829 unknown command 0 [ 419.122789] binder: 14819:14829 ioctl c0306201 20000180 returned -22 14:15:13 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) 14:15:13 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cachefiles\x00', 0x10302, 0x0) getsockopt$packet_buf(r1, 0x107, 0x17, &(0x7f00000000c0)=""/112, &(0x7f0000000140)=0x70) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) ioctl$UFFDIO_WAKE(r1, 0x8010aa02, &(0x7f0000000080)={&(0x7f0000ffb000/0x2000)=nil, 0x2000}) 14:15:13 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/snapshot\x00', 0x40000, 0x0) ioctl$RTC_RD_TIME(r1, 0x80247009, &(0x7f0000000300)) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer\x00', 0x6040, 0x0) setsockopt$bt_hci_HCI_TIME_STAMP(r2, 0x0, 0x3, &(0x7f0000000140)=0x800, 0x4) r3 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r3, 0x29, 0x24, &(0x7f0000001480), 0x4) getsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(r2, 0x84, 0xc, &(0x7f0000000240), &(0x7f0000000280)=0x4) sendmsg$kcm(r3, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) 14:15:13 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) syz_mount_image$gfs2(&(0x7f0000000040)='gfs2\x00', &(0x7f0000000080)='./file0\x00', 0x800, 0x5, &(0x7f00000012c0)=[{&(0x7f00000000c0)="7885e89ef3bb6a75c26e00060fba31e196923fa76820fef20584", 0x1a, 0xffffffffffffff81}, {&(0x7f0000000100)="6348491f32d57e53cc5088a210ad78169751dd5e403516f3bc8431d538f95d1f29159f6b2b216ffae96906165b41b2121e15761b0b6cb00a808276a2", 0x3c}, {&(0x7f0000000140)="4e398f1362cb556281e77f71b8590dde7886817ad37c524320fab8c349ec4f4418e3e28ab955447424c5c4956d14159345c5776c18a6790f14f4b0e7a8152367fd76dc98c09673bd2d8bc8818fbdd8ee6cc101451750542ae408ecbb47f5fedd3a4f1d3e0724973a98d35268c8ea023846a83c9e34139c1cac0431ae9c4939a6ff48736dacb95e254877e96989e633f27bf74514d4434691e8faae2b20178c9ae41221ea3d4c8853eaf6514abf80f6f90ed7e89f05c30dda62779b7d914153d0f41a8256ef485536e5fee50dac884ade5f0357c5bc4d892ea2103b8b6e4a18f4268ee38093bf923f6440261e73241f4567615122eb3c9db800c7", 0xfa, 0x1}, {&(0x7f0000000240)="bca8ecc2b44dc22dcbcdaabae495531ca89a0cdfe40b6be66468276735a2704bf386cf34f5b43aeb4e18910a208956daa8d972fa46bd2fd3c865ed2e97495f5cbd1ca4900ed93b46116de191abaf4d8af91c4eac93404bf67f5b9c17024d4e6e8cb335edcd3a78de6aa55107c130942ec060deb2d45f63d3264f4ea442f0aa6d5ffd484574391ae90f2e9e0c8d1774e3d750f512822f35e720b1114f10d195671c726773bd0970bd18240a84f68263c2b7af7fef4eda99352eaeeeb2a227cd41c5740b57936e89415050d7d2aceeeb2b7acde3b2fcd20965354cddf77398a8c43e7cb8a0b06d4b9ed0ea8c4acc26048c22dc4f6502da0ac54dde1ad9dd99e2b3686860dc1d1d334a3f6e54bb4c320ed6e703e15fa93e4a2ad80831f30304c8289afc665c67871b195f7bff794493e3a561e7435365caed33496e41a6a98bb5774aa3c2dc005c187086da8402a5b254cb0dc89d2707b1fedd9624a8d255a6fe87190c7f1902f5c13275f114f625e1c6d4f00686b140115b73972def3e56064877104b1934f648832997bbbc63b9d63670e5cb15efbe844d0f9af7d7b330f415ebc06f108b86405cc1afa241ce27fe3d5768618ab7c7e8ed78a9d46bff82d3bdb2dff5b7a48688726d889677d9b5db6e767e63a81ff3af1a8d72ffec210b52ed339ee87a9d10211b814e9ed5c42b66139f095251fbe64256454dfb0ba3d6660a17ad0c1a9bee56c50117989d9ad0d7a7b99b076d24eaf780abe6bd00960e1c2729593df329b4e024490fe5b5b93ee264cb7f5fb9b3e696292c54ebea4a9139ba7188e27a03e6a52f2d5a67e166c5eff316c96c8eff79b95cdf5c2028c40cf7891174fa8b5174c9decaaa41de8c68a8c2a72125ec64246edc269a9c584998952cb95bbf3b7b667afda98b28380fc8ace1f15083455ff1261c4b8f85ea54ad1932f48c8a5c24c8f9ca5f7d7c8882627e7e0e080e1ca4ccd136db1d4cb9441c756dca0a9d4f57f240c7581efbdb2d2f17027d12bea88b03ea5b98bcd73bb9ca5f48cd74c6a81d580e992abb100c7a398036c58394fafdcc46093b3260eee595c1cd2f1170c50f0557ff6e69577f01263929c1c62cfb6876888bf3af064a40c29e186c2da75e00927339d1fbbd8fad84f947a2f73defeffcbe455996eddd2852e7a6a24837006a213134f917e135b67095c5dc4dd8487dddf16b7c0c7441bfffa8a35c7e2948ac1cad049c4eb0db74f71ace701555593490bff4b7d2dc35e29130d15da4888254eb40873ca19a169ddd7b3a8da19e13a04654ae4718cdcee29b7d242b94135f46bc0996a22613878f0702e540bd2ab163d5c7d66183254ede296106981b88281e9a8e03abcc3142de25e2495dd0914f8f694db35e860d3a3133788e13c92cf29fd48613f354783af59000cf2e998ab566a1a61e342293c43d6f4e6cf734941f813d2907b9dd742f15e4d31836919b288df7f3cfa942d55602d5e3ec09b77ed081f0e8f5148a26df001b301496d0d6c652afad00abd0e7df9bff722de68a71da0010173f94f86bb2088e6586b0f49a33e7ac787782f522850b1d7bac72e8687436d3a2f28314a90f1196a7613e63ec4e32a49d58ea5a4e47ea911f4428ad087f0e14b508049d889673c5f5fc51bd5d3c68ea156cdc278be4a7d698edc3701ba1f946758109aef93394d18e94ed972313d9ff19e9f2c34ed8938790135a3a487c262db49181a262b2b787eb0827be08ec4d8c76b49e48257bdb74519ca41d0b0db50a67f73e87bf1d02de1469df960f8ce3c5f0d1a2783fcce70ec2f55cb8f5af7e606b059bb0aa1627bbee5d74055039ec527305240597b84b8b519d23d3e0f31acdbf4beda51e028619d761fec76009d46c4c81b1ebc6e0a96064fe895d78f31f6049d7bcbcdc62181b3637b17a856ea747195372f5e65147c95c959821b9a9383eace7e1d97523ab45473d739fe4d0eabe5f96a2895fead1b0af138fe5c2ece0a5dd6e54a8e9fccce3d8c13b659df77bcc5a0e9ef27ab0e85b6c974588bdc85d9a1f0f83bd5c42543c9b743b9bb8997febb1f28e7ef0b9323c75eb1317e0cf2f8604b538a39fc3d0ae550128b0937d0ce5226c645dd84544e85849acb0405cd88e14b256385ec35857aede3d4330ac530ab9ae0f0c55a1b8800340fdf3f65548ed5c92f8b500ced4e9f403b2866a59844536cc89c1ff893f88c28679fd2e6fd37a561fd2564875dd2dd5af6eb4236f5d67801ed1fbdf4f36ffa7ea2b2bb9ffdd5a7f40d62a25bb70aa3092971312df94c57e7df94f801ad166882d6c469a07acd04ed330e624fc351be29226344947a12b0e562ab63077f88f3251f5f17066c1d3b47321c969600502c546e366ac149c8da6893e3c8785fb3e11bf4cac409e08930bef070aa4833f4de11c8cdfbca575d611a104a6426860d0e90e5da30fef6c22dd3406388d024fd99eb34fff651273cddfee1086eb8954eff37dae312fa291c1ee2609ecf34c0b39e4a9060aeca947eefbf0dae21d0599f044724f58e52af2c98cc25d093fea734714f1d72006d05561d64f56468e945564fd4e3dfa02908639d7b86fec74b6102a90e94481ea7bfc492ef567f7d123ea2ec97acc7ac1d97ac45ebfa59018e12e4b6887813ab79dc4cd2c22b815f70dc9339f8c4b8dc2903f00cb1a2ea465a8d6bfc4fd33bc7f86591fd573d8c79e708887b80566062863146077fcfb48b9b790cff1311955fb44d20d55665ee7aa13c069004ea35c5acb75e56562451b9e9fa03276c23ad11be7e522e67de4ed5bec4c9be2793e4688f4e421bdf27b79c9eeaea80d5dad4173faadccb880be66225eb2ffed2d9911eb46b8513b3397fa82b76d2db02ee24c28ab6eecd08d18849cdba777d12a32c4d24a4366fe7fad3625714235657f0d08f16415a3bb1a404dc27226e8322808b7f0365659170ef2f50a5e43aa6526fed1770f76a8a53b154731b89e68733d9985dec20a10fc852dc6bb2a7b990d07bdfc2615e333736dccfb32d161318b667a7790ff8a206024d8b9e3cbf7be375112b5e647d676cc55db2d2da43098453dfa612b5201b03fa7ca203d7b9d5d3627ba897685ca957f49f7da98efb638b91c5cd354d89f514e2b9084a21bbdf0fb9862b63cef90f3635fb1c6366f06285fe208d4d8c7b734f5166408ea91072e2d08ae878d2a20f277e8a9acf1c17de0f9024f1ea734ce623fda4a27c627617745d194452688d45eda7a701f7f7ef57eedfcdb23eb303e79dbd897bd07db2988945d09ee69472054070225f09f85422c44c3221df75e87f3d8c252cd50124cc49c81286eca640335482795de7e5f4d362814572e7309d165cfaf2709933cf283127a47862e25b10500d6674acc541bbf0b5c60a32618df6ff5d0770be5a518762262878147e5606170b66b664d3930f40d744b15466d81ad2e3c414fe43ecfc1828abfe4dd279c30a5a69f9b4427aa67d802a17b63f04a295424d910bbc63b1fc03a57137019a6cb73074088916c4e5c7c472624477bef5c0d9104166e0c2ecb25929f875b32e78da8cdde02787219c034940fd6eaa18b97ee7330636381916f1113574a62794223c89ec2f43a869062c5e92eee119b6d39c020960ebf20b16c4127cef60ad15224f7bfc6f3a953770b02d2a392e34e69de47837ceede4d2e4f89f2049518a52a40739628742c02113af2369314b582b53f69df211895eb8dfe640b6180d9e2f5a2f2e833c4e53ab4c3ad443e19d0728baf84ae0d8dbc0f8a813f196452083bbc9a89351e397e0c8e4b9f2b1a77b79e3f787063ab75c490e4961b0b46c324bd1627e94483720782a643fe1b0f9da7e73898b5d36d5ac6c0c0b76f96ffc7914624bd9720200ce11df8c6863bb2e712fa3a07f04bc02354892b85ae8ffd0c6c1df2bcb1e8bf32bb9fa4740920f4cada5ce3263572ee1c7e16d04fe7ee1e865cb5360ae0e64dc9531aba4b8c6ee6ac2302cb904e58226510f8768cfb279f6adda18ed19972e6cc7ec648104e4afca7bdc205473b5bc8b085b082a514b05930bd0341e1c6f12f6eb05c2e2851d810accae6076a1abebeee9b8e7a560b877cb99c89e190b9dafea1978b6a7afb402e4cb0175bd17a8aa53aa00ec34821b732a861f0c793b2a99fac12fe3bce4461365cb08f2f955ddc036e4ccad02bccc799e4dcbbd488a005412ad512c60caa733abaccf622e5d6104e17aff906b8bd45a13ec258ec386f1d1e3aafe17fcc14cf3925e070b6198d0e2c05b2fa941b290dbcfacd735caabd5bb20d5d847d38faf9a54479eecb21f8f238a3708a6026ffc804d1f2768c89cdd50d3344287ea952886a8177a6de8b2fbaf709908e3a7a86e38156c5c9ce3f978ee1b4d25e54f3d3214ce6e6ccfe9c639d8955d8ad916ea3edd158daa450ad15195e40239e71b739248744d2489b3054f75493f042cc3f3ba92373260c09cf08dcb3f9752cf040403a758d5409c3a2b050e8bec148f7aca2ca36391d033b5391407d4f8e171ac51bc54915f6cbcf0e162f987df9414ec4c148f74e01dbcfa22b855030715d04c36160db4f6791fa3e67c11ed61662112b170cf3139cc29815ce0ad5335164bdb3fcfc5f72b04d0870e77caadb493a63bee5792141619d0b404fac48aa1140453346448574980debcc0d69d1769e411a994441bdca019015b4657c65402616cd5e420f66acb92a0e425d3a2fd4f305dfed3f5150fcc89b6375ac50c6d8278854c1b538ca935100d0be8a58b2353dfde40383d12db904d889af8522cf44f57d229b8f98b8acb5beca851f0436dc57f4ee58a557aae3f908537b16a2c0a7aeaa8d58ad21554675f19d57282b42c3f1ebb9eb68dfa4532fe3db5d14971c67840a5946f69e72f4fb234b77ae59f103ff11bc2f7675f6061937ac9500469d48da2769a09dd1f5c1350846e961ea74ecbeebb4104bdd1977d84922b4186663b56180dc0c6b4659a42bf893139f7345754215addf6a2fa4c16377e1ba1a8628bdda8409a7201bd5d2d19032691c531a9475e26b12fae028612f6c958bd14e93a789654ec50c7efc89c02475ecc5b493153a2ccf8ba4e44d2804a5637d5f7b74dfb673d1f3bc7977316c7eb4f184d95579d2bba37ece72339807adaa8e1a3c660fb9bb35dffd2815a7a7d0fa81a2bdc640ce55a42163936aab224147975a2d377a04d59d41e110d92189d79483360dab5136e825143b2f771b10443035e509e0142246df8d0cb5c68b202d7f3efa9dedf5141579fd33c8f74c994bd161900c9914a270c8f653feb9c84fb468018d55da8d8ba667a449c1451bce3ed84fc614e3e919ae2cf44ac06a6d819cebd304002424fe582d7fd7a27f77a8674c25531dc2d48d5cdbc8a4b4459b8c3286f8eab20422fe2849caf0176ad6ada0335eef6d838cf279a6cd72d52f90f329aafd4df025a9099a9165d10092984c593943f79ae7e579f7e0cc870456fe760c164bfa0957bd1a1932b66cddbbd9cf78bf049ecc8367ba17efeac254e6cba5f379b8f7ecb30451d4557921baf31638bc855ffd08fded569cb4e630ca4023d53184a5d28a012b7fe4c2dc93320ca1bded4d40d3fde6d3da8aa9db4c06c3c91be102bb8d983f1d110749625e3a6ecb64a9dd0460cae1e27336b00895ec74ac0b64d1f065c7e9f10891c96e4efee1b2d1a2307ea34efc883818fe15c59e07bb0d6b96007a08d7d4d5d29a94d4ef1499515cf9006a2167a82e579f231e49967b9af3defb7e4420c2e6498b513d9abb5ed338c8873e87fbde4a67c8e69ce5d9", 0x1000, 0x1}, {&(0x7f0000001240)="5a4278a68af1aa8b4c08d916dec264b1a6862ae6a7fcac2ba5bd91df6cd8b73c0f2afa26d74bfc2bc5b97558c730d122c7314223c052d242af8c6902e1dc57b961f94a2629e9caebb615383b7f4b078b933d6a9f9962f81d43b33bada94a13911e371a", 0x63, 0x5}], 0x80, &(0x7f0000001340)=ANY=[@ANYBLOB='norgrplvb,locktable=,proc,noacl,data=ordered,smackfstransmute=%vboxnet0#},fscontext=user_u,subj_typc=,measure,\x00']) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) 14:15:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000), 0x0, 0x0, 0x0}) 14:15:13 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x2, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) [ 419.768224] gfs2: invalid mount option: locktable= [ 419.777154] gfs2: can't parse mount arguments [ 419.784350] Dead loop on virtual device ip6_vti0, fix it urgently! [ 419.786496] binder: 14838:14846 unknown command 25344 14:15:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000), 0x0, 0x0, 0x0}) 14:15:13 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r1 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r1, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r1, &(0x7f00000000c0)={&(0x7f0000000040)=@ipx={0x4, 0x7, 0xbde, "146bf59b5a51", 0xd257}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x27}], 0x1, 0x0, 0xffffffffffffff27}, 0x0) 14:15:13 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) socket$l2tp(0x18, 0x1, 0x1) [ 419.815752] Dead loop on virtual device ip6_vti0, fix it urgently! [ 419.824906] binder: 14838:14846 ioctl c0306201 20000040 returned -22 [ 419.856143] binder: 14838:14854 unknown command 0 [ 419.866903] binder: 14838:14854 ioctl c0306201 20000180 returned -22 14:15:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000), 0x0, 0x0, 0x0}) [ 419.890802] gfs2: invalid mount option: locktable= [ 419.895760] gfs2: can't parse mount arguments 14:15:13 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) sendmsg$nl_crypto(r1, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200002}, 0xc, &(0x7f00000001c0)={&(0x7f0000000080)=@getstat={0xe0, 0x15, 0x10, 0x70bd28, 0x25dfdbff, {{'morus1280-avx2\x00'}, [], [], 0x400}, ["", ""]}, 0xe0}, 0x1, 0x0, 0x0, 0x40000}, 0x14) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000240)=[@in6={0xa, 0x4e24, 0x7, @mcast2, 0x8}, @in6={0xa, 0x4e24, 0x7, @loopback, 0x4}, @in6={0xa, 0x4e22, 0xb1, @initdev={0xfe, 0x88, [], 0x0, 0x0}}, @in={0x2, 0x4e21, @multicast1}, @in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0xf}}], 0x74) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) 14:15:13 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) [ 420.054219] binder: 14875:14879 unknown command 4219648 [ 420.074154] binder: 14875:14879 ioctl c0306201 20000040 returned -22 [ 420.085655] binder: 14875:14879 unknown command 0 [ 420.096979] binder: 14875:14879 ioctl c0306201 20000180 returned -22 14:15:14 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) 14:15:14 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)) select(0x40, &(0x7f00000000c0)={0x10001, 0x1, 0x36, 0xf8, 0x4, 0x282, 0xf431, 0x8}, &(0x7f0000000100)={0x100000001, 0x2, 0x1, 0x1, 0x4, 0xfffffffffffff908, 0xfffffffffffffffb, 0x7}, &(0x7f0000000140)={0xffffffffffffff01, 0x9, 0x4, 0x0, 0x5, 0x3, 0x4, 0x8}, &(0x7f0000000180)) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x10081, 0x0) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x2) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) 14:15:14 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000340)={0x0, 0xffffffffffffffff, 0x0, 0x6, &(0x7f0000000300)='vcan0\x00', 0xffffffffffffffff}, 0x30) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) sigaltstack(&(0x7f0000ffe000/0x2000)=nil, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x40, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r1, &(0x7f00000002c0)={&(0x7f00000001c0)={0x1d, r2}, 0x10, &(0x7f0000000280)={&(0x7f0000000200)={0x7, 0x10, 0x100000001, {}, {}, {0x2, 0x2, 0xffff, 0x8}, 0x1, @canfd={{0x1, 0x3, 0x10000, 0x91a3}, 0x31, 0x1, 0x0, 0x0, "68cfbe44aa52d3e1b0899d3b942564045dd53f3750cd67bf68126dcf88e4244fa971a8531fd26c383441c8a584a6df96399986ac2ec06065b044a2e19031da7a"}}, 0x80}, 0x1, 0x0, 0x0, 0x40}, 0x20008000) r3 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r3, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r3, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) 14:15:14 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:15:14 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x406, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) signalfd4(r1, &(0x7f0000000040)={0x2}, 0x8, 0x800) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000140)={0x3000, 0x114000}) r2 = syz_genetlink_get_family_id$fou(&(0x7f0000000200)='fou\x00') ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000240)={'team0\x00', 0x0}) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000000340)={&(0x7f00000001c0), 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x68, r2, 0x20, 0x70bd2d, 0x25dfdbfe, {}, [@FOU_ATTR_PEER_PORT={0x8, 0xa, 0x4e24}, @FOU_ATTR_PEER_V6={0x14, 0x9, @local}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e21}, @FOU_ATTR_AF={0x8, 0x2, 0x2}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_IFINDEX={0x8, 0xb, r3}, @FOU_ATTR_LOCAL_V6={0x14, 0x7, @remote}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}]}, 0x68}, 0x1, 0x0, 0x0, 0x4}, 0x80) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/mls\x00', 0x0, 0x0) setsockopt$IP_VS_SO_SET_DELDEST(r0, 0x0, 0x488, &(0x7f0000000080)={{0x0, @remote, 0x4e24, 0x3, 'nq\x00', 0x38, 0x401, 0x56}, {@rand_addr=0x5, 0x4e22, 0x40000, 0xc7, 0x10001, 0xfc}}, 0x44) 14:15:14 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:15:14 executing program 0: socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x6) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r1 = socket$kcm(0xa, 0x122000000003, 0x11) r2 = syz_open_dev$dspn(&(0x7f00000001c0)='/dev/dsp#\x00', 0x3, 0x0) setsockopt$sock_attach_bpf(r1, 0x29, 0x24, &(0x7f0000000200)=r2, 0x4) ioctl$sock_kcm_SIOCKCMCLONE(r1, 0x89e2, &(0x7f00000000c0)={r0}) utime(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={0x7, 0x5cc}) setsockopt$l2tp_PPPOL2TP_SO_LNSMODE(r3, 0x111, 0x4, 0x0, 0x4) sendmsg$kcm(r1, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) [ 420.679637] binder: 14890:14894 unknown command 4219648 [ 420.679718] Dead loop on virtual device ip6_vti0, fix it urgently! [ 420.704520] binder: 14887:14897 unknown command 0 [ 420.709497] binder: 14887:14897 ioctl c0306201 20000180 returned -22 [ 420.718065] binder: 14890:14894 ioctl c0306201 20000040 returned -22 14:15:14 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000040)={0x0, r1, 0x6, 0x1}, 0x14) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$FIGETBSZ(r0, 0x2, &(0x7f0000000080)) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) 14:15:14 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) [ 420.732889] binder: 14890:14902 unknown command 0 [ 420.739128] binder: 14890:14902 ioctl c0306201 20000180 returned -22 14:15:14 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) fcntl$getownex(r0, 0x10, &(0x7f0000000200)={0x0, 0x0}) perf_event_open(&(0x7f0000000080)={0x3, 0x70, 0x1e6, 0x100000000, 0xfffffffffffffffe, 0x0, 0x0, 0x10001, 0x20800, 0x3, 0x5, 0x2, 0x648b, 0x5, 0x40, 0x10000, 0x0, 0x5, 0x1, 0xffffffffffffffff, 0xffffffff, 0x401, 0x0, 0x80000001, 0x10000000000, 0x1ff, 0x400, 0x4, 0x7, 0x7, 0x80000000, 0x200, 0x1, 0x9, 0x2, 0xba4c, 0x6, 0x4, 0x0, 0xc2, 0x4, @perf_bp={&(0x7f0000000040), 0x2}, 0x20000, 0x7ff, 0x414331a4, 0xf, 0x7, 0x1f, 0x2}, r2, 0xf, r1, 0x8) 14:15:14 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) [ 420.814956] Dead loop on virtual device ip6_vti0, fix it urgently! [ 420.854918] binder: 14907:14914 unknown command 0 14:15:14 executing program 5: iopl(0xde) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$VIDIOC_QUERYBUF(r1, 0xc0585609, &(0x7f0000000080)={0x2, 0xf, 0x4, 0x0, {0x77359400}, {0x1, 0x0, 0x1, 0x7fff, 0x20, 0x1, "35a73d41"}, 0x498c, 0x4, @planes=&(0x7f0000000040)={0x8, 0x3f, @mem_offset=0x6, 0x7}, 0x4}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x201}}, 0xa) fsetxattr$trusted_overlay_nlink(r2, &(0x7f0000000100)='trusted.overlay.nlink\x00', &(0x7f0000000140)={'U+', 0x4000000}, 0x28, 0x1) [ 420.869302] binder: 14907:14914 ioctl c0306201 20000180 returned -22 [ 420.890295] binder: 14916:14921 unknown command 4219648 [ 420.898003] binder: 14916:14921 ioctl c0306201 20000040 returned -22 [ 420.937093] binder: 14916:14921 unknown command 0 [ 420.952710] binder: 14916:14921 ioctl c0306201 20000180 returned -22 14:15:15 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)}, 0x0) 14:15:15 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) ioctl$sock_rose_SIOCRSCLRRT(r1, 0x89e4) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4100080}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x28, r2, 0x300, 0x70bd2d, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x8}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x4084}, 0x0) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) 14:15:15 executing program 0: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x0, 0xa1}) ptrace$setregs(0xf, r0, 0x0, &(0x7f0000000080)) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x7dd5, 0x8042) ioctl$KDSKBSENT(r1, 0x4b49, &(0x7f0000000340)="9ae8bee50a832a274359678c18d25ce45534de0857d4890ebfb693f833143e04f835092d3442b722adc2aab920277667d1dc9b4b6b375ee911dd855126c860e6d5327aaa0a44f8c7101fd71b111f9096682aed13") ptrace$cont(0x1f, r0, 0x0, 0x0) r2 = socket$kcm(0xa, 0x122000000003, 0x11) r3 = openat$mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/mixer\x00', 0x200, 0x0) ioctl$PPPIOCGUNIT(r3, 0x80047456, &(0x7f00000002c0)) setsockopt$sock_attach_bpf(r3, 0x29, 0x24, &(0x7f0000000280)=r3, 0x108) r4 = syz_genetlink_get_family_id$tipc(&(0x7f00000003c0)='TIPC\x00') sendmsg$TIPC_CMD_GET_MAX_PORTS(r1, &(0x7f0000000480)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x1c, r4, 0x32, 0x70bd25, 0x25dfdbfd, {}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x4000) ioctl$sock_ifreq(r1, 0x0, &(0x7f00000005c0)={'bcsh0\x00', @ifru_addrs=@nl=@unspec}) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000140)={0x0, @multicast2, @initdev}, &(0x7f00000001c0)=0xc) setsockopt$inet_sctp_SCTP_RECVRCVINFO(r3, 0x84, 0x20, &(0x7f0000000240)=0x400, 0x4) bpf$MAP_CREATE(0x0, &(0x7f0000000200)={0x1f, 0x6, 0x7f, 0x2, 0x0, r3, 0x2, [], r5, r3, 0x3, 0x3}, 0x3c) recvfrom$ax25(r3, &(0x7f00000004c0)=""/246, 0xf6, 0x100, 0x0, 0x0) sendmsg$kcm(r2, &(0x7f0000000300)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180), 0x0, 0x0, 0xfffffffffffffe86}, 0x0) 14:15:15 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:15:15 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) r3 = syz_open_dev$amidi(&(0x7f0000000040)='/dev/amidi#\x00', 0x101, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r3, 0x40042409, 0x1) 14:15:15 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:15:15 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_sctp6_SCTP_STATUS(r1, 0x84, 0xe, &(0x7f0000000100)={0x0, 0x7f, 0xcc, 0x1, 0x8001, 0x4, 0x4, 0xffff, {0x0, @in6={{0xa, 0x4e22, 0x800, @mcast2, 0xae}}, 0x5c4, 0x8000, 0x3ff, 0x4, 0x3}}, &(0x7f00000001c0)=0xb0) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f0000000200)={r3, 0x1, 0x8}, &(0x7f0000000240)=0x8) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x5) bind$bt_rfcomm(r1, &(0x7f00000000c0)={0x1f, {0xf7eb, 0x1ff, 0x5, 0x0, 0xfffffffffffffffd, 0xffeffffffffffffd}}, 0xa) setsockopt$packet_fanout_data(r1, 0x107, 0x16, &(0x7f0000000080)={0x200000000000038f, &(0x7f0000000040)=[{0x8001, 0x0, 0x5, 0x9}, {0xe6, 0x3ff, 0xd96b, 0xe5e1}, {0x1, 0x1, 0x101, 0x7}]}, 0x10) [ 421.612460] binder: 14935:14939 unknown command 0 [ 421.616061] binder: 14936:14941 unknown command 0 [ 421.624608] binder: 14935:14939 ioctl c0306201 20000180 returned -22 [ 421.630422] binder: 14936:14941 ioctl c0306201 20000180 returned -22 14:15:15 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_open_dev$mouse(&(0x7f0000000200)='/dev/input/mouse#\x00', 0x1, 0x1) ioctl$VIDIOC_QUERYBUF(r1, 0xc0585609, &(0x7f0000000240)={0x9ba, 0x6, 0x4, 0x80002, {0x77359400}, {0x2, 0xc, 0x0, 0x200000000, 0x31, 0x4b, "ae1bee74"}, 0x56, 0x2, @offset=0x6, 0x4}) r2 = add_key$keyring(&(0x7f00000002c0)='keyring\x00', &(0x7f0000000300)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffa) keyctl$restrict_keyring(0x1d, r2, 0x0, &(0x7f0000000340)='/dev/input/mouse#\x00') r3 = fcntl$dupfd(r0, 0x0, r0) r4 = openat$apparmor_task_exec(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/attr/exec\x00', 0x2, 0x0) openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000380)='/proc/self/attr/exec\x00', 0x2, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000000c0)={0xffffffffffffffff, r3, 0x0, 0x15, &(0x7f0000000080)='/proc/self/attr/exec\x00', 0xffffffffffffffff}, 0x30) openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/snapshot\x00', 0xc100, 0x0) syz_open_procfs$namespace(r5, &(0x7f0000000100)='ns/ipc\x00') syz_open_dev$sndtimer(&(0x7f0000000140)='/dev/snd/timer\x00', 0x0, 0x80000) bind$bt_rfcomm(r3, &(0x7f0000000000)={0x1f, {0xffffffffffffff7f, 0x1ff, 0x2, 0x0, 0xfffffffffffffffd, 0xfffffffffffffffc}, 0x2}, 0xa) write$P9_RXATTRWALK(r3, &(0x7f0000000180)={0xf, 0x9, 0xffffffffffffffff}, 0xf) fcntl$setflags(r4, 0x2, 0x0) 14:15:15 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) 14:15:15 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vcs\x00', 0x100, 0x0) ioctl$KDSKBMETA(r1, 0x4b63, &(0x7f00000001c0)=0x40) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/hwrng\x00', 0x80000, 0x0) ioctl$TIOCLINUX3(r2, 0x541c, &(0x7f0000000280)) ioctl$UI_SET_FFBIT(r2, 0x4004556b, 0x79) ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f0000000200)={0x80000000000000, 0x9, 0x1, 0x9, 0x8}) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r3 = socket$kcm(0xa, 0xfffffffffffffffd, 0x11) setsockopt$sock_attach_bpf(r3, 0x29, 0x24, &(0x7f0000001480), 0x4) ioctl$FICLONE(r2, 0x40049409, r2) sendmsg$kcm(r3, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) 14:15:15 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:15:15 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) mknod(&(0x7f0000000200)='./bus\x00', 0x100c, 0x0) fsetxattr$trusted_overlay_opaque(r0, &(0x7f0000000040)='trusted.overlay.opaque\x00', &(0x7f0000000080)='y\x00', 0x2, 0x1) r1 = open(&(0x7f0000000600)='./bus\x00', 0x800, 0x0) r2 = memfd_create(&(0x7f0000000000)='^posix_acl_accessppp1\\\x00', 0x0) splice(r1, 0x0, r2, 0x0, 0x1d, 0x0) r3 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0x3, 0x1ff, 0x2, 0x0, 0x0, 0x800}}, 0xa) write$P9_RXATTRWALK(r3, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) [ 421.815656] binder: 14963:14968 unknown command 0 [ 421.828235] binder: 14963:14968 ioctl c0306201 20000180 returned -22 14:15:16 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)}, 0x0) 14:15:16 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)) r0 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/mls\x00', 0x0, 0x0) read$rfkill(r0, &(0x7f0000000240), 0x5c4) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) ioctl$VT_RESIZEX(r0, 0x560a, &(0x7f0000000280)={0x3, 0x0, 0x5889800000, 0x68c7, 0x3, 0x8}) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r1 = socket$kcm(0xa, 0x2, 0x11) setsockopt$sock_attach_bpf(r1, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r1, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) socket$unix(0x1, 0x3, 0x0) ioctl$NBD_SET_FLAGS(r0, 0xab0a, 0xffffffff) 14:15:16 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) ioctl$TIOCSLCKTRMIOS(r1, 0x5457, &(0x7f0000000040)) ioctl$UI_DEV_DESTROY(r1, 0x5502) r3 = syz_genetlink_get_family_id$tipc2(0xfffffffffffffffe) sendmsg$TIPC_NL_BEARER_SET(r1, &(0x7f0000000380)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400420}, 0xc, &(0x7f0000000340)={&(0x7f00000000c0)={0x250, r3, 0x520, 0x70bd26, 0x25dfdbff, {}, [@TIPC_NLA_NODE={0x10, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x2}]}, @TIPC_NLA_LINK={0xa8, 0x4, [@TIPC_NLA_LINK_PROP={0x34, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x101}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x68}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xc}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}]}, @TIPC_NLA_LINK_PROP={0x14, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0xc, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}]}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0xc, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x26b7388f}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}]}, @TIPC_NLA_NET={0x24, 0x7, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0xffffffff}, @TIPC_NLA_NET_ID={0x8, 0x1, 0xffffffff}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x26}]}, @TIPC_NLA_BEARER={0x130, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x3ff}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x10000}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x2, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x400}}, {0x20, 0x2, @in6={0xa, 0x4e24, 0x0, @local, 0x9}}}}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8001}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e21, 0x7, @mcast2, 0x1}}, {0x14, 0x2, @in={0x2, 0x4e22, @broadcast}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e21, 0x1000, @dev={0xfe, 0x80, [], 0x11}, 0x8001}}, {0x14, 0x2, @in={0x2, 0x4e21, @multicast1}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e22, @local}}, {0x14, 0x2, @in={0x2, 0x4e21, @multicast2}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz2\x00'}]}, @TIPC_NLA_SOCK={0x1c, 0x2, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x10000}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8}]}, @TIPC_NLA_MEDIA={0x14, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}]}, 0x250}, 0x1, 0x0, 0x0, 0x4000880}, 0x4800) 14:15:16 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) ioctl$EVIOCGMASK(r1, 0x80104592, &(0x7f0000000100)={0x17, 0x81, &(0x7f0000000040)="5ed5195a9df63769022519b645825ef0303866c81fef71f7b1c21567c39fe93f07ba8c70d1ec84ad895288812d8f6b29488d6029637668ab85c11906e7bee95d84b36209122f3eaf2618bffea2bdf8f28116db78e810c9e4f6698bfd6efd35bbe9c1c7df898f8a904c8384fcda4769490b34d3b5f17c2bbe6a43638c17ad4a1c2f"}) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) 14:15:16 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:15:16 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) ioctl$RNDADDTOENTCNT(r1, 0x40045201, &(0x7f0000000040)=0x4b) [ 422.507237] binder: 14979:14983 unknown command 0 [ 422.522424] binder: 14979:14983 ioctl c0306201 20000180 returned -22 14:15:16 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:15:16 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r1 = socket$kcm(0xa, 0x122000000003, 0x11) syz_open_dev$ndb(&(0x7f00000000c0)='/dev/nbd#\x00', 0x0, 0x2002) setsockopt$sock_attach_bpf(r1, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r1, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) 14:15:16 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)}, 0x0) 14:15:16 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) [ 422.657196] binder: 14997:15003 unknown command 0 14:15:16 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:15:16 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket(0x1, 0x800, 0x9) sendmsg$tipc(r1, &(0x7f00000007c0)={&(0x7f00000001c0)=@id={0x1e, 0x3, 0x2, {0x4e22, 0x2}}, 0x10, &(0x7f00000006c0)=[{&(0x7f0000000200)="2fecb5b5ea40d3fba0714c47bc526e0f1f550e51ae200affce723cc2d69f2a5ee02f421edbb3525763915208d99029ff315a54b3cd8490278c181a87268aff34cf0bd02ff09467fab5282f3e8da6f45a84ff66a8f5910a2bb4d408e26d179aca579245a8be1d1a2d13147fb65927856e469ec2048a9a175188b24868a0ce1d214cc577bf0925a85ad21229ccd0fe2153753989692b9a583c4468b3010223036aed6bbbe84b6a0d79", 0xa8}, {&(0x7f00000002c0)="8a33487850ee40b05062e7b39f3cc9d8002bcceabfef88d1c575f8c2ebde0f5d9526daf198f2eb071ac14cd0b8edbe5c3b97ebe26cd24c61477162c6f03532a134fb923dc028d65d75686305c0e5991793448b97f745d1a9fa49e29ef40737be98d7069652a80ede7e1608e3e5714bd57e8a5d83059495be24c594590bdc2662eb193f556aa5afcbe24717f62282a39ef9e1dcaf5c312dea55189cb0d3bd13c6d0e4f21fa0", 0xa5}, {&(0x7f00000003c0)="27f10eaf882035849bd66a4c9e5e90b5bea2d6876156571912a4a20ab7a3e37ab86f324bc8e75bb7ba1d788e63841d120870a0564d7134c613c767f8bb9e8d282d49bdb5ed6812a31a53ba2cb51f23f59fe582313bea403ad8494289ccac15a53da6fe85b69cfa73434a3198b9fbce673af37e207da7ea395ea0dd84f027f1afb441f6275de5b579e0374f3954aa9aab8b59fa7b26cf29", 0x97}, {&(0x7f0000000480)="715eb592cfc16b82ff1f4125ef995778e95efc9039e68bbf5c883fb251d86e16dac9a1f379d57215c4021310e1d8a5cc16b1c73b59f7307a21a50ebe3753290468e67282248e52627cd4fa99d251ae7ec7dee8b34453f1912e09cdeae0f7eaa4b215d8bc986c32782c2d87d073c0ecec129a4f8c35018168c50950f96d7c41ed44796bf36ce163deadd656d39319f0b2ce00ebe7e5", 0x95}, {&(0x7f0000000540)="c18aae5a3964914b4677c0bdd8d0df8c00c8e2658cbbed9dc79cc7c66fbc19c2b1b76b15985030c14715b0b585cceb30f0ade60ff322a8f0e40de05ff2be645bc02c98ca1cb0cc6acf9fdf58bdd3f2d40acfa82ff052d92dbdfed1b69eb0b8daea51fa700e8249df58a3af", 0x6b}, {&(0x7f00000005c0)="d725b1", 0x3}, {&(0x7f0000000600)="832b4deb99dc4c204eb70dd59078eaf0ca79cd9ff0394d3c418a497373fcc5088b51043b009ab929c53e4b6ad8b0e1236e77fe80beaea3b34274b87c4ad992cd1b73ea14e7d5b8bfe36c00b5286c092c3b064d41bb8706bf11b9bc5597efee6702743b753ba95aaa6692b615172134be8e0b98f38265435e6bb3188a4cab7b9bcfeb079e704a0d01b291a6f838b9", 0x8e}], 0x7, &(0x7f0000000740)="32300739a69ab3c8496e62e30c52f833456efaa3a9eea82ee97c3dd486f52c5c9fdfbd671b145e97ae277239d8a09a33279a0de573416b436ec1b851043d2905c64afb9cb1c3d9aa2d97a68914f482d7cd45f93223fd6ac643932a5741dcf603194025789d5fdfccfa7590d8ba0c1329d5030b0ec2d283d2e95a57ed2100", 0x7e, 0xc000}, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r2 = socket$kcm(0xa, 0x5, 0x11) setsockopt$sock_attach_bpf(r2, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r2, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) r3 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r3, 0x10e, 0x8, &(0x7f0000000140)=0x3, 0x4) [ 422.681491] binder: 14997:15003 ioctl c0306201 20000180 returned -22 [ 422.778207] binder: 15011:15017 unknown command 0 [ 422.791509] binder: 15011:15017 ioctl c0306201 20000180 returned -22 14:15:17 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)}, 0x0) 14:15:17 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xf, 0x9, 0xffffffffffffffff}, 0xf) 14:15:17 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0xf0, 0x7162d11381ffc898) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000080)={{{@in6=@ipv4={[], [], @multicast1}, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in6=@loopback}}, &(0x7f0000000180)=0xe8) r3 = getegid() write$FUSE_ATTR(r1, &(0x7f00000001c0)={0x78, 0xffffffffffffffda, 0x3, {0x99b, 0x1, 0x0, {0x5, 0xffffffff80000001, 0x2, 0xfffffffffffffffc, 0x81, 0x9, 0x10, 0x3, 0x1, 0x0, 0x3800000000000000, r2, r3, 0xfe0a, 0x40}}}, 0x78) r4 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r4, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) bind$bt_rfcomm(r4, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) 14:15:17 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:15:17 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r2 = socket$kcm(0xa, 0x122000000003, 0x11) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r0, 0x402c5342, &(0x7f00000001c0)={0x7efb3a2f, 0x7d6e, 0x6fbd7573, {}, 0x3b, 0x596a}) setsockopt$sock_attach_bpf(r2, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r2, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) 14:15:17 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) 14:15:17 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:15:17 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) getsockopt$nfc_llcp(r1, 0x118, 0x1, &(0x7f0000000040)=""/38, 0x26) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f00000000c0)) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) [ 423.435748] Dead loop on virtual device ip6_vti0, fix it urgently! [ 423.448172] binder: 15030:15037 unknown command 0 [ 423.456742] binder: 15030:15037 ioctl c0306201 20000180 returned -22 [ 423.475085] Dead loop on virtual device ip6_vti0, fix it urgently! 14:15:17 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) setsockopt$RDS_GET_MR_FOR_DEST(r1, 0x114, 0x7, &(0x7f00000000c0)={@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @empty}, 0x1, 0x2, 0x1, 0x3}}, {&(0x7f0000000040)=""/32, 0x20}, &(0x7f0000000080), 0x20}, 0xa0) 14:15:17 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r2 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r2, 0x29, 0x24, &(0x7f0000001480), 0x4) syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl$sock_inet_udp_SIOCOUTQ(r0, 0x5411, &(0x7f00000000c0)) sendmsg$kcm(r2, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) 14:15:17 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$KVM_INTERRUPT(r1, 0x4004ae86, &(0x7f00000000c0)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) getsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000100), &(0x7f0000000140)=0x4) fcntl$F_GET_RW_HINT(r0, 0x40b, &(0x7f0000000040)) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) ioctl$FIONREAD(r1, 0x541b, &(0x7f0000000080)) 14:15:17 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) setsockopt$RDS_GET_MR_FOR_DEST(r1, 0x114, 0x7, &(0x7f00000000c0)={@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @empty}, 0x1, 0x2, 0x1, 0x3}}, {&(0x7f0000000040)=""/32, 0x20}, &(0x7f0000000080), 0x20}, 0xa0) [ 423.624322] binder: 15052:15060 unknown command 0 [ 423.639646] Dead loop on virtual device ip6_vti0, fix it urgently! [ 423.646905] binder: 15052:15060 ioctl c0306201 20000180 returned -22 14:15:17 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm-monitor\x00', 0x54301, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x2400, 0x8) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0)='IPVS\x00') sendmsg$IPVS_CMD_GET_DEST(r1, &(0x7f0000000300)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x30800008}, 0xc, &(0x7f00000002c0)={&(0x7f0000000200)={0xb8, r2, 0x100, 0x70bd27, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1000}, @IPVS_CMD_ATTR_SERVICE={0x68, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@dev={0xfe, 0x80, [], 0x1a}}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x33}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x59cf9458b5e9a0c0, 0x9}}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0xffffffff}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@rand_addr=0x9}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e23}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x11}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e24}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0xfffffffffffffc98}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x3}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x20}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8}, @IPVS_CMD_ATTR_SERVICE={0x14, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'ovf\x00'}]}]}, 0xb8}}, 0x40) r3 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r3, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r3, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$FS_IOC_SETVERSION(r3, 0x40087602, &(0x7f0000000340)=0x7) 14:15:17 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0], 0x2}}, 0x0) 14:15:17 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f0000000040)={0x10}) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) 14:15:17 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) r2 = getuid() getresgid(&(0x7f0000000080), &(0x7f00000000c0)=0x0, &(0x7f0000000100)) ioctl$BLKRRPART(r1, 0x125f, 0x0) fchownat(r1, &(0x7f0000000040)='./file0\x00', r2, r3, 0x1400) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xf, 0x9, 0x0, 0x3}, 0xf) 14:15:17 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:15:17 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) setsockopt$RDS_GET_MR_FOR_DEST(r1, 0x114, 0x7, &(0x7f00000000c0)={@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e21, @empty}, 0x1, 0x2, 0x1, 0x3}}, {&(0x7f0000000040)=""/32, 0x20}, &(0x7f0000000080), 0x20}, 0xa0) 14:15:17 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x0, 0x0) ioctl$VIDIOC_S_PRIORITY(r1, 0x40045644, 0x2) r2 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) shutdown(r4, 0x0) recvmmsg(r4, &(0x7f0000002100)=[{{0x0, 0x0, 0x0}}], 0x3ffffffffffff5a, 0x10100, 0x0) ioctl$CAPI_GET_PROFILE(r2, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) bind$bt_rfcomm(r2, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) [ 424.318794] binder: 15079:15082 unknown command 0 [ 424.335889] binder: 15079:15082 ioctl c0306201 20000180 returned -22 14:15:18 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) 14:15:18 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000040)={0x0, 0xab, "1f1889fd0ad84fab37d9511da93f0eaa932a0875cf815b6c0ec0be37e98815e38d574e36179a220647d090ba5f6cc8d1099e749857d83ce10059e8735c04cb8e6c4b5444e1f8d8a774c7366357f7877618e4c121724ca1222cf48c515de807b1845ef43a15982bcf079b9a14e48af8078de63ea751df938d32e754c81996bb157098970ab8d014ea24ed2a5e638c4a8abeb897b441296c1e05e126aabea0f0c3d6f78c5be2a89f83efbc4b"}, &(0x7f0000000100)=0xb3) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000280)={{{@in=@local, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @initdev}}, 0x0, @in=@local}}, &(0x7f0000000380)=0xe8) stat(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000480)={{{@in6=@local, @in=@rand_addr=0x8, 0x4e23, 0x1, 0x4e23, 0x0, 0xa, 0x20, 0x0, 0x32, r3, r4}, {0x2, 0x3, 0x53e1dc20, 0x3, 0x200, 0x2, 0x4, 0xc623}, {0x81, 0x200, 0x7, 0x74d7}, 0x8, 0x6e6bbe, 0x2, 0x0, 0x3}, {{@in=@loopback, 0x4d6, 0x6c}, 0xa, @in=@loopback, 0x3507, 0x0, 0x2, 0xfffffffffffff718, 0x9, 0x9, 0x7fff}}, 0xe8) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f00000001c0)={r2, @in={{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}, 0x3, 0x6}, &(0x7f0000000140)=0x90) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) [ 424.364097] Dead loop on virtual device ip6_vti0, fix it urgently! 14:15:18 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:15:18 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x100007}, 0xfffffeb2) r1 = socket$kcm(0xa, 0x122000000003, 0x11) r2 = syz_open_dev$mice(&(0x7f00000001c0)='/dev/input/mice\x00', 0x0, 0x4000) setsockopt$sock_attach_bpf(r1, 0x29, 0x24, &(0x7f0000000200)=r2, 0x4) sendmsg$kcm(r1, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) r3 = shmget(0x0, 0x1000, 0x1, &(0x7f0000ffc000/0x1000)=nil) shmctl$IPC_INFO(r3, 0x3, &(0x7f00000000c0)=""/35) 14:15:18 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = request_key(&(0x7f0000000040)='blacklist\x00', &(0x7f0000000080)={'syz', 0x2}, &(0x7f00000000c0)='-\x00', 0xfffffffffffffffb) keyctl$instantiate(0xc, r1, &(0x7f0000000100)=@encrypted_new={'new ', 'default', 0x20, 'user:', 'eth1', 0x20, 0x10001}, 0x2b, 0x0) r2 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r2, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$P9_RXATTRWALK(r2, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) prctl$PR_GET_THP_DISABLE(0x2a) [ 424.433404] Dead loop on virtual device ip6_vti0, fix it urgently! 14:15:18 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) [ 424.553937] binder: 15105:15111 unknown command 0 [ 424.578638] binder: 15105:15111 ioctl c0306201 20000180 returned -22 14:15:18 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0], 0x2}}, 0x0) 14:15:18 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r2 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x4, 0x0) sendmsg$kcm(r2, &(0x7f00000005c0)={&(0x7f00000001c0)=@pppol2tpin6={0x18, 0x1, {0x0, r0, 0x4, 0x4, 0x4, 0x0, {0xa, 0x4e21, 0x95a, @rand_addr="5e0231257a92b6227a8b72cac759d54b", 0x93}}}, 0x80, &(0x7f0000000300)=[{&(0x7f0000000240)="0f9f79d22ea7dc819e811db766a7982ab7c69119e203e82a37c35e49f8019da3ca2001e5059c898685def7028cfd2f8b0d30bb2c0b7a261ae9bc47f64f189f264ec18da84de89409637571c6c2146db934297bdfd91816971b5c3c267eef87", 0x5f}, {&(0x7f0000000140)="e4444d99b9cd", 0x6}, {&(0x7f00000002c0)="15b43c255f2c904b6d0bb9c8885cf74309c22282429e9b7fc58ea4bd6a37926a19a50998d448b6a3dcb852201682266b7d73a2dfdc930dd6b6c1", 0x3a}, {&(0x7f00000003c0)="3be46eaab7875cb0dfc010e8bd7f42672f367f73acc624fe8d8f8f8621cf24210a52c4709854549a1dc4d7c809a7d841ed9c97f03eb2fe9f7c8b07e968f41b66defdb016b85abffa31679aa888604dfa2095fe758354099066ed948b28d15a3e138358afbbdc6fdbb98717aaa11cf1be589504f117a70273d1cc7056bddcba0173ea3d6b3e48177da33e52c3194bba64a7f1f370dc6d21feac29c8c951a3d040d37f072d79e6decf3d3de3e28c9b41a72b77322bb7bfe2b70c7885889ca7b1fa39fd3929668a0c7fbb0134e032a0f7fdb70a02f6dafcda93620698896a21dc39d5b69598ce3e43ad29bdd473d7c039", 0xef}, {&(0x7f00000004c0)="31821b98f92f24d04edffd4d543b2d3107fc26d3fe7030ffa0625d66a7d11d42d6d74b44c993a45fabc9e7ea66a936d26f3f306306b3220c074fe07e42b8537ac3b164f11f43ab09d87ba736381ced794d8ff7a0c5c9e2fcb7ff370881b11b755bf9149b6acd12a97b5cd10d862707f8da3c1833f3994b827d6aeab75d7663cb046c5eb9811bd5abee7e42727d76166c36e26fdd7b13628f034edaf0e2090d3f02fbd59d4c45e8f05dff221b7cdfdf39a715ea67dfebc606ff1355abba5a8a924ef9afb045ee6eb7101289", 0xcb}], 0x5, &(0x7f00000014c0)=[{0x90, 0x0, 0x3, "9d92678c85d2e9bd9746312b032ed69fbde73a7dbb267cdcae0c8ff40a87e8c41d32a403913bc5f61dace5b16d65916fb666215b6bc99c635591f39789512d58a0af28f814e47097695785ecad0053771543eefc173395ba57588b1370a3f524f0ccb782af72c3a179db3162b3a5a54ea2d295f39ee8794bbe9368bbfdc6"}, {0xd0, 0x1, 0x5, "4358f7c132d67d59d6b9b3788e23f8bc96891f1280714c498e239238db1374b65d876b87023c328128da099e3a0fd867c9283b9cc1b3549edfad73f8261ab36a13ad5c74956d7cf79f69786b42f657c107bd56ba5595987ead8298e65f70169d74deaf2b6af4f845d85a9227e4b0e9cddde2420ad51e8bff758661b12e7a2675742e3a4640d5c3bb66eef44f44468645d3fb02847a4281d215f28000853720ce6dd01ee8fd150933128ce78347d4d20f45fe4b26cb8f3da2ce5398"}, {0x90, 0x1ff, 0x0, "405ea6de294ccfa90e1e6dd193bd10f82dbc55abf5768ff315eb9fbd4e3387ee0406fbbc7937d85ee948793711a96fa560cf632315a9552d8ccc447d40af01b42ceb37492ee3df220479ec4a541d943047ae58771b11de36f415ff6c616b564a04f0a939ed792242bdaa88ccc79cea09ef558d302ae91c7dc8"}, {0x38, 0x107, 0x146, "1a2e5f37a0e4613d53155a365ff45669b074c3a7723663b76a56c063ab2828de6af3e6971e954f1a"}, {0x90, 0x0, 0x0, "de42274d98e14fa0c4563a61aa6405a424acf13de1ab11a923bce9254a693dce4026509385d5f7d822c78769c273f1a31c0116000815e50950dc00cf3a11a03c2f012e5ca193f7fad6117dac59df65225ad97c3d3d432f54999c13bffc3845b5d1a192ccb5b302bec13fcecd793ce67232b670f299ac4c423d0ed7c8"}, {0xd8, 0x10c, 0x402, "17d436d085c94471151fcaef22d671d73853e2858be67126f7c4929ce344cf40ca9484bec39c66182812ccaf6d57f775dbfa3f28e175f0702895055e2463fd294f90af3ef760c61e8705f614ea76f5959e5447f14e8e49f6e27a1a7af9db22702a92b30d18a7cff8d36d803efc567538dba20af2cfba61ba7d689cf5a501d61d0491dfb61ed1f4ff8bb7a9f075d47e105419f5190e1e5c2cbfd71705eb3d20a616a0b3888fc3d57fc497e75851db904c6ebb4534eb5b595013339f8bdeb7414ffd49"}, {0x1010, 0x1bf, 0x3f, "bb90949c814ef16b7789702a5c5779aef0888afc58e766c8b8387c004211e4bffa3d6baa5384dec2b8954a574642e9540bb2a8519b236addb04ce852547705231ebc010e2913de86a31f245179b18863b43340d005e2006d7602df38f751d96ab912f50c3dfd6c6cbb8a7f63e0003be55aadc8ce12de7f95350d6dceb05f12610c091c4b13d23b912b25f649ca3f7f3a7c712919e6f407c44df8b7a071410c8534b9ae2fc8827faa5dc2cc82e093b32bbc3484fc3a1224c16d9dc127f4e66de748bb107c54e38c7d4f750cf14a199dd136388a8bf678fb66289135004d00a7def9744a436c0a1ebb0946e60cd1666d5dc9c54d37ab5234dbf97fa0ad8b8ceb2fee4918c7146668ed8d85622353c3bc58385fb4408ebe2f9c7c21ac2c1382a2e3ebbfc8b04deb6d3bbf915a4388abd457b09d5a6dc1538df3a7c2e62658157cfaf548e1aa80f7c5fdd5aa23f9d000d1e4894016db8b665121b6f7b9c06538aec0a96a04e263d297b36f34c31f07c4ca16502c44ab7c2f9719b9fdc88d3aa8256946d776dcf3f143a6b1f824420480e5dca67e1f3b1603f41202035e492c50cb65aba368edac82d74b948ec24c252f04a8eb4de1c0fb77f0d7a2d29dc6c20874291c2c5c1a02983788bf96ed51d632decdad6643167368ce0273e51361383c672c1b2d1b05a67171d68998bcc8b45b184faef147b7c4aa06753141218916c33628bf8442b5d3a0f735b21683318c42aabc23edd5cf7104dc3c6b9ed97b196cd2dab4641f8c5793aa6dbd23374de09b1166b86b836097a53d48cc0bff1589bc962fb001b18d0c4c324534f7c02f49323e49347a35fa7a8c36a99ca2c3850bc4338d751ddd98297cd1c9aa26211518dee79e4833665cc9c99b50ebec340630eb83c453bcd698305af14faf03550ed024fd301cef2812005dcff3f2994b78ba0aa40399a88c484ff48a97322755d7fbb4b37f99ec746ecfacef4d4d74c7ba9dfe9abebae0591fbe67e3ab6221367dc7fdeeced6e5fb6ef8822e6c952d649db1e994ebd7cab257e8affaf9276a2edea1b776e49d444602faad36bfce40392d09c0e04d085c200f3a43556437fdc3011cc9eff25c43817dc8f86265d3733d7718fa29f378346929b3fd822bb2788f2494b73d09133fef150553f9d3fff224854d877a0ada03aff06ab661468fb318d17cf71a60f4fd385cdf41282bc4d4a44bbb34612c924c424960e279c32effc61649c71c6bed295e6b5759194eea57533597bbc1d35d11e3b44836055ae14630bcb104423361ad2997ebbe4e9912952aae234d1ff279fd9aa809c55ba49e15931c798bef2d44af8317afa116408febe8ba10aa755cea9dced741675f5f811193ce7e6714eaeaff8cd54e55809da92aaf7126ec6735a54dc2ef603b28df65b96f691e96c63a69f605c95bdcc1fcfd86b45a2e6c1d22880631f285d1f8cb4d918c5e5d0e69cb9aea1d1b872a1bf737d4c4850a91f20b1fb95e8316ff8021fbc0c514a9f7c7d759bc4add9182fff511c5dac860fce358362f4595877629826cbbbbd8e066d728fc22ba739a712b9288b03c2f94b220d9e437b30cfdd777da414706318e66f1841a671bb34e3d1fe561087adf821ba2d1cf0cb6b5fe01c7d67122a433d0a9217a3ee1717b5a857fd166e15cba794834f334133b36e41e038290d2c573e06296536daef714353f6ef846619b9fe0ac19644a2247ad94806ac167b0010099f848be8f51f998a0dcb74b4cb617c4ba022b68a7c198bd3040a52fa0ff398095231d8324ce5fc24d2f2f1a79b1322973c39a5fe2f53f55bee574f424525eaf0fe1ecb60efc74009e751f463f144b295df7cd24acf309db836ad57e196e528c83f960c9f11a285605446c164f5f5e77fd3ee29ea10c13338c8b7c27603fa47b80d7e1809d7d313f42be36f8c3a6e9c599c1b4e0851c32f4b7efd662904bb259f884a57c1d65b57b045f3c4a4e7fbf1f2bb7596ab98491cfb1d169d15ef12c0f96c024b610bf22bb09f8d4c6c995a8f1bb4bb4fb7dedd1dc31bbcc0e847fb2d8b193a828f16d701b780c49c757351e81a8418f299faff758f6ae039df70c78e567fc18068ea88d9f06aecf5518bae699bc5bcba6cf730541cfa53699927c73c8c8fd358d15d058847b7edab7c5caad5dcdb4169680be776987a9d4cd300dcdabb563f0de0e660deef6d42603e00c0c6f59843ed754ddd3b568fed4a057d3e3c99072e2b72439c9583104077fa9c9df7979ea2e0616b30a88922e24d2d0bec97d0dc3784b94a7d56e104e8879ad149ad3e89ef96986ce6fb6113b898489500546d4028c4ecaa238b91ed2e70d3755d1bdebeb90c4357be9cc7b8581380b14936916f28eb32604612252b0c77a9738b98d0c7a195be55655a932327b4081856e88589374b01d38606c4d5c4e54bfc0ae478ad16d8d60a4796ef3efe78b0f5e67ace799c6a991bb634695159465a671ecfb0009cde812445e8ca0cd854177bdeeb742ddd50a8741ee5fc74e779d7bee36ed11fcf06aa151073da27e016a8a8a3e8ec06408844578d3aca8f6a11a2fccacae58cec73b015613a26f61968db4e10ca567a243cd284e757492204a21576e979dcbbcda8978bcf6fa98d634a87ee24a759d976e52d4767557b8c1489e8302e83d40a7225b41d4fc93548442accc0cc3aab5d5550765fbcf0e2b3081c998d579623ea1263942d37ebc23f451017c8ae255b64bb581df5ed1ef10e89cd098698b91a7f89130c03937edaeced827ba3bb33964edfab6d817959867682b3ee66a4a07490c73f9cd4f2c185c24bfdfa0721aa7cb2f4e8af315207ecd303a350acf7d926441047f2d228a1417fee6f256d28183bb25c0dea73400688475944fd71fafa902f7d953f7591d201b945dfb1c2ec6e881ba25e1d8116c7f4aeb4659a0a80be6cf4f8ea7343dd1c95bab939827a7b113ab70d455e48ff51a503eb6ae489a7ac900334913412d90441ac9b9dc9dcb37609a014aef5ad1407278728ef9722c40172ab42dee114cdffc008c8f79ab51ae9ea0318631c24ec2f2687a8822b8d87b1d2ff3aca9e539b1370d00d1d99c7c9f0ad421594a730c2bafc02b74facb5c035c3fe552cb34e9e6631d35ba6c8f61e79955204326d796a8473c3748863b540f9cd75d56818548cea7d3f1ecb48eebb11f0ad65b3e9c06084bea4332f635723005925bf48405dce19c044f68454a9e389485f2f42a848f45ddc5de787e2a0f5f8dfdd581a635fdde329affb615d445a8073c76a8f78b58c56b7d69e81dbcca7551b9ee478686517f5f6f317656b70754f38096f91f62978366dfef11390a13a3b21d7958e79a431b96e8d67f2e6c3652bca7d63dd0542f8d5793916635cad4b8485d8b6ceb41620ee3f079dd1884b1ba007c32387267e4f888f2a1a7be455800066d676c8788d6f13153fe073d03c57ee3c072c1d4f75aad435757212847331a6ac7aeabd1076a06c486f4d3f3dd15d1a1f3ad382642a9419f2566d43e6f789e2741787c85fad32afccc7ee31492ffffc4712c65bc7d5457fad755ba8589084ef0c030109d111ac22c403c45ae8117c7e75147dcd3e2d7ccf284a02000afd530df8d1622b564bb7df3ab9d0532b9de49c47af88b59bdcb95469bc63e9c801f4df214b0707546b870218f3c488890d772418107793a9ba7d04d8fa9678125359ab83584162741edac9b65c6e2670c8b965fd8de57001c9aaba00b7c25564e1be054b48029342a7250a8ebf18d836391bc3902836d44fcade258ce37d37ec190978a4f0bda6daf38ae5434863ace66f66cab7742bd51177ef041700aad50d87e8f7f1609850202879fc70d1133bff37f94b46c119e06a347dc7e3715ed461f1d2dfc55219c497321a5422bb4df808f1e173f59c7aa3ed3bcc6927754a19cec0e1d2eb71dd64af52e8b64faa82e560128132312197b83aa3dca8358b436100a847406cca31311bdc93be9283e0db061966f8500d13cf94b0c03b92af3234187c97a2121d17910a28b726837877acd88323e57c86fee0c7c4f035b65c1337efac0dc049c758b7f177d43d59df8efb1205dc91fab29ae9ab686ca7179de440c776c19933459848cfdfacd46a0c192fa9cf6231dcb5c77b58defddcd11d40f4a4ed8e276284a09f3967c0d518a458d8a8516831820492a3c04339f8e4445c044e109a98a24cf2958943214d818f03819862a3b365553dada328fdf33597346fe94acc8f140d9fce068b22bccf8142e72f7d91eaa2e8e94032e6caa98e4d37325d8902484a6c54f3214c4ee19917f92a5626bf1dda179f1cda5a372e3bb1cd1768a1b93dad2bdeb83edb00251772ba71426db2667b404c956bafe68614ffc7d7d2900beb0fd7c5637cd7509cf380e08b640878deb4e868df765f98549bef20d04d5d723ff88d90c00273e7c4498aa70b495c1a82d4c79496e57e370c876bef89f87503d5636cedf1255337a760f7f11feeac130948cc0b341579240680cde5e1319e9e937cd3cd2be6dfe116d095a5da021c019637ea185a49b67c99dfbf1c7b2bf1fceb89c36706c2ab1ce055426acccd0786981687ccf45f23fd320553d478635677fefb67f88044c8238ca25e6f7aa8f50e5cb74ad1ef88d4b0af903cb92ef028f636eb508fb443cddc0de1e1ea1da1c453b9cc6641766b105065e233ecf6a23f1ea07e7267bf355456b7ff4efdcc4f51ed000eb71c48fcbc92f39666571c73253d87b88514e3d78604194162f7c0c9b403f1777a7bb29f393088024daabf5c45db5440824d18325f15d80f1ec480f2de8fa3519045cb73df2c1d4f9cfbb7a3909c874d0608a063792cd9807836e5a36f6d63d2772c82a1f59eda56a33c099c765e2526506d155cdcafb78f086ace7455840b2a6bb494e0e715a772f3dd85760fdc5b6d90a209c22df3c6795eba2e70f893e7ae24bd026f3f52248e399322439e90c9ddaec09cc40bf8573e1e737e37d58844a4b2e3415f4294f4a9f3530458371c70d157ea1b4759b9d953f9056180586a784b7df450077dc6b0423df6283e4c5cf606bf0bcab99c6de1e4e5c5856945f27405ac101ae833479c4f33bed7071bd1011d9e7512d41f696284e94d769a150fe070a1d557ca922f825678954559dc0c5e6ddc7dacfeee2ad99ffb67f0e60b53a57befaf2772798d4199dc262d32ac1c2cdf305874a6740433900a1e3e2565f717d799ab645059ff41c958401985af4a6d4b97daa959f282825b472e90120555130d9f3fd364f5313b96afd8b82be6958c98bb3bb708d8ab6f2229ff16e19082b11302278778092a7b2258e8a29384ce07448c25e265a6e6b31c8f5981de56a7e985e8d2e615f8127915240fa51cc668f51871deda114069759a5fcd551059cd545af9b233c1c3f38988606421638d43f44ba274c6fb146e1c02ad0ac33fb4d4638dd3b36afea6ce6335b95e28dbd134edebfe2c64d30bcff9eabeae67cc1568985bef7e0df784cef9af3e184d9f804bfb3100561915a690017430964709bd85c8c4bf42e8bd5f440d1d8cf21a3ff4abd227d39ee47bc9217c908798758f2fbc1ae3eb89452149679a99e726816362edbfacec7d72ea546340a4c12919cd99a0c1e7c75a79e29a7a94dff6067ae5ed69a5955aa772227add305a6b30cb86ab99f71cde86af9634f5fafc1dd192b78e27dfb72bb28b00a4d2bae3694e8c01f0f8a08e711ec7d7f4713d565898e6082c7bce49e2fe3fc2b5af91718fe2740aa0d18360dd06cfb136e7dc6967e54364fcb53ae50d03745"}], 0x13a0}, 0x920b5bce05b4a5a2) r3 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r3, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r3, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) 14:15:18 executing program 2: r0 = syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0x8, 0x2) r1 = fcntl$getown(0xffffffffffffffff, 0x9) ioctl$VIDIOC_QUERY_DV_TIMINGS(r0, 0x80845663, &(0x7f00000001c0)) fcntl$lock(r0, 0x7, &(0x7f0000000080)={0x0, 0x3, 0x9, 0xfffffffffffffffd, r1}) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$sock_inet_SIOCSARP(r3, 0x8955, &(0x7f0000000280)={{0x2, 0x4e21, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x306, @broadcast}, 0x10, {0x2, 0x4e24, @initdev={0xac, 0x1e, 0x1, 0x0}}, 'hsr0\x00'}) getsockopt$inet6_int(r0, 0x29, 0x19, &(0x7f00000000c0), &(0x7f0000000100)=0x4) bind$bt_rfcomm(r3, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$P9_RXATTRWALK(r3, &(0x7f0000000300)={0xf, 0x9, 0x1}, 0xf) ioctl$VHOST_SET_VRING_CALL(r3, 0x4008af21, &(0x7f0000000140)={0x0, r0}) 14:15:18 executing program 1: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_rfcomm(0xffffffffffffffff, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) 14:15:18 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) [ 425.344922] binder: 15124:15132 unknown command 0 [ 425.358070] binder: 15124:15132 ioctl c0306201 20000180 returned -22 14:15:21 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) pause() ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) 14:15:21 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) syz_open_dev$dmmidi(&(0x7f0000000040)='/dev/dmmidi#\x00', 0x5caf, 0x80) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) 14:15:21 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_open_dev$midi(&(0x7f00000000c0)='/dev/midi#\x00', 0x9868, 0x40000) openat$audio(0xffffffffffffff9c, &(0x7f0000000140)='/dev/audio\x00', 0x200240, 0x0) r1 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dlm_plock\x00', 0x800, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000001c0)={r1, 0x0, 0x0, 0x4}, 0x100000718) r2 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r2, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r2, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) 14:15:21 executing program 1: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_rfcomm(0xffffffffffffffff, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) 14:15:21 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:15:21 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0], 0x2}}, 0x0) 14:15:21 executing program 1: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_rfcomm(0xffffffffffffffff, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) 14:15:21 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2, 0x0, 0xfffffffffffffffc}, 0x2}, 0xa) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) 14:15:21 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r1 = socket$kcm(0xa, 0x7, 0x11) setsockopt$sock_attach_bpf(r1, 0x29, 0x24, &(0x7f0000001480), 0x4) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/sys/net/ipv4/vs/sync_sock_size\x00', 0x2, 0x0) ioctl$CAPI_GET_PROFILE(r2, 0xc0404309, &(0x7f0000000200)=0x9) sendmsg$kcm(r1, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcs\x00', 0x284200, 0x0) setsockopt$bt_hci_HCI_FILTER(r3, 0x0, 0x2, &(0x7f0000000140)={0x100000001, 0x6, 0x100000001, 0x8}, 0x10) [ 427.704847] binder: 15145:15150 unknown command 0 [ 427.721661] binder: 15145:15150 ioctl c0306201 20000180 returned -22 14:15:21 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:15:21 executing program 1: r0 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) bind$bt_rfcomm(r0, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) 14:15:21 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000040)={{{@in6=@remote, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in6=@dev}}, &(0x7f0000000140)=0xe8) setuid(r2) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) open(&(0x7f00000001c0)='./file0\x00', 0x1, 0xa2) [ 427.886924] binder: 15170:15176 unknown command 0 [ 427.914421] binder: 15170:15176 ioctl c0306201 20000180 returned -22 14:15:22 executing program 5: r0 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r0, 0xc0404309, 0x0) write$eventfd(r0, &(0x7f0000000640), 0x8) write$binfmt_elf32(r1, &(0x7f0000000040)=ANY=[@ANYBLOB="7f454c461fff801e02000000000000000300030000000000e20100003800000087000000490000005100200002000700090002000000000053e574640700000006000000ff0700000001000009000000010000800500000007000070070000000500000039000000010000006e000000040000000100000099e689e19cb4990303bb63f0571433fd704239ec0cfe8c0637dd1b6c14b6c9a626aa61ac27b251aec14fd6c805811e7b35254fea380958050a90b63b086dfedb11c82ce07d263f58f54bf4d6cddfeec23ec84c18373c6c091f23efa73815462a44d057b659f0123d815a7eeef0fe8fa40000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000068574fb3000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000442b476a18218ca300"/1512], 0x5e8) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bind$bt_rfcomm(r0, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) 14:15:22 executing program 1: r0 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) bind$bt_rfcomm(r0, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) 14:15:22 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/net/ipv4/vs/ignore_tunneled\x00', 0x2, 0x0) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f00000001c0)) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) socket$kcm(0x29, 0x2, 0x0) r2 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r2, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r2, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) 14:15:22 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}, 0xffff}, 0xfffffffffffffdcb) bpf$OBJ_PIN_MAP(0x6, &(0x7f0000000080)={&(0x7f0000000040)='./file0\x00', r1}, 0x10) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) fcntl$dupfd(r1, 0x406, r0) 14:15:22 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:15:22 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB], 0x3}}, 0x0) 14:15:22 executing program 1: r0 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) bind$bt_rfcomm(r0, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) 14:15:22 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$bt_BT_VOICE(r1, 0x112, 0xb, &(0x7f0000000080)=0x63, 0x2) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f0000000040), 0x4) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) 14:15:22 executing program 2: r0 = socket(0x18, 0x2, 0x0) getsockopt$X25_QBITINCL(r0, 0x106, 0x1, &(0x7f0000000040), &(0x7f0000000080)=0x4) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = fcntl$dupfd(r1, 0x0, r1) bind$bt_rfcomm(r2, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$P9_RXATTRWALK(r2, &(0x7f0000000180)={0xf, 0x9, 0x8000000004}, 0x4) [ 428.597034] Dead loop on virtual device ip6_vti0, fix it urgently! 14:15:22 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) 14:15:22 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) [ 428.659601] Dead loop on virtual device ip6_vti0, fix it urgently! 14:15:22 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$VFIO_IOMMU_UNMAP_DMA(r1, 0x3b72, &(0x7f0000000040)={0x20, 0x1, 0x6, 0x8001, 0x3}) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) write$P9_RREAD(r1, &(0x7f0000000080)={0xa9, 0x75, 0x2, {0x9e, "7772fb4ba56906f089f2b284f202b6fe0c600bb2d600ccb633c1844d58e96297e55f141a6691f3f9d219c2f0009946d241928083edaa4dba4cfde7606612fe4e5d7a499c4543ef32559ab5ef249dceb368488a3ab5daee2394c0eb55ce93f979bd89ea6241b11b0417c8c6a10b2cfb7df0592865a4587ffcbd53d75acafee1e5de144f67668faed07f1d146927bdeab6925e4b3dd95b41011765cd013419"}}, 0xa9) 14:15:22 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) 14:15:22 executing program 0: setxattr$security_selinux(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='security.selinux\x00', &(0x7f00000001c0)='system_u:object_r:passwd_exec_t:s0\x00', 0x23, 0x3) socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/status\x00', 0x0, 0x0) ioctl$RTC_EPOCH_SET(r1, 0x4008700e, 0xffff) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r2 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r2, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r2, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) r3 = openat$full(0xffffffffffffff9c, &(0x7f0000000280)='/dev/full\x00', 0x80100, 0x0) ioctl$TCXONC(r3, 0x540a, 0x8) 14:15:22 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) 14:15:22 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:15:22 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) [ 428.842325] Dead loop on virtual device ip6_vti0, fix it urgently! [ 428.912189] Dead loop on virtual device ip6_vti0, fix it urgently! 14:15:23 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB], 0x3}}, 0x0) 14:15:23 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 14:15:23 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000100)={0xffffffffffffffff}, 0x13f, 0xd}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r1, &(0x7f00000001c0)={0xe, 0x18, 0xfa00, @id_tos={&(0x7f00000000c0)=0xef, r2, 0x0, 0x0, 0x1}}, 0x20) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xfffffffffffffe77, 0x9, 0x0, 0xfffffffffffffffd}, 0xf) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0x0) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000040)={@loopback, 0x455, 0x2, 0x3, 0x2, 0xe4, 0xfff}, &(0x7f0000000080)=0x20) sendmsg$nl_netfilter(r1, &(0x7f0000000540)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x80200000}, 0xc, &(0x7f0000000500)={&(0x7f0000000240)={0x284, 0x13, 0xb, 0x800, 0x70bd27, 0x25dfdbfc, {0x3, 0x0, 0x4}, [@typed={0x14, 0x75, @ipv6=@dev={0xfe, 0x80, [], 0x1e}}, @generic="f18898aeea", @generic="b9ed58c912a21e59206259f343f699ab9401f63e6665f50189b6fdc9876d0649f863a76cb232bbefad662416ced91a0cf86219901ae540ab8a871aff1251640040c89be2a39bc2c24856f40b4c2181366d0f2c284816328fc9365af499d4d3c2e71faba46be773a629eaa0028bebf7ed531a098886e0c764323b0ae4c856dda151974d75dd96eb1c6d0659747d0dd7f67b8c0470908dac52d88a370e520368e94126c318543f4f88b0d67452916be298dacb6c865cb0eee5e26d315b69d93ffa86f3ec6dc3edf5a05902aa64", @generic="367a235370b4ccc2623e2519b8eed9093c9ccf7168578e02cbcc158265624b2001f0bcf73d3d3d34812e854e3c35ca9441999c5e5fe70b7eeb96e4826ac8adcfed65ffbf9a5c93250c036d1ca5f12b56ffbd925053b9b0023b4578e853643c5d2ae7c6160fb53d6d71c99b8ab8d7b92fe89ff1dcd6190547815ca68c31c7d8f26f2d3b458b3bcb00671bc753b15e247c4c344e", @nested={0x4, 0x47}, @generic="ae3efb80d2d63e02b6244c026aebb86759", @nested={0xe0, 0x87, [@typed={0x8, 0x8f, @u32=0x10001}, @generic="d39b183940d67ceb4b8d16ec0d00f1230be94e4da1ffdce699c4b8d9ad9475024709333aab5b3320f7d2b262754fe9cdf97109e5947b34336c32947a3293a233430cfe6020c17db8d418b0b45db4d650de99a3f91b4cc35b1b4c4e38147829f49c92a337177ffa0cdf186691808fde395371e211a748d5a1e35e949c002969c269cb9b72bc91c9c46b1df5b9ea62d11ab0c4ec213ad550d3af78e20adf1312cd21e881ef732a632318a348915f6b260ad210d0ffbf6969b01979d43a9e0a390af5557710b4a4ab5d8505582e5a2420c974bb"]}]}, 0x284}, 0x1, 0x0, 0x0, 0x10}, 0x4000000) 14:15:23 executing program 5: r0 = openat$mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/mixer\x00', 0x2800, 0x0) write$P9_RUNLINKAT(r0, &(0x7f0000000100)={0x7, 0x4d, 0x1}, 0x7) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000140)={0x0, 0x60000000000000}, &(0x7f0000000180)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f00000001c0)={r2, 0x3, 0x40, 0x80000001}, 0x10) r3 = fcntl$dupfd(r1, 0x0, r1) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) ioctl$CAPI_GET_PROFILE(r3, 0xc0404309, 0x0) r4 = shmget$private(0x0, 0x1000, 0x78000000, &(0x7f0000ffe000/0x1000)=nil) shmctl$IPC_RMID(r4, 0x0) ioctl$sock_rose_SIOCADDRT(r3, 0x890b, &(0x7f0000000040)={@dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x5, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @rose={'rose', 0x0}, 0x1, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}]}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) bind$bt_rfcomm(r3, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) 14:15:23 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) 14:15:23 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r1 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r1, 0x29, 0x24, &(0x7f0000001480), 0x4) r2 = syz_open_dev$midi(&(0x7f00000000c0)='/dev/midi#\x00', 0x7516, 0x40001) clock_nanosleep(0x3, 0x1, &(0x7f00000001c0), 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r2, 0x84, 0x8, &(0x7f0000000140)=0xcb000, 0xfffffffffffffe34) sendmsg$kcm(r1, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) 14:15:23 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) 14:15:23 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x4) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) 14:15:23 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendto(r0, &(0x7f00000000c0)="7ad402f6eb72ab4f9e88cb93756e5d213844b2a9c250d30e26e745eb78b59eea51b6afa4f8110307ba2bcbdf13e2", 0x2e, 0x4, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r2 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r2, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r2, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) 14:15:23 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) getsockopt$inet_sctp_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000040), &(0x7f0000000080)=0xb) fcntl$addseals(r1, 0x409, 0x4) [ 429.448330] binder: 15249:15256 ioctl c0306201 0 returned -14 14:15:23 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) [ 429.527531] Dead loop on virtual device ip6_vti0, fix it urgently! 14:15:23 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_open_dev$vcsa(&(0x7f0000000880)='/dev/vcsa#\x00', 0x9, 0x2100) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r1, 0xc018620c, &(0x7f0000000100)={0x3}) recvfrom$unix(r1, &(0x7f00000008c0)=""/135, 0x87, 0x2, &(0x7f0000000980)=@abs={0x1, 0x0, 0x4e23}, 0x6e) r2 = fcntl$dupfd(r0, 0x0, r0) r3 = semget(0x3, 0x57ff246b4f41d203, 0x204) ioctl$sock_SIOCOUTQ(r1, 0x5411, &(0x7f00000000c0)) semctl$SETALL(r3, 0x0, 0x11, &(0x7f0000000040)=[0xf600000]) bind$bt_rfcomm(r2, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4068aea3, &(0x7f00000001c0)={0x7b, 0x0, [0xffffffffffffffe1, 0x5, 0x32a, 0x9]}) semctl$IPC_STAT(r3, 0x0, 0x2, &(0x7f0000000080)=""/45) write$P9_RXATTRWALK(r2, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) [ 429.595432] binder: 15268:15280 ioctl c0306201 0 returned -14 [ 429.614398] Dead loop on virtual device ip6_vti0, fix it urgently! 14:15:23 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) 14:15:23 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 14:15:23 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r0, 0x800c6613, &(0x7f0000000040)={0x0, @speck128, 0x3, "1e1d3473de2a03d7"}) r2 = syz_open_dev$adsp(&(0x7f0000000080)='/dev/adsp#\x00', 0xffffffff, 0x8800) ioctl$KDSKBSENT(r2, 0x4b49, &(0x7f0000000100)="dbfbf45440af81ac327549e001c8829114956e837535febbfa732f48068f8683b19b099df1e631eaee95dc17649b39fd40dc5820bd99e34d9d85") socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) 14:15:23 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) setsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(r1, 0x84, 0x7, &(0x7f0000000040), 0x4) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) 14:15:23 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB], 0x3}}, 0x0) 14:15:23 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r1 = socket$kcm(0xa, 0x5, 0x11) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)) setsockopt$sock_attach_bpf(r1, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r1, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) 14:15:24 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(0xffffffffffffffff, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) 14:15:24 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) r2 = inotify_add_watch(r1, &(0x7f0000000040)='./file0\x00', 0xa0000000) inotify_rm_watch(r1, r2) 14:15:24 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x2, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = msgget$private(0x0, 0x7df) fstat(r2, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0}) getresgid(&(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000140)=0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000180)={{{@in6=@mcast2, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in=@broadcast}}, &(0x7f0000000280)=0xe8) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f00000002c0)={0x0, 0x0, 0x0}, &(0x7f0000000300)=0xc) r9 = getpid() msgget$private(0x0, 0x10) ioctl$sock_FIOGETOWN(r3, 0x8903, &(0x7f0000000480)=0x0) msgctl$IPC_SET(r4, 0x1, &(0x7f0000000380)={{0x2, r5, r6, r7, r8, 0x4}, 0x80, 0x1f, 0x100000000, 0x2, 0x5, 0x7b, r9, r10}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) [ 430.387309] binder: 15295:15303 ioctl c0306201 0 returned -14 14:15:24 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 14:15:24 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r1 = socket$kcm(0xa, 0x122000000003, 0x11) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcs\x00', 0x88000, 0x0) setsockopt$sock_attach_bpf(r0, 0x29, 0x24, &(0x7f0000000140)=r2, 0x4) sendmsg$kcm(r1, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) 14:15:24 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(0xffffffffffffffff, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) 14:15:24 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x0, 0x0) ioctl$VIDIOC_S_PRIORITY(r1, 0x40045644, 0x2) r2 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) shutdown(r4, 0x0) recvmmsg(r4, &(0x7f0000002100)=[{{0x0, 0x0, 0x0}}], 0x3ffffffffffff5a, 0x10100, 0x0) ioctl$CAPI_GET_PROFILE(r2, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) bind$bt_rfcomm(r2, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) 14:15:24 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(0xffffffffffffffff, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) 14:15:24 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vcs\x00', 0x42, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r1 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r1, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r1, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) renameat2(r0, &(0x7f00000001c0)='./file0\x00', r0, &(0x7f0000000200)='./file0\x00', 0x6) ioctl$sock_inet_SIOCRTMSG(r0, 0x890d, &(0x7f0000000280)={0x0, {0x2, 0x4e21, @rand_addr=0x4c9}, {0x2, 0x4e21, @multicast1}, {0x2, 0x4e22, @loopback}, 0x8, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0xeb7, 0x10001}) syz_open_dev$vcsn(&(0x7f0000000240)='/dev/vcs#\x00', 0x4, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(r1, 0x0, 0x48a, &(0x7f00000000c0)={0x100, 0x7a5f, 0x3}, 0xc) 14:15:24 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$VT_DISALLOCATE(r1, 0x5608) mkdirat(r1, &(0x7f0000000040)='./file0\x00', 0x28) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) [ 430.694093] Dead loop on virtual device ip6_vti0, fix it urgently! [ 430.748520] Dead loop on virtual device ip6_vti0, fix it urgently! 14:15:24 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e"], 0x3}}, 0x0) 14:15:24 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 14:15:24 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, 0x0, 0x0) 14:15:24 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) fgetxattr(r0, &(0x7f0000000040)=@known='com.apple.FinderInfo\x00', &(0x7f0000000080)=""/44, 0x2c) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$MON_IOCQ_URB_LEN(r2, 0x9201) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0xaf, 0x0, 0x0, 0x0, 0x3ff}}, 0xa) 14:15:24 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000380)='/selinux/mls\x00', 0x0, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000200)={0x1, 0x0, @pic={0x20, 0x1, 0x4, 0xce8, 0x7fffffff, 0x1, 0x0, 0x7, 0x0, 0x8, 0x100000001, 0x0, 0x8001, 0x1, 0x100000000, 0xe8}}) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={r1, 0x0, 0x0, 0x7}, 0x20) r2 = socket$kcm(0xa, 0x7, 0x11) setsockopt$sock_attach_bpf(r2, 0x29, 0x24, &(0x7f0000001480), 0x4) tee(r0, r2, 0x2000000000, 0xc) sendmsg$kcm(r2, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) ioctl$VHOST_SET_LOG_FD(r1, 0x4004af07, &(0x7f00000000c0)=r1) 14:15:24 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000280)={0x0}, &(0x7f0000000300)=0xc) perf_event_open(&(0x7f0000000200)={0x4, 0x70, 0x48000, 0x80, 0x80000000, 0x3, 0x0, 0x100000000, 0x0, 0x1, 0x2, 0x7fffffff, 0x100, 0x3cd, 0x3, 0x0, 0x9, 0xf4, 0x2, 0x0, 0x5, 0x3, 0x7, 0xfffffffffffffff7, 0x42a5, 0x462f, 0x40, 0x10001, 0x3, 0x2255, 0x40, 0x9, 0x337, 0x8001, 0x9, 0x6768, 0x7f, 0x2, 0x0, 0x4, 0x2, @perf_bp={&(0x7f00000001c0), 0x1}, 0x900, 0x401, 0x25, 0xb, 0x1, 0x27bb, 0x5}, r1, 0xa, 0xffffffffffffffff, 0x8) r2 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = fcntl$getown(r2, 0x9) ioctl$SNDRV_CTL_IOCTL_ELEM_REPLACE(r2, 0xc1105518, &(0x7f0000000080)={{0x4, 0x1, 0x4, 0x9, '\x00', 0x1}, 0x1, 0x400, 0x0, r4, 0x6, 0x1, 'syz1\x00', &(0x7f0000000040)=[']\x00', 'ppp1-\x00', '\x00', 'bdev@\\\x00', '.]em1\x00', '([md5sum\x00'], 0x1f, [], [0x501f, 0x401, 0x1, 0x15]}) ioctl$CAPI_GET_PROFILE(r2, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) bind$bt_rfcomm(r2, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) 14:15:24 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, 0x0, 0x0) 14:15:24 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 14:15:26 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x0, 0x0) ioctl$VIDIOC_S_PRIORITY(r1, 0x40045644, 0x2) r2 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) shutdown(r4, 0x0) recvmmsg(r4, &(0x7f0000002100)=[{{0x0, 0x0, 0x0}}], 0x3ffffffffffff5a, 0x10100, 0x0) ioctl$CAPI_GET_PROFILE(r2, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) bind$bt_rfcomm(r2, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) 14:15:26 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, 0x0, 0x0) 14:15:26 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/policy\x00', 0x0, 0x0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000001c0)='TIPC\x00') sendmsg$TIPC_CMD_SHOW_STATS(r1, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r2, 0x420, 0x70bd2d, 0x25dfdbfc, {}, ["", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000080}, 0xc0) r3 = fcntl$dupfd(r0, 0x0, r0) ioctl$sock_x25_SIOCADDRT(r3, 0x890b, &(0x7f0000000040)={@remote={[], 0x0}, 0x0, 'veth1_to_bond\x00'}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r3, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) bind$bt_rfcomm(r3, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) 14:15:26 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000), 0x0, 0x0, 0x0}) 14:15:26 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$audion(&(0x7f00000000c0)='/dev/audio#\x00', 0x1, 0x2000) ioctl$BLKPG(r1, 0x1269, &(0x7f0000000140)={0x7f, 0x3, 0xfffffffffffffeae, &(0x7f00000004c0)="ff275172e0b3510b5c5a2603c877b2c7085e9c206a9ddd5dd4aa4f57da3b5a60aa7072eaf2684f2eb9d7c41157865b8a0a0f6db30e74e50981a4779be83349f692e384e98bd4b537819915040b6ae6c38e022736da2451ee80d249121a387407a0d9f9fa8fc496683efaeccf298cdd99174f714f8f721e0f038b813d5d39c524401f4c4d74805d25178b12f5ec28f6a0068eaf9af9178483338ea434df707ad0e59c4d5a27976a4d9264471c7b273c96219062cecab19eb6537d58ffe8e0a7996ba5c2f8926ce51a9cb84a06ce0fe92b9c6763cdb0858fa1ffe417266f62e3117044df6bbb36126b16763a6e773614c657c3c8037c7a6625e309a330885eb39922ace91e7f29991e53fb"}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r2 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$ALG_SET_AEAD_AUTHSIZE(r1, 0x117, 0x5, 0x0, 0x1ff) ioctl$VIDIOC_G_AUDOUT(r1, 0x80345631, &(0x7f00000002c0)) setsockopt$sock_attach_bpf(r2, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r2, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) 14:15:26 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e"], 0x3}}, 0x0) 14:15:26 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0x0, 0x1ff, 0x2}}, 0xa) 14:15:26 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000), 0x0, 0x0, 0x0}) [ 432.558460] Dead loop on virtual device ip6_vti0, fix it urgently! 14:15:26 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vsock\x00', 0x2, 0x0) getsockopt$MISDN_TIME_STAMP(r1, 0x0, 0x1, &(0x7f0000000140), &(0x7f00000001c0)=0x4) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r2 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r2, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r2, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) 14:15:26 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0x0, 0x1ff, 0x2}}, 0xa) 14:15:26 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000040), &(0x7f0000000080)=0x4) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) 14:15:26 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000), 0x0, 0x0, 0x0}) [ 432.717228] Dead loop on virtual device ip6_vti0, fix it urgently! 14:15:27 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x0, 0x0) ioctl$VIDIOC_S_PRIORITY(r1, 0x40045644, 0x2) r2 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) shutdown(r4, 0x0) recvmmsg(r4, &(0x7f0000002100)=[{{0x0, 0x0, 0x0}}], 0x3ffffffffffff5a, 0x10100, 0x0) ioctl$CAPI_GET_PROFILE(r2, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) bind$bt_rfcomm(r2, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) 14:15:27 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0x0, 0x1ff, 0x2}}, 0xa) 14:15:27 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = add_key(&(0x7f00000000c0)='blacklist\x00', &(0x7f0000000140)={'syz', 0x0}, &(0x7f00000001c0)="f6d7b0ac3b6e77fd0cb8cee4eec125d910f9369929badd87b37a2d55a82a183955a69b93cbe9664159d78ff7b62a2997c448a65e63f13031726978297d6df87ed25d7f36c3f4e532250146c8055bc7b6471717d52fff817e429513f44b5705560b3ef1b6df26f2c7ce0f27e738a9b5c69aa9ebcd5e8d79a65b652bcfa10b93e6f3a9968d9ef717ce3ed2e089e2198fb94e102f40fc85694b23a40a6f0e672ed427526f0960975cbfbbe680ef55455fdd20004e7f3c91dd0ad81462fa559ffb94de0ffedd129cb62d28bc4885cb22559e5a11b0b67a24aff59c06a66c016878cdf9f58ac8", 0xe4, 0xfffffffffffffffa) keyctl$describe(0x6, r1, &(0x7f00000002c0)=""/138, 0x8a) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r2 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r2, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r2, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) 14:15:27 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) accept4$packet(r1, &(0x7f0000000080)={0x11, 0x0, 0x0}, &(0x7f00000000c0)=0x14, 0x800) setsockopt$packet_drop_memb(r1, 0x107, 0x2, &(0x7f0000000100)={r3, 0x1, 0x6, @random="7af15673ceb1"}, 0x10) ioctl$BLKBSZGET(r1, 0x80081270, &(0x7f0000000040)) getsockopt$inet_sctp_SCTP_STATUS(r1, 0x84, 0xe, &(0x7f0000000140)={0x0, 0x3c1, 0x8, 0x80000001, 0x100000000, 0x92, 0x4, 0x40, {0x0, @in6={{0xa, 0x4e21, 0x1f, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x401}}, 0x2, 0x55e, 0x81, 0x1, 0x4}}, &(0x7f0000000200)=0xb0) setsockopt$inet_sctp_SCTP_RESET_ASSOC(r1, 0x84, 0x78, &(0x7f0000000240)=r4, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000280)=0x1, 0x4) 14:15:27 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 14:15:27 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e"], 0x3}}, 0x0) 14:15:28 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x0, 0x2}}, 0xa) 14:15:28 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) getsockname$inet(r1, &(0x7f0000000040)={0x2, 0x0, @multicast1}, &(0x7f0000000080)=0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) [ 434.347773] binder: 15436:15441 ioctl c0306201 0 returned -14 [ 434.366867] Dead loop on virtual device ip6_vti0, fix it urgently! 14:15:28 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) recvfrom$rxrpc(r0, &(0x7f00000001c0)=""/253, 0xfd, 0x10000, &(0x7f00000000c0)=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x4e24, 0x5, @mcast2, 0x6}}, 0x24) r2 = socket$kcm(0xa, 0x122000000003, 0x11) preadv(r2, &(0x7f0000000140)=[{&(0x7f00000003c0)=""/238, 0xee}, {&(0x7f00000002c0)=""/69, 0x45}], 0x2, 0x0) setsockopt$sock_attach_bpf(r2, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r2, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='cgroup.controllers\x00', 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f00000004c0)={0x101ff, 0x1, 0x3000, 0x1000, &(0x7f0000fff000/0x1000)=nil}) 14:15:28 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$VHOST_NET_SET_BACKEND(r1, 0x4008af30, &(0x7f00000007c0)={0x3, r1}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000740)=@nat={'nat\x00', 0x19, 0x4, 0x690, [0x20000080, 0x0, 0x0, 0x20000186, 0x200003dc], 0x0, &(0x7f0000000040), &(0x7f0000000080)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0100000005000000120003000000697036746e6c3000000000000000000076657468305f746f5f626f6e64000000726f736530000000000000000000000076657468305f746f5f62726964676500aaaaaaaaaabbffffffff0000aaaaaaaaaaaaff00ffff00ff9e0000009e000000d600000063707500000000000000000000000000000000000000000000000000000000000800000000000000990f000000000000736e6174000000000000000000000000000000000000000000000000000000001000000000000000ffffffffffff0000fcffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000001000000ffffffff0100000000000000300000006607697036741835c0e18d274ed00000000074756e6c30000000000000000000000079616d3000000000000000000000000073797a6b616c6c657231000000000000ffffffffffff000000ffffffffffffffffffffffffffffff3e010000ee01000026020000617270000000000000000000000000000000000000000000000000000000000038000000000000002000000d000b0000ac1414aaffffffff00000001000000fffa5914f96627a50000ffffff4a29edde1548ff00ffffffff800800000000000072617465657374000000000000000000000000000000000000000000000000004800000000000000626373663000000000000000000000006272696467653000000000000000000000000300050000000600000000000000070000000000000001000080000000001f000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000de3fe4401f5a0000ffffffff000000004e464c4f4700000000000000000000000000000000000000000000000000000050000000000000000080000007000100010000009d83a567bce36a0f0ee77e422bbf49b93c248afcad7779f033dc1632afffd19080c0869fbb1607656f55619c7c15eef44fd37dd3a206713d380f7d6ab9be806200000000736e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000fcffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ffffffff010000000f0000004100000002016e7230000000000000000000000000007369743000000000000000000000000073797a6b616c6c6572310000000000007663616e300000000000000000000000ffffffffffffffff00000000aaaaaaaaaabbffffff000000260100005e010000960100006d61726b5f6d0000000000000000000000000000000000000000000000000000180000000000000006000000000000000000000000000000020300000000000069703600000000000000000000000000000000000000000000000000000000005000000000000000ff020000000000000000000000000001ff020000000000000000000000000001ffffffffffffff00ffffff00ffffffffff00000000023f40104e234e204e244e2200000000736e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa000010000000000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000003000000ffffffff01000000030000002000000000006272696467655f736c6176655f31000065727370616e3000000000000000000069705f7674693000000000000000000076657468315f746f5f626f6e640000000180c200000200ffff00ff000180c200000effffff000000ce000000060100003e010000766c616e000000000000000000000000000000000000000000000000000000000800000000000000030003000a17010063707500000000000000000000000000000000000000000000000000000000000800000000000000ffffff7f000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000000000000000000fcffffff00000000736e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa190000ffffffff00000000"]}, 0x6fd) 14:15:28 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x0, 0x2}}, 0xa) 14:15:28 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$DRM_IOCTL_AGP_ALLOC(r1, 0xc0206434, &(0x7f0000000140)={0xffffffffae9a796d, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_AGP_UNBIND(r1, 0x40106437, &(0x7f0000000100)={r2, 0xfd6}) mount(&(0x7f0000000280)=ANY=[@ANYBLOB="2f6465000000ff233000b96cef4a3f3db47eeb5709724f8447dc3e265236c9afba5dae725ffb38e95c7fed708f87f469a280b1a4251267b0937a69966901615d83afe1ed48dbb8ef145d5f76fdea1f4dc62d10680e04cb5c3664fe09e52e764777dfdeecf9e13237728d1e9896a55fe9dfac599aa483638d18a192fa802504d83988061beff681f1fb95707e32eaa558827a8e93305946e004adf23eafecbb676f7ddfe38dae581cb40000"], &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)='mqueue\x00', 0x8000, &(0x7f0000000200)='^\\-\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) openat$selinux_member(0xffffffffffffff9c, &(0x7f0000000480)='/selinux/member\x00', 0x2, 0x0) prctl$PR_SET_FP_MODE(0x2d, 0x1) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$TIOCSPTLCK(r1, 0x40045431, &(0x7f0000000240)) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) getsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r1, 0x84, 0x12, &(0x7f0000000080), &(0x7f00000000c0)=0x4) ioctl$DRM_IOCTL_IRQ_BUSID(r1, 0xc0106403, &(0x7f0000000040)={0x4, 0x5, 0x80000000, 0x1}) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xfffffffffffffffd, 0x8}, 0xfffffffffffffffe}, 0x70f) [ 434.566888] Dead loop on virtual device ip6_vti0, fix it urgently! [ 435.293178] Dead loop on virtual device ip6_vti0, fix it urgently! 14:15:29 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x0, 0x0) ioctl$VIDIOC_S_PRIORITY(r1, 0x40045644, 0x2) r2 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) shutdown(r4, 0x0) recvmmsg(r4, &(0x7f0000002100)=[{{0x0, 0x0, 0x0}}], 0x3ffffffffffff5a, 0x10100, 0x0) ioctl$CAPI_GET_PROFILE(r2, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) 14:15:29 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, 0x0, 0x0, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x28}}, 0x0) 14:15:29 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x0, 0x2}}, 0xa) 14:15:29 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000001440)='bbr\x00', 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) writev(r0, &(0x7f00000013c0)=[{&(0x7f0000000040)="79a0ad2337bc491160060e7f455f811b30f96924d569cfcbc00b5d9c74b2af06a8313b6ee71f243fdec840c7c2c74d5032ed0ea0ffbbfb5f7001d913e687e9f24c2dde85721c84e69425015688e5c2fd6e5ca5830cca1ba57490461ae6921943c785536d7b029df5a5832718591cc1af87c479c82b72589c57bc72120365178fea3f19419ed345278e43c0d1110df284d826ca888ce35fbfccf8bb8eb3df7288a73f78c7185860b2428cd94e5dfef05551d03a3d8772d0f047358018a8a23fc3c7c974fb1668438b8398924ae6cc587635478da24087a864636d0cf363f2a16950b4291e9d05fd1d8ddcc741e6f72b08be023ce9a2f8afe55e457bcbd58788a17f122d1fff43cef12c84d1b5b2a16e20b96059ec5324fb860f8db453324b7bc1e674ab141c605820818bd07921b787f3eedb42cf8e472c72e0959f9d9e45fc014ddb23b3572e4295f5051bbcf983ce33ab526bcd4eb5ec625448a7451593ebc1ab078c8b01c6360bf0b4cdfa99d2e923b517099a49ba29ef2b6f32e275078e21aabfadd64719e2e7244c251592b5093ca152efadbc0769af29efa04480f3fb3a609115dee5ec595da9ec4682bbc447808c729baf2c166245e1b8d4502e3cebea378407adcaa50a6696a71e5fc4013de3472a568c9da862c3b18870ccd2ece8486cb6388938b00680b09557b14ce66c30fc810d70ffa2b2f05b3cc882a955750bec4bb1940556bbd25603258f2506d56d2bdea9b06e33cc86e767e9d077e67c8bd5786a2b2204a6ab7bd01a8e67ccc10b99f71f62dc15b83983ced1fca6355fa127497f4742ead07db723936b511f88015f83ff4d1534879bba23e359c41e4548d45976a38998c64d6963c8eda597ae1cbb142b62f4d091f7164e5042ad48d89255f085f1b96ef908b86b36f5a9c258c00eb860ac91437852e9fd600b9c7ca7566a7fd862ca41eefed42b46292942f16997051522a80092ceedef062c15d4070e06dfdf17b1c90b07c908d02e6cf0eb72aeb14c331f2342622208b921c4db912823606cf460e3d0f107715982d9c571c16e373ec56c9870d2786b240b90be6e136f744925c96055f47c358b26819aabc7db27883807d6470207d71bcd3264ca9c36a0d9bf18b1be501e79b2cf9dcf5cb2d2631babb2cb680a1887c47d80093511c0c216bd68d93346154b10b7f4d23d1da364332140f2cf2fc232ef68f2d9c007138da2fe90e325b4208bd895fa333effa92d45c9c7841ed6db1eb6fa3820599591662848c24df11383e7c772f9343bc76e97c01339e6e1da9d5809d53aa6c4a69c326cb8dbd4d86e5805ba598f6bb053a8d64d2618b6a442477c705cbc15049c71249016e8df0b8282bbeaa0fefff8bc25107a29d2dbb93776fbea4536fb1196325b87944c010a66af481d4cd7ce18337a120d29fcca92f9e1a8b5da76d400d153841624b1c6f519bfbfeedfcfd73ffa860b23753c2ba536ad5185b9636c84e24be3d453de123dddaa2636e0cf6f4811c78d2d77687b7570d88f4585bc8518c9680bed535cb94b189f70381064ec393193cd33155f1aca8e82ddcdb90c69dd296855f93978fbc42632e8c2156fc846ece6bd3d11315d690c1c095c507c77be1477145968ce6e3099a6f5ad1ec6fa2cf28cb0c9045e7b8675e154e36da759d56311eddf03fe0a6398fd31c35af4c2a723299b7f81ec626f92913c5e7e78d5b384ad1f79d6bfdf030da50f6915f36b32bfb19c8685e77ad721d0d3fd97e8d7914dadaa013498cbe371a3adf094088ebc204f920718d7c454f3640f54bac87e2482b25374d76aebc8672427d1df1c673e98d768a6be244395e309c6eb03b4d6e645da6523d53f48326e3f7d7ff2aa4fde32939716f47620755fe56448fabc60986b7134818d5a386c7ce231111f4a2d468700a7d159ebcc8cc484c37bc9ced200a9a5dcf3fc75b40e46c30e044e53b731b950f18d000fbffeccfd4db6f47939657d8cc07d56c2f0ad8886cfd8f920d829917793bf0c33377849216a732e27fb0cecb5a26d31de91c29bc0f20bd73fe47679c8440f1ff5cd3926caed99b533b5cabbb1cc9a106512178f1e6ad159b1b6d45cb2f2e9415bddb5de2c5c09a2364c00c326dae549d3d98d5a089845f7cc249f00e46ebe3b1b79a580c9ac822b3bcc345853bb4ae2ecaf33adf81f69e32579d2cd58ff7a8c8e0e2d10e394848ef52103afbd677f8f9e30c6189ff466ea02ac930c55558ff5b0f87fa96a2ac3b6eebce5108d1b2c63f6808724a803b01fc9d493127e7f5d7e57ec314e25980c87f34bff9a0c16cb8220e1e64b8373a34aa10dcd86b5c95130271bebbc9849c868bad89a7d9c25446b134c9ca9f2332e8564c24a2d0ab937e6d137618617cc54957e38a2929c64e61bc57e5018b9597ad71b612c9fbae8b8cd4ca82044798dac18411d0edfcec17e871bbaf46b0e8c02097e7aa1b079eeddcc6ecf1f34987aba4dd070cb4b700b5bb7af8b775bd4d97ad09c623f8d74f0df43c55a4e6faeec05ec50a288b0eec472bc457f12a3b18d0677ede2f05ef3d33c37455c42c4e9579de1b9d9fd7fedd2d6396b921cd31f4daa77f927e0b44c44ed6609755297eb9d8c4fc194f941b7578927c0936a23575bbecc44aadd35a3943303284a74ec34fcbd799dee574665f357c76920545676f77828ef32e4d602b3d5f0c6b5c4ef116f7658218753a8ecd89e90785a8a2a39183c72b7990a2e14b319ba8c88ac820d3a2eeae6fc2ebc618c47911e3eb443b829eb9fc2c5c0a3396dbed2e75142d5dc342349a91b0bd27bade52d825befe3537edc00cf72d65fd05cc28d461a86f2b9c4817c42e3f72e70f7459fbc1b57a5037173da26fa0142de30178eef28d498c64707a2cba84ef430e222bdd487f50e61b9c345d1c71b51f5fde4688a7ea5dd914b423a2cb89ea12b8ee3a2495deb602ebbb14f988d35af72d61331172170482f28efe0c4faeb078f318dc13f97d05b2f309458746194deb07592a4a1661434cfd986f998790230f0ee7720b25bf86d0b9de0e3f26fbbb046df80e5d6973037ebfa856d4af2e1a13e814274208dcd64e477597904b593a9fd7ccd4e89f803f455fdce2a2e9daa974941160f3b14ad5486be59f8be7a0fad3bbf0b9f7e508cd9dbc4b1dfebc15fccb905f0deb4ce9cc548807fc45676a2c09bcddd0c486d17882d1be696d869ef728415c7d6dae3c37826e74ae63f8d1001e8a7dd17d71ea26e725706f213c88c9da7c54bdc0c40418df2411e2204f84809dde8af6e66f4cc6f9b0dd10462e0a7ea13738500227feab46a9354c1b4ce681790085a5171699184dbe90881bf63d8a6bacd8ec3bd8e7c4521aaf88c4304875ff76e74531b8e067e47351de5fafd1182a22231d823b30ac5c1d65074dc89d8f6032d25bd7cf51fe1c4a97f99bcf0efa9821d19ec77f26a508595727f952ba72de52be84cea7325b80170c71b0dfef74a0086a38ee2f31b5a4f13c912d40bd24d2c7c443f5aaf00e2504438f6e616c075a0928774bfd2a603d053eda011cf98627f8ff6b79479bdae35bfd8a14ca91e8f983a5e5666d29850a06a8d9e30e29704269ecf545f8665d1b255d130e26e49728d3039fb558b615a975ef7c9b8d36bc60b6698332e4f151dc2158ac73e0fcbc4b6c21631c956d81fee770da176393f7846d601cb1aa971a378eb1096a4abfcd90ed5a8176dc80f94f64fc32f7cc0a6b7d7d25b7dec9127438c294cc43592f8b841192b49db119c68380a7aeeac164e077f878abc56c9909b1004107d2c7a2a0384e7cf6f1a68564e9c76f81726f29f617f964e300de83a9a78747636798032365f73ed28e4bace54e995c83b7ca1dca7c0932b44f5f627eb34d50d618cd73bc23ca49df79a521c0c8030272b66a2c6075520785d0cf00a91fd56c13793f370d6e4c204174561dda1258e39dc56df531c0b6689e74f6ac7ed4e6e94bb3bda7ae1453cae0a690cdbec8f0c4d90aaf21b853198cfb74be2653d1e483ee28b189f25ccfc454c01cb155e9e41dae03ee0cf679194ce5f9ee0df063bd40ee50b66acc48d0eacdbafde21978bc2d14f24b4ade581ecec7f35103681ecfd42d6f8085e4e7d23af68bd2d1f1a84aa4c51bd7d9bd5a0f088923da78038760a0fddcf5300617b0487ad3b417dfa2f65c5c44b9592bb0bdf3940d8abed3138a5f7b87bff995a2e0d5a0bbf8a2d5c447101b93a01e029a4d3c608b6eb381589067ac3388e247fcaf26c4ef8ffbce8c1854aeaeb64cd3fef61611aecba34e1b5ffcae31b564b49246e0def4f76408f266fd557623b215602cc0eee8a6a1ade12ecaa46db4e2a54a3aff46cdb6ac51601178169c60e28a75d897c09ba69ef2b30c70333a66b67bc17b80d8e8af2e536910ce850b1247a1eb5c2b3d9c5bf794a1e76e2268a5d7068a1f0eb353136317f70c8733fc8a36ad2635c620b6215b0d4ec5df3b4bd6d273a15bae7420b976acee0e3c7faaa64ce69b41557ddb7d34be12f0e728a6088415298b62251e916c76eb084ac85160ecc47377dd0a256ade5f5e53ffc6970486ea190b4f7a708e740e381fbd5747821b6702c8a8b469de6cdb9869136364b33b92143d01da2195353712004f527d98696a30655aec218889bcdecd102766516685226bfd17b824209d157ad17f0d6bbb7cae0739f1ad88910b9049ca64fd7947180c9eff5f2a958be0373da2826e8b7f6ebe7cef4ea620255f9ec0e790e4002d1644bfb81165bd6766f5c57f269d66d73bcdd9015197f9484e38c53437b4322fa5ee0bad9f83aa2619fd857533906dd797cce2ad83a9ff9247fed0483ae1a4284b00f1167cb183d013fe03aee9ea6d9f258d3e472332471d489161ec65313498a9a66f96259a8cc31e92309efb06b30efd3e76615c132c81c0243be6ab7ecc2d35955e3598081774470b8b78f201e1d2df08d7c342cb73f692de1c3d2cd7cd76f3493dcf24974bc005264d2e2f3b4e6095912cb635b4a9a8bca7b2fe2c47bdae811a88d02ea049582cb32b1964d0bf8d1743260ffaa27707441774f6692ef6f15e6d83a7e5ea405e6552b0556e150b8be165490f7acdde26e480aee9d60b50c37c0dd541decea1feb167f36f964730d41c1c6ac156dd190b82b6e263b0ec022b7972bea7f6490c024aa5262aaa6b76578fc2befa863635580738c839d2e8831311c2bc396b3a5651025976f6e4abd42e9e23a8b1a213507693107e36e95090d950a10e173fc260aa76695ff6e77778e68405d19d2271821164f600630790edc9990c4d29c47f864488dcbb6fd325b579536b6b7efbc95314c31ceab6c4d8e455843aa75bf40c4210e4911a8be7d314b412349ebb9a91cc09e3060d65d437bf639a110341d4d7112083b4e27b5f9d34721208f792f5897e98a680a2f1b06957a996128290708916853f53d4cc3dfb3a6e0427063811c4572bf6ce6613ca1140ad902e7723210ff31538f4d001577e64bb03d158c16357485ecd7e881ad5e7adb606880972897b0da6110d9851711c977ed970bca0458eea1792847f9b2823b28e642eb21e252bc2159f44eb4a986e67e1c19eb20adf9b5fa5efd33107dae4c8ea735ddbba176f8ab76c689fa4d44027cca729a26fbf291aaee34b9d97bb29a71ec49fa36120dca7ac1efa6b33f3657875868bb9c0c3c401ce336924f651875df07a4471d8307f996712c6bbc491226809d2c271da9e4b199ab2568d7fbd1c6bce6a71dab4462764eaac13a4f87c8736bc9200826f54f168e154cfab8dfa1bca6a076", 0x1000}, {&(0x7f0000001040)="b1d0dc5a43209a4f3924c36b27de5d56be48fb9535b8101940b622da741e62adf6d845c4243ec855f0881e64ecce4bcd7daa8bfbcfbe2fc59051cf5d59cb17761bcaf7501f897ecfb9564c4f92c880415007241cd85f3f170681df5dc5d28a28a95dd4f6a52d9eda023afa3f3ad2e3cdc0342b6a63e2ec145f931d3ef96d080c9718a011de342d75f0bc8d4f6de2f3287307b0d7e4edc4080d66b914f55c1a8a8bb3b555409763803217126e1839a39a75624aee4d7244e2c86789a4832b524fb1a151417ba50099225a5fc2412f623fb90e63c87910da515320bc8bae0d9b19d0ee59ff4124d64f725f2ffc43c0f0d35c848d9e0ac76ac995", 0xf9}, {&(0x7f0000001140)="8ef2a46eeeb35e1ce003f8ea3af951dd572ef3a48fe21c0d28ef8ce7dd7f7d06169d9d9d1ae05645a6dd778d4b8bf746245fd80cc9b6777625fa9b0bd1e6c1bf7421eb993f8fb3c649f6742998d773efecd2fb700e0455605b4ea5856534f0ae78bbd088d3b85b195925231ecbad6121ce2954a66d1b1d40dd066a3fef0c13fc27ac05f4cdf187bab864f763fbaa435b5386843e811d0578f95fe18bf0cb1cf6cf050b8bd94e68c1b06a04d6d185535120bf6172792d2cde9d3949e5bb5bfd545a3a1bf55797bc3e3c011ccbc84683a28fa4d94b04ac004e758b22aee5b10294a0fdd1d93765842951735d1e54d0eb2e26d4088eab7adc8db81aa0", 0xfb}, {&(0x7f0000001240)="4c78f67ad3fd9dd7457d45be07a0211dfd75b72affe1af0a9794ae2f6910601a00f52575b2fa9e25544979e5399f0e5e1daa2e3347824eb38b7bad7dd9485307729e64d0a33b83186138b07582647f3cb0e2c89a173bafcea400c102d515e53f78e9f3d5ccac40ea5e9980f59edfaa289f188dd5118ed1cf4d90d2693f64d4ed87d54031d64a7fb3e0417fa55c5ac80d7000cb737a829e58ed5678e82987b5ca079c266bfc9f08796e2502782f9ae23c1bafbe4f475b93fd6a4121ef820a58b0e21923aae80ad04e24d10c3b144c1fb59b38273d07db298202202028157b5ee6847d10", 0xe3}, {&(0x7f0000001340)="64a5bdde82a201136b73007077932644e0e83c6917167c6a850de5e08b415f944161cf1d251b9ad2a0fc5265b199154860e8c592ef89a1cf08aac281a10979b182004b123aaec88b6bbfdd422487b46b0902eecd5953368dc0caeacbb7c94d1771a7b2cca083cd4ba88204b55f54a400bf", 0x71}], 0x5) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) 14:15:29 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c41"], 0x3}}, 0x0) 14:15:29 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000140)='/dev/cachefiles\x00', 0x0, 0x0) syz_open_dev$dspn(&(0x7f00000001c0)='/dev/dsp#\x00', 0x269a, 0x100) r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400204) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r1 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r1, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r1, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) 14:15:29 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) [ 436.135021] Dead loop on virtual device ip6_vti0, fix it urgently! 14:15:29 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) [ 436.184849] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 436.205901] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 14:15:29 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000600)={0x2, 0x4e20, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @loopback}, 0x10) pwritev(r0, &(0x7f0000000300)=[{&(0x7f0000000640)="cfbf77a03daf8101f314fdb51858dac3b4617cdca968756bf0229119a10017ee4862a10d5423b90d26cf38f907d898e88658371ceaaa4e0d485f91376911e33815d5b770754ed19cf9d7098c8e04280dfefeb2e8df47d4681519253985d5fd33536b641675e0cbf1286598bd93da7cea8d7c9a223e793d6edee0fde4cb53f015ecc1d0d85c8a5af92c0a17b695ec120da8c0f7cc5501abc98481ef2c9c81336f705def6a7fe62247745cb4bcd1d38e4b4455ab28689e1f6311458778bd86c163a8a5f88295246df8e052e07aeae002f67455123e878c8f1a3cc2756a0db6671009809826e6b67ca9fac63cc0307ffd4ac9fedb6224f1b684567cf40a701931378b326ac64b2106ed0506ab798d36eb7458b64066f6830f5e22f4637df1a936e59bc8c3773249630a49ff206f2b3db6451705ab27d877795767387fef742c878d848dfea41e52231b063eea5a9442189e323bac420e6d9fb511503bc944a5d06b0bb10efc0a5074589db0621485caf6e54a29a2020499b7c205d8140e7b26cf4f71a443d6bb3baf4852707daa19dd421793321e82168f88286a034ac94d6d405f128f9aaefae64f264fc99ddf9c1aaad8a983a0628e8d18b02f85b420c1bd54521781a66340fd6c052a5ce8218b4ac008052b5a58c455fbd174031ce326b72feb5e49f4e9c0b94dc9640afb066c4ab45b874a821050af587ade80d41a694a9e52ae28611eb9d2bbe5f4f80a7b4a557f421c1a7c372eecf61adcca106489bcdd315faf0423404a2528e8bfa28c6b5c575052f20d6e60f54f80b07c91a755a6c8e240f047834ea37fe51c30ab13b7609515eedccab87b3630d657776a8ae949dfe85eaadbe9f18f6f93c90f0553211f6884cc888eb76480bc657a2fca03159db83e47ec36f726bea6de913dd21ce6140f56a7a9c12e810949f7a8e4a8e7bcfc1557ed4aa394d1e72c81ff748fd9ce767a3f5ec5787af5cf4f653f750322b49a4efe430e9a15425a7f4116c84248fb3ea8e2ceb2a4e5dc7e6c4ae52741b4757c5fadc9d603b7e21e4f28db8cb9b2d038c5d7ac551649ea6c83d24a533697879fba24b976b402f773f7cdd6933ca5edf896e2a85a50cabcd836cd2a7c70c7020cb827e8159d115b9ce4d66dbd45fb448bb3528771ee8bb0d06461ea5e2aaf42d26c60d0ea19f424dc9f4a47ed3cc22652f091e11c526c750528d562103a1c2de997214859a215d9822436dc02f0f8c1d5bd379f9e10d16c00ed91872c8df7fd5704044d9000c000c88a06649a9ef541cbe3d044f3140f6e9f150d16112c46486da194e3a64ddf80a4254f35933e3d29d59b4892998cb101709c3ed23b3dd47e9ee186f16cc183cb6a27ec16a28a89edaa7f9827e6109faffa1c84192bd6be6eca8d1a8712895f208bc6bebb63d25a91b794f3e0e8581a476b46ba2b2555071f1198d7674604102f3993d39be833d3b1327863a759d9428f0f2326538bb3fe63424aae644ebd91c829de602a139efc12c214be52426d6167566d59d989a06bb37377119b7b5aaf45fe99c96be66497faf62ef4aa53fb69a37d577dca1b08a60cc4a59fba433a0c3e31ea1dce6d8b8471ac2cb43bc490d102d09c0000ed677ab49e061de7a4c2511b9129d6512ab9f85354a857f65bfe60b550493b82f541f39c0aae23c08b7762b3ee85313ec225e4a6dd828f70ad5ec916b07a7dc7a01d288609bdf9f26d827e417103664dd88f5ff3e623ad0e7f24260387cfa11be0a59f26a6e9c7845edd375d56d8aec1eb47bcd27e2135c348400a6869826fa3634a8f57a70f813d837d290173ed462ebbff237d9951f69cdfc1f9e07f9ed3489f0be76eff30bc71416f1b9c0e503aee95d3af3c0b2518600834990f3474c3886bc71379726fde9456f95080b77f48e5923b71a4784b2367b1c4441cc8d0e41da27deb37b41be76a5e55f2dc9a4a2e1006c0f69ea3a74df90a0df7e574fe159a3f358e912ad314c9d8d6ec6de7a609bd45e9ab0668f08e8ed630732180f314357cd9fbcbc0b479420f4f223d549a9028bfb868468d9b904013f8ec67dbc3e84279de52cd3efecae813c3384b3ae75780b798dffe44405d97033eef7f2f038b93dbcf8cb7f8eb703d0e3f25ee8e8d333cb9d5e76a0a762dbb986d4cd67264eec0ee329029741204dc1127c0ae8eb9b802e1a07464f2f0a11aca357e999eb1bf826c8f7dc25e2042625e628c64076bb475d228f892ee9858a282e01e16b9926a66c454427aca25ac2ae9685524d6f32f265bc658ca0d654fc7ec7040bbc771ab6e3a995a833c4fb26a6bc2f47eaf9b6ccc50762f1daf18c24143a1e40200c09db9c4042338e8510c9cb79bd521c3d52928383b4750a6e92657373a3e43db4080935eb19c1f7d7a8b09e9857571ba495ffa9914d4f1fab45fcc3d79f29f95d265ab3065c52deb2c55d37b20361e52f89255cefd50fef9f23a8f79e5c608e83be745e7324d7d056128015a555a81a80555b54cd423e05f4fe1cb3b6ff57638ca10297eac72f1192d36b932fb203a5ca4a2b0e5d2d96eac0383b23bda3e71290b8058200a277d21ebe30f9d4976f09d05ff9711cb8364e50c2ec18784661333a987941b714f9e7bb51db67fb93d74ee685456ae8026c09bffe9f46af3d0bfa645969271ea1d00d98ea3d3441672b4a80ea0666d5e17f4d433ec912b65a2731d82e40bd737e42e4e6c8904b15f3ef2523baf338d74412f5d01b115d150ab0995875e95ef4bb5bac0857d7c5087bbf5c2232613ced055146aa1e13dcd2ea13d419e660278854b880ce21fbe2230568ceac3e26b6c260368d5392660e07205ab1c6792d18a5c8f7ad20ebb13666552adaff2f92d2e9338b56d93effe31cd76db74bc3ad18f48a0e495d991f11a5eac4910c8f2cfe2e6f2ff8da96e4ab21f63fbfe44e61b8e37a0176d77ec977673257858818b38f0ff086bbe7f83e74e8cc8a5f32998da679d837c4f55493d01ac73f5a167e5406a02dc5915a971b624cb8fb0d9dd2842883eaa9ad2a0dcfa1c2ba25e795e487833e54e10f07ba96e08c3af116568900cf6ea20751416954bf4b8c9aadfd2f7b634cfc9d2c7a60e0ce5cf76f885bda17487cfee0b55092c9b7d267481fdc4aeb95b4815c21f104c6aec914383676d9260ad295392641c0b4d00c2ac51d9ae6bb678a7a3fba1cf23635f0632574d877da770905fecb9e1d5ddfcb694c981468fca0dd2ad3563f865f24da4a82dee2f8558decbb2b630f99cd984a63e3124d4b6d4e5633a9a98f4a6cf6b0dfd411b76732335a714de2ce37de96ae93db5f4909ab419df359909a706667c3c7c0eb340c6726b3e7d0dcce680dd3ca90d71ab48dee5af8b7ee3cb312185acf622abbfb19163eddcf4f6874c63a3b14506eb547b8e0d1461ad569e565217d45a9dcb6afab769825a6270fcd48b46b77fb44d166500a2d87a4f058243d81dcf5bccfd5366671228836e4588e45d8ec523446560d9134ff4ae8f890b3efe978f4ee51bc694571fa47948ef51c3e391805f46eb9207d4ffbfc41d28c551ae37b2a235cad3bdb942ee5dd6f1672bd4d4c39ef98592fdbb0b1bb1bfbcee6bf6a72da7c02951dfdb7f15c28c6dbae175b67a09996b511443532833e01d5711376a0726e480d08bd62f5931eb467cb8b2c8ffc19ae705fee1e04a3910e91752435d5c70945a1d86622411a85908a8c5ba6ccbcfea2b00ad6df505a4f3eba1bce5b1abb384822de61a6d2d4f6f13bc5d223ce4593f3373b281734ae0dc819ff59615c2154004303b971d44b4781acd8bedc98afad3f54df533a8698bc521ef80bbd9d28025a776af4068405bf69e5bcb80d9c942506d6438a6d21505dd83eff99a815954d31d42881b9b8e9f486229e7381bc231ac5f7a0f0c8b05f38a396bfa31ec553070ab542214caeae03a313e5b9ca2f07b4c149cca74ee12b8309d987637baa439967f42347143da0abd14c61a0773cda228bdee009837c72b85ab7e074c6247bd8d01d8e375f07c7cc64539635e372cb477be2e3b424fd6fd2c8d16a01b12cf3118e86f83a65270a926c9cbed303f14f03a15a0ad506ff7bedebd000db8081174fdd85b85054bc0b85b23e53d956a58e9e4a856e4baffd067e90808622d8e49e19b5ba9e7d5b61b5ebe08641dde01fe00ca3594caf0b0fc7a4e82c1d4f169050708873613689ee6e6999108705ef782dff1d0ef5494eff3be3ec2cf7d512dd0ecee101ff69c94ae0afb64d0539d4cc660402899d09530fd3bf5e7b87cfe0d765ffd165931788fe56863860ef640e86b097e861154c5ec4439e6bc7417786cfdbc78a07b03dd9d7181feb882f504fcdde99ef758558366f16a93c853c5b196c1b3beef51461f3db1101bd66f6198cdc18da91f08ace335b49aa48b96e79b10da627e4a7ce87e30adacef93b8eb75deb1c9b6abe52b8ec2042f661435c1945ee7d4198bf47b2c6631832b989f76c33212abe04eed9ed92e7fa1d5b2351ca89c913d6ab5342d141430bcae65c0bb2b2c50e3c9a15a8bc720f02b48d65ba87b3a72935ae8bbf7ef01595582f6477c41bc38f0330934a3096e42dad13a4eed2209ab07621fb709c2c23e63d2fa1ff2b93587101f62c2a069e6748b8b9b5a66685f610764706330eddae57655c372a645890849554a0c8cdae11baa895306c9d0126991b1f43651bc05483ad84288f5f142af4e2addd921d5f3a24f04edb21c775e51b107e17f74f112053accbdb08ce174c76e1238fe5ed125303b4a86d0a04eeefd3139fd421c77ce15efcce3e6338a8b8c27771b15f1d690e9dd4a8809efa519184848f9df566e69ccc1442d2e3c3562010f91088b8db3f492b62fa99fecd80bf09facb932628e56aa45e60f169454d55109fc98f0767dea125d49c506dbcdfa5e68cc392500de37c916f514c48be88f2baca9fa950c66e6bf37138304ff84523136c98e8e39efca269dfeb678e3587bf38fafb8047209922a286bdb5d4d800217226bc949985784453393f0b83868675f2c3cf93b54e1ea5533f81798630f4b9010d08c5e742ac0c8b43c91c464c152f25b61a049cb41b0c386fca7bfda23c12e9d5e49d475b584fd9db3d5404f693dbe91d9a0b115a5ee4efb21853aae9957d3c5856c6a77edb68d94c2587c1189baf77bb84a520709bc07fbab41fb5f9f884705c7f21ff38e4811e795cc7e0eeb8203b63fa14f63bc5fd3608a98f3dfd2f716bffee34eabca6404ad8d9e0b38b99a9999beb465169743f04fd17df7b1a52e38d05478806fa62a9701f001b07bba7fc31514b165b4c2e267302a2ad659e9cf6344389e76c173986aebd0b3fac73296fd1185b62d68686f6bfb5033d32180e9b85d44e3e618873a4fd88e2b96887ad0e6e1c4c55411b847b08e0aee993373dafbba14f8f02a553b3fd82a4093d920483cc41a043067e26d9a9aef8a7fe66d6c59547a19aa0b8d801396811c99780faad24eff20e93d5b2a0f89380e3ba9afcb4522023dd19ff08a65a4be932b8038a2a0291091f84458086116e8c8224c23f24ba870ee9c0e0c51f6df3d3336eca14ed671e3a014f5e6309716d447e9f56c3c340a98bf154075c1999f1d3a24d4539a6529f7fd411fd1faa04f335d3f5a27b6cbd29700d1dde4ad32bd33b7b0813c3155b0eb696957ff8f07e189faf15695d2c70b0ff307d31d8ea4ac5d59670bbcebdff54cc42b2ab6054f9995709fd2d22235a9cab719bcbe13b4510b67c727f6d1f3b5f5355a64039997999e94076482d839b21be9c63248825ea5a2ce7a81c2", 0x1000}, {&(0x7f0000000240)="b5a90456111473535c2e3f172c527e0553a83e1f31090b9850686ed86261fc090d7f8bb49eb7a87e71df6a1a7b27cd3d1849b940c2a15da37af046a4110ff7811c3e91b38945be5dbb56f73bccc9b370b66e06230521bd9ea8ac2de39f164dad49b9b9ddbfd0d8f387fd0e5aaed0ec34bab715ca7ae4ce4bec159753332ace0dab49d4bb2fc3bdbb2557e9be2b2760eb9562742ed55e8f62a7b06ec8141f32841de907db", 0xa4}, {&(0x7f00000003c0)="defe2e174f0984371da30a5cf89f11769dae0708dcd8988906ac5e56c433f0ee2f4450393a03d2aaded89a70f68ebab2dc38a1a9586d6cbbf45e30cdb000af6285ce02186d562ea1472d76a4008e9a9b889b4f0fc1e346ee4d64809d8815b0b288d07828645125e3bf422b6b77ef7b00430656f671ae296403bb8011a68e9c055bcc2489eec21bbe41edf49712eeee9037aa0867e4ea620991036d5a7188732f68911323ba7e0cc90b", 0xa9}], 0x3, 0x0) sendto$inet(r0, 0x0, 0x0, 0x20008800, &(0x7f00000000c0)={0x2, 0x4e20, @multicast1}, 0x10) sendto$inet(r0, &(0x7f0000000180), 0x144, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000003a40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2, 0x0) socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)) syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x414, 0x0) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x200, 0x20) pipe2(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r2 = socket$kcm(0xa, 0x122000000003, 0x11) sendmsg$kcm(r2, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) 14:15:29 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) [ 436.260349] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. 14:15:29 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r1, 0x84, 0x76, &(0x7f0000000040)={0x0, 0x28e}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f00000000c0)={r2, 0x7}, &(0x7f0000000100)=0x8) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400202) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0x0, 0x1ff}}, 0xa) 14:15:30 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$vbi(&(0x7f00000000c0)='/dev/vbi#\x00', 0x0, 0x2) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000140)=0x0) write$FUSE_LK(r1, &(0x7f00000001c0)={0x28, 0x0, 0x4, {{0x2, 0x8, 0x3, r2}}}, 0x28) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r3 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r3, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r3, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) [ 436.456277] Dead loop on virtual device ip6_vti0, fix it urgently! 14:15:31 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x0, 0x0) ioctl$VIDIOC_S_PRIORITY(r1, 0x40045644, 0x2) r2 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) shutdown(r3, 0x0) recvmmsg(r3, &(0x7f0000002100)=[{{0x0, 0x0, 0x0}}], 0x3ffffffffffff5a, 0x10100, 0x0) ioctl$CAPI_GET_PROFILE(r2, 0xc0404309, 0x0) 14:15:31 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(0xffffffffffffffff, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x28}}, 0x0) 14:15:31 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(0xffffffffffffffff, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x28}}, 0x0) 14:15:31 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) ioctl$PERF_EVENT_IOC_REFRESH(r1, 0x2402, 0x34) 14:15:31 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SNDRV_TIMER_IOCTL_GINFO(r1, 0xc0f85403, &(0x7f0000000240)={{0xffffffffffffffff, 0x3, 0x400, 0x1, 0x77e}, 0x2, 0x2, 'id1\x00', 'timer1\x00', 0x0, 0x81, 0xffffffff, 0x81, 0x3}) fsetxattr$trusted_overlay_redirect(r0, &(0x7f0000000140)='trusted.overlay.redirect\x00', &(0x7f00000001c0)='./file0\x00', 0x8, 0x2) r2 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r2, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r2, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) 14:15:31 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c41"], 0x3}}, 0x0) [ 437.939540] Dead loop on virtual device ip6_vti0, fix it urgently! [ 437.974378] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 14:15:31 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="240000002ae101002dbd7000fbdbdf2500000000", @ANYRES32=r3, @ANYBLOB="f2ff00000000ffff0e000d00"], 0x24}}, 0x20000010) [ 438.030239] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 438.064550] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 438.098287] Dead loop on virtual device ip6_vti0, fix it urgently! 14:15:31 executing program 0: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm-monitor\x00', 0x8000, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f0000000140), &(0x7f00000001c0)=0x4) socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r2 = socket$kcm(0xa, 0x122000000003, 0x11) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r0, 0x84, 0x6c, &(0x7f0000000200)={0x0, 0x3e, "1595b4a629c993e4d32ebbd43dd0b943ee10c2944c80c0b5d0b47647589bac86872fcbb16ceabd2415247bc99fa3f4e618d2370b95e65905b17eb57e6379"}, &(0x7f0000000280)=0x46) setsockopt$inet_sctp6_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f00000002c0)={r3, 0x8}, 0x8) setsockopt$sock_attach_bpf(r2, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r2, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000300)='/dev/full\x00', 0x0, 0x0) [ 438.140188] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. 14:15:31 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$KVM_SET_MP_STATE(r1, 0x4004ae99, &(0x7f0000000040)=0x6) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) 14:15:31 executing program 1: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000680)='/dev/snapshot\x00', 0x200220, 0x0) getsockopt$ARPT_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x0, 0x63, &(0x7f0000000600)={'TPROXY\x00'}, &(0x7f0000000640)=0x1e) socket$packet(0x11, 0x0, 0x300) ioctl$VIDIOC_ENUM_FREQ_BANDS(0xffffffffffffffff, 0xc0405665, &(0x7f00000005c0)={0x7d89f8ba, 0x6, 0x7f, 0x44, 0x5, 0x33, 0x8}) pipe2(0x0, 0x0) r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000440)='/proc/sys/net/ipv4/vs/snat_reroute\x00', 0x2, 0x0) r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000004c0)='TIPC\x00') sendmsg$TIPC_CMD_GET_MAX_PORTS(r0, &(0x7f0000000580)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x8020}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x1c, r1, 0x8, 0x70bd2c, 0x25dfdbfb}, 0x1c}}, 0x40) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(0xffffffffffffffff, 0x111, 0x3, 0x0, 0x4) ioctl$VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000180)={0x0, 0x6}) unlink(&(0x7f0000000280)='./bus\x00') r2 = socket$inet6_udp(0xa, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x349, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x1, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r2, 0x89a1, &(0x7f00000000c0)={@local={0xfe, 0x80, [0x1600, 0x3ef, 0x2000000, 0x3f00000000000000, 0x100000000000600, 0x0, 0x1103, 0x0, 0x0, 0x0, 0x0, 0x6]}}) prctl$PR_GET_FP_MODE(0x2e) ioctl$sock_inet6_SIOCADDRT(r2, 0x89a0, &(0x7f0000000040)={@local={0xfe, 0x80, [0x0, 0xfeff0000]}, @local, @local}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) ftruncate(0xffffffffffffffff, 0x0) write(0xffffffffffffffff, &(0x7f00000002c0)="60b7fdfefe5f021ce1eef846f2e3402518b4878718dba7bc53eaaec76281255a6d32f40eb26b15108f75cf531c785ec46fd4eca035aa274e01456277d142de586e0300f3046a957353d67c0266a97601e4a538a6cb7463b32137efa8bc601828341d945dfff47e0ade421675a0c3076bbd039ec4060f05965c5035356f520e2899008659e1fcbaca361da5c7ca5faa66b64f541c581a474eb2dec05831a3fc5c10535733ab4534bac96e6d46729211453ca25db42097a9ac0713ba", 0xbb) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x3f, &(0x7f0000000000), 0x4) openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000140)='/dev/dlm_plock\x00', 0x800, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/sequencer\x00', 0x200000, 0x0) ioctl$sock_FIOGETOWN(r2, 0x8903, &(0x7f0000000380)=0x0) setpgid(0x0, r3) syz_open_dev$sndpcmc(&(0x7f0000000200)='/dev/snd/pcmC#D#c\x00', 0xffffffffffffcd4b, 0x204006) openat$vfio(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vfio/vfio\x00', 0x1, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000400)='/dev/dlm-monitor\x00', 0x121080, 0x0) lchown(0x0, 0x0, 0x0) 14:15:31 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r1 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r1, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r1, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm-monitor\x00', 0x0, 0x0) ioctl$sock_inet6_udp_SIOCOUTQ(r2, 0x5411, &(0x7f0000000140)) 14:15:31 executing program 4: r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x28}}, 0x0) [ 438.461767] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 14:15:33 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x0, 0x0) ioctl$VIDIOC_S_PRIORITY(r1, 0x40045644, 0x2) r2 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) shutdown(r3, 0x0) recvmmsg(r3, &(0x7f0000002100)=[{{0x0, 0x0, 0x0}}], 0x3ffffffffffff5a, 0x10100, 0x0) ioctl$CAPI_GET_PROFILE(r2, 0xc0404309, 0x0) 14:15:33 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400201) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) 14:15:33 executing program 1: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000680)='/dev/snapshot\x00', 0x200220, 0x0) getsockopt$ARPT_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x0, 0x63, &(0x7f0000000600)={'TPROXY\x00'}, &(0x7f0000000640)=0x1e) socket$packet(0x11, 0x0, 0x300) ioctl$VIDIOC_ENUM_FREQ_BANDS(0xffffffffffffffff, 0xc0405665, &(0x7f00000005c0)={0x7d89f8ba, 0x6, 0x7f, 0x44, 0x5, 0x33, 0x8}) pipe2(0x0, 0x0) r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000440)='/proc/sys/net/ipv4/vs/snat_reroute\x00', 0x2, 0x0) r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000004c0)='TIPC\x00') sendmsg$TIPC_CMD_GET_MAX_PORTS(r0, &(0x7f0000000580)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x8020}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x1c, r1, 0x8, 0x70bd2c, 0x25dfdbfb}, 0x1c}}, 0x40) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(0xffffffffffffffff, 0x111, 0x3, 0x0, 0x4) ioctl$VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000180)={0x0, 0x6}) unlink(&(0x7f0000000280)='./bus\x00') r2 = socket$inet6_udp(0xa, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x349, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x1, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r2, 0x89a1, &(0x7f00000000c0)={@local={0xfe, 0x80, [0x1600, 0x3ef, 0x2000000, 0x3f00000000000000, 0x100000000000600, 0x0, 0x1103, 0x0, 0x0, 0x0, 0x0, 0x6]}}) prctl$PR_GET_FP_MODE(0x2e) ioctl$sock_inet6_SIOCADDRT(r2, 0x89a0, &(0x7f0000000040)={@local={0xfe, 0x80, [0x0, 0xfeff0000]}, @local, @local}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) ftruncate(0xffffffffffffffff, 0x0) write(0xffffffffffffffff, &(0x7f00000002c0)="60b7fdfefe5f021ce1eef846f2e3402518b4878718dba7bc53eaaec76281255a6d32f40eb26b15108f75cf531c785ec46fd4eca035aa274e01456277d142de586e0300f3046a957353d67c0266a97601e4a538a6cb7463b32137efa8bc601828341d945dfff47e0ade421675a0c3076bbd039ec4060f05965c5035356f520e2899008659e1fcbaca361da5c7ca5faa66b64f541c581a474eb2dec05831a3fc5c10535733ab4534bac96e6d46729211453ca25db42097a9ac0713ba", 0xbb) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x3f, &(0x7f0000000000), 0x4) openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000140)='/dev/dlm_plock\x00', 0x800, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/sequencer\x00', 0x200000, 0x0) ioctl$sock_FIOGETOWN(r2, 0x8903, &(0x7f0000000380)=0x0) setpgid(0x0, r3) syz_open_dev$sndpcmc(&(0x7f0000000200)='/dev/snd/pcmC#D#c\x00', 0xffffffffffffcd4b, 0x204006) openat$vfio(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vfio/vfio\x00', 0x1, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000400)='/dev/dlm-monitor\x00', 0x121080, 0x0) lchown(0x0, 0x0, 0x0) 14:15:33 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r1 = syz_open_dev$sndpcmp(&(0x7f00000000c0)='/dev/snd/pcmC#D#p\x00', 0x7f, 0x240040) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000140)={0x0, 0x7}, &(0x7f00000001c0)=0x8) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000200)={r2, @in6={{0xa, 0x4e22, 0x6, @remote, 0x1}}, 0x4, 0x7, 0x40, 0x0, 0x84}, &(0x7f00000002c0)=0x98) r3 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r3, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r3, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) 14:15:33 executing program 4: clone(0x40000, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc) r0 = inotify_init1(0x0) fcntl$setown(r0, 0x8, 0xffffffffffffffff) ioctl$SNDRV_TIMER_IOCTL_PVERSION(0xffffffffffffffff, 0x80045400, &(0x7f0000000040)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SNDRV_TIMER_IOCTL_INFO(0xffffffffffffffff, 0x80e85411, &(0x7f0000000140)=""/163) fcntl$getownex(r0, 0x10, &(0x7f00000000c0)={0x0, 0x0}) process_vm_readv(r1, &(0x7f0000000380)=[{&(0x7f0000000340)=""/61, 0x3d}], 0x1, &(0x7f0000002540)=[{&(0x7f00000003c0)=""/63, 0x7ffff002}], 0x1, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_rfcomm(0xffffffffffffffff, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, &(0x7f0000000140)={0x1, 0x0, &(0x7f0000000040)=""/32, &(0x7f0000000080)=""/137, &(0x7f00000001c0)=""/220, 0x6000}) write$P9_RXATTRWALK(0xffffffffffffffff, &(0x7f0000000180)={0xffffff3b, 0x9}, 0xf) 14:15:33 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c41"], 0x3}}, 0x0) [ 439.890634] ptrace attach of "/root/syz-executor.4"[11611] was attempted by "/root/syz-executor.4"[15580] 14:15:33 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000240)=@migrate={0x54, 0x21, 0x1, 0x0, 0x0, {{@in=@remote, @in6=@mcast1}}, [@migrate={0x4}]}, 0x54}}, 0x0) [ 439.939032] net_ratelimit: 5 callbacks suppressed [ 439.939039] Dead loop on virtual device ip6_vti0, fix it urgently! 14:15:33 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffff9, 0x31, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_GSI_ROUTING(r1, 0x4008ae6a, &(0x7f0000000040)) 14:15:33 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) 14:15:33 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ubi_ctrl\x00', 0xc02, 0x0) r1 = syz_open_dev$swradio(&(0x7f00000001c0)='/dev/swradio#\x00', 0x0, 0x2) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x4001ff) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r2 = socket$kcm(0xa, 0x122000000003, 0x11) r3 = dup3(r2, r0, 0x80000) setsockopt$sock_attach_bpf(r2, 0x29, 0x24, &(0x7f0000000200)=r3, 0xfffffffffffffffe) sendmsg$kcm(r2, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) 14:15:33 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e0469"], 0x3}}, 0x0) 14:15:33 executing program 1: pipe(&(0x7f0000000080)={0xffffffffffffffff}) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x40, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mknod(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) renameat(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) ioctl$FIONREAD(r0, 0x541b, &(0x7f00000005c0)) 14:15:35 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x0, 0x0) ioctl$VIDIOC_S_PRIORITY(r1, 0x40045644, 0x2) r2 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) shutdown(r3, 0x0) recvmmsg(r3, &(0x7f0000002100)=[{{0x0, 0x0, 0x0}}], 0x3ffffffffffff5a, 0x10100, 0x0) ioctl$CAPI_GET_PROFILE(r2, 0xc0404309, 0x0) 14:15:35 executing program 4: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(0x0, 0x0, 0x0, 0x0, 0x0) chdir(&(0x7f0000000380)='./file0\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='environ\x00') sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) 14:15:35 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) msync(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bind$bt_rfcomm(r1, &(0x7f0000000140)={0x1f, {0xffffffffffffffff, 0x1ff, 0x0, 0x1f}, 0x4}, 0xa) connect(r2, &(0x7f00000000c0)=@in6={0xa, 0x4e24, 0x8, @remote, 0x4}, 0x80) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, &(0x7f0000000040)=0x100) syz_genetlink_get_family_id$net_dm(&(0x7f0000000080)='NET_DM\x00') 14:15:35 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r1 = socket$kcm(0xa, 0x122000000003, 0x11) r2 = syz_open_dev$vcsa(&(0x7f00000003c0)='/dev/vcsa#\x00', 0x6, 0x40000) r3 = openat$null(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/null\x00', 0x0, 0x0) getsockopt$SO_TIMESTAMP(r3, 0x1, 0x23, &(0x7f0000000300), &(0x7f0000000340)=0x4) getsockopt$kcm_KCM_RECV_DISABLE(r3, 0x119, 0x1, &(0x7f0000000140), 0x4) getsockopt$netrom_NETROM_IDLE(r3, 0x103, 0x7, &(0x7f0000000280)=0x2, &(0x7f00000002c0)=0x4) setsockopt$sock_attach_bpf(r1, 0x29, 0x24, &(0x7f00000000c0)=r3, 0x4) setsockopt$TIPC_MCAST_BROADCAST(r2, 0x10f, 0x85) sendmsg$kcm(r1, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) ioctl$sock_inet_SIOCGARP(r3, 0x8954, &(0x7f0000000200)={{0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x28}}, {0x0, @local}, 0x2, {0x2, 0x4e24, @remote}, 'syz_tun\x00'}) 14:15:35 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000180), 0xc) ioctl$sock_bt_hci(r0, 0x800448d7, &(0x7f0000000000)) 14:15:35 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e0469"], 0x3}}, 0x0) 14:15:35 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r1 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r1, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r1, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vga_arbiter\x00', 0x80000, 0x0) write$P9_RSTAT(r2, &(0x7f0000000200)={0x67, 0x7d, 0x1, {0x0, 0x60, 0x10000, 0x8, {0x8, 0x4, 0x5}, 0x0, 0x9, 0x7, 0x0, 0x11, '/dev/vga_arbiter\x00', 0x11, '/dev/vga_arbiter\x00', 0x2, ':)', 0x9, 'vmnet1#\\['}}, 0x67) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000140)={0x5, 0x0, 0x0, 0x5}) ioctl$DRM_IOCTL_SG_ALLOC(r2, 0xc0106438, &(0x7f00000001c0)={0xffffffffffff699e, r3}) 14:15:35 executing program 1: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bind$bt_hci(r0, &(0x7f0000000140), 0xc) ioctl$sock_bt_hci(r0, 0x800448d7, 0x0) 14:15:35 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400202) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) 14:15:35 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000080), 0xc) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$sock_SIOCGIFCONF(r2, 0x8912, &(0x7f0000000140)) 14:15:35 executing program 4: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(0x0, 0x0, 0x0, 0x0, 0x0) chdir(&(0x7f0000000380)='./file0\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='environ\x00') sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) [ 441.794005] Dead loop on virtual device ip6_vti0, fix it urgently! 14:15:35 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r1 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r1, 0x29, 0x24, &(0x7f0000001480), 0x4) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcs\x00', 0x100, 0x0) write$UHID_CREATE2(r2, &(0x7f00000003c0)={0xb, 'syz0\x00', 'syz1\x00', 'syz0\x00', 0xc0, 0x3, 0x6, 0x100, 0x9, 0x9, "835ba3056dd960c914ba585665f3be5fdc86b6b59545adf04b998d1926b08673fcdb229710af4a836508e1ab793a7f58ca317cf47d08f1171ea355c743fdc86ac7541b921d92e0609a580e8556cf590c749c331b142831e5057cc9415cafebf43dbcbdd1432ea898f7837fc25bbc1278af28f3b493ad5aa168a52fa9113fc8f3fadcf077a730d65c7d4544a03b5515d5d7a497acff05421d4f8dd1ddca6d15d8ea8157765c0a230a76181087ba246776e0b0dc991e17a0bc23ac81054a15807f"}, 0x1d8) sendmsg$kcm(r1, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) [ 441.846807] Dead loop on virtual device ip6_vti0, fix it urgently! [ 441.937244] Dead loop on virtual device ip6_vti0, fix it urgently! 14:15:37 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x0, 0x0) ioctl$VIDIOC_S_PRIORITY(r1, 0x40045644, 0x2) fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) shutdown(r3, 0x0) recvmmsg(r3, &(0x7f0000002100)=[{{0x0, 0x0, 0x0}}], 0x3ffffffffffff5a, 0x10100, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 14:15:37 executing program 5: r0 = syz_open_dev$dspn(&(0x7f0000000080)='/dev/dsp#\x00', 0x1, 0x121000) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f00000000c0)={@rand_addr="d68abda22f4102893de0ca723a579926", 0x400, 0x2, 0xff, 0x0, 0x8, 0xffffffffffffff01}, &(0x7f0000000100)=0x20) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = fcntl$dupfd(r1, 0x0, r1) socketpair$unix(0x1, 0xffffffffffffffff, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r2, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) bind$bt_rfcomm(r1, &(0x7f0000000040)={0x1f, {0x4, 0x8, 0x3, 0x9, 0x1fffc0, 0x2}, 0x9}, 0xa) bind$bt_rfcomm(r2, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}, 0x4}, 0xfffffffffffffcaf) 14:15:37 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/hwrng\x00', 0x800, 0x0) ioctl$EVIOCSABS3F(r2, 0x401845ff, &(0x7f0000000200)={0x2, 0x4000000009, 0xfffffffffffffffc, 0x2000000007fff, 0x6, 0x80}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r3 = syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x1, 0x400000) write$P9_RSETATTR(r3, &(0x7f0000000140)={0x7, 0x1b, 0x2}, 0x7) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x6}, 0xb4) r4 = socket$kcm(0xa, 0x122000000003, 0x11) r5 = fcntl$getown(r0, 0x9) write$FUSE_LK(r3, &(0x7f0000000240)={0x28, 0xfffffffffffffff5, 0x8, {{0xfffffffffffff003, 0x0, 0x2, r5}}}, 0x28) setsockopt$sock_attach_bpf(r4, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r4, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) 14:15:37 executing program 1: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = creat(&(0x7f0000000180)='./file0\x00', 0x0) perf_event_open(&(0x7f00000000c0)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r1, 0x0) 14:15:37 executing program 4: mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mount(0x0, 0x0, 0x0, 0x0, 0x0) chdir(&(0x7f0000000380)='./file0\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='environ\x00') sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=ANY=[]}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x0) 14:15:37 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e0469"], 0x3}}, 0x0) 14:15:37 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$RTC_VL_READ(r1, 0x80047013, &(0x7f0000000040)) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) 14:15:37 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r1 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r1, 0x29, 0x24, &(0x7f0000001480), 0x297) sendmsg$kcm(r1, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) 14:15:37 executing program 1: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) prctl$PR_SET_DUMPABLE(0x4, 0x0) 14:15:37 executing program 4: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) fcntl$setlease(r0, 0x400, 0x4003) 14:15:37 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)) r0 = creat(&(0x7f00000001c0)='./file0\x00', 0x20) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x4001fd) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r1 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r1, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r1, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/btrfs-control\x00', 0x100, 0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r2, 0x10e, 0x1, &(0x7f0000000140)=0x15, 0x4) [ 443.591841] Dead loop on virtual device ip6_vti0, fix it urgently! 14:15:37 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) getsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000000c0), &(0x7f0000000100)=0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = fcntl$getown(r2, 0x9) ioctl$sock_FIOSETOWN(r0, 0x8901, &(0x7f00000001c0)=r3) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$KVM_SET_IDENTITY_MAP_ADDR(r1, 0x4008ae48, &(0x7f0000000180)=0x6001) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000040)) ioctl$KVM_GET_NR_MMU_PAGES(r1, 0xae45, 0x4) bind$bt_rfcomm(r1, &(0x7f0000000080)={0x1f, {0xffffffffffffffff, 0x1ff, 0x80000000}, 0x73}, 0xa) pipe2(&(0x7f0000000140), 0x84800) [ 443.678195] Dead loop on virtual device ip6_vti0, fix it urgently! [ 443.698467] Dead loop on virtual device ip6_vti0, fix it urgently! 14:15:38 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x0, 0x0) ioctl$VIDIOC_S_PRIORITY(r1, 0x40045644, 0x2) fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) recvmmsg(r3, &(0x7f0000002100)=[{{0x0, 0x0, 0x0}}], 0x3ffffffffffff5a, 0x10100, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 14:15:38 executing program 4: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) times(&(0x7f0000000000)) 14:15:38 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca50d5e0bcfe47bf070") perf_event_open(&(0x7f0000000280)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x9, 0xffffffffffffffff, 0x0) 14:15:38 executing program 0: prctl$PR_GET_KEEPCAPS(0x7) r0 = socket$inet6(0xa, 0x4, 0x654073eb) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000000140)={0x20}, 0x1) socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) getsockname$unix(r1, &(0x7f00000001c0)=@abs, &(0x7f00000000c0)=0x6e) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r3 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r3, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r3, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) 14:15:38 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) 14:15:38 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c88"], 0x3}}, 0x0) 14:15:38 executing program 1: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) shmctl$SHM_INFO(0x0, 0xe, &(0x7f0000000240)=""/95) 14:15:38 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/status\x00', 0x0, 0x0) ioctl$RNDADDTOENTCNT(r1, 0x40045201, &(0x7f00000001c0)=0x100) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r2 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r2, 0x29, 0x24, &(0x7f0000001480), 0x4) ioctl$SNDRV_CTL_IOCTL_POWER_STATE(r2, 0x800455d1, &(0x7f00000000c0)) sendmsg$kcm(r2, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) 14:15:38 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$VIDIOC_QUERYMENU(r1, 0xc02c5625, &(0x7f0000000040)={0x10001, 0x9, @value=0xff}) getsockopt$inet_sctp6_SCTP_STATUS(r1, 0x84, 0xe, &(0x7f0000000080)={0x0, 0xdd1, 0x7e0000000000000, 0x8, 0x4, 0x3, 0xcf3b, 0x52, {0x0, @in={{0x2, 0x4e24, @local}}, 0x8, 0xffffffff, 0x72, 0x7f, 0x9}}, &(0x7f0000000140)=0xb0) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r1, 0x84, 0x19, &(0x7f0000000180)={r3, 0x100000000}, 0x8) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) [ 445.228105] Dead loop on virtual device ip6_vti0, fix it urgently! 14:15:38 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f00003fefff)=""/1, 0x1) readv(r0, &(0x7f00000002c0)=[{&(0x7f0000cd8000)=""/1, 0x2e171c03}], 0x1) 14:15:38 executing program 1: r0 = creat(&(0x7f00000002c0)='./file0\x00', 0x0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$P9_RREMOVE(r1, &(0x7f0000000000)={0x86}, 0xffffffca) lseek(r0, 0x0, 0x3) 14:15:38 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) setsockopt$bt_hci_HCI_TIME_STAMP(r0, 0x0, 0x3, &(0x7f0000000040)=0x80000001, 0x4) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) setsockopt$ARPT_SO_SET_ADD_COUNTERS(r1, 0x0, 0x61, &(0x7f0000000100)={'filter\x00', 0x4}, 0x24) 14:15:39 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x0, 0x0) ioctl$VIDIOC_S_PRIORITY(r1, 0x40045644, 0x2) fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) recvmmsg(r3, &(0x7f0000002100)=[{{0x0, 0x0, 0x0}}], 0x3ffffffffffff5a, 0x10100, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 14:15:39 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r1 = socket$kcm(0xa, 0x122000000003, 0x11) sendmsg$kcm(r1, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) 14:15:39 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x7, 0x2c840) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xffffffffffffff20) 14:15:39 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clone(0x802102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) dup(0xffffffffffffffff) unshare(0x0) setns(0xffffffffffffffff, 0x0) lsetxattr$trusted_overlay_nlink(0x0, 0x0, 0x0, 0x0, 0x0) clone(0x70024100, 0x0, 0x0, 0x0, 0x0) gettid() tkill(0x0, 0x0) 14:15:39 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c88"], 0x3}}, 0x0) 14:15:39 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) socket$inet_udplite(0x2, 0x2, 0x88) prctl$PR_SET_FP_MODE(0x2d, 0x3) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r1 = socket$kcm(0xa, 0x122000000086, 0x11) recvfrom(r0, &(0x7f00000001c0)=""/163, 0xa3, 0x2041, &(0x7f0000000280)=@x25={0x9, @null=' \x00'}, 0x80) pipe2(&(0x7f0000000340)={0xffffffffffffffff}, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000003c0)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_LISTEN(r2, &(0x7f0000000440)={0x7, 0x8, 0xfa00, {r3, 0x3f}}, 0x10) r4 = syz_open_dev$mouse(&(0x7f00000000c0)='/dev/input/mouse#\x00', 0xa497, 0x4000) write$USERIO_CMD_SEND_INTERRUPT(r4, &(0x7f0000000140)={0x2, 0x8}, 0xfffffffffffffdf3) ioctl$SCSI_IOCTL_GET_PCI(r4, 0x5387, &(0x7f0000000480)) sendmsg$kcm(r1, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r4, 0x6, 0x15, &(0x7f0000000300)=0x7ff, 0x4) 14:15:39 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$SIOCX25CALLACCPTAPPRV(r1, 0x89e8) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0xfff) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) [ 446.082857] audit: type=1400 audit(1564496139.693:69): avc: denied { sys_admin } for pid=15761 comm="syz-executor.1" capability=21 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 14:15:39 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) bind$bt_l2cap(r1, &(0x7f0000000040)={0x1f, 0x100000000, {0x0, 0x1, 0x2, 0x1f, 0x400, 0x7}, 0x0, 0x401}, 0xe) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$RFKILL_IOCTL_NOINPUT(r1, 0x5201) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) 14:15:39 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r1 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/capi/capi20ncci\x00', 0x1c002, 0x0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000001c0)='TIPC\x00') sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r1, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x12}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r2, 0x2, 0x70bd2d, 0x25dfdbfb, {}, [""]}, 0x1c}}, 0x80) r3 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r3, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r3, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) [ 446.221263] Dead loop on virtual device ip6_vti0, fix it urgently! [ 446.240057] Dead loop on virtual device ip6_vti0, fix it urgently! 14:15:39 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) clock_getres(0xfffffffffffffffe, 0x0) 14:15:39 executing program 5: prctl$PR_MPX_DISABLE_MANAGEMENT(0x2c) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r1, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff}}, 0xa) 14:15:39 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000200)='/dev/vcs\x00', 0x84, 0x0) ioctl$CAPI_NCCI_OPENCOUNT(r1, 0x80044326, &(0x7f0000000140)=0x5) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={r1, 0x0, 0x0, 0x7}, 0x20) r2 = socket$kcm(0xa, 0x2, 0x11) setsockopt$sock_attach_bpf(r2, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r2, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) [ 446.830265] IPVS: ftp: loaded support on port[0] = 21 14:15:40 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x0, 0x0) ioctl$VIDIOC_S_PRIORITY(r1, 0x40045644, 0x2) fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) recvmmsg(r3, &(0x7f0000002100)=[{{0x0, 0x0, 0x0}}], 0x3ffffffffffff5a, 0x10100, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 14:15:40 executing program 4: clone(0x10000000800100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f00000021c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB="14eb0f34"], 0x4}}, 0x0) select(0x40, &(0x7f0000000140), &(0x7f0000000040)={0x5}, &(0x7f00000000c0)={0x0, 0x0, 0x6}, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x30) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000080)={0x0, 0x0, 0x0, {}, {}, @cond=[{}, {0x0, 0x0, 0x0, 0x40}]}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 14:15:40 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) migrate_pages(0x0, 0x2a, &(0x7f00000004c0)=0xfffffffffffffffe, &(0x7f0000000000)=0x2) ioctl$IMGETCOUNT(0xffffffffffffffff, 0x80044943, &(0x7f0000000100)) getpgrp(0xffffffffffffffff) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f0000000140)={0x0}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f0000000180)={r2}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r3 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r0, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r3, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180), 0x0, 0x0, 0xffffffffffffff25}, 0x0) [ 446.899451] ptrace attach of "/root/syz-executor.4"[15813] was attempted by "/root/syz-executor.4"[15814] 14:15:40 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x400, 0x800) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f0000000080)=[@in6={0xa, 0x4e21, 0x2, @ipv4={[], [], @broadcast}, 0x800}, @in6={0xa, 0x4e20, 0x6, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}, @in6={0xa, 0x4e22, 0x1, @local, 0x8}, @in={0x2, 0x4e22, @remote}, @in={0x2, 0x4e20, @local}], 0x74) r2 = fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$CAPI_GET_PROFILE(r2, 0xc0404309, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) bind$bt_rfcomm(r1, &(0x7f0000000100)={0x1f, {0xffffffffffffffff, 0x1, 0x267}}, 0xa) 14:15:40 executing program 4: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(r0) creat(&(0x7f0000000000)='./bus\x00', 0x0) rename(&(0x7f0000000280)='./bus\x00', &(0x7f0000000340)='./file0\x00') 14:15:40 executing program 1: 14:15:40 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c88"], 0x3}}, 0x0) 14:15:40 executing program 4: 14:15:40 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) timer_create(0x3, &(0x7f0000000100)={0x0, 0x17}, &(0x7f0000000040)) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000180)={'team0\x00'}) timer_settime(0x0, 0x1, &(0x7f0000000080)={{}, {0x0, 0xe4c}}, 0x0) 14:15:40 executing program 1: r0 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/policy\x00', 0x0, 0x0) r1 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, r1) r2 = perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x4000000000000, 0xffffffffffffffff) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f00000002c0)={&(0x7f0000a29000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000613000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000b1f000/0x9000)=nil, &(0x7f0000256000/0x4000)=nil, &(0x7f0000d1a000/0x1000)=nil, &(0x7f0000c02000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000cab000/0x3000)=nil, &(0x7f0000f56000/0x4000)=nil, &(0x7f00000001c0)="a43e47d409f8b26640898688af51a840b7952f70740406c4bcc92221d047adce3e3b17e9e79c392c892b031b5cff7b4ba349e7d24c89749a80a6256599ebb494560d60bac6fc9841712a74ed65bd79ae463b0dd5b4376e2a6553ac4af42ead7c2dda1124c97a8a5012e00f18c8b8775909fb74463d5cc505eb6df13aec067a2d526b4c7633fbb55f166ca5fdecef17f537a017d345e20efd0ee9639f201c65ecb3d009c31753ef1ba24faab7cac6e70af7b236e4da8a4350ce6885e9559bc18fd86bbc50ce6e6119f0dbf1da4d7573af6523dd36ec0f64e556fc952e", 0xdc, r2}, 0x68) munlock(&(0x7f0000ffd000/0x3000)=nil, 0x3000) mmap(&(0x7f00009fd000/0x600000)=nil, 0x600000, 0x2000007, 0x6031, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000a94000/0x2000)=nil, 0x2000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) munlockall() fgetxattr(r2, 0x0, 0x0, 0x0) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/current\x00', 0x2, 0x0) 14:15:40 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00\x00\x00\x00\x00\x05\x00'}) socket$inet(0x2, 0x0, 0x0) setsockopt$inet_msfilter(0xffffffffffffffff, 0x0, 0x29, 0x0, 0x0) 14:15:40 executing program 4: openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x2, 0x5, 0x0) setsockopt$sock_attach_bpf(r0, 0x1, 0x2c, &(0x7f00000001c0), 0xfce9) [ 447.670319] IPVS: ftp: loaded support on port[0] = 21 14:15:41 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x0, 0x0) ioctl$VIDIOC_S_PRIORITY(r1, 0x40045644, 0x2) fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) shutdown(0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000002100)=[{{0x0, 0x0, 0x0}}], 0x3ffffffffffff5a, 0x10100, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 14:15:41 executing program 4: 14:15:41 executing program 5: 14:15:41 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r2 = socket$kcm(0xa, 0x122000000002, 0x11) setsockopt$sock_attach_bpf(r2, 0x29, 0x24, &(0x7f0000001480), 0x4) ioctl$FS_IOC_ENABLE_VERITY(r0, 0x6685, &(0x7f00000003c0)={0x1, 0x8, 0x1000, 0xae, &(0x7f00000001c0)="6da1dd23005b2dbeaa66037868a865073d6fe48793bace4205c6745908cd2662ba6e651123e96378a45cbdbcb04c7fcfe6a8d528ebfff19aa013f146e39d9687bc565b618bc783bec74cad6d6e7e2f2e5bcf693d62f00e51e113c8624b509009d3512a1cb8ae3d1d73b0ed40e301d755d851e1b991aa46dcbc2ead4260a030760b1faab52e5dd8171c991b75c5ceb0a444fdf50bc0e82ff5772dc755581fba2ea63ab6fad694e569859ec25cdd53", 0x8a, 0x0, &(0x7f0000000280)="2941563d74d59aa3d0f6efc42fe0c371b1be124b7010eb69f7693dbe9739911bd8bbb3851fd9c8320a2bc3d0824f7294ca352d43ed94af4622138ce40b9a294eb073ec195f2b1d76d2c6d3bf16e437a0745b39ab727e7a024521bc716a003af755fd2a41c15dfd8bb49c85400b6f16b238c270fb04125c37f812f02e4ec4c4002070874e270f52cb55c7"}) sendmsg$kcm(r2, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) 14:15:41 executing program 5: 14:15:41 executing program 4: 14:15:41 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25"], 0x3}}, 0x0) 14:15:41 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x0, 0x0) ioctl$VIDIOC_S_PRIORITY(r1, 0x40045644, 0x2) fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) shutdown(0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000002100)=[{{0x0, 0x0, 0x0}}], 0x3ffffffffffff5a, 0x10100, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 14:15:41 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r1 = socket$kcm(0xa, 0x2, 0x11) setsockopt$sock_attach_bpf(r1, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r1, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) 14:15:41 executing program 1: 14:15:41 executing program 5: 14:15:41 executing program 4: 14:15:41 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$KDGKBMODE(r1, 0x4b44, &(0x7f0000000140)) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r2 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r2, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r2, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) openat$null(0xffffffffffffff9c, &(0x7f0000000200)='/dev/null\x00', 0x0, 0x0) ioctl$SIOCGIFMTU(r1, 0x8921, &(0x7f00000001c0)) 14:15:41 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x0, 0x0) ioctl$VIDIOC_S_PRIORITY(r1, 0x40045644, 0x2) fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) shutdown(0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000002100)=[{{0x0, 0x0, 0x0}}], 0x3ffffffffffff5a, 0x10100, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 14:15:41 executing program 5: 14:15:41 executing program 4: 14:15:41 executing program 1: 14:15:41 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x0, 0x0) ioctl$VIDIOC_S_PRIORITY(r1, 0x40045644, 0x2) fcntl$dupfd(r0, 0x0, r0) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) shutdown(r2, 0x0) recvmmsg(r2, &(0x7f0000002100)=[{{0x0, 0x0, 0x0}}], 0x3ffffffffffff5a, 0x10100, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) [ 448.248522] Dead loop on virtual device ip6_vti0, fix it urgently! [ 448.262388] Dead loop on virtual device ip6_vti0, fix it urgently! 14:15:42 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25"], 0x3}}, 0x0) 14:15:42 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm_plock\x00', 0x80000, 0x0) ioctl$TIOCLINUX3(r1, 0x541c, &(0x7f0000000140)) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r2 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r2, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r2, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) 14:15:42 executing program 5: 14:15:42 executing program 1: 14:15:42 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x151, 0x0, &(0x7f0000000200)=[@release={0x400c630e}], 0xfd34, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xc, 0x0, &(0x7f0000000300)=[@dead_binder_done], 0x0, 0x0, 0x0}) 14:15:42 executing program 1: 14:15:42 executing program 5: [ 448.952094] binder: 15915:15919 unknown command 0 [ 448.959385] Dead loop on virtual device ip6_vti0, fix it urgently! [ 448.970616] binder: 15915:15919 ioctl c0306201 200001c0 returned -22 14:15:42 executing program 4: [ 449.035297] Dead loop on virtual device ip6_vti0, fix it urgently! 14:15:42 executing program 1: 14:15:42 executing program 5: 14:15:42 executing program 4: 14:15:44 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x0, 0x0) ioctl$VIDIOC_S_PRIORITY(r1, 0x40045644, 0x2) fcntl$dupfd(r0, 0x0, r0) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) shutdown(r2, 0x0) recvmmsg(r2, &(0x7f0000002100)=[{{0x0, 0x0, 0x0}}], 0x3ffffffffffff5a, 0x10100, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) 14:15:44 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) openat$audio(0xffffffffffffff9c, &(0x7f0000000140)='/dev/audio\x00', 0xc2, 0x0) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) prctl$PR_SET_DUMPABLE(0x4, 0x2) ioctl$VIDIOC_S_PRIORITY(r1, 0x40045644, 0x3) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r2 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r2, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r2, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) 14:15:44 executing program 1: 14:15:44 executing program 5: 14:15:44 executing program 4: 14:15:44 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25"], 0x3}}, 0x0) 14:15:44 executing program 5: 14:15:44 executing program 1: 14:15:44 executing program 4: 14:15:44 executing program 5: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0xe, 0x4, 0x4, 0x5, 0x0, 0x1}, 0x2c) bpf$MAP_LOOKUP_ELEM(0x4, &(0x7f0000000180)={r0, &(0x7f0000000040), 0x0}, 0x18) [ 450.857542] Dead loop on virtual device ip6_vti0, fix it urgently! 14:15:44 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='comm\x00') ptrace$getregset(0x4204, 0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000002c0)=""/126, 0xb2}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0) writev(r0, &(0x7f0000000080), 0x5b) 14:15:44 executing program 0: socketpair$unix(0x1, 0x7, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) pipe2(&(0x7f00000000c0)={0xffffffffffffffff}, 0x84000) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0xfffffffffffffeb9, 0xfa00, {0x0, &(0x7f0000000300)={0xffffffffffffffff}, 0x200000106, 0x6}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r1, &(0x7f0000000240)={0x16, 0x98, 0xfa00, {&(0x7f0000000140), 0x0, r2, 0x10, 0x1, @ib={0x1b, 0x1f, 0x1f, {"30fabef7bafb37747213af2e63107fda"}, 0x5, 0x9, 0x1}}}, 0xa0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r3 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r3, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r3, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) [ 450.975760] Dead loop on virtual device ip6_vti0, fix it urgently! [ 451.007591] Dead loop on virtual device ip6_vti0, fix it urgently! 14:15:46 executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x0, 0x0) ioctl$VIDIOC_S_PRIORITY(r1, 0x40045644, 0x2) fcntl$dupfd(r0, 0x0, r0) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) shutdown(r2, 0x0) recvmmsg(r2, &(0x7f0000002100)=[{{0x0, 0x0, 0x0}}], 0x3ffffffffffff5a, 0x10100, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) 14:15:46 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x151, 0x0, &(0x7f0000000200)=[@release={0x400c630e}], 0xfd34, 0x0, 0x0}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 14:15:46 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) mknod(&(0x7f0000000040)='./bus\x00', 0x1000, 0x0) r1 = gettid() mknod(&(0x7f0000000180)='./file0\x00', 0x8001420, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) r3 = open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = open(&(0x7f0000000600)='./bus\x00', 0x2, 0x0) splice(r3, 0x0, r4, 0x0, 0x3d, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{0x0, 0x8}, {0x0, 0x989680}}, 0x0) tkill(r1, 0x13) write$UHID_INPUT2(r2, &(0x7f0000000640)=ANY=[@ANYBLOB], 0x1) 14:15:46 executing program 1: socket$inet_udplite(0x2, 0x2, 0x88) r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x28}}, 0x0) 14:15:46 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r1 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r1, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r1, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f00000000c0)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1000000000000205}, 0x0) 14:15:46 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a296"], 0x3}}, 0x0) 14:15:46 executing program 0: socketpair$unix(0x1, 0x8000000000001, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) r1 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r1, 0x29, 0x24, &(0x7f0000001480), 0x4) [ 452.556178] binder: 15976:15987 unknown command 0 [ 452.561433] binder: 15976:15987 ioctl c0306201 200001c0 returned -22 14:15:46 executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x0, 0x0) ioctl$VIDIOC_S_PRIORITY(r1, 0x40045644, 0x2) fcntl$dupfd(r0, 0x0, r0) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) shutdown(r2, 0x0) recvmmsg(r2, &(0x7f0000002100)=[{{0x0, 0x0, 0x0}}], 0x3ffffffffffff5a, 0x10100, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) [ 452.597793] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 452.681002] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. 14:15:46 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='cgroup.events\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_STREAM_STATUS(r2, 0x84, 0x74, &(0x7f00000001c0)=""/169, &(0x7f0000000140)=0xa9) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x7}, 0x20) ppoll(&(0x7f0000000300)=[{r0, 0x90}, {r0, 0x4}], 0x2, &(0x7f0000000340)={0x0, 0x1c9c380}, &(0x7f00000003c0)={0x5e82}, 0x8) r3 = socket$kcm(0xa, 0x122000000003, 0x11) setsockopt$sock_attach_bpf(r3, 0x29, 0x24, &(0x7f0000001480), 0x4) sendmsg$kcm(r3, &(0x7f0000000000)={&(0x7f0000000040)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="035db86376863a68fe800000000000004208c349d7c40346d59be131ad18d92c2bca9d7f6e6a6ac7d6", 0x29}], 0x1}, 0x0) ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f00000002c0)={0x6000, &(0x7f0000000280), 0x6, r2, 0x8}) setsockopt$inet_sctp_SCTP_EVENTS(r2, 0x84, 0xb, &(0x7f0000000400)={0x0, 0x7fff, 0x9, 0x20, 0x80000000, 0x0, 0xfff, 0x5, 0x8000, 0x8, 0x3}, 0xb) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000440)={{{@in6=@remote, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in=@broadcast}}, &(0x7f0000000540)=0xe8) setsockopt$inet_mreqn(r2, 0x0, 0x20, &(0x7f0000000580)={@empty, @initdev={0xac, 0x1e, 0x0, 0x0}, r4}, 0xc) 14:15:46 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0xfffffffffffffffc, r0) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r1, 0x6, 0x15, &(0x7f00000001c0)=0x1, 0x4) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) ioctl$RTC_EPOCH_SET(r1, 0x4008700e, 0xd430) write$P9_RXATTRWALK(r1, &(0x7f0000000180)={0x100000520, 0x9, 0x0, 0x8000}, 0xf) setsockopt$llc_int(r1, 0x10c, 0x3, &(0x7f0000000140)=0x3, 0x4) fsetxattr$trusted_overlay_upper(r1, &(0x7f0000000080)='trusted.overlay.upper\x00', &(0x7f00000000c0)=ANY=[@ANYBLOB="eee5676dd3fa0e5a76850000000000000000"], 0x15, 0x3) ioctl$sock_inet6_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000100)) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000040)={0x0, 0x3, 0x100000000, 0x1f}) 14:15:46 executing program 5 (fault-call:2 fault-nth:0): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) [ 452.808715] Dead loop on virtual device ip6_vti0, fix it urgently! 14:15:46 executing program 0 (fault-call:7 fault-nth:0): r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) [ 452.850673] Dead loop on virtual device ip6_vti0, fix it urgently! [ 452.887032] FAULT_INJECTION: forcing a failure. [ 452.887032] name failslab, interval 1, probability 0, space 0, times 0 [ 452.922572] CPU: 0 PID: 16014 Comm: syz-executor.5 Not tainted 4.14.134 #30 [ 452.929712] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 452.939075] Call Trace: [ 452.941675] dump_stack+0x138/0x19c [ 452.945320] should_fail.cold+0x10f/0x159 [ 452.949478] ? format_decode+0x1d8/0x930 [ 452.953544] should_failslab+0xdb/0x130 [ 452.957523] kmem_cache_alloc_node+0x56/0x780 [ 452.962023] ? vsnprintf+0x290/0x1560 [ 452.965824] __alloc_skb+0x9c/0x500 [ 452.969453] ? skb_scrub_packet+0x4b0/0x4b0 [ 452.973869] ? find_held_lock+0x35/0x130 [ 452.977933] ? lock_sock_nested+0x9e/0x110 [ 452.982178] send_monitor_note+0xca/0x420 [ 452.986335] ? create_monitor_ctrl_close+0x460/0x460 [ 452.991443] ? security_capable+0x8e/0xc0 [ 452.995601] hci_sock_bind+0x8bf/0xe50 [ 452.999491] ? kasan_check_write+0x14/0x20 [ 453.003729] ? hci_sock_ioctl+0x650/0x650 [ 453.007886] ? security_socket_bind+0x89/0xb0 [ 453.012387] SYSC_bind+0x1d3/0x220 [ 453.015931] ? move_addr_to_kernel.part.0+0x100/0x100 [ 453.021129] ? fput+0xd4/0x150 [ 453.024318] ? SyS_write+0x15e/0x230 [ 453.028164] SyS_bind+0x24/0x30 [ 453.031452] ? SyS_socketpair+0x4d0/0x4d0 [ 453.035600] do_syscall_64+0x1e8/0x640 [ 453.039514] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 453.044362] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 453.049550] RIP: 0033:0x459829 [ 453.052737] RSP: 002b:00007f8708d4fc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000031 [ 453.060445] RAX: ffffffffffffffda RBX: 00007f8708d4fc90 RCX: 0000000000459829 [ 453.067717] RDX: 000000000000000a RSI: 0000000020000000 RDI: 0000000000000005 [ 453.075163] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 453.082430] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8708d506d4 [ 453.089702] R13: 00000000004bf96a R14: 00000000004d13e0 R15: 0000000000000003 14:15:49 executing program 2: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x0, 0x0) ioctl$VIDIOC_S_PRIORITY(r0, 0x40045644, 0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) shutdown(r2, 0x0) recvmmsg(r2, &(0x7f0000002100)=[{{0x0, 0x0, 0x0}}], 0x3ffffffffffff5a, 0x10100, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 14:15:49 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000004000/0x1000)=nil, 0x1000, 0x8, 0x20014, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) sendto$llc(r2, &(0x7f0000000240)="f48bec85daa1d3fa902bdd884bc5ffa6194a5ed78425412e1113d53b3aa9c875b0881b60ebdd196c707a694a257dbd40c66c77e75925e7e29b5a5c393a6720855d1a9c119a16db656dcfd317dee504a36f1d5c04193ce800f795b15eae86cba5fdf7f55364185a1fc580ed2cb9a44d0055b1884d57b15287bfe4141876c0f6165ad2c7ff05716325e57da790ad0b3ff02b473ebc804f98a6adb32776f7dc8976fc7ccf4f67e4cf05bbb4490542f3acd85ce343d7c4cb15ff5d472c89", 0xbc, 0x4000, &(0x7f0000000040)={0x1a, 0x339, 0x80, 0x1716000000, 0x6, 0x4, @random="8abd67a93f08"}, 0x10) ioctl$sock_bt_hidp_HIDPCONNDEL(r2, 0x400448c9, &(0x7f00000000c0)={{0x3, 0x100000001, 0x101, 0x80, 0x9, 0x20}, 0xfffffffffffffffa}) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000300)={0x1, 0xfffffffffffffff8, 0x6, 0x3, 0x6}, 0x14) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) socketpair$tipc(0x1e, 0x7, 0x0, &(0x7f0000000340)) socketpair$unix(0x1, 0x100000800001, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="4cb5e41d65d647926c0859277c477345978d8df958ad603b0be1effc27f43833a1b125bc89f22cb6287e556533de8f62a715d2b55aec4debd644b4a827ed358ae0f65ceb75ea084b629622c6e05835465658", @ANYRES64=0x0], 0x0, 0x0, 0x0}) 14:15:49 executing program 5 (fault-call:2 fault-nth:1): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) 14:15:49 executing program 1 (fault-call:6 fault-nth:0): r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) 14:15:49 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a296"], 0x3}}, 0x0) [ 455.838386] binder: 16025:16032 unknown command 0 [ 455.846243] binder: 16026:16031 unknown command 501527884 [ 455.852878] binder: 16026:16031 ioctl c0306201 20000180 returned -22 [ 455.859565] binder: 16025:16032 ioctl c0306201 20000180 returned -22 [ 455.866990] FAULT_INJECTION: forcing a failure. [ 455.866990] name failslab, interval 1, probability 0, space 0, times 0 [ 455.884505] CPU: 0 PID: 16033 Comm: syz-executor.5 Not tainted 4.14.134 #30 [ 455.892505] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 455.901856] Call Trace: [ 455.904453] dump_stack+0x138/0x19c [ 455.908103] should_fail.cold+0x10f/0x159 [ 455.912256] should_failslab+0xdb/0x130 [ 455.916232] kmem_cache_alloc_node_trace+0x5a/0x770 [ 455.921253] ? rcu_lockdep_current_cpu_online+0xf2/0x140 [ 455.926721] __kmalloc_node_track_caller+0x3d/0x80 [ 455.931745] __kmalloc_reserve.isra.0+0x40/0xe0 [ 455.936415] __alloc_skb+0xcf/0x500 [ 455.946654] ? skb_scrub_packet+0x4b0/0x4b0 [ 455.954308] ? find_held_lock+0x35/0x130 [ 455.958371] ? lock_sock_nested+0x9e/0x110 [ 455.963130] send_monitor_note+0xca/0x420 [ 455.967284] ? create_monitor_ctrl_close+0x460/0x460 [ 455.972394] ? security_capable+0x8e/0xc0 [ 455.976580] hci_sock_bind+0x8bf/0xe50 [ 455.978169] binder: 16026:16038 unknown command 501527884 [ 455.980470] ? kasan_check_write+0x14/0x20 [ 455.980481] ? hci_sock_ioctl+0x650/0x650 [ 455.980496] ? security_socket_bind+0x89/0xb0 [ 455.980508] SYSC_bind+0x1d3/0x220 [ 455.980517] ? move_addr_to_kernel.part.0+0x100/0x100 [ 455.980534] ? fput+0xd4/0x150 [ 455.980545] ? SyS_write+0x15e/0x230 [ 455.980559] SyS_bind+0x24/0x30 [ 455.995835] binder: 16026:16038 ioctl c0306201 20000180 returned -22 [ 455.998937] ? SyS_socketpair+0x4d0/0x4d0 [ 455.998952] do_syscall_64+0x1e8/0x640 [ 455.998962] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 455.998980] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 456.043053] RIP: 0033:0x459829 [ 456.046247] RSP: 002b:00007f8708d4fc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000031 [ 456.053960] RAX: ffffffffffffffda RBX: 00007f8708d4fc90 RCX: 0000000000459829 [ 456.061229] RDX: 000000000000000a RSI: 0000000020000000 RDI: 0000000000000005 [ 456.068597] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 456.075871] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8708d506d4 14:15:49 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/enforce\x00', 0x8800, 0x0) getsockopt$inet_sctp_SCTP_NODELAY(r1, 0x84, 0x3, &(0x7f0000000240), &(0x7f0000000280)=0x4) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r1, 0x84, 0x70, &(0x7f00000004c0)={0x0, @in6={{0xa, 0x4e22, 0x100000001, @mcast2, 0x81}}, [0x7ff, 0x20, 0x414272bd, 0x100, 0x7ff, 0x5, 0x100000000, 0x5, 0x0, 0x7fffffff, 0x6, 0x3, 0x6, 0x5, 0x1]}, &(0x7f00000003c0)=0x100) setsockopt$inet_sctp_SCTP_AUTH_KEY(r1, 0x84, 0x17, &(0x7f00000005c0)={r3, 0x5, 0xc8, "9ed82b82e0faf0018787b22ccf74ba89202405b4b456572d2b7ce3bcbfd8ebba6038ac281fc0ddf5a7a5612e62f759bb41debef50972459c6444ea932b2b91071453fb7c50d9edc97f7829fbdfd160272a764d207b85187f711905060d6342348aaf7b2403e0f1c069a54e7ed98701fa882610aa3cdf651a0ee30c5e625c823456541cd4ba349dec931726ea20467c8544703858646328c35dad0808fc59f23c9c063e354d8b13564f249b03b47b8efb56ff396f34463d67e5c4adbabee914bfcee623dde2d5c65d"}, 0xd0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400000, 0x0) lseek(r2, 0x0, 0x4) ioctl$SNDRV_RAWMIDI_IOCTL_DRAIN(r4, 0x40045731, &(0x7f00000000c0)=0x2) sendto$unix(r4, &(0x7f0000000300)="59349219c9c55559251a6bad592a756fa7dac3a6237e833a1719b83284100aab2fac977008bc", 0x26, 0x800, &(0x7f0000000340)=@file={0x0, './file0\x00'}, 0x6e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) fsetxattr(r0, &(0x7f0000000100)=@random={'osx.', '/dev/sequencer\x00'}, &(0x7f00000001c0)='\x00', 0x1, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11f2", @ANYRES64=0x0], 0x0, 0x0, 0x0}) 14:15:49 executing program 4 (fault-call:2 fault-nth:0): r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/fscreate\x00', 0x2, 0x0) write$binfmt_misc(r0, &(0x7f0000000040)={'syz1'}, 0x4) creat(&(0x7f0000000100)='./file0\x00', 0x0) [ 456.083147] R13: 00000000004bf96a R14: 00000000004d13e0 R15: 0000000000000003 14:15:49 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00634040d2bb80af2f91b5d6344ca95a46bc579937c11ac74e60b7808398595dfd5606958a00c10faa2b3ebc4580ea91c3062b1a0b09b7e0ee77344dc5ca00000000d7db28fadf2a1222cd6e0e12f881905d9731cdafe7b358f69e499630074cfb3d42b5e9ca4a4ca4bc6d01cf23c10243ce7905d252ebce4d921370f9757b62f2f5e3bee0d41899fd5cf0b6a9faac"], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) 14:15:49 executing program 5 (fault-call:2 fault-nth:2): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) 14:15:49 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0xffffffffffffffff, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="9a5c1f694b04"], 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000000100)={0x7, 0x4, 0x206, 0x1, 0x9, 0x1ff, 0xfff, 0x8001, 0x0}, &(0x7f00000001c0)=0x20) setsockopt$inet_sctp_SCTP_AUTH_KEY(r0, 0x84, 0x17, &(0x7f0000000300)={r2, 0x9, 0xe2, "6e60595057e0df7802964b045554b9b099b2670b7794933984d70e06371c68bd2859664f330b0532997d3d8db9b5120887d57ad39a6a8ea1fe56fa797d5be06fe20324ff4e0ed86c4064246c5fa22f6130eb0c06625c985b68f7c1af7a990aaa8f3e351ed58374874efe6fecf6cf58e96b8184c78a2a9784b80e0abdfab2f9640e6249bd5a56ace10ed358bb434732b3c6bcb3769e7d14244dd25ed479b0aa7e9d21a33afafd9f47b06f333ecd2f4245e343ccbbe01e4983bbe29439ddcf89c24b9e8b33ead9f4479e383e00a46a4519e2cd1d611cf611225f10a06d3ec775ea7a35"}, 0xea) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)) openat$mixer(0xffffffffffffff9c, &(0x7f0000000200)='/dev/mixer\x00', 0x20000, 0x0) openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/dlm_plock\x00', 0x410403, 0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000280)='/dev/hwrng\x00', 0x101000, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x8001) mincore(&(0x7f0000001000/0x3000)=nil, 0x3000, &(0x7f0000000080)=""/19) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) [ 456.198119] binder: 16042:16046 unknown command 61969 [ 456.203946] binder: 16042:16046 ioctl c0306201 20000180 returned -22 [ 456.211885] FAULT_INJECTION: forcing a failure. [ 456.211885] name failslab, interval 1, probability 0, space 0, times 0 [ 456.259311] FAULT_INJECTION: forcing a failure. [ 456.259311] name failslab, interval 1, probability 0, space 0, times 0 [ 456.265290] binder: 16045:16050 unknown command 0 [ 456.281907] CPU: 0 PID: 16047 Comm: syz-executor.4 Not tainted 4.14.134 #30 [ 456.289030] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 456.298393] Call Trace: [ 456.300988] dump_stack+0x138/0x19c [ 456.304625] should_fail.cold+0x10f/0x159 [ 456.308782] should_failslab+0xdb/0x130 [ 456.312763] kmem_cache_alloc+0x2d7/0x780 [ 456.316924] getname_flags+0xcb/0x580 [ 456.320732] getname+0x1a/0x20 [ 456.323932] do_sys_open+0x1e7/0x430 [ 456.327821] ? filp_open+0x70/0x70 [ 456.331367] ? do_syscall_64+0x53/0x640 [ 456.335338] SyS_creat+0x27/0x30 [ 456.338703] ? compat_SyS_openat+0x40/0x40 [ 456.341124] binder: 16045:16050 ioctl c0306201 20000180 returned -22 [ 456.342935] do_syscall_64+0x1e8/0x640 [ 456.342946] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 456.342964] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 456.342973] RIP: 0033:0x459829 [ 456.342979] RSP: 002b:00007f531f52cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000055 [ 456.342991] RAX: ffffffffffffffda RBX: 00007f531f52cc90 RCX: 0000000000459829 [ 456.342997] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000100 [ 456.343002] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 456.343011] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f531f52d6d4 [ 456.403297] R13: 00000000004bfe84 R14: 00000000004d1c80 R15: 0000000000000004 [ 456.412316] CPU: 0 PID: 16051 Comm: syz-executor.5 Not tainted 4.14.134 #30 [ 456.419459] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 456.428833] Call Trace: [ 456.431438] dump_stack+0x138/0x19c [ 456.435077] should_fail.cold+0x10f/0x159 [ 456.439226] ? format_decode+0x1d8/0x930 [ 456.443292] should_failslab+0xdb/0x130 [ 456.447277] kmem_cache_alloc_node+0x56/0x780 [ 456.451956] ? vsnprintf+0x290/0x1560 [ 456.455764] __alloc_skb+0x9c/0x500 [ 456.459389] ? skb_scrub_packet+0x4b0/0x4b0 [ 456.463493] binder: BINDER_SET_CONTEXT_MGR already set [ 456.463712] send_monitor_note+0xca/0x420 [ 456.468980] binder: 16045:16050 ioctl 40046207 0 returned -16 [ 456.473114] ? create_monitor_ctrl_close+0x460/0x460 [ 456.473126] ? security_capable+0x8e/0xc0 [ 456.473141] hci_sock_bind+0x8d8/0xe50 [ 456.473151] ? kasan_check_write+0x14/0x20 [ 456.473160] ? hci_sock_ioctl+0x650/0x650 [ 456.473170] ? security_socket_bind+0x89/0xb0 [ 456.473182] SYSC_bind+0x1d3/0x220 [ 456.473192] ? move_addr_to_kernel.part.0+0x100/0x100 [ 456.473212] ? fput+0xd4/0x150 [ 456.473222] ? SyS_write+0x15e/0x230 [ 456.473237] SyS_bind+0x24/0x30 [ 456.473244] ? SyS_socketpair+0x4d0/0x4d0 [ 456.473257] do_syscall_64+0x1e8/0x640 [ 456.473269] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 456.492160] binder: 16045:16060 unknown command 0 [ 456.492241] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 456.505990] binder: 16045:16060 ioctl c0306201 20000180 returned -22 [ 456.508610] RIP: 0033:0x459829 14:15:50 executing program 4 (fault-call:2 fault-nth:1): r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/fscreate\x00', 0x2, 0x0) write$binfmt_misc(r0, &(0x7f0000000040)={'syz1'}, 0x4) creat(&(0x7f0000000100)='./file0\x00', 0x0) [ 456.508616] RSP: 002b:00007f8708d4fc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000031 [ 456.508628] RAX: ffffffffffffffda RBX: 00007f8708d4fc90 RCX: 0000000000459829 [ 456.508635] RDX: 000000000000000a RSI: 0000000020000000 RDI: 0000000000000005 [ 456.508641] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 456.508646] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8708d506d4 [ 456.508656] R13: 00000000004bf96a R14: 00000000004d13e0 R15: 0000000000000003 14:15:50 executing program 0: r0 = syz_open_dev$sndpcmc(&(0x7f0000000080)='/dev/snd/pcmC#D#c\x00', 0x7, 0x80040) setns(r0, 0x8000000) r1 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) [ 456.684125] binder: 16063:16067 unknown command 0 [ 456.710840] binder: 16063:16067 ioctl c0306201 20000180 returned -22 [ 456.743694] FAULT_INJECTION: forcing a failure. [ 456.743694] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 456.755537] CPU: 0 PID: 16070 Comm: syz-executor.4 Not tainted 4.14.134 #30 [ 456.762639] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 456.772016] Call Trace: [ 456.774617] dump_stack+0x138/0x19c [ 456.778253] should_fail.cold+0x10f/0x159 [ 456.782413] __alloc_pages_nodemask+0x1d6/0x7a0 [ 456.787090] ? fs_reclaim_acquire+0x20/0x20 [ 456.791414] ? __alloc_pages_slowpath+0x2930/0x2930 [ 456.796441] cache_grow_begin+0x80/0x400 [ 456.800510] kmem_cache_alloc+0x6a6/0x780 [ 456.805194] getname_flags+0xcb/0x580 [ 456.809016] ? _raw_spin_unlock_irq+0x5e/0x90 [ 456.813518] getname+0x1a/0x20 [ 456.816717] do_sys_open+0x1e7/0x430 [ 456.820434] ? filp_open+0x70/0x70 [ 456.823977] ? do_syscall_64+0x53/0x640 [ 456.827950] SyS_creat+0x27/0x30 [ 456.831314] ? compat_SyS_openat+0x40/0x40 [ 456.835544] do_syscall_64+0x1e8/0x640 [ 456.839424] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 456.844270] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 456.849452] RIP: 0033:0x459829 [ 456.852635] RSP: 002b:00007f531f52cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000055 [ 456.860431] RAX: ffffffffffffffda RBX: 00007f531f52cc90 RCX: 0000000000459829 [ 456.867707] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000100 [ 456.875073] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 456.882347] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f531f52d6d4 [ 456.890150] R13: 00000000004bfe84 R14: 00000000004d1c80 R15: 0000000000000004 14:15:51 executing program 2: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) shutdown(r1, 0x0) recvmmsg(r1, &(0x7f0000002100)=[{{0x0, 0x0, 0x0}}], 0x3ffffffffffff5a, 0x10100, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 14:15:51 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="08e34040"], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r3 = syz_open_dev$media(&(0x7f0000000080)='/dev/media#\x00', 0x8, 0x2) write$vhci(r3, &(0x7f0000000100)=@HCI_ACLDATA_PKT={0x2, "826818562ca05db4f32f949618aad4f0df6f1600a245c9fbaa4bc3e59c83b968547739ec4ffd0c95533d4b9940577731291fa62885e164015858701d"}, 0x3d) ioctl$SIOCRSSCAUSE(r3, 0x89e1, &(0x7f00000000c0)=0x7) setsockopt$IPT_SO_SET_ADD_COUNTERS(r3, 0x0, 0x41, &(0x7f00000001c0)={'security\x00', 0x4, [{}, {}, {}, {}]}, 0x68) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) 14:15:51 executing program 5 (fault-call:2 fault-nth:3): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) 14:15:51 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a296"], 0x3}}, 0x0) 14:15:51 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = syz_open_dev$adsp(&(0x7f0000000080)='/dev/adsp#\x00', 0x7fffffff, 0x40201) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_GET(r2, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000001c0)={&(0x7f00000004c0)={0x22c, r3, 0x1, 0x70bd26, 0x25dfdbfb, {}, [@TIPC_NLA_SOCK={0x28, 0x2, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0xeb}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x6}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0xfffffffffffff198}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_NODE={0xc, 0x6, [@TIPC_NLA_NODE_ADDR={0x8}]}, @TIPC_NLA_MEDIA={0x98, 0x5, [@TIPC_NLA_MEDIA_PROP={0x54, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4dc2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1f}]}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7ad}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x100}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_SOCK={0x34, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x7}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x9}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x28ff}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0xfffffffeffffffff}]}, @TIPC_NLA_MON={0x24, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x7fff}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x40}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x80000000}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x5}]}, @TIPC_NLA_MEDIA={0xd0, 0x5, [@TIPC_NLA_MEDIA_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xc}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xa715}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x40}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xce}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}]}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7fe}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80000000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8340}]}]}, @TIPC_NLA_SOCK={0x24, 0x2, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x401}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x1}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0xffffffff}]}]}, 0x22c}, 0x1, 0x0, 0x0, 0x8004}, 0x800) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xffffffac, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="0340f76eb0782c43865ef532637fc787f73c58be73fd1789c198ea93c09d97d40f8f66e7c9e8984f1c0f7f00000000000000b8bdb698ad3da6beb39d58aa298d0169d85ed31098fd02c7cb7e8658e7237cac2a8fb3ac6d1200"/105, @ANYRES64=0x0], 0x25f, 0x0, 0x0}) 14:15:51 executing program 4 (fault-call:2 fault-nth:2): r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/fscreate\x00', 0x2, 0x0) write$binfmt_misc(r0, &(0x7f0000000040)={'syz1'}, 0x4) creat(&(0x7f0000000100)='./file0\x00', 0x0) [ 458.125571] FAULT_INJECTION: forcing a failure. [ 458.125571] name failslab, interval 1, probability 0, space 0, times 0 [ 458.133195] binder: 16075:16085 unknown command 1077994248 [ 458.144398] FAULT_INJECTION: forcing a failure. [ 458.144398] name failslab, interval 1, probability 0, space 0, times 0 [ 458.156434] CPU: 0 PID: 16083 Comm: syz-executor.4 Not tainted 4.14.134 #30 [ 458.163558] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 458.172938] Call Trace: [ 458.175617] dump_stack+0x138/0x19c [ 458.175637] should_fail.cold+0x10f/0x159 [ 458.175655] should_failslab+0xdb/0x130 [ 458.175672] kmem_cache_alloc+0x2d7/0x780 [ 458.187394] ? rcu_lockdep_current_cpu_online+0xf2/0x140 [ 458.187410] ? check_preemption_disabled+0x3c/0x250 [ 458.187426] selinux_file_alloc_security+0xb4/0x190 [ 458.187439] security_file_alloc+0x6d/0xa0 [ 458.187452] get_empty_filp+0x130/0x3b0 [ 458.207135] path_openat+0x8f/0x3f70 [ 458.207149] ? entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 458.207161] ? get_pid_task+0x98/0x140 [ 458.207176] ? save_trace+0x290/0x290 [ 458.207189] ? path_lookupat.isra.0+0x7b0/0x7b0 [ 458.228385] ? __lock_is_held+0xb6/0x140 [ 458.228398] ? save_trace+0x290/0x290 [ 458.228412] ? __alloc_fd+0x1d4/0x4a0 [ 458.228425] do_filp_open+0x18e/0x250 [ 458.228434] ? __alloc_fd+0x1d4/0x4a0 [ 458.228445] ? may_open_dev+0xe0/0xe0 [ 458.248614] ? lock_downgrade+0x6e0/0x6e0 [ 458.248632] ? _raw_spin_unlock+0x2d/0x50 [ 458.248644] ? __alloc_fd+0x1d4/0x4a0 [ 458.248669] do_sys_open+0x2c5/0x430 [ 458.268489] ? filp_open+0x70/0x70 [ 458.268505] ? do_syscall_64+0x53/0x640 [ 458.268517] SyS_creat+0x27/0x30 [ 458.286880] ? compat_SyS_openat+0x40/0x40 [ 458.286894] do_syscall_64+0x1e8/0x640 [ 458.286904] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 458.286922] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 458.286931] RIP: 0033:0x459829 [ 458.286939] RSP: 002b:00007f531f52cc78 EFLAGS: 00000246 [ 458.308431] ORIG_RAX: 0000000000000055 [ 458.308439] RAX: ffffffffffffffda RBX: 00007f531f52cc90 RCX: 0000000000459829 [ 458.308444] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000100 [ 458.308450] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 458.308456] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f531f52d6d4 [ 458.308463] R13: 00000000004bfe84 R14: 00000000004d1c80 R15: 0000000000000004 [ 458.315458] binder: 16075:16085 ioctl c0306201 20000040 returned -22 [ 458.327139] CPU: 1 PID: 16080 Comm: syz-executor.5 Not tainted 4.14.134 #30 [ 458.334934] binder: 16075:16087 unknown command 0 [ 458.340244] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 458.340250] Call Trace: [ 458.340268] dump_stack+0x138/0x19c [ 458.340284] should_fail.cold+0x10f/0x159 [ 458.340291] ? number+0x756/0xa50 [ 458.340305] should_failslab+0xdb/0x130 [ 458.340317] kmem_cache_alloc_node_trace+0x5a/0x770 [ 458.340336] ? rcu_lockdep_current_cpu_online+0xf2/0x140 [ 458.347790] binder: 16075:16087 ioctl c0306201 20000180 returned -22 [ 458.354888] __kmalloc_node_track_caller+0x3d/0x80 14:15:52 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x5, 0x16, r0, 0x100000) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) [ 458.354905] __kmalloc_reserve.isra.0+0x40/0xe0 [ 458.354917] __alloc_skb+0xcf/0x500 [ 458.354925] ? skb_scrub_packet+0x4b0/0x4b0 [ 458.354942] send_monitor_note+0xca/0x420 [ 458.354953] ? create_monitor_ctrl_close+0x460/0x460 [ 458.354965] ? security_capable+0x8e/0xc0 [ 458.354980] hci_sock_bind+0x8d8/0xe50 [ 458.367277] binder: 16075:16087 unknown command 1077994248 [ 458.368663] ? kasan_check_write+0x14/0x20 [ 458.368675] ? hci_sock_ioctl+0x650/0x650 [ 458.368689] ? security_socket_bind+0x89/0xb0 [ 458.368702] SYSC_bind+0x1d3/0x220 [ 458.373952] binder: 16075:16087 ioctl c0306201 20000040 returned -22 [ 458.383181] ? move_addr_to_kernel.part.0+0x100/0x100 [ 458.383200] ? fput+0xd4/0x150 [ 458.383211] ? SyS_write+0x15e/0x230 [ 458.383226] SyS_bind+0x24/0x30 [ 458.383233] ? SyS_socketpair+0x4d0/0x4d0 [ 458.383244] do_syscall_64+0x1e8/0x640 [ 458.383253] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 458.383269] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 458.383278] RIP: 0033:0x459829 [ 458.383287] RSP: 002b:00007f8708d4fc78 EFLAGS: 00000246 14:15:52 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r2 = syz_open_dev$dspn(&(0x7f0000000080)='/dev/dsp#\x00', 0xb16, 0x4002) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) getsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x11, &(0x7f00000000c0)={0x0, 0x4}, &(0x7f0000000100)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r3, 0x84, 0xa, &(0x7f00000001c0)={0x6, 0x2, 0x0, 0x1, 0x0, 0x3, 0x6, 0x6a, r5}, 0x20) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) setsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r2, 0x84, 0x71, &(0x7f0000000200)={r5, 0x3}, 0x8) [ 458.387946] binder: 16075:16087 unknown command 0 [ 458.389475] ORIG_RAX: 0000000000000031 [ 458.389483] RAX: ffffffffffffffda RBX: 00007f8708d4fc90 RCX: 0000000000459829 [ 458.389488] RDX: 000000000000000a RSI: 0000000020000000 RDI: 0000000000000005 [ 458.389495] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 458.389501] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8708d506d4 [ 458.389507] R13: 00000000004bf96a R14: 00000000004d13e0 R15: 0000000000000003 [ 458.394779] binder: 16073:16090 unknown command 1861697539 14:15:52 executing program 5 (fault-call:2 fault-nth:4): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) [ 458.397796] binder: 16075:16087 ioctl c0306201 20000180 returned -22 [ 458.436162] binder: 16073:16090 ioctl c0306201 20000180 returned -22 [ 458.499550] binder_alloc: 16091: binder_alloc_buf, no vma 14:15:52 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000940)='/dev/mixer\x00', 0x80, 0x0) sendmmsg$nfc_llcp(r2, &(0x7f0000000b80)=[{&(0x7f0000000980)={0x27, 0x1, 0x0, 0x5, 0x9, 0x100000001, "400e07ddb84e09fbb282c46cf6fcc2fda666817beff37e2665da73b28be3f85f39b8fc322a40036a095e0a6de2fcbc4dc0120dab20d828f40cb5cd5ae2b15c", 0x3d}, 0x60, &(0x7f0000000b40)=[{&(0x7f0000000a00)='o+', 0x2}, {&(0x7f0000000a40)="84c557ece7c14cb61249a3f467f32f34d27a209dbf0a47bab9743c20e9f40316f76c521c255cf2e1ab38c17dbdf4d48fc9b82a97ce3ef248c8c61e096ba494992c663c0c01a4f3298c7e27bde44daebecd197171dc4f1eefa3b53d679aa04588ee9fac6fbe49deba605d2980cd25292a8b0bc13e6a71b476f8cf9e595368fb5ef135c6c71586f5b3533a455de64305353679f09b458c6fed031bf7cb8a2c70069cd60d2fb4a49cbf3e23057468be0adab9e6e8238ce68115aa7c3f3e4983c6a9cfc2b44bca3853f3fbf679af7ffa", 0xce}], 0x2, 0x0, 0x0, 0xabedf511be8e97f8}], 0x1, 0x10) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/autofs\x00', 0x101000, 0x0) getsockopt$packet_int(r4, 0x107, 0xa, &(0x7f00000000c0), &(0x7f0000000100)=0x4) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r4, 0x6, 0x21, &(0x7f00000001c0)="0c243357c5ef33e57bff7ad2b5ebda1d", 0x10) [ 458.639357] binder: 16093:16097 unknown command 0 [ 458.645821] binder: 16093:16097 ioctl c0306201 20000180 returned -22 [ 458.664808] binder: 16091:16094 unknown command 0 [ 458.675154] binder: 16091:16094 ioctl c0306201 20000180 returned -22 [ 458.705299] binder_alloc: 16091: binder_alloc_buf, no vma [ 458.714876] FAULT_INJECTION: forcing a failure. [ 458.714876] name failslab, interval 1, probability 0, space 0, times 0 [ 458.726504] CPU: 0 PID: 16102 Comm: syz-executor.5 Not tainted 4.14.134 #30 [ 458.733615] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 458.742966] Call Trace: [ 458.745566] dump_stack+0x138/0x19c [ 458.749206] should_fail.cold+0x10f/0x159 14:15:52 executing program 4 (fault-call:2 fault-nth:3): r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/fscreate\x00', 0x2, 0x0) write$binfmt_misc(r0, &(0x7f0000000040)={'syz1'}, 0x4) creat(&(0x7f0000000100)='./file0\x00', 0x0) [ 458.753363] should_failslab+0xdb/0x130 [ 458.757343] kmem_cache_alloc_node+0x56/0x780 [ 458.761846] ? sock_def_readable+0x170/0x3f0 [ 458.766257] ? save_trace+0x290/0x290 [ 458.770068] __alloc_skb+0x9c/0x500 [ 458.773695] ? skb_scrub_packet+0x4b0/0x4b0 [ 458.778016] ? hci_sock_bind+0xb57/0xe50 [ 458.782102] create_monitor_ctrl_open+0x144/0x7d0 [ 458.786951] ? hci_sock_bind+0xb63/0xe50 [ 458.791114] ? send_monitor_note+0x420/0x420 [ 458.795534] hci_sock_bind+0xbb6/0xe50 [ 458.799427] ? kasan_check_write+0x14/0x20 [ 458.803668] ? hci_sock_ioctl+0x650/0x650 [ 458.807824] ? security_socket_bind+0x89/0xb0 [ 458.812332] SYSC_bind+0x1d3/0x220 [ 458.815877] ? move_addr_to_kernel.part.0+0x100/0x100 [ 458.821088] ? fput+0xd4/0x150 [ 458.824288] ? SyS_write+0x15e/0x230 [ 458.826848] FAULT_INJECTION: forcing a failure. [ 458.826848] name failslab, interval 1, probability 0, space 0, times 0 [ 458.828105] SyS_bind+0x24/0x30 [ 458.828121] ? SyS_socketpair+0x4d0/0x4d0 [ 458.828135] do_syscall_64+0x1e8/0x640 [ 458.828145] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 458.828162] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 458.828179] RIP: 0033:0x459829 [ 458.864153] RSP: 002b:00007f8708d4fc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000031 [ 458.871866] RAX: ffffffffffffffda RBX: 00007f8708d4fc90 RCX: 0000000000459829 [ 458.879135] RDX: 000000000000000a RSI: 0000000020000000 RDI: 0000000000000005 [ 458.886416] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 458.893691] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8708d506d4 [ 458.900963] R13: 00000000004bf96a R14: 00000000004d13e0 R15: 0000000000000003 [ 458.908272] CPU: 1 PID: 16104 Comm: syz-executor.4 Not tainted 4.14.134 #30 [ 458.915378] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 458.915382] Call Trace: [ 458.915398] dump_stack+0x138/0x19c [ 458.915413] should_fail.cold+0x10f/0x159 [ 458.915429] should_failslab+0xdb/0x130 [ 458.939085] kmem_cache_alloc+0x2d7/0x780 [ 458.943236] ? check_preemption_disabled+0x3c/0x250 [ 458.943251] selinux_file_alloc_security+0xb4/0x190 [ 458.943263] security_file_alloc+0x6d/0xa0 [ 458.943276] get_empty_filp+0x130/0x3b0 [ 458.943286] path_openat+0x8f/0x3f70 [ 458.943297] ? entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 458.943312] ? trace_hardirqs_on+0x10/0x10 [ 458.943323] ? check_preemption_disabled+0x3c/0x250 [ 458.943334] ? save_trace+0x290/0x290 [ 458.977934] binder: 16101:16106 unknown command 0 [ 458.979830] ? path_lookupat.isra.0+0x7b0/0x7b0 [ 458.979846] ? __lock_is_held+0xb6/0x140 [ 458.987218] binder: 16101:16106 ioctl c0306201 20000180 returned -22 [ 458.988474] ? save_trace+0x290/0x290 [ 458.988492] ? __alloc_fd+0x1d4/0x4a0 [ 459.011252] do_filp_open+0x18e/0x250 [ 459.015053] ? __alloc_fd+0x1d4/0x4a0 [ 459.018853] ? may_open_dev+0xe0/0xe0 [ 459.022661] ? lock_downgrade+0x6e0/0x6e0 [ 459.026808] ? _raw_spin_unlock+0x2d/0x50 [ 459.030950] ? __alloc_fd+0x1d4/0x4a0 [ 459.034766] do_sys_open+0x2c5/0x430 [ 459.038501] ? filp_open+0x70/0x70 [ 459.042995] ? do_syscall_64+0x53/0x640 [ 459.046969] SyS_creat+0x27/0x30 [ 459.050330] ? compat_SyS_openat+0x40/0x40 [ 459.054563] do_syscall_64+0x1e8/0x640 [ 459.058438] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 459.063287] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 459.068467] RIP: 0033:0x459829 [ 459.071664] RSP: 002b:00007f531f52cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000055 [ 459.079378] RAX: ffffffffffffffda RBX: 00007f531f52cc90 RCX: 0000000000459829 [ 459.086646] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000100 [ 459.093927] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 14:15:52 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = accept(r2, 0x0, &(0x7f0000000080)) accept4$packet(0xffffffffffffffff, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x3f5, 0x80800) recvfrom$packet(r3, &(0x7f00000001c0)=""/250, 0xfa, 0x1, &(0x7f0000000300)={0x11, 0x10, r4, 0x1, 0x20, 0x6, @random="9758bad5a865"}, 0x14) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) [ 459.101197] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f531f52d6d4 [ 459.108988] R13: 00000000004bfe84 R14: 00000000004d1c80 R15: 0000000000000004 [ 459.211180] binder: 16110:16112 unknown command 0 [ 459.216082] binder: 16110:16112 ioctl c0306201 20000180 returned -22 14:15:54 executing program 2: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) shutdown(r1, 0x0) recvmmsg(r1, &(0x7f0000002100)=[{{0x0, 0x0, 0x0}}], 0x3ffffffffffff5a, 0x10100, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 14:15:54 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="036308405f2542dc44e5653a6e4ccb0e608b8a88c8051a9001bc84c63adbceeff812c1578822605481845f5e052e8f5cc62680b7627420647a3a1ba008c898b0be2184c53976816113f2dd4383", @ANYRES64=r2], 0x0, 0x0, 0x0}) 14:15:54 executing program 5 (fault-call:2 fault-nth:5): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) 14:15:54 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x2}}, 0x0) 14:15:54 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x35a, 0x0, &(0x7f0000000100)=[@exit_looper, @release={0x40046306, 0x3}], 0x0, 0x0, 0x0}) 14:15:54 executing program 4 (fault-call:2 fault-nth:4): r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/fscreate\x00', 0x2, 0x0) write$binfmt_misc(r0, &(0x7f0000000040)={'syz1'}, 0x4) creat(&(0x7f0000000100)='./file0\x00', 0x0) [ 460.559422] FAULT_INJECTION: forcing a failure. [ 460.559422] name failslab, interval 1, probability 0, space 0, times 0 [ 460.567046] FAULT_INJECTION: forcing a failure. [ 460.567046] name failslab, interval 1, probability 0, space 0, times 0 [ 460.570843] CPU: 1 PID: 16123 Comm: syz-executor.5 Not tainted 4.14.134 #30 [ 460.589295] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 460.590413] binder: 16116:16127 unknown command 0 [ 460.598653] Call Trace: [ 460.598672] dump_stack+0x138/0x19c [ 460.598689] should_fail.cold+0x10f/0x159 [ 460.598705] should_failslab+0xdb/0x130 [ 460.598719] kmem_cache_alloc_node_trace+0x5a/0x770 [ 460.598733] ? rcu_lockdep_current_cpu_online+0xf2/0x140 [ 460.617858] __kmalloc_node_track_caller+0x3d/0x80 [ 460.617876] __kmalloc_reserve.isra.0+0x40/0xe0 [ 460.617889] __alloc_skb+0xcf/0x500 [ 460.617899] ? skb_scrub_packet+0x4b0/0x4b0 [ 460.617908] ? hci_sock_bind+0xb57/0xe50 [ 460.617925] create_monitor_ctrl_open+0x144/0x7d0 [ 460.633554] ? hci_sock_bind+0xb63/0xe50 [ 460.633573] ? send_monitor_note+0x420/0x420 [ 460.633587] hci_sock_bind+0xbb6/0xe50 [ 460.633598] ? kasan_check_write+0x14/0x20 [ 460.633607] ? hci_sock_ioctl+0x650/0x650 [ 460.633621] ? security_socket_bind+0x89/0xb0 [ 460.633635] SYSC_bind+0x1d3/0x220 [ 460.633646] ? move_addr_to_kernel.part.0+0x100/0x100 [ 460.633663] ? fput+0xd4/0x150 [ 460.633674] ? SyS_write+0x15e/0x230 [ 460.633690] SyS_bind+0x24/0x30 [ 460.633700] ? SyS_socketpair+0x4d0/0x4d0 [ 460.639627] binder: 16116:16127 ioctl c0306201 200000c0 returned -22 [ 460.642008] do_syscall_64+0x1e8/0x640 [ 460.642020] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 460.642037] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 460.642046] RIP: 0033:0x459829 [ 460.642051] RSP: 002b:00007f8708d4fc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000031 [ 460.642061] RAX: ffffffffffffffda RBX: 00007f8708d4fc90 RCX: 0000000000459829 [ 460.642066] RDX: 000000000000000a RSI: 0000000020000000 RDI: 0000000000000005 [ 460.642071] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 460.642077] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8708d506d4 [ 460.642083] R13: 00000000004bf96a R14: 00000000004d13e0 R15: 0000000000000003 [ 460.656207] binder_alloc: 16117: binder_alloc_buf, no vma [ 460.659824] CPU: 0 PID: 16126 Comm: syz-executor.4 Not tainted 4.14.134 #30 [ 460.675626] binder: 16117:16130 unknown command 248204398 [ 460.676200] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 460.676205] Call Trace: [ 460.676221] dump_stack+0x138/0x19c [ 460.676238] should_fail.cold+0x10f/0x159 [ 460.686367] binder: 16117:16130 ioctl c0306201 20000180 returned -22 [ 460.689538] should_failslab+0xdb/0x130 [ 460.689552] kmem_cache_alloc+0x2d7/0x780 [ 460.824028] __d_alloc+0x2d/0x9f0 [ 460.827488] ? save_trace+0x290/0x290 [ 460.831296] d_alloc+0x4d/0x270 [ 460.834580] d_alloc_parallel+0xe5/0x17f0 [ 460.838822] ? lock_downgrade+0x6e0/0x6e0 [ 460.842978] ? __d_lookup_rcu+0x630/0x630 [ 460.847128] ? d_lookup+0xe5/0x240 [ 460.850668] ? d_lookup+0x166/0x240 [ 460.854297] lookup_open+0x493/0x1860 [ 460.858093] ? save_trace+0x290/0x290 [ 460.861904] ? complete_walk+0x1f0/0x1f0 [ 460.865974] path_openat+0xfca/0x3f70 [ 460.869812] ? entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 460.875269] ? trace_hardirqs_on+0x10/0x10 [ 460.879510] ? path_lookupat.isra.0+0x7b0/0x7b0 [ 460.884177] ? __lock_is_held+0xb6/0x140 [ 460.888423] ? save_trace+0x290/0x290 [ 460.892229] ? __alloc_fd+0x1d4/0x4a0 [ 460.896036] do_filp_open+0x18e/0x250 [ 460.899875] ? __alloc_fd+0x1d4/0x4a0 [ 460.903682] ? may_open_dev+0xe0/0xe0 [ 460.907498] ? _raw_spin_unlock+0x2d/0x50 [ 460.911650] ? __alloc_fd+0x1d4/0x4a0 [ 460.915463] do_sys_open+0x2c5/0x430 [ 460.919191] ? filp_open+0x70/0x70 [ 460.923042] ? do_syscall_64+0x53/0x640 [ 460.927022] SyS_creat+0x27/0x30 [ 460.930417] ? compat_SyS_openat+0x40/0x40 [ 460.934662] do_syscall_64+0x1e8/0x640 [ 460.938552] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 460.943580] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 460.948779] RIP: 0033:0x459829 [ 460.951974] RSP: 002b:00007f531f52cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000055 14:15:54 executing program 1: r0 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x1, 0x2) ioctl$KVM_GET_MSR_INDEX_LIST(r0, 0xc004ae02, &(0x7f00000000c0)={0x5, [0x0, 0x0, 0x0, 0x0, 0x0]}) r1 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$KVM_ASSIGN_PCI_DEVICE(r0, 0x8040ae69, &(0x7f0000000100)={0xfffffffffffffffc, 0xd80a, 0xa8, 0x1, 0x8f}) r3 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r3}], 0xfffffffffffffe10, 0x0, 0x0}) 14:15:54 executing program 5 (fault-call:2 fault-nth:6): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) [ 460.959686] RAX: ffffffffffffffda RBX: 00007f531f52cc90 RCX: 0000000000459829 [ 460.967122] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000100 [ 460.974391] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 460.981661] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f531f52d6d4 [ 460.988937] R13: 00000000004bfe84 R14: 00000000004d1c80 R15: 0000000000000004 14:15:54 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x800) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) [ 461.070774] FAULT_INJECTION: forcing a failure. [ 461.070774] name failslab, interval 1, probability 0, space 0, times 0 [ 461.082393] CPU: 1 PID: 16136 Comm: syz-executor.5 Not tainted 4.14.134 #30 [ 461.089518] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 461.098974] Call Trace: [ 461.101578] dump_stack+0x138/0x19c [ 461.105221] should_fail.cold+0x10f/0x159 [ 461.109384] should_failslab+0xdb/0x130 [ 461.113370] kmem_cache_alloc_node+0x56/0x780 14:15:54 executing program 4 (fault-call:2 fault-nth:5): r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/fscreate\x00', 0x2, 0x0) write$binfmt_misc(r0, &(0x7f0000000040)={'syz1'}, 0x4) creat(&(0x7f0000000100)='./file0\x00', 0x0) [ 461.117872] ? find_held_lock+0x35/0x130 [ 461.121937] ? sock_def_readable+0x149/0x3f0 [ 461.121950] __alloc_skb+0x9c/0x500 [ 461.121959] ? skb_scrub_packet+0x4b0/0x4b0 [ 461.121977] create_monitor_ctrl_open+0x144/0x7d0 [ 461.121988] ? send_monitor_note+0x420/0x420 [ 461.122001] hci_sock_bind+0xbb6/0xe50 [ 461.122012] ? kasan_check_write+0x14/0x20 [ 461.122022] ? hci_sock_ioctl+0x650/0x650 [ 461.122034] ? security_socket_bind+0x89/0xb0 [ 461.122046] SYSC_bind+0x1d3/0x220 [ 461.122056] ? move_addr_to_kernel.part.0+0x100/0x100 [ 461.122074] ? fput+0xd4/0x150 [ 461.122084] ? SyS_write+0x15e/0x230 [ 461.122099] SyS_bind+0x24/0x30 [ 461.122109] ? SyS_socketpair+0x4d0/0x4d0 [ 461.130314] do_syscall_64+0x1e8/0x640 [ 461.130324] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 461.130339] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 461.130348] RIP: 0033:0x459829 [ 461.130353] RSP: 002b:00007f8708d4fc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000031 [ 461.130365] RAX: ffffffffffffffda RBX: 00007f8708d4fc90 RCX: 0000000000459829 [ 461.130372] RDX: 000000000000000a RSI: 0000000020000000 RDI: 0000000000000005 [ 461.130378] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 461.130384] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8708d506d4 [ 461.130390] R13: 00000000004bf96a R14: 00000000004d13e0 R15: 0000000000000003 [ 461.135101] binder: 16135:16138 unknown command 0 [ 461.166967] binder: 16139:16140 unknown command 0 [ 461.205083] binder: 16135:16138 ioctl c0306201 20000180 returned -22 [ 461.242974] FAULT_INJECTION: forcing a failure. 14:15:54 executing program 5 (fault-call:2 fault-nth:7): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) [ 461.242974] name failslab, interval 1, probability 0, space 0, times 0 14:15:54 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) select(0x40, &(0x7f0000000080)={0x20, 0x401, 0x8, 0x3ff, 0x7ff, 0x3, 0xffffffffffffffff, 0x2}, &(0x7f00000000c0)={0x401, 0x9, 0x1ff, 0x7, 0x100, 0x400, 0x3, 0xa2f}, &(0x7f0000000100)={0x6, 0xfc8, 0x3483, 0x1000, 0x2, 0x5, 0x90, 0x1}, &(0x7f00000001c0)={0x0, 0x2710}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) [ 461.313925] binder: 16139:16140 ioctl c0306201 20000180 returned -22 [ 461.338225] CPU: 1 PID: 16144 Comm: syz-executor.4 Not tainted 4.14.134 #30 [ 461.345360] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 461.354887] Call Trace: [ 461.357487] dump_stack+0x138/0x19c [ 461.361125] should_fail.cold+0x10f/0x159 [ 461.365282] should_failslab+0xdb/0x130 [ 461.369267] kmem_cache_alloc+0x2d7/0x780 [ 461.373423] ? save_trace+0x290/0x290 [ 461.377228] ? ext4_sync_fs+0x800/0x800 [ 461.381208] ext4_alloc_inode+0x1d/0x610 [ 461.385279] alloc_inode+0x64/0x180 [ 461.389008] new_inode_pseudo+0x19/0xf0 [ 461.392983] new_inode+0x1f/0x40 [ 461.396354] __ext4_new_inode+0x32c/0x4860 [ 461.400589] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 461.405698] ? trace_hardirqs_on_caller+0x400/0x590 [ 461.410710] ? save_trace+0x290/0x290 [ 461.414594] ? d_splice_alias+0x497/0xba0 [ 461.418739] ? ext4_free_inode+0x1210/0x1210 [ 461.423145] ? d_splice_alias+0x497/0xba0 [ 461.427324] ? dquot_get_next_dqblk+0x160/0x160 [ 461.432020] ? lock_downgrade+0x6e0/0x6e0 [ 461.436193] ext4_create+0x1da/0x4f0 [ 461.440003] ? ext4_mknod+0x4f0/0x4f0 [ 461.443815] ? security_inode_create+0xd0/0x110 [ 461.448480] ? ext4_mknod+0x4f0/0x4f0 [ 461.452306] lookup_open+0x11a6/0x1860 [ 461.456193] ? save_trace+0x290/0x290 [ 461.459999] ? complete_walk+0x1f0/0x1f0 [ 461.464065] path_openat+0xfca/0x3f70 [ 461.467862] ? entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 461.473225] ? trace_hardirqs_on+0x10/0x10 [ 461.477468] ? path_lookupat.isra.0+0x7b0/0x7b0 [ 461.482143] ? __lock_is_held+0xb6/0x140 [ 461.486198] ? save_trace+0x290/0x290 [ 461.489995] ? __alloc_fd+0x1d4/0x4a0 [ 461.493791] do_filp_open+0x18e/0x250 [ 461.497611] ? __alloc_fd+0x1d4/0x4a0 [ 461.501408] ? may_open_dev+0xe0/0xe0 [ 461.505220] ? _raw_spin_unlock+0x2d/0x50 [ 461.509383] ? __alloc_fd+0x1d4/0x4a0 [ 461.513192] do_sys_open+0x2c5/0x430 [ 461.516904] ? filp_open+0x70/0x70 [ 461.520446] ? do_syscall_64+0x53/0x640 [ 461.524419] SyS_creat+0x27/0x30 [ 461.527868] ? compat_SyS_openat+0x40/0x40 [ 461.532104] do_syscall_64+0x1e8/0x640 [ 461.535986] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 461.540834] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 461.546019] RIP: 0033:0x459829 [ 461.549200] RSP: 002b:00007f531f52cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000055 [ 461.556908] RAX: ffffffffffffffda RBX: 00007f531f52cc90 RCX: 0000000000459829 [ 461.564177] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000100 [ 461.571459] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 461.578728] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f531f52d6d4 [ 461.585997] R13: 00000000004bfe84 R14: 00000000004d1c80 R15: 0000000000000004 [ 461.614362] FAULT_INJECTION: forcing a failure. [ 461.614362] name failslab, interval 1, probability 0, space 0, times 0 [ 461.626748] CPU: 0 PID: 16151 Comm: syz-executor.5 Not tainted 4.14.134 #30 [ 461.633874] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 461.643240] Call Trace: [ 461.645842] dump_stack+0x138/0x19c [ 461.649475] should_fail.cold+0x10f/0x159 [ 461.653833] should_failslab+0xdb/0x130 [ 461.657819] kmem_cache_alloc_node_trace+0x5a/0x770 [ 461.662859] ? rcu_lockdep_current_cpu_online+0xf2/0x140 [ 461.668327] __kmalloc_node_track_caller+0x3d/0x80 [ 461.673267] __kmalloc_reserve.isra.0+0x40/0xe0 [ 461.677945] __alloc_skb+0xcf/0x500 [ 461.681578] ? skb_scrub_packet+0x4b0/0x4b0 [ 461.685915] create_monitor_ctrl_open+0x144/0x7d0 [ 461.690766] ? send_monitor_note+0x420/0x420 [ 461.695180] hci_sock_bind+0xbb6/0xe50 [ 461.699073] ? kasan_check_write+0x14/0x20 [ 461.703309] ? hci_sock_ioctl+0x650/0x650 [ 461.707458] ? security_socket_bind+0x89/0xb0 [ 461.711957] SYSC_bind+0x1d3/0x220 [ 461.715497] ? move_addr_to_kernel.part.0+0x100/0x100 [ 461.720704] ? fput+0xd4/0x150 [ 461.723898] ? SyS_write+0x15e/0x230 [ 461.727648] SyS_bind+0x24/0x30 [ 461.730933] ? SyS_socketpair+0x4d0/0x4d0 [ 461.735096] do_syscall_64+0x1e8/0x640 [ 461.738986] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 461.743837] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 461.749033] RIP: 0033:0x459829 [ 461.752223] RSP: 002b:00007f8708d4fc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000031 [ 461.759946] RAX: ffffffffffffffda RBX: 00007f8708d4fc90 RCX: 0000000000459829 [ 461.767216] RDX: 000000000000000a RSI: 0000000020000000 RDI: 0000000000000005 [ 461.774486] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 461.782041] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8708d506d4 [ 461.789429] R13: 00000000004bf96a R14: 00000000004d13e0 R15: 0000000000000003 [ 461.831292] binder: 16149:16152 unknown command 0 [ 461.837117] binder: 16149:16152 ioctl c0306201 20000180 returned -22 14:15:56 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) shutdown(r1, 0x0) recvmmsg(r1, &(0x7f0000002100)=[{{0x0, 0x0, 0x0}}], 0x3ffffffffffff5a, 0x10100, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 14:15:56 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) r3 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm_plock\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_START(r3, 0x54a0) 14:15:56 executing program 5 (fault-call:2 fault-nth:8): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) 14:15:56 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x2}}, 0x0) 14:15:56 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = syz_open_dev$dmmidi(&(0x7f0000000080)='/dev/dmmidi#\x00', 0xfff, 0x1) write$FUSE_GETXATTR(r2, &(0x7f00000000c0)={0x18, 0x0, 0x1, {0xff}}, 0x18) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) getsockopt$inet_sctp_SCTP_INITMSG(r2, 0x84, 0x2, &(0x7f0000000100), &(0x7f00000001c0)=0x8) r3 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r3}], 0x0, 0x0, 0x0}) 14:15:56 executing program 4 (fault-call:2 fault-nth:6): r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/fscreate\x00', 0x2, 0x0) write$binfmt_misc(r0, &(0x7f0000000040)={'syz1'}, 0x4) creat(&(0x7f0000000100)='./file0\x00', 0x0) [ 463.005500] binder: 16158:16166 unknown command 0 [ 463.018969] FAULT_INJECTION: forcing a failure. [ 463.018969] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 463.030830] CPU: 1 PID: 16167 Comm: syz-executor.4 Not tainted 4.14.134 #30 [ 463.037933] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 463.037939] Call Trace: [ 463.037960] dump_stack+0x138/0x19c [ 463.037979] should_fail.cold+0x10f/0x159 [ 463.037997] __alloc_pages_nodemask+0x1d6/0x7a0 [ 463.049939] ? __alloc_pages_slowpath+0x2930/0x2930 [ 463.049965] cache_grow_begin+0x80/0x400 [ 463.049979] kmem_cache_alloc+0x6a6/0x780 [ 463.049996] ? ext4_sync_fs+0x800/0x800 [ 463.057752] ext4_alloc_inode+0x1d/0x610 [ 463.057764] alloc_inode+0x64/0x180 [ 463.057775] new_inode_pseudo+0x19/0xf0 [ 463.057785] new_inode+0x1f/0x40 [ 463.057797] __ext4_new_inode+0x32c/0x4860 [ 463.057811] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 463.067522] ? trace_hardirqs_on_caller+0x400/0x590 [ 463.067532] ? save_trace+0x290/0x290 [ 463.067548] ? d_splice_alias+0x497/0xba0 [ 463.067566] ? ext4_free_inode+0x1210/0x1210 [ 463.067578] ? d_splice_alias+0x497/0xba0 [ 463.075866] ? dquot_get_next_dqblk+0x160/0x160 [ 463.075879] ? lock_downgrade+0x6e0/0x6e0 [ 463.075899] ext4_create+0x1da/0x4f0 [ 463.075915] ? ext4_mknod+0x4f0/0x4f0 [ 463.075927] ? security_inode_create+0xd0/0x110 [ 463.075937] ? ext4_mknod+0x4f0/0x4f0 [ 463.087677] lookup_open+0x11a6/0x1860 14:15:56 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x2000000000100, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) socket$rxrpc(0x21, 0x2, 0xa) [ 463.099248] ? save_trace+0x290/0x290 [ 463.113252] ? complete_walk+0x1f0/0x1f0 [ 463.113276] path_openat+0xfca/0x3f70 [ 463.113291] ? entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 463.121831] ? trace_hardirqs_on+0x10/0x10 [ 463.121850] ? path_lookupat.isra.0+0x7b0/0x7b0 [ 463.121860] ? __lock_is_held+0xb6/0x140 [ 463.121871] ? save_trace+0x290/0x290 [ 463.121885] ? __alloc_fd+0x1d4/0x4a0 [ 463.121898] do_filp_open+0x18e/0x250 [ 463.121906] ? __alloc_fd+0x1d4/0x4a0 14:15:56 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = accept4(0xffffffffffffffff, 0x0, &(0x7f0000000440), 0x80800) setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000007c0), 0x4) r2 = socket(0x8, 0x4, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(r2, 0x112, 0xa, &(0x7f0000000340)=0xfff, 0x4) syz_open_dev$dspn(&(0x7f0000000400)='/dev/dsp#\x00', 0x1, 0xc0001) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x1b4) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') sendto$rose(r4, &(0x7f0000000700)="89091c70125654f423e4f19b1cee0ed3375bd73dbba983a90df1c173e755fbc42a7343c8ed8295d54c96da65a76fe6dabbb1d312aa613be1587040b641b9095f9cb16ffac3a2b3da5db289a8f3715622d66cf05068738ecf528ce880e40eab8b19efee3b7cd052f8588e3436bb0e26cae3dd5b23a27b3a12470b31abdf59ead427a17d4f", 0x84, 0x0, &(0x7f0000000280)=@short={0xb, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x1, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}}, 0x1c) sendmsg$TIPC_NL_LINK_GET(r4, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x21400020}, 0xc, &(0x7f00000001c0)={&(0x7f00000004c0)={0x204, r5, 0x19, 0x70bd28, 0x25dfdbfc, {}, [@TIPC_NLA_MEDIA={0x4c, 0x5, [@TIPC_NLA_MEDIA_PROP={0x34, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}]}]}, @TIPC_NLA_BEARER={0x88, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xa6}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x129, @dev={0xfe, 0x80, [], 0xc}, 0x3}}, {0x14, 0x2, @in={0x2, 0x4e23, @rand_addr=0x2}}}}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xe8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}]}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x4}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x101}]}, @TIPC_NLA_MEDIA={0xfc, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfd9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xc6c}]}, @TIPC_NLA_MEDIA_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xc}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7fffffff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x55}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}]}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x54}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}]}, @TIPC_NLA_MEDIA_PROP={0x54, 0x2, [@TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000020000000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x401}]}, @TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x10000}]}]}, 0x204}, 0x1, 0x0, 0x0, 0x80}, 0x20008880) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f0000000380)='scalable\x00', 0xfffffffffffffe2b) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r2, 0x660c) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$IMCTRLREQ(r4, 0x80044945, &(0x7f0000000300)={0x400a, 0x2, 0x8, 0xaad}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) syz_genetlink_get_family_id$net_dm(&(0x7f0000000240)='NET_DM\x00') syz_open_dev$loop(&(0x7f00000003c0)='/dev/loop#\x00', 0x4, 0x2800) 14:15:56 executing program 5: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_rfcomm(0xffffffffffffffff, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) [ 463.121917] ? may_open_dev+0xe0/0xe0 [ 463.135153] ? _raw_spin_unlock+0x2d/0x50 [ 463.135166] ? __alloc_fd+0x1d4/0x4a0 [ 463.135191] do_sys_open+0x2c5/0x430 [ 463.147449] ? filp_open+0x70/0x70 [ 463.147467] ? do_syscall_64+0x53/0x640 [ 463.147480] SyS_creat+0x27/0x30 [ 463.147490] ? compat_SyS_openat+0x40/0x40 [ 463.147500] do_syscall_64+0x1e8/0x640 [ 463.147509] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 463.147525] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 463.158966] RIP: 0033:0x459829 14:15:56 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) r2 = getpgrp(0xffffffffffffffff) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000040)={{{@in6=@dev, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in6=@mcast2}}, &(0x7f0000000140)=0xe8) ioctl$DRM_IOCTL_ADD_CTX(r1, 0xc0086420, &(0x7f0000000280)={0x0}) ioctl$DRM_IOCTL_DMA(r1, 0xc0406429, &(0x7f00000003c0)={r4, 0x1, &(0x7f00000002c0)=[0x0], &(0x7f0000000300)=[0x100000000, 0x800, 0xfff, 0x9, 0x91d9], 0x1, 0x4, 0x1, &(0x7f0000000340)=[0x9, 0x6, 0x3, 0x7], &(0x7f0000000380)=[0x23b, 0x3f, 0x5, 0x400, 0x3, 0x0]}) getresgid(&(0x7f0000000180)=0x0, &(0x7f00000001c0), &(0x7f0000000200)) setsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000240)={r2, r3, r5}, 0xc) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) [ 463.158972] RSP: 002b:00007f531f52cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000055 [ 463.158984] RAX: ffffffffffffffda RBX: 00007f531f52cc90 RCX: 0000000000459829 [ 463.158990] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000100 [ 463.158997] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 463.159003] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f531f52d6d4 [ 463.159010] R13: 00000000004bfe84 R14: 00000000004d1c80 R15: 0000000000000004 [ 463.174092] binder: 16158:16166 ioctl c0306201 20000180 returned -22 14:15:56 executing program 4 (fault-call:2 fault-nth:7): r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/fscreate\x00', 0x2, 0x0) write$binfmt_misc(r0, &(0x7f0000000040)={'syz1'}, 0x4) creat(&(0x7f0000000100)='./file0\x00', 0x0) [ 463.285700] audit: type=1400 audit(1564496156.863:70): avc: denied { map } for pid=16180 comm="syz-executor.0" path="/dev/dsp1" dev="devtmpfs" ino=15641 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:sound_device_t:s0 tclass=chr_file permissive=1 [ 463.298034] binder: 16164:16184 unknown command 0 [ 463.345070] binder: 16164:16184 ioctl c0306201 20000180 returned -22 14:15:57 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x802) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00C@@'], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) [ 463.413351] FAULT_INJECTION: forcing a failure. [ 463.413351] name failslab, interval 1, probability 0, space 0, times 0 [ 463.467541] binder: 16191:16192 unknown command 1077953280 [ 463.467802] CPU: 0 PID: 16190 Comm: syz-executor.4 Not tainted 4.14.134 #30 [ 463.480025] binder: 16191:16192 ioctl c0306201 20000040 returned -22 [ 463.486867] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 463.486873] Call Trace: [ 463.486890] dump_stack+0x138/0x19c [ 463.486906] should_fail.cold+0x10f/0x159 [ 463.486921] should_failslab+0xdb/0x130 [ 463.510560] kmem_cache_alloc+0x2d7/0x780 [ 463.514713] ? __debug_object_init+0x171/0x8e0 [ 463.519299] ? ext4_alloc_inode+0x1d/0x610 [ 463.523545] selinux_inode_alloc_security+0xb6/0x2a0 [ 463.528655] security_inode_alloc+0x94/0xd0 [ 463.532981] inode_init_always+0x552/0xaf0 [ 463.537231] alloc_inode+0x81/0x180 [ 463.540861] new_inode_pseudo+0x19/0xf0 [ 463.544864] new_inode+0x1f/0x40 [ 463.548228] __ext4_new_inode+0x32c/0x4860 [ 463.552467] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 463.557663] ? trace_hardirqs_on_caller+0x400/0x590 [ 463.558710] binder: 16191:16192 unknown command 0 [ 463.562719] ? save_trace+0x290/0x290 [ 463.562736] ? d_splice_alias+0x497/0xba0 [ 463.562747] ? ext4_free_inode+0x1210/0x1210 [ 463.562760] ? d_splice_alias+0x497/0xba0 [ 463.562775] ? dquot_get_next_dqblk+0x160/0x160 [ 463.562785] ? lock_downgrade+0x6e0/0x6e0 [ 463.562802] ext4_create+0x1da/0x4f0 [ 463.562817] ? ext4_mknod+0x4f0/0x4f0 [ 463.562830] ? security_inode_create+0xd0/0x110 [ 463.567783] binder: 16191:16192 ioctl c0306201 20000180 returned -22 [ 463.571450] ? ext4_mknod+0x4f0/0x4f0 [ 463.571463] lookup_open+0x11a6/0x1860 [ 463.571474] ? save_trace+0x290/0x290 [ 463.571495] ? complete_walk+0x1f0/0x1f0 [ 463.571516] path_openat+0xfca/0x3f70 [ 463.625347] binder: 16191:16194 unknown command 1077953280 [ 463.627292] ? entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 463.627309] ? trace_hardirqs_on+0x10/0x10 [ 463.627328] ? path_lookupat.isra.0+0x7b0/0x7b0 [ 463.631724] binder: 16191:16193 unknown command 0 [ 463.636743] ? __lock_is_held+0xb6/0x140 [ 463.636755] ? save_trace+0x290/0x290 [ 463.636769] ? __alloc_fd+0x1d4/0x4a0 [ 463.636786] do_filp_open+0x18e/0x250 [ 463.651385] binder: 16191:16193 ioctl c0306201 20000180 returned -22 [ 463.655901] ? __alloc_fd+0x1d4/0x4a0 [ 463.655915] ? may_open_dev+0xe0/0xe0 [ 463.655937] ? _raw_spin_unlock+0x2d/0x50 [ 463.661275] binder: 16191:16194 ioctl c0306201 20000040 returned -22 [ 463.663797] ? __alloc_fd+0x1d4/0x4a0 [ 463.663821] do_sys_open+0x2c5/0x430 [ 463.663833] ? filp_open+0x70/0x70 [ 463.707107] ? do_syscall_64+0x53/0x640 [ 463.711100] SyS_creat+0x27/0x30 [ 463.714463] ? compat_SyS_openat+0x40/0x40 [ 463.718696] do_syscall_64+0x1e8/0x640 [ 463.722578] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 463.727423] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 463.727433] RIP: 0033:0x459829 [ 463.727438] RSP: 002b:00007f531f52cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000055 [ 463.743504] RAX: ffffffffffffffda RBX: 00007f531f52cc90 RCX: 0000000000459829 [ 463.750862] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000100 [ 463.750869] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 463.750874] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f531f52d6d4 [ 463.750880] R13: 00000000004bfe84 R14: 00000000004d1c80 R15: 0000000000000004 14:15:58 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) shutdown(r1, 0x0) recvmmsg(r1, &(0x7f0000002100)=[{{0x0, 0x0, 0x0}}], 0x3ffffffffffff5a, 0x10100, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 14:15:58 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2, 0x0, 0x7}}, 0x3) write$FUSE_POLL(r1, &(0x7f0000000040)={0x18, 0x0, 0x1, {0x8}}, 0x18) 14:15:58 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x2) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c4@'], 0x0, 0x0, 0x0}) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$IMGETCOUNT(r2, 0x80044943, &(0x7f00000000c0)) r3 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="ac26528341f3af000000", @ANYRES64=r3], 0x0, 0x0, 0x0}) 14:15:58 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="d083101d4a92b59a2bb0886fe9ba3815cfaae372be5e586ea159ba2894f3f348325785d185bc0b1a26fc7bafde49c25d04a372b689e318128dba184f596a806e1a31676f03ac1f5c3d1a0359b7c2152a43668cb200985e7096cccea4454999f29dd360d09f8db211524bc90b240285c5491b0b60402f46d69d249ed6903c754eba3d57ad5afba0024661f9d7a9035f06e21498ee1275405bdc"], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) r3 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000080)='/proc/capi/capi20ncci\x00', 0x101000, 0x0) ioctl$KVM_GET_SUPPORTED_CPUID(r3, 0xc008ae05, &(0x7f00000001c0)=""/160) 14:15:58 executing program 4 (fault-call:2 fault-nth:8): r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/fscreate\x00', 0x2, 0x0) write$binfmt_misc(r0, &(0x7f0000000040)={'syz1'}, 0x4) creat(&(0x7f0000000100)='./file0\x00', 0x0) 14:15:58 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x2}}, 0x0) 14:15:58 executing program 4: r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/fscreate\x00', 0x2, 0x0) write$binfmt_misc(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="73797e31652c89ec5b0330a0d0d90d5fd9ed"], 0x4) creat(&(0x7f0000000100)='./file0\x00', 0x0) [ 465.227532] binder: 16204:16209 unknown command 1077175040 [ 465.237044] binder: 16203:16214 unknown command 487621584 [ 465.247842] binder: 16204:16209 ioctl c0306201 20000040 returned -22 [ 465.262036] binder: 16203:16214 ioctl c0306201 20000040 returned -22 14:15:58 executing program 5: r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000040)='/dev/btrfs-control\x00', 0x341082, 0x0) write$FUSE_INTERRUPT(r0, &(0x7f0000000080)={0x10, 0x0, 0x5}, 0x10) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r0, 0x84, 0x1b, &(0x7f0000000240)={0x0, 0x6a, "38a88c7b0efabae95d7449fc60281f5a9cad32fb3dd0b4e8d8e94776329ccdeb3b53eca2e6e07bdc51884a1eb194c30946cd66e677abaa7a9dc69c9d0fa741751cb4a58c6c5f05f08866d05752af5c9ce0b66d5959dc3679025e4f5f338d2dbff37636151df4e057a0b9"}, &(0x7f00000002c0)=0x72) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000300)={r1, 0x1ff, 0x4, [0x2, 0x1, 0x6, 0x6]}, &(0x7f0000000340)=0x10) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r3 = fcntl$dupfd(r2, 0x0, r2) bind$bt_rfcomm(r3, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) getsockopt$inet_sctp_SCTP_RESET_STREAMS(r3, 0x84, 0x77, &(0x7f00000000c0)={0x0, 0x401, 0x6, [0x56, 0x100, 0x9, 0x1f, 0x9, 0x8]}, &(0x7f0000000100)=0x14) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000000140)={r4, @in={{0x2, 0x4e22, @multicast1}}, 0x9a, 0x101}, &(0x7f0000000200)=0x90) [ 465.282153] binder: 16204:16217 unknown command -2091768148 [ 465.303570] binder: 16203:16219 unknown command 0 [ 465.315382] binder: 16204:16217 ioctl c0306201 20000180 returned -22 [ 465.325725] binder: 16203:16219 ioctl c0306201 20000180 returned -22 14:15:59 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x28, 0x0, &(0x7f0000000080)=[@request_death={0x400c630e, 0x1}, @register_looper, @acquire_done={0x40106309, 0x1}], 0x8d, 0x0, &(0x7f00000001c0)="e2650781fe5c2aa91adafc3531d1a19b2951a2674d63d79f1f7b3fd64b6140f9c7a7b9856392da732ce93e676f69fcad17f22da15b695b9b225f95a4c1280dc0c124d47198ce8738187f39bd73c787c5ca27aa2e678926732a23c418ea9e789d54c9e01fc55ff1c12db763458030b33c947c10d5fa0962794c02d7a250913b5f81dc53c7f66eb15d938a6bb18c"}) r3 = fcntl$dupfd(r1, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) [ 465.344720] SELinux: Context sy~1 is not valid (left unmapped). [ 465.352995] binder: 16204:16217 unknown command 1077175040 [ 465.369659] binder: 16204:16217 ioctl c0306201 20000040 returned -22 14:15:59 executing program 4: r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000140)='/proc/thread-self/attr/fscreate\x00', 0x2, 0x0) write$binfmt_misc(r0, &(0x7f0000000040)={'syz1'}, 0x4) creat(&(0x7f0000000100)='./file0\x00', 0x0) 14:15:59 executing program 5: openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x2, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vsock\x00', 0x100, 0x0) getsockopt$bt_sco_SCO_OPTIONS(r1, 0x11, 0x1, &(0x7f00000000c0)=""/61, &(0x7f0000000100)=0x3d) r2 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r2, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) [ 465.404683] binder: 16204:16230 unknown command -2091768148 [ 465.426725] binder: 16204:16230 ioctl c0306201 20000180 returned -22 [ 465.439723] binder: 16229:16232 ioctl 8912 400200 returned -22 [ 465.470578] binder: 16229:16232 unknown command 0 14:15:59 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r2 = syz_open_dev$media(&(0x7f0000000080)='/dev/media#\x00', 0x7fffffff, 0x0) ioctl$KVM_GET_NESTED_STATE(r2, 0xc080aebe, &(0x7f00000004c0)={0x0, 0x0, 0x2080}) r3 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r3}], 0x0, 0x0, 0x0}) [ 465.494082] binder: 16229:16232 ioctl c0306201 20000180 returned -22 [ 465.546674] binder: 16229:16232 unknown command 0 [ 465.554964] binder: 16229:16232 ioctl c0306201 20000180 returned -22 [ 465.571806] binder: 16240:16244 unknown command 0 [ 465.576717] binder: 16240:16244 ioctl c0306201 20000180 returned -22 [ 465.621610] binder: 16240:16248 unknown command 0 [ 465.626878] binder: 16240:16248 ioctl c0306201 20000180 returned -22 14:16:00 executing program 2: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) shutdown(r1, 0x0) recvmmsg(r1, &(0x7f0000002100)=[{{0x0, 0x0, 0x0}}], 0x3ffffffffffff5a, 0x10100, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 14:16:00 executing program 4: r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/fscreate\x00', 0x2, 0x0) write$binfmt_misc(r0, &(0x7f0000000040)={'syz1'}, 0x4) modify_ldt$read(0x0, &(0x7f0000000140)=""/137, 0x89) creat(&(0x7f0000000100)='./file0\x00', 0x0) 14:16:00 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000100)='/dev/sequencer2\x00', 0x141801, 0x0) getresgid(&(0x7f0000000040), &(0x7f0000000080), &(0x7f00000000c0)) ioctl$FICLONE(r0, 0x40049409, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) 14:16:00 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = creat(&(0x7f0000000080)='./file0\x00', 0x114) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r2, 0x84, 0x6b, &(0x7f00000000c0)=[@in={0x2, 0x4e21, @local}, @in6={0xa, 0x4e21, 0x8, @remote, 0x7}], 0x2c) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00i@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:16:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)=ANY=[], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x802) 14:16:00 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x2}}, 0x0) 14:16:00 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) [ 467.078282] binder: 16255:16258 unknown command 0 [ 467.093255] binder: 16255:16258 ioctl c0306201 20000180 returned -22 [ 467.101029] binder: 16254:16264 unknown command 1077963008 14:16:00 executing program 4: r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/fscreate\x00', 0x2, 0x0) write$binfmt_misc(r0, &(0x7f0000000040)={'syz1'}, 0x4) r1 = syz_open_dev$midi(&(0x7f00000000c0)='/dev/midi#\x00', 0xffff, 0x800) write$P9_RLINK(r1, &(0x7f0000000140)={0x7, 0x47, 0x2}, 0x7) creat(&(0x7f0000000100)='./file0\x00', 0x0) openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/avc/hash_stats\x00', 0x0, 0x0) [ 467.128615] binder: 16254:16264 ioctl c0306201 20000040 returned -22 [ 467.153750] binder: BINDER_SET_CONTEXT_MGR already set [ 467.159546] binder: 16255:16258 ioctl 40046207 0 returned -16 [ 467.165109] binder: 16255:16276 unknown command 0 [ 467.172957] binder: 16254:16264 unknown command 0 14:16:00 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_open_dev$amidi(&(0x7f0000000140)='/dev/amidi#\x00', 0x4, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f0000000180)=[@in6={0xa, 0x4e24, 0xb, @empty, 0x1}, @in6={0xa, 0x4e22, 0xf8, @loopback, 0x4}, @in={0x2, 0x4e22, @loopback}, @in6={0xa, 0x4e20, 0x20, @local}, @in6={0xa, 0x4e23, 0x7, @mcast1, 0x800}, @in6={0xa, 0x4e20, 0xc1, @ipv4={[], [], @broadcast}, 0x8b63}, @in={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x10}}, @in={0x2, 0x4e22, @rand_addr=0x9}, @in={0x2, 0x4e23, @loopback}, @in={0x2, 0x4e23, @multicast1}], 0xdc) r2 = fcntl$dupfd(r0, 0x0, r0) ioctl$FS_IOC_GETFSMAP(r0, 0xc0c0583b, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, [], [{0x7, 0x9, 0x9, 0x100000001, 0x1, 0x6}, {0x100, 0x4, 0x7fff, 0x9, 0x400, 0x7}]}) bind$bt_rfcomm(r2, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) ioctl$SIOCSIFMTU(r2, 0x8922, &(0x7f0000000040)={'team_slave_1\x00', 0x3}) 14:16:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="03630841", @ANYRES64=r2], 0x0, 0x0, 0x0}) [ 467.189342] binder: 16254:16264 ioctl c0306201 20000180 returned -22 [ 467.196643] binder: 16255:16276 ioctl c0306201 20000180 returned -22 14:16:00 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000080)='/dev/zero\x00', 0x2, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) syz_open_procfs(0x0, &(0x7f0000000300)='net/rt6_stats\x00') r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000680)='/dev/mixer\x00', 0x8000, 0x0) r3 = accept$ax25(r2, &(0x7f00000006c0)={{0x3, @default}, [@default, @null, @default, @default, @null, @netrom, @remote, @bcast]}, &(0x7f0000000640)=0x61d) ioctl$sock_ax25_SIOCADDRT(r3, 0x890b, &(0x7f00000001c0)={@bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, 0x4, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @null]}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:16:00 executing program 4: r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-{elf/attv/fsireate\x00', 0x2, 0x0) write$binfmt_misc(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="737961304c6301ce0e096d24f32e166a2c"], 0xffffffffffffff9d) r1 = getuid() r2 = getuid() getgroups(0x2, &(0x7f00000001c0)=[0xffffffffffffffff, 0x0]) stat(&(0x7f0000000200)='./file0\x00', &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getresgid(&(0x7f0000000340)=0x0, &(0x7f0000000380), &(0x7f00000003c0)) r7 = getgid() lsetxattr$system_posix_acl(&(0x7f0000000100)='./file0\x00', &(0x7f0000000180)='system.posix_acl_access\x00', &(0x7f0000000400)={{}, {0x1, 0x3}, [{0x2, 0x1, r1}, {0x2, 0x1, r2}], {0x4, 0x2}, [{0x8, 0x1, r3}, {0x8, 0x7, r4}, {0x8, 0x4, r5}, {0x8, 0x3, r6}, {0x8, 0x3, r7}], {0x10, 0x1}, {0x20, 0x4}}, 0x5c, 0x1) splice(r0, &(0x7f0000000040), r0, &(0x7f0000000080), 0xfffc000000000000, 0xb) creat(&(0x7f0000000140)='./file0\x00', 0x180) [ 467.307641] binder: 16282:16286 unknown command 1091068675 [ 467.330394] binder: 16282:16286 ioctl c0306201 20000180 returned -22 [ 467.357286] binder: 16282:16293 unknown command 1091068675 [ 467.362226] binder: 16288:16291 unknown command 0 [ 467.379785] binder: 16288:16291 ioctl c0306201 20000180 returned -22 [ 467.379998] binder: 16282:16293 ioctl c0306201 20000180 returned -22 14:16:02 executing program 2: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) shutdown(r1, 0x0) recvmmsg(r1, &(0x7f0000002100)=[{{0x0, 0x0, 0x0}}], 0x3ffffffffffff5a, 0x10100, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 14:16:02 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000380)='/proc/sys/net/ipv4/vs/sync_ports\x00', 0x2, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000000040)=@ipx, 0xfffffffffffffce7, 0x0}}], 0x1, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000180)='fd/3\x00\x02\x17\x87:\xf4\x03\xdfc\x88,5I\xd7^\xb5D\xf7\xd7\xdb,(\xd5\x00\xc2\x06MG\xcd\xe9w\xe5s\x02\xf2\xea\xb6\xabsp\x12xT8\x01\x00\xd4S\xd8F\xab.x|\x8b\x87\xb0\xa2\xf5Y>\xb1 p\x998(\xe63\xcf\x7f\xac\x89F\x03n\x96\x15zsw\x98\xca\xcb3\xb6M=h\x01i.\xa3\xda}\x190~\xe7d6\xa5\x17\xb3\xe9\xd9QV\x0f\xf3\x02\xd6\xc1\xc3n\xcd*R\x9a\x95\x12\x05K\xa0<\xc9\xe3\xed\xab\xc9\x8bK\xb3\x86\xe2\x93f\x92iKA|e\x97k :,J36\x11\xf0\x99\x96\xb7]\xfd\xe3\v\xd8\x98\xc5o\xc6\xde\x80\xf7_\xc9\x8f\xaf\xf9\xd5\xb7ui\xea\xde\xd0\xeb\xd9\xf5_\v\xe2*\xa3\xf4\xab?n\xcb\x19i\x80\x91\xd2\xf6\x14\xfe!!0\x84L\x86\x81\x95,B\x11\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xab*[\xa5\xb217\x93\xf3\x88\x92\xa6\xde\x11\xa2-J\x9d\xc9\xb2\x97\xa3\x88v\x9eR\x155\xc7N!\xdb\"8\xc8I\xb9c\xed\xa7!\t\x85s\xb1\xa5\xa7R2Yf\x1c\xf8\xc2z>\xb1\x9c\x02a\x87\xe9\xb8\xf8\xdcv\xb6\xe4\xa6\n\x0e\x83lM7\xcc?\xea\x19\x99\xce\x1c\x10\xd2lQ(\xc7\xe9\xef\xd2Q\vY\xf58\x10|8}uE\xaf\xb4w;\xbc\xe4\x01\xd8\xf2\xf9u\xc1Dt\'\x84\xb5\xa4\x83\xeft\xfc\xf3\xdd\x870x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) ioctl$PPPIOCATTCHAN(r0, 0x40047438, &(0x7f0000000040)=0x2) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={&(0x7f0000000000), 0xc, &(0x7f0000000280)={&(0x7f0000000240)=@newqdisc={0x2c, 0x24, 0x201, 0x70bd2c, 0x25dfdbfd, {0x0, r1, {0xfff3, 0xffff}, {0xfff2, 0xfff3}, {0x7, 0xffff}}, [@TCA_INGRESS_BLOCK={0x8, 0xd, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x800}, 0x20000010) bpf$OBJ_PIN_MAP(0x6, &(0x7f0000000140)={&(0x7f0000000100)='./file1/file0\x00', r0}, 0x10) 14:16:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = open(&(0x7f0000000080)='./file0\x00', 0x2800, 0x20) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f00000000c0)={0x0, 0x1, &(0x7f00000001c0)=""/195, &(0x7f0000000300)=""/132, &(0x7f00000003c0)=""/180, 0x10000}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$KVM_X86_SET_MCE(r2, 0x4040ae9e, &(0x7f0000000000)={0x0, 0x2, 0x100000000, 0x0, 0x19}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="036308400ff2007062fd0ba4375eeeb1e74539264d7c89ddeaf7e175ddd2c43b1f12717bc3c49cf00f0ccd844dd594887d328817c0cfada30d8d2db49f260dd78050f8a80af288e4de764fb97a0eee1e13dc013119e6d17de7e22b34f563034f53f6297985b81d5f0c931a323985355c9345b82ee01d69ec77a8188e2440f9fc77f9f091803ca6b60e584013965e0202", @ANYRES64=0x0], 0x0, 0x0, 0x0}) 14:16:02 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = dup(r0) ioctl$SNDRV_CTL_IOCTL_TLV_WRITE(r2, 0xc008551b, &(0x7f0000000080)={0x3, 0x14, [0xa837, 0x400, 0x0, 0x9, 0x0]}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r3}], 0x0, 0x0, 0x0}) 14:16:02 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x2}}, 0x0) 14:16:02 executing program 4: r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/fscreate\x00', 0x2, 0x0) r1 = syz_open_dev$adsp(&(0x7f0000000040)='/dev/adsp#\x00', 0xfff, 0x10b000) ioctl$UI_GET_VERSION(r1, 0x8004552d, &(0x7f0000000280)) write$binfmt_misc(r0, &(0x7f00000000c0)=ANY=[], 0xfffffe24) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) getsockopt$inet_sctp_SCTP_RESET_STREAMS(r2, 0x84, 0x77, &(0x7f0000000240)=ANY=[@ANYRES32=0x0, @ANYBLOB="080005000000800000000462663faf"], &(0x7f00000000c0)=0x12) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r0, 0x84, 0x5, &(0x7f0000000140)={r3, @in={{0x2, 0x4e22, @empty}}}, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r2, 0x84, 0xb, &(0x7f0000000200)={0x40, 0x7, 0x100000001, 0x8, 0x4, 0x9, 0x6, 0x1, 0x14, 0x7fff}, 0xb) ioctl$SIOCGIFHWADDR(r2, 0x8927, &(0x7f0000000080)) [ 468.907291] binder: 16301:16311 unknown command -1309778377 [ 468.919343] binder: 16303:16312 ioctl c008551b 20000080 returned -22 [ 468.920102] binder: 16301:16311 ioctl c0306201 20000180 returned -22 [ 468.944207] binder: 16303:16312 unknown command 0 14:16:02 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) close(r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) ioctl$KVM_PPC_ALLOCATE_HTAB(r1, 0xc004aea7, &(0x7f0000000300)=0x3) ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000340)=0x0) ptrace$setregset(0x4205, r2, 0x206, &(0x7f00000003c0)={&(0x7f0000000380)="76d4417771ee31370fffdf", 0xb}) vmsplice(r1, &(0x7f00000002c0)=[{&(0x7f0000000040)="ac610386e00de94bb27b7587c89f55aa77c77f64d4b895137acacad6870b0998c6e4080d8ff7b38ae026f194fc9730d77cbc5a8d9235f88230f65406d1e6993f33481a4a14ac990958b3fc5901e6e177b9bc1c5b0683c9ece6f850894eb0254534b7d5d32e5c5d884a3b24186664c3c01ffd5790bd37815605c9728e9b23fc5794ca7d6c40b58a887f9b4889a03759664fa584e0527348ec274f88de14da096eb3af9a162fbcc668d97e1241cc6a7d870ab31968d585a430dfc4295b3749431497c36c9b104bcf7e54a38810b224335cf9439248b62fa9ffe3", 0xd9}, {&(0x7f0000000140)="4030ab0ae89e63e4b9d389c57432adce13c89b7ae57aab26a241cccf8eb94f7e83e1eada0ed2b12105d80757575b8c208ae68176d7d0be54504b2be0d678e1414e9762222d4c0d4f4c25d7aee18f4d00c06c85a3c484bbc05f0de13762", 0x5d}, {&(0x7f00000001c0)="9de6ed796e35a5fd08a0a6418c34002debe84e89f7df12d66eae59ea95ee0ba222c77669b8ab2b2630278c287e14f3e084ecbc20efcdfcd027911d29de3105c00b6e2d9743c4481656a29a8c6fb8aeb640fbdb681f56940c53b54a353d0b3648f46b469be5e40f69999717cc20fcf7ac97fa09d0bb210d9f2108aa66", 0x7c}, {&(0x7f0000000240)="1dabb05400dd3c21f1b69f5dadaff62a373a99fdb6f24a6d9c96c254ed8b43f1b6f6d735d7c768952dbee027c3dfaaa0c742e08cbb6e3d23f98b8bef8b41f55230e6bb24bf15fcff768922bcdc09498460785a3d17c722038917741e8588e42857d8beb904208f02a0a28d76cf1dab8687a1c2f2b31ff7", 0x77}], 0x4, 0x2) [ 468.959289] binder: 16303:16312 ioctl c0306201 20000180 returned -22 14:16:02 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) [ 469.004502] binder: 16303:16322 ioctl c008551b 20000080 returned -22 [ 469.022318] binder: 16303:16322 unknown command 0 [ 469.037069] SELinux: Context  is not valid (left unmapped). 14:16:02 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_open_dev$vcsn(&(0x7f0000000100)='/dev/vcs#\x00', 0xc4, 0x610280) ioctl$TCGETA(r1, 0x5405, &(0x7f0000000140)) r2 = fcntl$dupfd(r1, 0x406, r0) connect(r0, &(0x7f0000000080)=@in={0x2, 0x4e21, @remote}, 0x80) bind$bt_rfcomm(r2, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r2, &(0x7f0000000280)={0x10, 0x30, 0xfa00, {&(0x7f0000000240)={0xffffffffffffffff}, 0x0, {0xa, 0x4e24, 0x400, @mcast2, 0x3}}}, 0x38) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r1, &(0x7f00000002c0)={0x11, 0x10, 0xfa00, {&(0x7f0000000200), r3}}, 0x18) syz_genetlink_get_family_id$SEG6(&(0x7f0000000040)='SEG6\x00') openat$dsp(0xffffffffffffff9c, &(0x7f0000000180)='/dev/dsp\x00', 0x105040, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r0, 0x400c6615, &(0x7f00000001c0)) 14:16:02 executing program 4: r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/fscreate\x00', 0x2, 0x0) write$binfmt_misc(r0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000294b86d15eccdc33f9f34f7b9a16814180000297b323146a8d03164b0ea57cd1c663bdc3403c4b02049a761e950ab3dd2f2d86c873693af956589cb34f05477454a53732b3e27691e0bf370281b09b4c9d8ebd8d2fa51814304088da34cc43e1b4b6ac778bca8a38029bfb0a979ddde07e5eb1966bc4d48a17726287ad3b1f51c7ad14de3930dad7e175e54b8d95049d2ba5697434348cbb82d9ede49e3906cb388ca925388423c6406a4ebff9b554b08727f1b0f2857f59e2095a354fa490e68028804af91dbf4086c51853c"], 0x4) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000080)={0x1000, 0x4000}) [ 469.048882] binder: 16303:16322 ioctl c0306201 20000180 returned -22 14:16:02 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x800) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r1 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0363084035096fb126d0a18ef2489baaafe2f5426766195616033f067f19d9b94c52b66344d03c5327be6b4605ae1c6bfc46b037651810c2ebda786163079cbb67dfca44782bf8d19bfa0ef5062afcce81be89ab3c701de11bcfe037735c36c92be492cdd26ef91b074f86b575b769874693737de123be015c31de440a089b40a56b600ccf5990b4555fbca5b9d00a755a83c667967e575b743fb65847493ae9c9669ffd1b3d0dae8429e38c9e499d20b97c073390fd8a588e7bf3574a656857951e5f79adc2fc01cc10ddebea7ffeec6ecb6478ddd29c928253093d9c361d7d4db7031257f4baf4a46368c7d8508ad71220000000000000000000000025f94e1da026a608531a42b94a6360c59a4b56b9198d93b2b1b6dbf31ca495dbaecb9fb6", @ANYRES64=r1], 0x0, 0x0, 0x0}) [ 469.120550] binder: 16328:16330 unknown command 0 [ 469.131382] binder: 16328:16330 ioctl c0306201 20000180 returned -22 14:16:04 executing program 2: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) shutdown(r1, 0x0) recvmmsg(r1, &(0x7f0000002100)=[{{0x0, 0x0, 0x0}}], 0x3ffffffffffff5a, 0x10100, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 14:16:04 executing program 4: r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/fscreate\x00', 0x2, 0x0) write$binfmt_misc(r0, &(0x7f0000000080)=ANY=[@ANYRESOCT=r0], 0x17) creat(&(0x7f0000000100)='./file0\x00', 0x0) 14:16:04 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:16:04 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x3, 0x0, 0x7fff}}, 0xa) 14:16:04 executing program 1: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0xfffffffffffffd84, 0x0, 0x0}) r1 = mmap$binder(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r1}], 0x0, 0x0, 0x0}) poll(&(0x7f0000000080)=[{r0, 0x80}, {r0, 0x1000}, {r0, 0x20}, {r0, 0xd003}, {r0, 0x4604}, {r0, 0x4}], 0x6, 0xfffffffffffffff8) 14:16:04 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x2}}, 0x0) 14:16:04 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0x1, 0x1ff, 0x2}}, 0xa) [ 470.712488] SELinux: Context 00000000000000000000003 is not valid (left unmapped). 14:16:04 executing program 4: r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/fscreate\x00', 0x2, 0x0) write$binfmt_misc(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="1b2d73797a31"], 0x4) creat(&(0x7f0000000100)='./file0\x00', 0x0) [ 470.757578] binder: 16349:16358 unknown command 0 [ 470.765043] binder: 16349:16358 ioctl c0306201 20000180 returned -22 14:16:04 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x1a61e39e254020b2) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000), 0x0, 0x0, 0x0}) 14:16:04 executing program 5: r0 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) bind$bt_rfcomm(r0, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) [ 470.819011] SELinux: Context -sy is not valid (left unmapped). 14:16:04 executing program 4: r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/fscreate\x00', 0x2, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vcs\x00', 0x2000, 0x0) ioctl$CAPI_NCCI_OPENCOUNT(r1, 0x80044326, &(0x7f0000000040)=0xb) accept4$vsock_stream(r1, &(0x7f00000000c0), 0x10, 0x80800) write$binfmt_misc(r0, &(0x7f0000000180)=ANY=[@ANYBLOB="dfba3b7086f91c783e2373973a166814264566fb541881dbfa89775b3a6b703c7087e655"], 0x4) creat(&(0x7f0000000100)='./file0\x00', 0x0) 14:16:04 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x20000, r0) accept$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) [ 470.923473] SELinux: Context ߺ;p is not valid (left unmapped). 14:16:06 executing program 2: socketpair$unix(0x1, 0x2, 0x0, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) shutdown(r0, 0x0) recvmmsg(r0, &(0x7f0000002100)=[{{0x0, 0x0, 0x0}}], 0x3ffffffffffff5a, 0x10100, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) 14:16:06 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x10, r0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) syz_init_net_socket$x25(0x9, 0x5, 0x0) 14:16:06 executing program 4: r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_ENABLE_CAP(r0, 0x4068aea3, &(0x7f0000000080)={0x74, 0x0, [0x0, 0x3, 0x25b000, 0x1]}) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000000)={'syz1'}, 0x4) creat(&(0x7f0000000100)='./file0\x00', 0x0) 14:16:06 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) ioctl$ASHMEM_GET_PROT_MASK(r1, 0x7706, &(0x7f0000000040)) 14:16:06 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x3}}, 0x0) 14:16:06 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rtc0\x00', 0x81, 0x0) ioctl$RTC_AIE_OFF(r2, 0x7002) r3 = syz_open_dev$swradio(&(0x7f00000001c0)='/dev/swradio#\x00', 0x1, 0x2) ioctl$SIOCAX25OPTRT(r3, 0x89e7, &(0x7f0000000200)={@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, 0x2, 0x20}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r4 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x38, &(0x7f0000000240)=[@in6={0xa, 0x4e21, 0x0, @rand_addr="706d20846b63f2abe3239dc3ac95cb61", 0x3}, @in6={0xa, 0x4e23, 0xd9d5, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x16}}, 0xfffffffffffeffff}]}, &(0x7f00000002c0)=0x10) setsockopt$inet_sctp_SCTP_RESET_STREAMS(r4, 0x84, 0x77, &(0x7f0000000300)={r5, 0x800, 0x1, [0x80000001]}, 0xa) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r4, 0x4008240b, &(0x7f00000000c0)={0x0, 0x70, 0x0, 0x401, 0x7, 0x9, 0x0, 0xa01c, 0x20, 0x2, 0x9, 0x4, 0x8, 0x80000000, 0x1, 0x8, 0x400, 0x0, 0x2, 0x7, 0x10001, 0x8001, 0x6, 0x80000001, 0x80000000, 0x3, 0x7, 0x3, 0x5, 0x4, 0x6, 0x8, 0x5, 0xffffffffffffff84, 0x0, 0x7, 0x2, 0x6, 0x0, 0x1, 0x0, @perf_config_ext={0x5, 0x1}, 0x2000, 0x6, 0x40, 0x0, 0x4, 0x9, 0x6}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="226308404b65bba9da509a77732e7c3a2212a364f5606d84407453e8431f2b1343ab3326a7e61f5d1b2010e59e85dd5900d85d6996e328c1425f9125065163b8700068c2d1a00166f75a53dabd0db868a8c8e1be9a4499453d4a05275844997dfa1683b6e5a1fc6c84074310742ba6a4ecc614d2fd0dca0f4c9e07b72cc1", @ANYRES64=0x0], 0x0, 0x0, 0x0}) [ 472.470892] binder: 16395:16397 unknown command 0 [ 472.482207] binder: 16395:16397 ioctl c0306201 20000180 returned -22 [ 472.500984] binder: 16399:16402 unknown command 1074291490 14:16:06 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) fallocate(r0, 0x10, 0x6, 0x80000000) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) 14:16:06 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)) syz_open_dev$vcsn(&(0x7f0000000080)='/dev/vcs#\x00', 0x1, 0x208000) r2 = syz_open_dev$vcsn(&(0x7f00000000c0)='/dev/vcs#\x00', 0x38000, 0x101080) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x4001fc) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) [ 472.517840] binder: 16399:16402 ioctl c0306201 20000180 returned -22 14:16:06 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sndpcmc(&(0x7f0000000100)='/dev/snd/pcmC#D#c\x00', 0x0, 0x2) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000002c0)={0xffffffffffffffff, r2, 0x0, 0xd, &(0x7f0000000280)='/dev/binder#\x00', 0xffffffffffffffff}, 0x30) capget(&(0x7f0000000300)={0x20080522, r3}, &(0x7f0000000340)={0x8, 0x10000, 0x5, 0x7f, 0x200, 0x9}) write$FUSE_NOTIFY_DELETE(r2, &(0x7f0000000240)={0x36, 0x6, 0x0, {0x1, 0x1, 0xd, 0x0, '/dev/binder#\x00'}}, 0x36) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r4 = syz_open_dev$sndpcmp(&(0x7f00000000c0)='/dev/snd/pcmC#D#p\x00', 0x3, 0x200000) fstat(r1, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$nl_generic(r2, &(0x7f0000000600)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000440)={0x148, 0x2f, 0x2, 0x70bd2a, 0x25dfdbfb, {0x1b}, [@generic="269a81d65586720836acdd2a40609b766bb2d8e2a3944ba65ce260d5cf08915cd3c20f6f40ad1d28", @generic="e1424c4a0fd5c7aa0a2594e494a720415ebe2e7dcbd1d2da4ac2810280057db2243e1fa9640cd9cc55dd82ad2b827ce4a4ce65574c338444b305da3147d266d27c4b1a1093875294bf0c66d68fe170da6929ff3992b921d05601debb40e006d480fb340323707349be80c49f4c69006ba5dd1b2fede97b590b8c607b51b42b90ce2b335a23baee92d3edbf691981d9d5a7b6298c96326a885cea8fed49c2d123c4c480484161ebd06ae200c08cb0e1de02cd1c84485496e228b3a6fef1753b33a73e", @typed={0x4, 0x92}, @generic="b71eb2d930200628f1f02dce4cb1e7457005128521db44eabb81f4469768549385b03226ad2bcd82b68d81b975cf95942af8ad19e20183d0595f9d7c", @typed={0x8, 0x51, @uid=r5}]}, 0x148}, 0x1, 0x0, 0x0, 0x4}, 0x400c000) ioctl$EVIOCGREP(r4, 0x80084503, &(0x7f0000000740)=""/118) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="e5626effc5596671d683cf11ff09f90501b6570554e38f0000"], 0x0, 0x0, 0x0}) r6 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) fcntl$getflags(r1, 0x1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r6}], 0x0, 0x0, 0x0}) 14:16:06 executing program 4: r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/fscreate\x00', 0x2, 0x0) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/mls\x00', 0x0, 0x0) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r1, 0xc01064b5, &(0x7f0000000180)={&(0x7f0000000140)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x6}) unlink(&(0x7f0000000080)='./file0\x00') fchmodat(r1, &(0x7f0000000040)='./file0/../file0\x00', 0x8) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000200)='./file0\x00') write$binfmt_misc(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="010004009648ecbfcb2bc5256ede8ec8fc34cb15d439d17310dc8360d2296e7fdc64e987720bfebb72cb78a5b6804a41c7ad128287a4315aff3792d588f0919e3f5e0a3dfce706adfa7bf787244e1c0c3f411ac0d18b0c7d85095c2c2e291be3ca3a298dc5ca93659b0dfb25834d00a42c09a64eacd756eccffe8ced34f824b8d5e4deecd3eed306d95d9251e7bc746f25604ea64393778a3b3b0ca0324250f197c099c30000000000000000"], 0x4) creat(&(0x7f0000000100)='./file0\x00', 0x0) [ 472.595439] binder: 16413:16415 unknown command 0 [ 472.609736] binder: 16417:16418 unknown command -9542939 [ 472.616222] binder: 16413:16415 ioctl c0306201 20000180 returned -22 14:16:06 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_open_dev$mouse(&(0x7f0000000140)='/dev/input/mouse#\x00', 0x1, 0x40) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in=@multicast1, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in6=@dev}}, &(0x7f0000000300)=0xe8) connect$can_bcm(r1, &(0x7f0000000340)={0x1d, r2}, 0x10) getsockopt$inet_int(r1, 0x0, 0x22, &(0x7f0000000180), &(0x7f00000001c0)=0x4) ioctl$TIOCGPGRP(r1, 0x540f, &(0x7f0000000380)=0x0) tkill(r3, 0x2f) r4 = fcntl$dupfd(r0, 0x1, r0) bind$bt_rfcomm(r4, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) lsetxattr$trusted_overlay_opaque(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='trusted.overlay.opaque\x00', &(0x7f0000000100)='y\x00', 0x2, 0x3) setsockopt$SO_TIMESTAMP(r0, 0x1, 0x0, &(0x7f0000000040), 0x4) 14:16:06 executing program 4: r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/fscreate\x00', 0x2, 0x0) write$binfmt_misc(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="73797a31d16ffbff05"], 0x4) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/mls\x00', 0x0, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000340)={r1, 0xc0, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=0x7ff, 0x0, 0x0, 0x0, &(0x7f0000000180)={0x4, 0x2}, 0x0, 0x0, &(0x7f00000001c0)={0x1, 0xd, 0x5, 0xa66}, &(0x7f0000000200)=0x2, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=0x3ff}}, 0x10) syz_open_dev$amidi(&(0x7f00000003c0)='/dev/amidi#\x00', 0xf915, 0x100) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000380)=r2, 0x4) ioctl$sock_inet6_tcp_SIOCATMARK(r1, 0x8905, &(0x7f00000000c0)) creat(&(0x7f0000000100)='./file0\x00', 0x0) [ 472.648686] binder: 16417:16418 ioctl c0306201 20000040 returned -22 [ 472.659009] SELinux: Context  is not valid (left unmapped). [ 472.668618] binder: 16417:16425 unknown command 0 [ 472.683084] binder: 16417:16425 ioctl c0306201 20000180 returned -22 [ 472.721923] binder: BINDER_SET_CONTEXT_MGR already set [ 472.727248] binder: 16417:16418 ioctl 40046207 0 returned -16 [ 472.755848] binder: 16417:16425 unknown command -9542939 [ 472.761882] binder: 16417:16425 ioctl c0306201 20000040 returned -22 14:16:07 executing program 2: socketpair$unix(0x1, 0x2, 0x0, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) shutdown(r0, 0x0) recvmmsg(r0, &(0x7f0000002100)=[{{0x0, 0x0, 0x0}}], 0x3ffffffffffff5a, 0x10100, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) 14:16:07 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080)='/dev/zero\x00', 0x400, 0x0) syz_open_pts(r2, 0x181802) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000300)='syzkaller1\x00', 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r2, 0x84, 0x1b, &(0x7f00000001c0)={0x0, 0xf3, "bad140df3833528485e1bf72e8a4939e7a7103e24ad8699536e2f3c9013aaf3727a0fa8c3c5924e5a108c71b642f7c83ecc169e6ee221148193303e0d1db37803b648ce817dd40ac1f82a322234ed92ab82478f7186ace73a46aaa0479ea7578d2dfdeb60390bfd3f6a0e35089a4f6201cc0f4b9b967772b59f93cc971084a494136d22a1a3b6254b599a58be73b78b74495b9c37d3c2e13116dadf7c731fa06d4171f8ba37b0296addeaa898a141d56ad8e71978cd94b861bcc6c6856a70de3e4dead44fb6b1f43ab164c03417695a9e79687090f5470a141f1f287f8d99dfb84a750fe1498ec589df8ae2105ee622964a1ac"}, &(0x7f00000000c0)=0xfb) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r2, 0x84, 0x7b, &(0x7f0000000100)={r4, 0xfffffffffffffff7}, 0x8) 14:16:07 executing program 4: r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/fscreate\x00', 0x2, 0x0) write$binfmt_misc(r0, &(0x7f0000000040)={'syz1'}, 0x4) creat(&(0x7f0000000100)='./file0\x00', 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) 14:16:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) ioctl$sock_netdev_private(r3, 0x89fc, &(0x7f00000000c0)="57122f44c384deb1bf96415c3e65926d123be53a34a78b5889af2d8476ca") 14:16:07 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000280)='/dev/hwrng\x00', 0x80, 0x0) r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000040)='/dev/btrfs-control\x00', 0x103040, 0x0) r3 = openat$full(0xffffffffffffff9c, &(0x7f0000000240)='/dev/full\x00', 0x400000, 0x0) perf_event_open(&(0x7f0000000180)={0x5, 0x70, 0x8, 0x9dc695, 0x400, 0x1, 0x0, 0x7ff, 0x10080, 0x2, 0x1000, 0x100000001, 0x1, 0x0, 0xffffffffffffffc1, 0xc0fe, 0x6, 0x915d057, 0x1, 0x100000000, 0x1, 0x0, 0x80, 0x3, 0xfffffffffffffe01, 0x2, 0x5, 0x5, 0x7ff, 0x2000000000, 0x1, 0x20, 0x10000, 0x4, 0x800, 0x1, 0x5, 0x0, 0x0, 0x8, 0x1, @perf_config_ext={0x3, 0x7}, 0x1, 0x2, 0x4, 0x4, 0x1f, 0x7f}, 0x0, 0x10, r2, 0x1) ioctl$VIDIOC_S_CTRL(r3, 0xc008561c, &(0x7f00000002c0)={0x2000000000, 0x9}) ioctl$KDSKBSENT(r1, 0x4b49, &(0x7f0000000300)="fe7283bc9f5c7e0003bcaba158f49da8a15cf60d16d0d978fedd53fcb65723074de25abeccacdd") getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000080)=ANY=[@ANYRES32=0x0, @ANYBLOB="040600"/16], &(0x7f00000000c0)=0x14) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r2, 0x84, 0x73, &(0x7f0000000100)={r4, 0xffffffffffffffff, 0x30, 0x5, 0xd645}, &(0x7f0000000140)=0x18) r5 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r5, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000200)='/dev/btrfs-control\x00', 0x10000, 0x0) 14:16:07 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x3}}, 0x0) 14:16:07 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) ioctl$VIDIOC_G_JPEGCOMP(r1, 0x808c563d, &(0x7f0000000200)) ioctl$VIDIOC_OVERLAY(r1, 0x4004560e, &(0x7f0000000100)=0x5) 14:16:07 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x4) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:16:07 executing program 4: r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/fscreate\x00', 0x2, 0x0) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1'}, 0x4) creat(&(0x7f0000000100)='./file0\x00', 0x0) [ 474.292190] binder: 16445:16457 unknown command 0 [ 474.294181] binder: 16447:16454 unknown command 0 [ 474.308476] binder: 16445:16457 ioctl c0306201 20000180 returned -22 [ 474.315180] binder: 16447:16454 ioctl c0306201 20000180 returned -22 [ 474.371921] binder: 16464:16467 unknown command 0 [ 474.388524] binder: 16445:16462 unknown command 0 [ 474.389452] binder: 16464:16467 ioctl c0306201 20000180 returned -22 [ 474.401428] binder: 16445:16462 ioctl c0306201 20000180 returned -22 14:16:08 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0xfffffffffffffffd, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0xffffffffffffff7f, 0x80) ioctl$EVIOCGEFFECTS(r3, 0x80044584, &(0x7f0000000040)=""/140) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x1f5c14ec, 0x0, &(0x7f0000000040)=ANY=[], 0xffffffffffffff81, 0x0, 0x0}) 14:16:08 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x1, 0x2) write$P9_RRENAME(r1, &(0x7f0000000080)={0x7, 0x15, 0x1}, 0x7) r2 = fcntl$dupfd(r0, 0x406, r1) bind$bt_rfcomm(r2, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) ioctl$CAPI_GET_SERIAL(r1, 0xc0044308, &(0x7f00000000c0)=0x4) sendmmsg$nfc_llcp(r2, &(0x7f00000056c0)=[{&(0x7f0000000140)={0x27, 0x0, 0x2, 0x0, 0x1ff, 0x6, "48525d8aca4f0365670bd8dafbbdca6685474e97485451599d4e4dc482ec743b289f46de3728696dd3989b6ca8eb573df9b24728c938d09d9c5df9b51f757d", 0x39}, 0x60, &(0x7f0000000200)=[{&(0x7f00000001c0)="12b9d98c1d69364a8b868a45ed0ab3637d5a8c29b0589c3ba290d910ecca8c719b07", 0x22}], 0x1, 0x0, 0x0, 0x40}, {&(0x7f0000000240)={0x27, 0x0, 0x1, 0x7, 0x400, 0x200, "69714fb6d7bee9eb94746ab1a58cd0124494cca28aa45855ae752a000644a81921bab2fff916e5fac81d9c7e459d6087e6194e0884ed055cae20b9f5fc2383", 0x2f}, 0x60, &(0x7f0000000940)=[{&(0x7f00000002c0)="d42db7c92154ef0bcf0402c2864f427581aaffc190243d286dd5e385f96edf02aeee90ed432aafb3fefa4bdb96bf54a5870c8e85a72f7f647654f8a7adef13fef0b60de06d9b9a3d3dcc4226ffe2fa72d7ffad27be381aa8833107350d63c3d4f52b26143b2ed7817f7919fc", 0x6c}, {&(0x7f0000000340)="a9f6d0400fed08aaaf09fc2e83646aa25a49b45a633f00e64848a87f9aad264d786c6aca8f2d47a8a79792ec6b8d32bb76a71b2ffcc85d3fdb2f8dbd0c7732958752e85201ff1109151f33361292c503a8dce79ef94fa6561d7135a3c5a20d80058f80edba8932a1250ac36aeeb1c5da134cfc7883523a47e4a76fe0af5a6906a25ed636af507ee3d31938c5cf85256cfd5dcdda76f4fea2183c1be448f5b9e2b76f466a2a9262955e5181642ce8273a966997159391c039a53b940efb475586c1a684e46fc940a9d8cdea", 0xcb}, {&(0x7f0000000440)="e569389e25bcdf21fcc098b71d9f69216736784608a87c2149466246363248205fd7baba5d7d84ba85af5180659d6fa6fd114cb40673ee318d681fd4dd03e34c4d3f32b5cfab3bccb86e30", 0x4b}, {&(0x7f00000004c0)="77d8b6c440a99678dd50b33b0ee78f87b7c21694211108d6737b8484a25adebab5a45dcf58d4a0d14e7146ad82e2d13b818f51b09493c20a65bbd89e277e557dc1991d0bf1b38f4a1b53dbcf07760e7045567b1d6cd01cf189c1d8d49568d5f3a79d129c1cca4ae781c57712b19a6504b886141011d9f1939bcf3f8b751f4886479bbbadc26e6e6e47075e6ff2cf14d9cd348a2e", 0x94}, {&(0x7f0000000580)="d23a3dd6f76201db25bc82969d649770dbbeacb3", 0x14}, {&(0x7f00000005c0)="35aaf4f610732240ec2144f7af5af7e151d87feaf906232d9a493fb7f7a6895b47375ef0e2d40ba6fed1cad01154156748f8b99863d55964b91f0ea9f8ad1d2763eb97dd85ffbf3a45f3b719e04166191fb89aa3a1f2c73f4455526b4b1de485efff4166ebb4b4f6b777e678ebf078db2ab68699bd896b20be3095ab952d08d46114c8196732c584fab50d7d48c72dfcfbcd855b5afba665d3d1f86d6688a723add8e22c3b", 0xa5}, {&(0x7f0000000680)="0ef3891b392418aff5a91e6ca3f38ad79bac1ed06a806c27554080da58884438f946b0df0452413e57717bea1c9b62f92cf392acd955aaa9565b180d9f6489aa0d67bdee5e7ce12773d97cdab48fbdcd56cf5b6ddffc01256bcad7815daaea610ff32df8f497215b86e4045dfcb2d2f9769b72c2da83732fa6215da557f763f007103d3d5a0fe3a43f902d18d39944511029642c6670a696cb75e0e1d2fa3ff07a4db0cee3", 0xa5}, {&(0x7f0000000740)="355f32ec6446a5431fb4bdf7c2b90e5193ae03800cd990ecfb24764e2be4d501245820a99d64fbbd9f34992fbf4d37af0d72d6e6717843c99e43eb1a5be6ae6d72d1bbc52ab4e6ccf7e9e69ae5689b0a00df1ad29a8db176100f9eb0db967ffeb724b198f07b22eb1deb433d57480ca837ad6b3500c40592ae0e27a3550ddb4be20be5deaab05de40948b7f68c87341279d900cd9bb12f240391ae6b4a00d4ff2618f43618901719f528bb99be65f2f098b8", 0xb2}, {&(0x7f0000000800)="215fd9bfdf9134427565d6191367e91d7a74344891b8a40ba531875f3e6b196e0d8cc48c126ab14d4fa3bcb5edbc19521966d25e4f189bad4cdff87e0dc4b746200158234b663b24c87182bc87f8777e3791afcc38f96449cf431e5c2955425f8786916564ac6d51b99a60291298fd8630062b353adb6df4b43f1c398248027ea90af98f6904aa84d4b57fa8c60a3abbcbdcfde8acede3c7790e115909ae40c4eaef2cc0ae02c6dc4c82bbc29a82bbc561ccf5cb637aeacec01c6efdf98b9d4ca572d96304632e2ed024365ebe4729be6be5c4c343babdd15de13c60ab244d107034579a16c500bdb98330e0ff345ac8421703f6fbff15f4", 0xf8}, {&(0x7f0000000900)}], 0xa, &(0x7f0000000a00)={0x58, 0x1, 0x2, "f5bed615e799b725d3eb82f8fb85deb0fbb4ae9dba179aedc07261b36e7bf870bdf74de388f8db2987b4d006b8b71fbf4306f8f9f917cefa5b7ddcc473391b3d76178f74"}, 0x58, 0x20000040}, {&(0x7f0000000a80)={0x27, 0x1, 0x1, 0x4, 0x4, 0x6, "618751f53180fd2dd72786f0c5e8408187b7eff5ea200e3c7378367dd8597fac669a1b9cc2fa1b22f3966a1b2b6b80f589a7dd34fabb564a997ad081b12b43", 0x20}, 0x60, &(0x7f0000001e00)=[{&(0x7f0000000b00)="c480ea9e1569c61a8f94564ec71941b1a6cea3c140c71ea329014763110dfc33237c657f31a935a5b8a102358308ae5d15a47fcb530e1b704f01f73c2c4180b1ab6859c38310fbd1cee779b8281294acdbac73f1dca689a035abd059521150bc9b3eca7e4d9505ec2597f115a609ad8105088ff97fc5fc789871cf46bdb733eefd452c605d62f9a8c439e3f50a4a668b0a44daf71f110b0412eb95f5b99cf5b5fbdc0a800c0b01f2e09aa7ddae37b9b3fbbb9cfb08f0b47d26d0979de0335b9e3d942df28a086e7af55f82f50d0f978975d694819e2d3da10a095bbc7e5d540f26825dd0d88d711ee13c9d1b1e67892eba338cad2808ed002614c6aa888f44fdc4a0c5d0886dc6ce559a0dfb93728debf77e1a4ac72802c3a1bf9b818302f5afa65b0dc0fbc30f2121d20c41f27a12a7b8f831e527f8b46f60837e001d30f591258eb290245dbc5b3539f023fcdb44478df7eb14861e93b6962fb46f838b8d7e7a9bc8e2efd63227eddb1daabc57757fea6b6201dc0bdc2fab917db5d9e9c36b5262e9cc592bea4a8808a627e0d37c33acb6c95d415d9653710650e7ec05497b7ffc695cd028563bb38021bb0238e0ea73d2f2f119c430d4de6393a2638ce8b468a9585713a2de75ef88830518d9a418968a78b6eb6632f62fc6663aad2ccfdb906dcf8d986d28991fe6cecff69a9bcb27b6f7afa2d375ea65e52af5439d20cf66e0216afabb1143238eac684c82c133f92fca8fd3e9f418c4871a0a296b9913dbbc675bcb4fe0f1b88be0aabdf77a2b2c7eb48d6d615d2bbde3cd2863e6117dc2e363b2dab0a091a45b3fd54bb7abc613d6baf501af52d0e29f68ff05798109c77895017d4d38234bec7e7b89c53c334d1e5d08aa0d795c28353f2eb8b98a98fb4fea94ab12b094d0aec600bd8847d90fd12e3dda759b3a4c7f44d2686185279c057a4d6d3c2e643beabe78f980b22427f3ed460359c98ce783d974cc53f47c283d513f871fb1566ccf7939ac110deebdf8a3d81d101a76e6bfcf40bc4bc7a25ec3ebd518e40ef62f13bc718514b8d9206b64ef9fa4713a85b4dc876beb4f97a8313604bba3c656840dc3d92dfd511b8a02dc295aaf383814ba2c8d9ca720ffc7262155984264ea77467d281ac1f50fe9703d058909f0eafb14485f071206a1ae894f8d1ade803e675bffeb8fed15ccb04f918bbbc8b1c6a66b05c76590b46f66d9a74263c77ea86af09bfb7192647887e2c25d297f11dae3e76e027d7e75e38e5bde58cbba2f9a2e357632a9ca6043902d34118c5f8111184faee331b31a6d68c262529a97d0d1743ca340aeada8131f871a016b01f3c594f05a420487ff2dc0f0d6dd1c3680b768042e96cb42d2dfe78a3f2e4b634e5ce7e98553236f7c6051a7c5fc03075aa37f8ce6b014397f745828202c32ae387ffc7ffaa876cf8f38d68ac83417f6df24bba670dfbf4cd5c2699a234fc8eb78a5ba17af266516b2b9c5e259efcc392528c197bf456641c0b7893fdc0dbcca3894b0de812b55e99c857cb9fdd672b1a20fd0c9e43ef9a3de2e57a539f16090c8e62392514389b0bc7bacd2b98b47cc0cd45553d4524926c3ad9e31687a2c57df423085fbc4670ba64035ee3d8ead0971c965c3912cf9f8aaa16143e84bba29e5ec7efb5dda18bb482326f4df0fc22cf1266d5724f99bdc792d4422b86402ed68b371dc3ca8ba2fb6708bb588974ea4243fb2126be30840bb4d4b1df880ea9692a9eca733e65055dace2ed21eea40fcf81f0badea43db6b498c327fe5a0719e42a623c35f4f119a611c7ad3758e696113746abbf8f42929f3b72bc4d0cc8ee183c6a8951a3d32b4c8fd00badaaa6e7942e47534515c3873046fb268ba76ffe7b00be790d87c912ee31e7a7515f5f1cac068a76d4f063f0dc3bdf1e0a89d7ae4ec28c4ac515029493a865f8ea9f49527e64df3e66b7f40dacc467e88fc143b8005208e81e070f96a268bd4c08701bd91415789aead15855c1a90b072f3c7989df36ddead22993e009a582bb1d0032a3a684d477ee7edc72e87f873b7809bd773f39891731f89894f4bdf06eb641b2c8096d2a30dd8ae3b1fa83d534e13b2175f7e07262015e9617d234aa82a76c43a1931c1df63daddb1b1996bfc63e4ab4ac10e116eb9911bf6f5d8b14e95d17f384270b6e3c7040efcbaad81a494d5e18f5c26a864c4fdfc7b2956b4a702a1ed020f98ebcbd62ce57f0593b08840e8260ebdd629cefa8775cbb5d355177765bd7e598b2f98cd41ecb610a23c479aa148a3294abde8a116c6d5ce459948ba15c0935a09a7ce348c109cff0ba42182dd71e00dcca164a30dd095f2949128d877c84e60a9c6b74ec646b2ba22b0cab0cd43cbf625f2360ad902ff22e29749ae4966783badc437c2ec1c3c1d2ef2fd65a33194f2208ce098c1709d83aa34cb2c43c767e44748eb65c569b04dfdea116f6691720cc3c6589ed240b9e160dd2c91ddc0bb8929e4cab84d0ee20b1f858e917531ed2006b0bc3c3df398f9d4bf5fdb73a6d83ce87b6992b32cf770231cd307f9d36da0f5e1931f6fbf3db22b38362d2c2486b39bd9bbd0a7053d3776a1d2a0838c8495b98493ffbc7c3b59d4c283a62a282206dce1d7b83d63e0144106d4fc17d75cc000aef3f81c5287172d1c10bc290aa9b79db478e0963fefc986715d1986a4a11721b13ce872bec565fd0c5efc2c4ceb23f241d5b6ff46449a6246f9e34f77b0fe6c905790cb587596d99c25e0a5bf0d8c5ecc6085101810c3e0d377f14cc44b646372718812166577a48d80a75a39597a3f14734b18014b69ca28bcc7417e486d04d6cacbd6bfd4d6d8d1aa98702322b4634c7406b4589cd47111502058755eaff60892ed518c0f7d634b375f94a06b566d4e2ea42905211ff24877df774a19cbd479ef881b3c7c42502a0838222554037399ee6bcdaadfe6f07e8749df438404bbc2fad0b9098361811fcb4864bda6b55698e76edd6e2dd4c5d025675275ea30174a9a69d43458b9c6909ba57c5019cc77e375f806190d3499d1b1e59db867d05f017976dd1169457d2e73ff0689b43903ed8868cdf1c45815854c47223b0ac14cc03c5d2bcbfb17ef79be5ea1cdd13b2e045e987d816917d32037c62849e8584a466e764ce6e7555c288d8db1e01f540b31a6fd99af15711bc5105d183b47251ca4b7811cadf4dffaf30134908fdff134bc249112897af686a38278db3c1948a79a574e08b47a7f6bbac09a86d0b10b732dcb7f098ea93d6f61b0da9029938ce24de7ef15c689cc53bd74baa7df2e6114c0dfb5f2cc8a7a2c61996ec9953117cacb38c0ac878b3fc41c0f640a9bcdaee9867a47df9c14a2e60fb0417952deac6513d525617567029424ac980e2ab2d2ac80dc4e95cba47cd699979479e9f00fad0a02e5b744cb386dcffedd0a246c02aa1bd1207c1a49e0e750cef68b8a1e6dbe97ed45e4094b981a982c77704441e6a224797ac00ce03c1dc476d635fd8ed1ea21fc7beb04999634e4dc61d1d200860cc32704b53baf6dc6ba41143252f74006481a18bc5e14127e7ac13daa045e3967f15ab7c760475626f4d650ac408d4b818c4cf0e9871f5393ab832838e9c97815071f686619775b53e3ab0c5ed134147de4b5de956f054dcbef080b14e9a4d3a05599fff1603053f41084b539ef4c3337de8cb574c6a2624cd7f90a91ec4a95643fd1ed18485cfd50153c67da684ac4b67c73cbd3ee1978ed1e6e45e2e5a84bfa93b7fe2b8295594a0b0423e328f5874c9b09f88b120ef4a6ded2babacded63a89c76cf90962abbb7f419de218e2927c5a4eb8b2aff7bcaffb39933b431407506a605cab312dd106840007eed5b7559303d8d4dae19c5a6cdb86af2264fca05b45f190394f9383267e6c97a1939a36088863904161f812d9b39b9489de68cfa2e8eb1e80a80b62a97cac1e378b5c5abfaa34e8682c27837d0e452781d7d7bbb4fe025c971529ff373cb72ac72214113be837e6b4e4d6ed483e0715dec7e263f4624e14f8daae12112dc4d21465b0fc07758d6b6ace6402a47f545144418e080ef5c709e3feebd2805ce50d547ab35f22fbb8ddaa193c7c7b710afc3378b74bdf181fb7d5a7c2c88da9ef9ff6e75728b99e283cdc5b44ee917bec6ab02128909472b51fcc4158c3b56404c9c4febe5b82fe15c22571cd6efd8c6592479ee3c12ad3febca283ea162daaff5138592dda589dbcb663f1b14713515d90ea89f2d21da0d8b231853959c40654de3dc165e7810b645d1476032a60266c3d49e863b4d7b5aa7b61e5fff697d6a3044d3bc534a911bd396f15519d1c3c4423228ba9b68cf731d0f9262ff96fc46ba8876ac4e65dd4c5b10cd0be8d4d7502c447f73a74ed7e58834a7febb358fc5f5a3afe3be2c88603d9dada2bc5f9bd419f825a59576b2d20f9e17f43c661f1e46f155d264620d3b4c59265f4251d489f788bf10234af94f24f3f419ee1bab631c0e946ca0f2a1a75f90ec5fcaf778e3a90de9124813e132e1752df60843fa9b74ff9b4e46c1e8d3e1c5c36678d8134f4ade889a8149f701ce756bb3192604142d338dc3b2f28f210bbeb841b78f8049f5d7f82eded83940daf7e9d5745e7d3938bd369e267abde405173527473b7a121f07b1c97a07148786d668721ce99a1c44e462c7ae01f267e6d1b5992afe1d179de476133159f096e587a8cf668212c3422f8d9d13cca65cc0cc285809cd4f6638e1d740b202c5f74ff00a063e50baa1cb467d22d330d511e99f53292b576e490d92893cdeedbb3948481e64cd542a5db792adeb508f1a005991608f2c0d4b7196636ed08eb4433204beacc652b51c47356aaa0124e1ce78bb724162ee72fc1cc0098cbbace61783f6ed3bce81dcd4c504f068f9d2c06bb8e98e5c6d214f393fb0b9187ccf351e587220b4808f7ea764259189bd8cb00585dc7008337bd037b4d765bf0180a4748a9e653be4ca922d7949634c6bba77babd0ea0ab37be8c1d43e53ad0c0a86da50ee0ca2cc2629d7bc7ae6ff39682aae971a9ddf23e61f4aff341bdd39eda5c40dd310e1057fb05ae122a237653b8ba35bcfd25a2bc409b97ecd2ebcfbbbfeed9327fd91fbdf449329c4a14f836b9c2b90bc897503cac41b77d756accb9704f8a7cc708ff5292a9c19f8ee04fdd8670098fcf399e373590186c8fe04c485320033710ecf46026285306f90c10bc366b019f42d1ca959b2906488bb4dd5150fcc756ac6370fc977e37f1c070ed4be734475420a490f82d1cb1edbd2a96fd6f84937b56008298d4406e7f30068c7ddfdc706ab2987ff6d163079fede5a2ad0886002979d089f64e263354c26cd15ff3224cd41b8bc505dc4275d6863375957e9baa9c333b96b47bb827924380891681914187d4a330a49a76edc6a5370974e079acb7e615910b656609dd27ce808591697d4b9cea50c7e67c4fa3ea2352552cf1fb0fb3e6fb171bbed5d0aa088af5357dd3df49b50167f96f5b51a4fbde733ece4a40e130096d25475dfb62d7327aba62b6704d7da12951b0c15f8304f381377707ef16770804b948545b9b1c7d6014f97cc4033845fd2d758e8ce7d14dc2befc63518f4dd808e655cbd28e08d7b182250db1f6008c9c5306c7458449accb38a36d909c3e085d4d5779697f6a15e68d8985ec0db790aea61fb104e39fd61a31220e75295e5fd2aceeaa3d0997e6c78fd6febb9cba3378694a43f45d4e287d460aa643c2575946e2b10879c7ef2c4855ea53932a8fa8b704b5f8d8", 0x1000}, {&(0x7f0000001b00)="594c9fe9b3a88924c02242da13582ff59525e5ff8927ee480cdc9c1ae143e6cf012a06f41cb1d7cf1a5913f59806378e0ccce7af09af5f1eb9a33901ba0a7ac93263db8cb3a975776405753609c19892601d273ff41dd36f6b61d53b9fb835760dd7fb40e87f5dd49d2fffc2eb83fa58ac3c6c340414b93449a0513426476bd83d4eee2bfc9d23f63a465f12d9a1df08068578072be8e08984499dd3403d5bc248010ca1d4b9f5521f4615a55626d326333c41323dca3b763ded66c30949ccb3690790c196d80217b6d7f925ab11f45b0d8632c15147f3f4fafcb33636f2e6e836c3562daa1e0db6cbf6a13b03644b9a0fb28d5fc6e7524f8762939f", 0xfc}, {&(0x7f0000001c00)="ed9ccde866a994ad277cf7723529ded8d9db36bc0a9c4c277ff6242ae1c7f8faddfd1b250f7859b1e5963210f0dd4d1545c32476db10a876dcab5dcfea7ccc7ccc0da77783e24545149a72cbcb453a94914ac4a5626057da1a11daf33b", 0x5d}, {&(0x7f0000001c80)="0c72dacade2609afdfd4d16ab2626d39bb08775546dcd2cf25bb197ea2ad0ed54f859e387ce8ea0fd150087521de2fd1600eba21cd75b19f8af0a9a2b1b6d5805247d4cfb8e85cf24daecba79836186fd67caab77def525b1fa4cf0874295a19555eab433048b4d33f2f8542c15f25c62cc7638454c5ce1dff452b65860c7d5eb61a09e983519f1ffbda50c785c53fca986b5cd10823aaaaaa0ad2bee6c04d1117d2b21f1dfc05efaf9cdedcfc1f30ba437a2653d47360245cce9ca97719c8b5f20afe453234fbacfa2b", 0xca}, {&(0x7f0000001d80)="ea5edfc26cd319e1ac328d294fe176044e2b75928ccecab99d6702bcbf5d6549b16bf9c522f8fb0bae71eefd184f6ba317a136eeddeaae580ae97c9b3d54b506940c355f3258d953061451bbbb70ec4bf6493c3be50e6c71f7b3a1ea7fcf0f17a9e49de21c6c4d42", 0x68}], 0x5, &(0x7f0000001e80)={0x108, 0x118, 0x1, "04c4e946d577eb28038f66e0ab724f67e0706e14c3d6bccc5daf840646516b8f7dad77ea9ffc4d27f84ea392f3f724b3c691cadf484502e91cdf81ba6909cafe037bb68f80f2e8c55746a43e3f27ec86653c9211156c3128a345772408c22001129977fea5c118fdcaf11f78140c9374445314e55ce7377c2c9d02a2e546ebe3244b0be8e9ad7578db33c8c155880d24c3783dbf977927efa6f6df1b055bd1471586c300c4ffb9e9581ff01d79699ac68544192d91a0efb6891f52fc2bed0e5995930a5ea59f5c996bf58a849482ef7b12249af54aa5326972bf68357cff8ee9337b586851adb7fae8eecb61c9990b8f00605be97c196e90"}, 0x108, 0x4}, {&(0x7f0000001fc0)={0x27, 0x0, 0x2, 0x7, 0x6, 0x0, "ec3d5bdabb3a4d3acd859ba02f1a3668b38b2797f402bec772cc72e212cd463f02cd733864c947c83255d33a2554a29898da2b0cbe9d8304329173b601e956", 0x34}, 0x60, &(0x7f0000002040), 0x0, &(0x7f0000002080)={0x48, 0x103, 0x1, "f67ebd51f5edf71c37a299f994a16e26e9d2ef97442e11ba77abb2dfc4020b0d17ab87cf5fadb8cb75bd06994eced2e7c33f"}, 0x48}, {&(0x7f0000002100)={0x27, 0x1, 0x1, 0x7, 0x8, 0x100000001, "978f9e5368fb4f1b5ba852d4bce6dfd106c4b867079e029d5d37e2861069cc2a45512d95578ed020dbde515606943914843ae049ca64d0b0f50f9e1bce2b15", 0x36}, 0x60, &(0x7f0000002240)=[{&(0x7f0000002180)="859e9fa0756f74f2a7e46cf1a0afc82e77c25791a9ec438e938936ca229c8e32958e544f1f4057111b662db2f0c70ca66073b67a13b6f2b121e5f024a0af8fa4b10b73103b1f48c32f83cef291dff0f50572faef5a95031ce194c9447c89af3c4ecf21b63ebb2f5b753361c6afafa3f5a8f0f23a1f1586462ced8bc521ec7a9dcfdf8a30fbd7562d6d48cdcd09119361174f52967d22bc6245d876ba584cffd1de772d", 0xa3}], 0x1, &(0x7f0000002280)={0x110, 0x107, 0x80000000, "8d3c6d745513a2f1e3713bbe04ad1dc11f6213bc3b560ae196063ecc9ddfa4cf8c477e9fec2fc9f38aaa81fa5bc3d001465235f8237472942bf222f4d71a075938ce6e93003ae7dd394abb95e235fcbcb5769ba54aa2a6d8857850737fde012a3efb39e164ff773c665c6cb3d36323c1678afb1cacabc40f88c5b45517e69ae73b0b49082e2372e4003841f0276890dd8d240b60fe406aacc917d54b392395e093e56cdf5b88187eed8fdcd4a85942aca04cf5957386be9f8106a05644ea89889ca652deea4992dee7eded47a3a5b46f62bead0127548c6bef5939595143e49712df0335fcabcf05e1a8f816cf30e51c82e30a3423a5b83aed1ef92686"}, 0x110, 0x20000000}, {&(0x7f00000023c0)={0x27, 0x0, 0x2, 0x5, 0x6, 0x7fff, "9bf14bd3dad9bf6f1b1a0ceca31eea536c3f528857bc3ca6857d97c6716ec0c7bd84e137de75ffefe2d952d9515cd5662ee52cc8e23261bdde10c4a4b3fb53", 0x14}, 0x60, &(0x7f0000002540)=[{&(0x7f0000002440)="c1332dca242f65bdd33003b3a0e8020115999e3ef2c33d304d07b9b790733b7ce4eb66160a5cac1faf6b76ec93d293f323d90fd65cbf527d17c1a94f5b0babd8d5a4a603a9efbec234810854e1d1036c856f8d3fa5021f1c993e49393823060ff469a3a32e89d979ded7bbe7a9f006afbf90d7b4f9ed04196aea76749fb2493a7d909008c9fe024f57a84efe4bf92c2f9ef77288e80cd4a3e00bdc780d50053a827e69a7a962d4db3e8f2846f1912089b33b97089aba9d45129814bffb553a3c330982f7d4aa7d7b7c7ccfb22fecdc63e8daf6b4b14c6bbc91e9057a799eeb5ef4521fbd6e92a535b124961bdf400aa90053", 0xf2}], 0x1, &(0x7f0000002580)={0x70, 0x112, 0x7fffffff, "d0f436df720000ec098c8867025144182888c872f96804d4354a1aafa29fd0b1f68cc01a9999b6943e769f3db1db05e5cfa8d70e5aed246305587dd909eccdb9712d6d94a5b991bb0f328e5c4f9afeb2835e4df4198287f0e9002fbaeab9e149"}, 0x70, 0x20000041}, {&(0x7f0000002600)={0x27, 0x0, 0x1, 0x5, 0x6, 0x800, "c8dc617de2a78ff5d772e01df6039466db41ec94e3e23d152d5ad411aa1c2ed44730424e81432c0172eb930fa4bb881ec0ec94ec5c78e4e107313b23ff71a0", 0x3d}, 0x60, &(0x7f0000003b40)=[{&(0x7f0000002680)="50e2a62b8c43dc48188f158d5b7f05afdabce24591d20c84e131873e75f33a9e1e57254c124c454379af7e1f3ce7ccc635927f90594ae47eb52034201cde4465d61ca430fe90ed209cf238dd666127716c5f25152be65d4dd44327bda2d7eb49254d49bdfe2edb60563a757655153ca1bdde38a9f934e3c01c0a8fce3bb03bc7cbde7e15e069e87301fee26378a34b5ce1f174b78b181949e744c31903e35bd2bce35ed9711fce04503973e93ddbcad82060cd01fed028546834d32c2bd6b496a9c086c4bfce2e872ede95a351df51e21eb9f29aaa970fcb00aec865eb91f6fe5d40961aaa6d", 0xe6}, {&(0x7f0000002780)="5ee8c08c653996f2a3030e5e2c4d4ac50dca3433cb8bf737eae390495521ccb159daf61e45e5c8308a5f36bc950cda4b68e6bddb5acbfedb0a5bdab719bb18588411931bee018aa458d9a4b6b9f5a718", 0x50}, {&(0x7f0000002800)="4783d95de7bf45ba2862e49e1b", 0xd}, {&(0x7f0000002840)="34dbd999a0134faeb2f564979e176fb4ac1991134ed048ff0be097a9b991d511c31d508a3484419bdcbb9d6d068cec9a0c70f57cab67de8cc98394e397487df8039238b0289bd3b4f5536ae9600a8b6bca7af48f7509793c2a85811d1d1d8fdec9a6832b84b26f1ef30ab884998faf1326efb7cfbef008a40f59be4db86d8d510635c382501aedf4596487c0433d112300a07a4f94a217408fc31996bbe9aff81fd54ad7479d1378f6eb80836f31e20cf9f24a1d7e083bbd2b56e7626e86c2b355f7e1585a229adb611131834a", 0xcd}, {&(0x7f0000002940)="ecf6b8c6e6268ef49c98d6f86f2f4b23d208b59f1085268aaffe4afe67dac83e948dda9599491362c276a58a9374cdd1ef4fb41481e630e6e3070f240d28a302134ac22a7c463edcf18e3e7d26b4a4cb34b1c86cd03015d9d2186479da40d04b04fdbb6fe15ad054e8", 0x69}, {&(0x7f00000029c0)="1d85ab2882d8362a0e2bf738d6ad014a04cc699ad648f8", 0x17}, {&(0x7f0000002a00)="ccd145e27306dc98e8f2cdf1eb60ef9a1ea52387d3566145da31b5b5f0a879cd6f6d4dcf6b0fbf0f050429629074adf79902d9f21ada57483cc80142fd8e61ce30ce5d42d889bf25a089c64bfd5c410959a259a80d01db7f03b3db7ba807bba6768597c5f0d1bce31a20e7c3cb6b7e4b093a8d54ab4f9742b3ee890a8d8a19e0e659a990995f62df3752493ed8d67fd8c0388cac63d7a7379436b5c90712e0a7a0d0f829489a5d4f9a54a3ce24cc399d57728e0fc06b975da8019d7b46ecff6476793b05d3c07ee71fc248f912f2b4db7dfb71fe6989e50d717f2500b0a3762b0bcdf38e31bdfdecd3eb39068760c7bbfe860edec9186c0a92f2ac5b351dea54e5209aba4c1d4536999e76b0e298221d7b7ec7a97a121e4b4d940b5e053a30379a2a86ba308ce737569d4e063f242dbb694c29ea3c719baba911741edf3cdb8c8462856ed6b123d4413f5b39f3252934832521c82c38934a916b04badb7365ba458428dbc62b1e6a5dcc5a5ea72cb92ac46a8f504989606bf7400f9e938a5b86f018934ba163bd2493ba244d8cdea506d440be3150dd9d730237f3c48d6d7896194ffca5421ec0572fb40c00a14fb0f41f96bc78acb8cc3f5b9447eeeba2d4745a83c876722ff25a11fef87fd3a00e993fd88b6c881d547f510bb800bff91942d01a9348f7d9b830314487da9fc0289db5bacc3d8c9897c52a6879149b21a9db1dc1fdb4685d8c39dc82416170b7041b3ac827a9de5a46e939ade838db5edf61f96c0d0627a1c6c2178146d3cbd66a46116c42ea330bcdb7825b9b0a75217ffd10526e290159f647d42ceaab49ee67d3c45a1086b8da7e8c6f18875349c0f2f506c80895ce08d17b3c5e5df01bca0d8460680bfb312870f99b13814a0721fa29981239fa600998657020a3a0134182f488ca0bad26f9abf9ec95fc21dbedacd5d5328296ba0f023efdc982f120cf77d23973f809a71d9ec40a0b2fb5075cf52779b65bac49699ce6604358135969eeddafe8d774c50971a6489b08860aec81f5f3e96825cceafd8bd29b4991d63fd2d97b5cc6f61f9e104c67e70e8eed8067c96daee414d8e9e7321ace369de1d4be014dacd0bd1f00bb353a7afd884d6f1b7b9575cefa6a5d4265ab81a6fb2b8f395c5c6b6b77900daf38423c81f7764201761305fa74a831f7a0a3bc61236a3ddd7e831e3037416d648939808720c933424df45f155ca4fe11172be5c96aec6bdd6d74ce7282a8ed541e1048bd632a4c02a7afe6233c88185fc796ea1ac16f34dd6475c2fc766cfcb44277e43f82ddefcd06570d38e15f4aceec3948cfef47052230faf7faaecf4e5993aa01845e648689bc56614ebe34c588fc91646ad7e2c187ba910907a536aad5932770e2eb9db5f0dff5423479d7832d05606ce89464aff35535b11bb902695effc2c65fd7ff4fd5eb2977010815e0f5400074e7afdd9e75865f292691cca42943c662bd2240b6491984162243ed125acc3333f9d1295c095b5320e25618bedc9370638166f445d20976efb36250493de07cca1721b79fdfb730df42870c40f722081cd1fd441318fa3f81d29894cea6400c7be1f7d7cd4f7d161b08f4b6eae74ac5141ea4c8cbccd7da82d499246eaf6b9f571c883995921414f2d1574855d0e12232f48fe2ee32edb6e4ebfdd06243886f6190887044c392616794f0bcddd63d05c19c18b039fb28f8038dc9b7a0ca96f207f19f29720aea25625d7fe7a5be230f12ae71f8dcea20cccb0467aecf0f45b4cb11f62c1fa978a901f05a72837d1a9b5c8ec4821184c987b848d5c805a75bc945b77fa676210e5f2181a926b3a4004c3029ef0cd3c5ee3dbbd670fa698b8a871e75168c2f93f8015c8ae84c5eb8a2683bba04bdaa51fc45bc45ae411549af2ebaf558a5c61e4e663ce6d3016196a5c78a5905a21f684c6514f41b71f47212f03fbab2d2031465a7103ef2984f04e1bb09042f67f349e4f2e4167351f84f92cb6c1049330127284245f965a6d3a6f2a8214f93ca3b0ba6190f66798840f6739e84555ecdbf6cb60ce61b2d6b35ec7d09f68259bcb391b7f176c438efcdf50222ce2b88838da66ff76a8635b60cbedbdfaf6b1ceb2b1ab9d1489fe698466c550e2ad41da6d64160e2c84270636312872af44deee6fa260086e2e250a54070b6626a4cd5c9a5417fc0826717232299525d4da31b0530327870aee0b66faeb03564b6080bb0938d57f844610c1acffcb3fa690a12cb7c0e893b36d6616b7a64190f51d01fb3b10087ae607548189f150c758e92f4a87bb247c56745fbb3f7a29619af3a37a317a5c8768ca6c1bf9b373974ad61fa681c1c997cc9532c04f21c3814b4da2d8b714f9d04d53a2e312d8cc0f64dd2058f060b9e18f6a74aaee4b323bcc0420633a9f33c865c9672ba8062ff906f829a72e5baac37de7fb0fc1276f8f8eaee59270b30a8d3fa6a7a23d618ba164072f3534f6580f2cc04aaa366785e33fb37a4b17e402eaba29fe83b69288f8802b9b70cd9c4f744cec613d3a6ec81e9ba7dbe33a98c87681bd39f2e7b7d7578fe83fc0ec4ce3a824d4b1eb8eeb98b594feccc8e101a58dbce2dc75b2ed2c048132801e79bb35923fcab10db2a15b17e0b60373275f5b88a2c9148e5e994ff769d155330387a8840f6353e4dc0fbde512c0d386ac98a126946116baf58f7eec7429e460a6806e3834dfda02a4b25bf57e9c4ed2afc151ef606b29f8abd958574cfb898d7dd6d94594a837c447bdcbb7aeba678ccad5471dafec9a9ab44897bae15c5e4269bf659517a7708672c92533e4a22559d874b62bc76d0180000f33102fd19564d70ef238ce96dbc737368e426268aa6f57b78a8c6ec31ab7d4a58217f828e02e0bd24593e111c282832ddc714dd618677798fd0de60fc3148bf23f5776b133971c4617efe2c54c26d247ea043a387078ab534c5a50882022b76c9983ac56bd8f8a8caeca07ab4c60ec883e0ea1d31ced729fc9622656c0e73edb13fa5cbfa463159767c9a6d7d3689559ff76ac272dff872b83b0aa70e5960e612582cf54813699d42fbc049fd801a5f8e5ca4cf4d4eda98bffe27e559177027fe202962fc906a39855154cc681e19efd6a5d645ee6c4ad7641bf4cf929c1b5a8752490ce04ef47ef51ad91ffa7da04edba32ae94c68fccc646de6f73b37a49f650701a0458a71ba20c72c0fa2d50b1c3908e6dd2aa4c79c0df4f8c7189fea00335f32f92b19ac0119909e6e36df90316e15e1c289c1acd3f9abb5d484d6a98b326d369677d46c3225c6af5d10f844beb81cdf66c53a45a26c347869a7779886de94e0b596db57ef352792aab32668a4d5fc9472691d5738d7758e4062f03036580ce3a4d43da89b204164e9793fb55f6e9af9228a2df0bee1de976d0dacb207cb17f6eebf81a4c7ac3b8856c6c64819716ca819c2d72384f51dc9ee1159aeed1fd76fccd035ea8ef2e3fbd2f5354185d87c2c89992f065ff1107ee5154d07aeef4d42eb981ea5c55fa4122a0ddf5c1738d97f57454b187e915e61ea8ba9d6983ca2e5c82f57d002afe8bae3986582c95ebdf1c68d6f8686d817cedeaf2d93a0a1add79e7502823530673f7c435c1ac7bbae4ad872f7c60172f48e6817e2231aad1d2ba6a7af5da32d4a252dddeb033cde70b858eb155bb894e13d7f7510f937f0ba19f9bc12ab35c5f91de6251bea016a05bb6a5c8c57cf97fc13c3553171c1c5547f23744ada7c921587ab698b220dfe6ce9442a4bb7376cffa1611bc2ffd955e6050d5cfbf2513cdf0beb2f7bd030a70ebb7df54936d88c51440b58f13d11b1ac3114f1ba7fee7096987db51f2232cd09f4a19ba85fe624144867e16822f3c47e4826d0ca887cdc8c7efb1c9ea2a7a65910b5cb91915d006a4c20846ec66f7065cec76aaee85a7951a75e6ba60965f4e17233170aef9001d6cd14fa088c80ea871fee56f7a80cd82de336fdc81c6a4677f2c60bc0dae6502537d1185fb6a21905bb2b276776bc1c4c1489e5b830febdd706770ea37bc21013416064818a6943e011fee35dcf7c7fc0f1df55812d3240d698439e84aeb82abdc03685101b1e609cffe783098d7160366a4aa3e663e0d6a61608e4211ed32747ea0c821216547b34036118977ddcfe1b5db2595f81b8f5344cca47a29d5f86b449b262c801afc587c452594d396c001efbf732c195120e461e9b3149f35664ffd7fa6de5567a3eb0adc9de44447f2789fec2a797c8918dbea0d254c0886a5b73fa8ba8cea56ebf9c48cf366f583d9889c012e7cc8737db187e919f8e32de77433fb8b71993293d64ae43690198e173fca9c2493c8e65fc1610b81d5d579a1d5613f88304770bb788638be4b0853a8b635044b17576ef7c985c01763fe5071a7d37a032bc506da1a3a036cfdfa62aaacbf6dac6e64be92635a69e6d69e3a8934d9fa00de922cedf18750e4620b9df20693a0392a0d7d6cdab7571df4a0a0065ef9e822cc60010fd014cbeb742c44b1e4c74c7f8854ff5c5338def77744f12be3c9bd3c3529771730e2e09ddf3d76358a39b6fcd4dc96bb480f220deb01dd16813e25129a4825b668d6993e50cc5856bebaa408590f254e728f5d815967bb07fc8eb1984a7701d7793cbfdce4612c54a665e2a0678fe4d7c7a1a3d196d47e58fdc95190424dd39e30d2c704b1e7ca3750fc0f4d8d94b613332054aebc8e7bdf6bc648b2b6c2f53e3453de083a6d933269b512f9626ac1d65c73e2e1c760d86a4d884d4b277e4e6554b60c7b05f995f59c2dba2463c22444e14d6b740be6fa70078e0f1e3536635704623fd961676bbd676849c6829536846d2de80ce20070a04573b53624943f0db89d69cd85506264d7a78843a5dc5bde804795b613305d55e60add84983ee92d5d631714c47f0cfd2af1bf054f085d7470b52cc8e8bab012018da207fe86c2908b467752a6b217d07d35d85378c8459017d954eb404dfeccd55f82c539ce46d89eb8a0e7093727acbdc7b4478055f6652c45e139f6ba598799319c1f20827c3d441cc738b52d948048bd3c7da9a36ec7f02a85eb93f75e0a24c0a2dd92e548a12e1fbe48e2f480e47f47e0b22f3fdbd12841792a10c1035a62026f9fd3c946bbaad96749e75b4a51065ea6ba13aafc0fed3dcff56e33d11a3987b93bcda655fa8fc5740b8d9a0e3a3aa3b292d71b8634c81ff405aeeb19312ea6f07a0e0350af0aa5dc330545a936d549cecc8d839bf89388a4ddbbe5d21a4841aab418aca6760883a483a085db0a0553a74bf946c15c87c759fdb30ef841d714f28d976bf64efbc1999ed476acc6a5b1c6cc156bf3ad57d2646c0346c876ca6558a4c389d825a4e3c4d90784ffe39421df1b2a391aaa117da0182bfa531b666af3e970f76d27480ce3b0676cefd3c1403e70fbb73dc44c762ab24a824425be7ddfd6c5df59d79e8958e6a7fc4e0cc4c8d90bdcc823bb207ba107a0adfc7d7320d03b292117551dd81e5d8b3d15a9b054b2d72fc8911e6d4ebb0e2e65b4382a57eee8f7f7492cd2b44281ed386b321638d536d073b9991ad464208a09696a0083566955dc59ba88a6283e73421d72e641a062e4cfd9bd22fd97a393edaff6bf1294f64adbf8e0ae9ff3aac751eb6e3802761e763ce197b37407b07aaaf5e2881461dc725cadc5ceb7a0cb651ebc6faa10db8522dde0537ce3de7b9f5516f24a6ae7eb604479bc3ab19fe9cc75bb901e52b8fe812f58586d4aa9e80964dae5ee71b6674a1356681d3882648738f78e0d2", 0x1000}, {&(0x7f0000003a00)="1ce7bedec74d5cc7b278ef16163582cf7ce57c90ab3d8c1645252c15b96c1589f0b6f71b0f3649924a6c9236c579", 0x2e}, {&(0x7f0000003a40)="3a0c273c162aa4ed85aaa35277860812f8633ab0f020517e4c4beeb5c73d3599c05e52b2487602bb2e60cf566d5988c66bf3957589fd6793b428ff2c916681c1914d7a8c91d47251afde8a1f13575a931bd720c01c038ff769c8f8555e1742c3b8b74869a477f0ede4ea64565dca8a136dbd62e7e9561dea87c14f5f13e33c4dc27716d377f954a78e530863aa748f7f89175d5c2cd5fa67e5feb06aa9ae988737cf", 0xa2}, {&(0x7f0000003b00)}], 0xa}, {&(0x7f0000003c00)={0x27, 0x0, 0x1, 0x4, 0x7fff, 0x3ff, "985bdafbe0b7fde3f673635638f7ace92ffb3179ed81d77af7603ba4327ee34a3283f6d98fb6bbf9b6f2fdc182cc92d26a44b84d26731145575cc7c2e148a5", 0x27}, 0x60, &(0x7f0000003f80)=[{&(0x7f0000003c80)="99ea491e3b1152900e967ee56de408ebf797207b8860f19cd6f9a9760425b55e6c1e27fd8947ad53d9b67e63e4dc2a04f37c2c7381758dbc4f3304fd4455", 0x3e}, {&(0x7f0000003cc0)="df511986109822c6ea6b086c", 0xc}, {&(0x7f0000003d00)="f5b7615205ce4383d014ccd49e8c3319865d4c316690e344ec49fea63be8a60f0729a39da925dcb281eb78e653255c158099ea3d2e5b3dc940d2541b31a1bfdf130a1c3f1462ca70d7fb95230afe8a0fcaac1613f4b1ee10f724167ecfb9d388a56adcb0cc80657e77cfe8ccf58d4e3c258e563c6e6f4ab62200c5bd13e95e0229b542fef24df7e74d5e57f3b8a5b8df1a30f5a1a389f9b139fb202a7a6713b58ec51d3cce", 0xa5}, {&(0x7f0000003dc0)="2ccb43acfae5eff5dc5e0f90a68cefba2bcdba24cdafab28870c79c1fe0e6856bf2b7e3dc3353165b3a91010929f96746c53df2506af624174b243531343b4c2dcca6c757ef31374963de9beaa47ef6ee9f16d1124816b5e41f964fcbcd9871f2ad8e3ce421da6c2f77304ac40ba9581b96ad42b2751d4aa1c418bac01bcfd3ccdb2b5f23bb171a3779addcc9dd5b64334427cc560e0b63188d249c9c84d6f9523d3ed2c3bf1bec36f0b73e43869c0e2b39ab34d6b73a201ffb89001784a0eb99b0b92d4e0b6a229a68ff19e002b9448bac59260e2c8054890cc1daa45d21abe45a289dc1b6f1533fc909a40af5cf6a680d59626a44d36261b2f", 0xfa}, {&(0x7f0000003ec0)="641c700929c0f1fec860087388ae1d79ea076a14e04499babb03d49bbaa4fe933fe7cab60c84b808c4220f7ebf0425ab2e0999cfacac55b8bb966d09e528f35bc4228d4dfb0a9a1fbda16003f77ed6267d876d10033d7dbbd650db3678858e93fffd1bf3a73e", 0x66}, {&(0x7f0000003f40)="bf04498b179f0e0f6a96b6a9be51b24b099d5a17ef8d0d31566c7b62e0d851dcaf41c8433f15", 0x26}], 0x6, &(0x7f0000004000)={0x1010, 0x114, 0xaa, "a30e5f412b9205763940c11b947ec210daebcfd9616f357f8edc5ae1dd97b37bd05d79b37ced90f77f6f52d99f8d285f4be9f6925b8ffa0299b1cdbc86c6a9534a2d9ac3dcde153332abe6853fde86e17b0a4b06829c5a919abebb7edb4f293d19d0aea27acdcea115f8a0252e5d01d23242ad66547514951fa88faad25105724f397b9ddf687f3afcad3a2709f72863f2f6136ddef50aca7bca98a166c64cc4c1bef773a31657f727a065fb709bb19dff87cb7d54765c886e2684013272302520344c4d2477b43853af3763abcb2c3945082c1b83ba29e9adcb0cf9e04e4711c24d16ae776529c134e68187e4b1bc476a27812ca3a6c2c05a88e788b41e24f30c975259a871eca15fc0948ee2da4ba20962b8a6319a7bf7e44a654287f3c0bc74d6a8a961809a0e635d1f7787a08e277f7d9d3349fda6facbab97a3ad49a96aebf8eab38f975cadb88bed7e2e2a3d433117cb707a201257b0f80cc63c7166592a44d3997518bf2e7fc6faac3c9ebe34b1fd0818635d806955626413c7305cb96234baf8740d101f27f388454dfcf79564ee3aa632272244cc5d90032d5188f4809c3ce5879d3aac5457e507b799c3dd5f026e546a49962c8d4e44b33196b6e057b5ee3099c57f86485f254c613ae6b9d43dad37548e8b957ded69f3667f67e7de449c6b024d70356d66d3d11bf0cc0715e8f844b71035d66e8a9e3d1d51bba26f5e83464f30f4becaf5a8a42915211c71e2bdd0e11581efdedd7c6bdebd10c42898f5b8a44c8d22362e7e8b028c3c4bd314e5b714f73743ccb40f6b8024faa6160c8acf8ab57809dba4fc7453ee12eda901ec99c36689a8c3525a5434934be1529058f60280964b987213a144fe824144fa1e3409ab984e0bd9a7d744f0198e922ab18405f354ffd9a83b03a1ef8fa8a258c615876f10a9d1f5b00e0cf74f42c3ffb11785475b55f0b2e2cfe1b43303ffcba2bf81e22ed46a0fd6c057e0d7dcad0da4e82139ebac252e7372103268e923051b42a5ae5a9f2ed80af79e67ad36f34fdb8d9fd4c98842b71572ea8ee259def1b17a600c18ebff0607399867b48ec50d5b9b5b0e085d76d4850ed8cfefbb293bdbd7bcabb963e54ef6db175a3b4250be30e248964dd59f164027360af756cd54b37872cd353bee42275fd9499dff98eac35c1d3db96b2a4e3bf41c3d6c65ce98382e764d75d392c22cb19278e21f84fc5a940aaf08e86958e03c2e7f3554430b3789907e777b95fdb49b9504baf717eca47fb5a3bafbac2a512e78d217990c305efa82acee1fab704ce94d4a597ba08d0c56ade41dc835bf74df39493b80598e6f2c37979f0c4dfd791e41480d5e48d26518d74111ad9a64bc135f151488dab5260845a1a2410e89423ba26debca1dddfd9050b5cd8193b61e58f396fd11242df60db4c21995e5d2ba43c3738363f51ad739179ab96c43e50ebed35b4514903461c6e5f13b96acbb87b6a48faf4670176c759c3c3102c20a9b5815fd130f80fef58571d42bcac30809a7a69df2d59a69bfb6c6e203a3a1c214434fa650b3e7912e7b6d531428f5c98c5946d8dfdbc351de885f6a0b3fc83a6656c6b494540242cc3ba98c9fe6c5e5c3befa3f445ded39c3dbd61ea1aea91488b727d1508e0cfda4b877ece787b0bc95d25373792da596ffe8b0fbb6c9c4a8e49fd86038037c8c26cfbc368de01b8f13a872842b8d11b28572accee3377e619ebe1dc389525866076ec46f901c87423c000379a4a6b38c3a2cfb9aa17be94a8de32b32168e23e4f38500615f9f7743c52a4f43d8c011d6447b5410170948c8a29cf8f776822f98d9591c456f247c19a6659faa38f221351d82ffd19d60c4202e98e90d78d24b8b5a1123f6db60dacd0239c0c333065e5b8b95593a5c6d82d97bf43589f6d0c74ce31fc2dfce03a9a9fcacaa043416c0432d8a8a75b08bfc7bd76428359308179f299b3318cdf08ebf157eb001f7e512322414d1f7623efd060cfac9f19611b2a0b235a80c598ff1d0746200c4d0e878cf59c2f6315812d6ecb0b20fbfd847c6dec5763526ce488cf0597717ba7fbcffd621307ec51ff639fbcb4228a8d86e98483c15f02349793432fc34c2d8baa13ffde5bc117e6b3c46d870b4d31b12b0d61186bcd8eab94ceb3534da2e84adb61b2f3aa06a1d2a945eeb23fe748bc4324f80027b12f41c6507c1e6e3e50655bf5594b0b09a2df30988382c067ab43313a8483d6323a112acea075bd006d5d796b0491cabc6f1786e16f825f5cfbed557335469405772d042403c1c3f67b9edecea9e86fbba7c4b11e8b768cf08f019c54b2109127bc50c5d4684317cf4d77c03208314c6d7651b90fb29182b7bc41077e308b795e9fdc2254706adb397bbc7317b71567817acaffb510513c4085178b87aa74ac6150b594edb6245f68aee9b9c98a46624e041669783f3461f2cac0e81ffcc12cbbd1eace5dcfdbac5816c06c6a85b23123491d1f38dbdea23051366c69ee3b65da9f9051cf8dcaac4274c49b847d6fa37b78eb37df4d0d50c3b6688294342fef7d7f7fe4523729395829f18d5e4d4f2ae49f52b9ac6a67f03a66f58ae255c0274202b497a4cc539307f1f5be79fe27439fdc51dfcf677ea86031c63fb7ba4ce1c0c2590efb2dc237538a87ee62e78cfbe506f7c180ae2d91536de3b1c84c4f7a34129a0c82b8f1c077a40e23bfa68a308e41826d17d751d1b8a6caac88f7b9538bcb3c6f65efd63d9efafca6fd36f9e10d0456b44ffc2fbe33d8e8c8e7e5e911957e5af59a44eb1bec93d6838fba731d43cc69656c9b3c76e2c1df7b33bc2409a3dae32f4569971f721239221b424e1e4c21f5ca9ebe9f783b7177eb8665a91cc1e8d21c2c3021feae8d6fcdf95f8a5ac8e020bdc08a98fb98400940f960c4d305d86d73f6e4e47edc6bb22880064737dbcf7ee3740efb4bb3e5b0eb11e21eae3d2936f60cdc2da42db601097ab0b1914f38c689053bc7a0d4b92cf32f8269f4c23b61109322a52180bb0d27f2ab545383a36b9efdbd5da9800fddbce6730f3e2b26dd483daf1c6be1b8b9d91b0357592d034332900589597bbae548a8338cbc7a9f7c510d8d84523f062035a12ab265c293521dcef84f23397c407fec43cb0f583a088ab811c01629c2a7b772d045a4c96a3f798110c1db9afe203b35a04baad9a4823dddafa30bb45a9211837508817ff583f2d1e6fc5edbb329a76296bb9cae18545a3b0999c8f3f7e49f92abdd2a979ce8873c8d7c6283c608f7687e0bebab8e850e63e4da01aa81f9d2db3fc312e72c31d5a32b56d7399d53c22541330309b68dcca35fbb435274421b60c42331e75a486fd1eb7e6e0564227af7a6168c30df9a8616cfd81a25a944a1709f35d56dbd63406d907378d7e93da16c229ad1d30387bdd616e6b5d3718d2bfa259df3dd8de089b2a5af46c2d7339c2eeb3aa96bd1aae7fee3a8914b61795f36df771c88dc7f3bb87c35f483f545d7effe0c83281ba25d4b912f92bdc15ab357694fa006500b9938e5b313840d846003b24a89b75366c23272e1398fa911dfd1bfe0c9ec6c019a052f816ba28f072b093cc8845cbc54e9d2a8248b49c86a16de5c77c89104cc94465ab7cd91ecb0cc757bbd62a8e28282dc179969066a4988a1db9b4fb814e3e199906bbcc389fd3d9eff4966edca4b874f3a4ac8f962bf6f14636f7f250f711c8b32c7e6c4da5fd88109e0f52ab96674aff3da2ceb75222bca7200ef7c518d5b00afcb705a2eea4e1245624bbdcb216a35420f4fd48a11bda7b35a669141e70bccc1529aab946caf1e08c3db1d0473ed65e049dd0cd3e0ae5cd07c79d2225aa023c6847d4a786498e1a0c44947f9fd026e6dadb6af912d38834441902693ba900aa94aafa28b7e312656a76ad6e39849384541a4cc3de69f736b0b678cfa9606c7cbcc5cf464e1ca036e6c5b6958bd1f279981b061c2b4b845cb928b17aeda23d221cb5df79a38565aa95bd002a98f84b60670e1903994239ccb2076cce86c13939df3245726957f28ed8664e43a42c1914c9c1017659b70a29770b96c61cd1d7e3b99167c131a2205d0000d977959bc26150bcbeea969e2745e3478821340a2f22c666de2f46c8a99c66dbc6df15fe14feaa166025401b57dd5584967ffa0d4958c2948ed285c470edab6642d2f1e9a5b7814b51eedbfdd73314aab25657445c8e44e4f312f4ee854636cbd496ca861700be0ba269f19e52817863206bb4a5a92d1d675afed32895b2e1614a3be4190b6e15f1e213fb76866c44a84f8b76d4aeee78c147bffda157aae04674927e294ea705d17ce6db428a98a7ae527d894659b5d8e15b5a79aa4a6524ecaa6ca0c15b4f1b4891f524d9fcf9a5962200e32b86a6919f4ef14a9a7d5e744d7da33aaae8674d772cd78f6772f09b762c0f5d457e112a83e9f2e8094bd6b2bcd75c14bafb592c6d2eee629f87e7da8a102641d9016dde29da89f75ef6e31c0ed6b04961cba8b956cd83c7d1e66351615c151d2f981aba774e00f8190a4b74c4613a376e01ed04512bbac9760aa6e59eb639e4b99dd236ed99f6ec630d7542675649bda1449a30139c4535b196a6552d90ed6b7b9113b7c4ad900dd2c3a8a63340d28157faca221bb0fc1aaea4cb584a7668aba1e52098bfab29dded5712a9f67997ca4c33b28b498e86cae26f5f727d699a3d8065b7efda780330695c97dc3b2ef14daf2d339142da6d2e02de8f7f2755e515a06bf0fa157148d9373e667052055c8476b0dbc0dd632d5b41d02e15ed1d2703a726a52d1cbd7bf3309d59b6510cb8e050be172c319f153d6c6505fe6337c4ff52dc180e0be7d173c8491da5dab4a91e8d39687bf72d74cc312aa8eb89dc5c71839baadbfec836daba60becaa0a50141364361dbbceda7b8024282570a8a7e0c0e52ba7f6c135c5ce9d40ba7bf164bd4a61bed8ff4d7309514a9f1bccb898b53edc30a010f42e20edf4efd811c0ca6eb807a3c2a18e9eeac65b0192d3cb23ae0cbafbd5eb1ee36c08a9c50319b1d67525159666ce9ae8626b4216cbd5b4dd0db27da77977e5c83745029a52b47143421548024c291436aa282ebd5fafca6e297f7dd4b9bec40ae96c4b4c0f0c9623aff210f81e1dd286dbf5fa3830fbfde7b313265299c089d61ceb3ecb07489809c50524f2b76aa0399bd7ec9440809ce95fe390696f8878c19bf88d28af1a8d0d7855ba1f861a0010baa6fc2eeb4c8db97d5a534ca08cae9770e4a8f9ff6692d17065aeae82208d6589d4dabfb35f6af0346c0476de5c5aed6b103d9f43e2e679f3808687e28ad5a75fbe4d0ae95b8e65824d513fa17697ecf8e8cf8c6ff927bd2ed1f967d60ce920ab4f542a05ede312ad5849a34b37818e207b7b124dd8f77eaa9e1b9b40f8a6cb7adcb3182eee7d40121f0238f5305df9bea342964d313a50a7220c20b8b33c491350bf67ed3bc3480afb26838e87022513d652b91083bcf283a92c100664be85a5c3a900d0b67310ddce442a7418d06065a17724d7a8857a9c864e5f0722b8f68433d125e2ede24bd1cb60a3e05efad33031a15a58036fb1c452c6d97d9d3f5bb1b9e1751b1478ee678f14b9c0ed2e8db43e9d63241b9255f0e8580f4a86bf844b8df78a58c139030be2cff1805e083ca893ba6624d41ae905304d8749f84daec431708d85875f366f11520768a0f7fce3e440276884a6104e55e3e8ff244de4b00b934e350dcefed5688c9727b29046dc514b30c4004df736019e575f1a120d0e54a39"}, 0x1010, 0x20008011}, {&(0x7f0000005040)={0x27, 0x0, 0x2, 0x7, 0x101, 0xcf9, "08789ae06220002aee9251d15ecfb7ed7e59cebb76b0f3e94f20b15582a9e5f88bc1a828ce845e354bae91f0132cba7b8330a9c75933d0a3dc7c6fceaf04b8", 0x3c}, 0x60, &(0x7f0000005280)=[{&(0x7f00000050c0)="5a50b6efef0fa2271993132277088419828b7fcf5e081a13828e0788732c793640a83be66de5f21f35579274ae1cfd45cdc6f7a48fed2f0cafe1830d5876c2087a41485280af6c1cd7", 0x49}, {&(0x7f0000005140)="9bd0fc2b9e9a7415a2fa81294c78c1930d82178c1a2a3e0033b63f64e237aa1929465adbbbed9590592b4d7df3f6484170ec7a5282a2bb7110e803f0072633a886ca3aa077d2d3be3f77389607458b617ac4e67c98e2ae712f", 0x59}, {&(0x7f00000051c0)="5c577fbb37f51c03fbc401a75b2579ab2f8c178fb38b92aed8cac8b2246757cc0a38a49a5fa10a", 0x27}, {&(0x7f0000005200)="8668125be845a61f91ad9e5eaa1e0c2f74167a79a87c29f07482c59fb3718bfe61e4e057444ed2cb5393af68b0335fe40fafebb6fad9c3c1f779d6c23df29b97b5e180f84b724f5325d522de546c74dec610dc6a6f4c215e724930b4ba803c9bbfae34e76e49", 0x66}], 0x4, 0x0, 0x0, 0x4008080}, {&(0x7f00000052c0)={0x27, 0x0, 0x0, 0x7, 0x200, 0x400, "53420f0fc56a0c2f1b55ff675e141433747064c3f1bd2a0ed1b2522074cc0e35e53edeaeb123485976ccfe1c0bde62d45d2ab2815a2b0c1d264f158cbae9dc", 0x5}, 0x60, &(0x7f00000055c0)=[{&(0x7f0000005340)="664ad627b0e8b8b5f22c42b5be4b2939fa4efb7d368bab0168988514e1012fb4961b9edf7bbf646b363f6b518a1050422b3999b0c07242c3f5c99f1a2de6bf8191e7adb04aefbc7edb26d02d52354acbe9e63b9386ca0fb4e346ca027d56ca36c706d068182886965df9c4ebe60b27949cc15285343a4fb3c122433d75f5d434d61659d751d184923ed08094bdf7c1a4ceadf71743deddaec77d9aa198f4d3eff691667de749a802dd98db6a725a1ca7c0c0f26c4b6d9a27fffb4c3f523f758e267d668997948167c59e164ddd39a95295a8a2", 0xd3}, {&(0x7f0000005440)="2694a5bb56656b470c177f1918195cfc64f2eebf31bf7bbe1b7e463f655d5e11407a01604bb3c6dd1951eeaf01cf8bd717c13aa4be8b672eef90ee9188d75a66271c972ad65bde05a505f5e7e48cd661d828f45fe0c785cd7b813739d60fef64c255725d7314d8544bf0bafd0d58ef38aad8ca3a550194f1cc3b1973961ee0b680e4db32a68b6547524dc6ade7e2eeac43bae46f5e59b609e8780e91ce828c7f7f53a1959e5f4b871691480248bb9890229459e0b4f0dbd4a0f240068a7052cb7a01bb2e45025a5dab3230cc0edbf79a222b8193d02d5100a5074fdba016699d4382c69f90554134980f425876d4ed43b80d77522021623094e2", 0xfa}, {&(0x7f0000005540)="76650203cd882410607d91f3298f306850796968705da477cec98c8e99c5901d231c1ac8b8bcba57be0bd9258cbbc49bc2565ef7a8b21e3a82a43b810a38a7e88c36df1a", 0x44}], 0x3, &(0x7f0000005600)={0xb0, 0x119, 0x100000000, "0aced78ce088e7006ab0b8f82569b4f2c1bca0b7d6a6832820fb9a7a9e421738e34c8f74d6cd887f31fea4617d74e7eaef8725d5d5c39501d999c53386f09b4607996b73101de864d68e814c9cc22b1e6e99adac526a843f5be5be7f94ac704a42f1eab6920de628709bca42cbe2b3082dda53185df9fbe2d69a5531daeeb7d5600e4955288c5b9737a42895186b5f95a5064f05724c964e831b376c0e"}, 0xb0, 0x40}], 0xa, 0x4) write$FUSE_POLL(r1, &(0x7f0000000100)={0x18, 0x0, 0x7, {0x9}}, 0x18) 14:16:08 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000080)={'ip6_vti0\x00', 0x8103}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r3}], 0x0, 0x0, 0x0}) [ 474.507775] binder: 16476:16480 unknown command 0 [ 474.539211] binder: 16476:16480 ioctl c0306201 20000180 returned -22 [ 474.554697] device ip6_vti0 entered promiscuous mode [ 474.573237] binder: 16478:16484 unknown command 0 [ 474.584876] binder: 16478:16484 ioctl c0306201 20000180 returned -22 [ 474.595475] binder: 16478:16487 unknown command 0 [ 474.600942] binder: 16478:16487 ioctl c0306201 20000180 returned -22 14:16:09 executing program 2: socketpair$unix(0x1, 0x2, 0x0, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) shutdown(r0, 0x0) recvmmsg(r0, &(0x7f0000002100)=[{{0x0, 0x0, 0x0}}], 0x3ffffffffffff5a, 0x10100, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) 14:16:09 executing program 4: r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/fscreate\x00', 0x2, 0x0) write$binfmt_misc(r0, &(0x7f0000000040)={'syz1'}, 0x4) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080)='/dev/btrfs-control\x00', 0x2000, 0x0) setsockopt$sock_int(r1, 0x1, 0x13, &(0x7f0000000140), 0x4) timerfd_gettime(r1, &(0x7f00000000c0)) creat(&(0x7f0000000100)='./file0\x00', 0x0) 14:16:09 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xfdffffffffffffff, 0x1ff, 0x200002}}, 0xa) 14:16:09 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/qat_adf_ctl\x00', 0x0, 0x0) recvfrom(r2, &(0x7f00000000c0)=""/67, 0x43, 0x10000, &(0x7f00000001c0)=@rc={0x1f, {0x2, 0x1, 0x0, 0x2, 0x5, 0x1}, 0x80}, 0x80) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:16:09 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000280)='/dev/binder#\x00', 0x0, 0x2) r1 = syz_open_dev$binder(&(0x7f00000007c0)='/dev/binder#\x00', 0x0, 0x7ff) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = openat$zero(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/zero\x00', 0x100, 0x0) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r3, 0x84, 0x76, &(0x7f0000000340)={0x0, 0x2}, &(0x7f0000000380)=0x8) syz_genetlink_get_family_id$tipc2(&(0x7f0000000080)='TIPCv2\x00') setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f00000003c0)={r4, 0xb48b}, 0x8) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r3, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000200)={&(0x7f0000000880)=ANY=[@ANYBLOB="e0020000e2b7534c76fe41392b1d09f6a7ea5849d1bd2296befeb1a603bbce2097fd79c5b1d9c7124b71cc71ef8e2cc74fa99464d6421d11df15aa5ee393cf976345d74b89c9334635f790ee07bb254d1e6430042c289bbe575a03792e33f4a62c73b3bb26ce7ea961a73ee4277a58b2c4c8041ec0c926fae53c1f6cf385bb64c5884962d8f7e5ad638aa10189e2859eb88efd665f993dd31cdb56aac19ce0092719ab4a45", @ANYRES16=r5, @ANYBLOB="000328bd7000fcdbdf25030000002800060008000100ffff00000800010000080000040002000400020004000200080001000180000010000600040002000800010000000000bc0005000800010075647000080001006962000034000200080004000900000008000300ffffffff0800020000000100080001001e000000080001001a0000000800020001000000080001006962000008000100657468003c00020008000400ff07000008000400050000000800020020000000080001001a0000000800040008000000080001001c000000080004001f0b00000c0002000800020001000000080001006574680008000100696200000c0002000800010014000000880004001c000700080003001900000008000200010000000800040097c900004c00070008000300090000000800040000000000080001001000000008000300a6010000080003000700000008000300300900000800020007000000080003000000008008000400080000001c000700080003000800000008000200faffffff08000300080000000c00090008000200ff7f00001001010038000400200001000a004e210000000300000000000000000000ffffac1414bb050000001400020002004e20ac1414aa000000000000000008000300060000002c00020008000300c700000008000300010000000800020005000000080001002000000008000200060000002c000200080004000100000008000200010001000800040008000000080001000700000008000200050000001400010069623a76657468315f746f5f687372002c0004001400010002004e22e000000200000000000000001400020002004e23ffffffff0000000000000000340002000800010008000000080004000500000008000200000000000800040000000000080002009d060000080003003f0000001800070008000100020000000c0003003f000000000000001c00090008000100ca0c000008000100010000800800010059c60000"], 0x2e0}, 0x1, 0x0, 0x0, 0x20000800}, 0xc0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) write$cgroup_int(r3, &(0x7f0000000000)=0x7, 0x12) r6 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x0) ioctl$sock_SIOCGPGRP(r3, 0x8904, &(0x7f00000002c0)=0x0) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000140)='/dev/loop-control\x00', 0x20200, 0x0) ptrace$setopts(0xffffffffffffffff, r7, 0x68, 0x41) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="03b2cc0857a2c0990d1db1e4bf4a69a3ef06004032979fbacc797826916746f694fd217cf4f83aab1cd020983227d9203e274d334f4636a0937f1074ff41f050c6e8f4eaedc50000004a6c4e29402b094af134733f8ef7538d75fcc02c197d6e130000000000000000000000007b9c47240fd97d40c09c93bc2c68eb18222325bd2729ac01b569b46073035ac0809cefc9dff2c32f8b33e36f5874744664838df7bdfe", @ANYRES64=r6], 0x0, 0x0, 0x0}) 14:16:09 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x3}}, 0x0) 14:16:09 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$EVIOCGBITSND(r1, 0x80404532, &(0x7f0000000040)=""/234) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) [ 476.086066] binder: 16496:16501 unknown command 0 [ 476.102031] binder: 16496:16501 ioctl c0306201 20000180 returned -22 [ 476.104286] binder: 16494:16500 unknown command 147632643 14:16:09 executing program 4: r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/fscreate\x00', 0x2, 0x0) write$binfmt_misc(r0, &(0x7f00000001c0)=ANY=[@ANYBLOB="73797a31e542c0cd674fd050cb8c5babbec56e7214b396460ba37edba0872043787e16bc48ef87ff03a3be0019a42e64f3229d3dc3834c63d42b90ad4a955a996fe3b8ace3aae1bf398c13491f94f0f844f77d8e4ef00092237f68151a40721f35a735a7128277b230798273152a782de2fedf5ea64f03c5b8cd2ff99b3d3daad9c60950cfbf46b36cf35d973334db2a5860c0f7a811811f63b8e133d0ccabd4203f477451a63c314bb77d86b90e3e1c126f11780f867cd8b9fa567b864bde513a4b80ba67c02587869a28accddf3e4258e89863957fa9cc0002925874cc56a410b98ad5d9a939ac3d415b109f081ae974a399094893b308aaf16bd86f91fe638010d23570c534898c01758b376849f23e9dd46db7b0ba1cccde729c4528aa1bc8d1b800"/306], 0x4a) syz_open_dev$vcsa(&(0x7f0000000040)='/dev/vcsa#\x00', 0x4, 0x200000) r1 = openat$zero(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/zero\x00', 0x80001, 0x0) ioctl$VIDIOC_S_OUTPUT(r1, 0xc004562f, &(0x7f0000000140)=0x6) creat(&(0x7f0000000100)='./file0\x00', 0x0) 14:16:09 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r2 = open(&(0x7f0000000080)='./file0\x00', 0x400000, 0x92) ioctl$KDGETKEYCODE(r2, 0x4b4c, &(0x7f00000000c0)={0x8, 0x7f}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) [ 476.163929] binder: 16494:16500 ioctl c0306201 20000180 returned -22 14:16:09 executing program 5: r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mixer\x00', 0x80, 0x0) r1 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000080), 0x4) fcntl$dupfd(r0, 0x406, r1) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_inet_SIOCDARP(r0, 0x8953, &(0x7f00000000c0)={{0x2, 0x4e24, @multicast2}, {0x306}, 0x0, {0x2, 0x4e22, @multicast1}}) r3 = fcntl$dupfd(r2, 0x0, r2) bind$bt_rfcomm(r3, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) [ 476.210228] audit: type=1400 audit(1564496169.813:71): avc: denied { map } for pid=16494 comm="syz-executor.1" path="/dev/zero" dev="devtmpfs" ino=13691 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:zero_device_t:s0 tclass=chr_file permissive=1 14:16:09 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="573c69d09af0514d6cc8069983a7b9af03b608ab894ec8b0de3bd174bfd22f5514f1f239f9c27cd18125872b7932b7d0c1bce85963c7326004866e980828c496465472e23a2e212260889c46da3566057eccc2c8687ba62036d090494442"], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r3 = syz_open_dev$adsp(&(0x7f0000000080)='/dev/adsp#\x00', 0x0, 0x8000) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_REM(r3, 0x84, 0x65, &(0x7f00000001c0)=[@in6={0xa, 0x4e22, 0x0, @mcast2, 0x3}, @in6={0xa, 0x4e22, 0x81, @mcast2, 0x5}, @in6={0xa, 0x4e21, 0x2, @mcast2, 0x4}, @in6={0xa, 0x4e22, 0x101, @ipv4={[], [], @loopback}, 0x4}, @in={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}, @in6={0xa, 0x4e23, 0x7fff, @mcast2, 0x3}, @in={0x2, 0x4e22, @local}], 0xac) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) [ 476.254816] binder: 16513:16517 unknown command 0 [ 476.263318] binder: 16513:16517 ioctl c0306201 20000180 returned -22 [ 476.283709] SELinux: Context syz1åBÀÍgOÐPËŒ[«¾Ånr³–F £~Û ‡ Cx~¼Hï‡ÿ£¾ is not valid (left unmapped). 14:16:09 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x9, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) openat$selinux_mls(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/mls\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) [ 476.312634] binder: 16523:16527 unknown command -798409641 [ 476.364406] binder: 16523:16527 ioctl c0306201 20000040 returned -22 [ 476.372200] binder: 16523:16531 unknown command 0 [ 476.387571] binder: 16523:16531 ioctl c0306201 20000180 returned -22 [ 476.406983] binder: 16530:16533 unknown command 0 [ 476.412713] binder: 16530:16533 ioctl c0306201 20000180 returned -22 [ 476.420147] binder: 16523:16531 unknown command -798409641 [ 476.425914] binder: 16523:16531 ioctl c0306201 20000040 returned -22 [ 476.435071] binder: 16523:16531 unknown command 0 [ 476.444997] binder: 16523:16531 ioctl c0306201 20000180 returned -22 [ 476.452110] binder: 16530:16533 unknown command 0 [ 476.457410] binder: 16530:16533 ioctl c0306201 20000180 returned -22 14:16:11 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x0, 0x0) shutdown(r1, 0x0) recvmmsg(r1, &(0x7f0000002100)=[{{0x0, 0x0, 0x0}}], 0x3ffffffffffff5a, 0x10100, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 14:16:11 executing program 4: r0 = geteuid() syz_mount_image$gfs2(&(0x7f0000000040)='gfs2\x00', &(0x7f0000000080)='./file0\x00', 0x6, 0x3, &(0x7f00000003c0)=[{&(0x7f0000000140)="b9fe5f82e17da7d3d43ba1ea98249e6fee796fe0a7c6818414bac008e58ee1d8714ac4c971110b1db3b23531873e8720a9429f3b68541d4258bcfddd0e5dc444cd1ed9bc60358bee3913c0cf220e9ce4dfb043b8d856d6650841f7c3197ff1976a3488bd27e9b2e1b07d7413bf03c009b81b2d6dde480b5abcdb168c11b40efb6cdbda05a6cffdcaaa67531648d74296fcdd9a45c16de0dc377774907d2736023572d9cd19e1b2f1193b656a2ae68017487a12dfa9c3a24ce3cfe09c9157f2ae7ac8ff06f0f6292c1fc2f573c97450047ca8d1", 0xd3, 0x3ff}, {&(0x7f0000000240)="b11ea4c8bfcae5456bf13fc2e70f6c4df12a0c20da7899452d40e3f85a354c7648bccda52751177a90807aaed84df78bf405188a65dc7ec798fbbe1af209e3d692aba715221ef3f154bcf0f9b2f6b99f678bdee59d2a17f4c20c4f48c78d783f8157fdced31536fcd39b89f96d", 0x6d, 0xad0}, {&(0x7f00000002c0)="baef310236c25a53074474b4d8152a68c03f926415811bb0083c29056e70232edf38ad359132ebc8f5cd27c4e5913fb55619acb8deb650db9c99ee740b3be22b1010850d3f2292ffb7abc7800f97ff6ff3ba8ec385ecf002496a2760e33f76ceea6c22fc9b66bdd56eb2be9a89c13ae5eb4f3ac105ccf3a1150c568b7a3b7b3e8b3d593f1c6abc96622a792f6dd15a1a6d3c406011c7e5f055319fa1805c8141481ce48d646b0a4acbcf05d0c733a07d2e828601149b33435706220a05f8e3acb20a4dbb84f7696c8a1cbff5367b8a3ab0011ee58291", 0xd6, 0x3}], 0x2000, &(0x7f0000000440)=ANY=[@ANYBLOB='nosuiddir,localflocks,quota=account,locktable=syz1,localcaching,loccookie,upgrade,nodiscard,localflocks,euid<', @ANYRESDEC=r0, @ANYBLOB="2c646f6e745f61707072616973652c66756e633d504154485f434845434b2c6673757569643d63387737773277392d776434342d7737617f2d3f7734342d38373761323300672c646566636f6e746578743d7379736a646d5f752c00"]) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000540)='/dev/hwrng\x00', 0x80000, 0x0) ioctl$sock_ifreq(r1, 0x8995, &(0x7f00000005c0)={'erspan0\x00', @ifru_names='veth1_to_team\x00'}) openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/fscreate\x00', 0x2, 0x0) r2 = openat$vimc1(0xffffffffffffff9c, &(0x7f0000000580)='/dev/video1\x00', 0x2, 0x0) write$binfmt_misc(r2, &(0x7f0000001480)={'syz1'}, 0x45) r3 = creat(&(0x7f0000000100)='./file0\x00', 0x0) setsockopt$inet_sctp6_SCTP_HMAC_IDENT(r3, 0x84, 0x16, &(0x7f00000000c0)={0x4, [0x0, 0x3, 0xfffffffffffffffb, 0x8]}, 0xc) 14:16:11 executing program 5: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x4200, 0x0) ioctl$sock_inet_SIOCDELRT(r0, 0x890c, &(0x7f00000000c0)={0x0, {0x2, 0x4e22, @local}, {0x2, 0x4e21, @empty}, {0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x21}}, 0x40, 0x0, 0x0, 0x0, 0x3, &(0x7f0000000080)='gretap0\x00', 0x3, 0x3, 0x3f}) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000180)='TIPCv2\x00') getsockopt$inet_sctp_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f0000000440), &(0x7f0000000480)=0x4) sendmsg$TIPC_NL_BEARER_GET(r0, &(0x7f0000000580)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2}, 0xfffffffffffffd34, &(0x7f00000005c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="c4ffffff", @ANYRES16=r1, @ANYBLOB="00002dbd7000fbdbdf25040000002800070008000200ffffffff0cac9de245e69a00030001000000000000000800010007000000080002000800000000000200000002000300000000000200050000000000020001000000dc0004003c00070008000200060000000800030005000000080001002000000008000200040000000800010005000000080001001e00000008000300ff0f000054000700080004000100000008000100020000000800020002000000080004000500000008000200090000000800040001010000080004000180ffff08000300ec0a00000800030007000000080004002f3e00000c00010073797a3000000000240007000800020004000000080001000d000000080002000200000008000300050000000c00010073797a30000000000c00010073797a30000000006c000100100001007564703a73797a3200000000100001007564703a73797a3100000000100001007564703a73797a310000000038000400200001000a004e210000000400000000000000000000000000000001008000001400020002004e22ac1e000100000000000000004800020008000100f7ffffff080002000800000008000200810000000800020040000000080002000100000008000100ff01000008000200e400000004000400080001007f000000540004002c000700080004000004000008000400070000000800010020000000080001002000000008000300000100000c00070008000300070000000c00010073797a30000000000c00010073797a3000000000240002000800020001010000080002000101000008000200ffffff7f0800020000040000"], 0x368}, 0x1, 0x0, 0x0, 0x40}, 0x10) mknod$loop(&(0x7f00000001c0)='./file0\x00', 0x800, 0x1) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r3 = fcntl$dupfd(r2, 0x0, r2) bind$bt_rfcomm(r3, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) 14:16:11 executing program 1: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r1 = syz_open_dev$amidi(&(0x7f0000000080)='/dev/amidi#\x00', 0x100000000, 0x20c01) getsockopt$inet_sctp_SCTP_RECVNXTINFO(r1, 0x84, 0x21, &(0x7f00000000c0), &(0x7f0000000100)=0x4) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) 14:16:11 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x2, 0x0, &(0x7f0000000100)=ANY=[@ANYRESHEX=r0], 0xffffffffffffff77, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="38be9c920fd44d32deab50348c5f03630840", @ANYRES64=0x0], 0x0, 0x0, 0x0}) 14:16:11 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba0000", @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x3}}, 0x0) 14:16:11 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x0, 0x0) shutdown(r1, 0x0) recvmmsg(r1, &(0x7f0000002100)=[{{0x0, 0x0, 0x0}}], 0x3ffffffffffff5a, 0x10100, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 14:16:11 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x200, 0x0) ioctl$VIDIOC_TRY_DECODER_CMD(r1, 0xc0485661, &(0x7f0000000200)={0x4, 0x1, @raw_data=[0x4, 0x1bcea48, 0x5, 0xffffffffdb300430, 0x1, 0x630ae140, 0x7, 0x8, 0x6, 0x2, 0x100000000, 0x79, 0x8001, 0x1, 0x3, 0x6]}) r2 = syz_open_dev$binder(0x0, 0x0, 0x2) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000280)='/dev/hwrng\x00', 0x2000, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x66, &(0x7f0000000080)={0x0, 0x8}, &(0x7f00000000c0)=0x8) setsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000100)=@assoc_id=r3, 0x4) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="81f377a5"], 0x0, 0x0, 0x0}) r4 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r4}], 0x0, 0x0, 0x0}) [ 477.925100] binder: 16543:16547 unknown command 808482864 [ 477.943525] binder: 16543:16547 ioctl c0306201 200000c0 returned -22 14:16:11 executing program 5: r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x2c000, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r0, 0x4020565a, &(0x7f0000000080)={0x8001003, 0x5, 0x3}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = fcntl$dupfd(r1, 0x0, r1) bind$bt_rfcomm(r2, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) [ 477.992862] binder: 16543:16558 unknown command -1835221448 [ 478.007153] binder: 16543:16558 ioctl c0306201 20000180 returned -22 14:16:11 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x0, 0x0) shutdown(r1, 0x0) recvmmsg(r1, &(0x7f0000002100)=[{{0x0, 0x0, 0x0}}], 0x3ffffffffffff5a, 0x10100, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 14:16:11 executing program 4: r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/fscreate\x00', 0x2, 0x0) write$binfmt_misc(r0, &(0x7f0000000040)={'syz1'}, 0x4) r1 = syz_open_dev$admmidi(&(0x7f0000000080)='/dev/admmidi#\x00', 0x100000000, 0x10000) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f00000000c0)={0x7, 0x7, 0x200, 0x101, 0x9, 0x9, 0x1ff, 0x8, 0x0}, &(0x7f0000000140)=0x20) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r1, 0x84, 0x13, &(0x7f0000000180)={r2, 0x3}, &(0x7f00000001c0)=0x8) creat(&(0x7f0000000100)='./file0\x00', 0x0) 14:16:11 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) socketpair(0x3, 0x2, 0x9, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000100)={0x0, 0x6}, &(0x7f00000001c0)=0x8) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000200)={0x0, 0x4}, &(0x7f0000000240)=0x8) getsockopt$inet_sctp6_SCTP_STATUS(r1, 0x84, 0xe, &(0x7f0000000300)={r2, 0x7, 0x6, 0x4, 0x7f, 0x8, 0x5, 0xf199, {r3, @in={{0x2, 0x4e21, @broadcast}}, 0x8, 0xf83, 0x1, 0x7, 0xf2d}}, &(0x7f0000000280)=0xb0) r4 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r5 = syz_open_dev$radio(&(0x7f00000003c0)='/dev/radio#\x00', 0x0, 0x2) ioctl$TIOCMBIC(r5, 0x5417, &(0x7f0000000400)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0) r6 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/hwrng\x00', 0x80, 0x0) ioctl$TCFLSH(r6, 0x540b, 0x3) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00634040f70b878c17226dc671f51f1bc9183b42309b0f18c526dfe5a3ba"], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) [ 478.068539] binder: 16565:16569 unknown command -1518865535 [ 478.099383] binder: 16565:16569 ioctl c0306201 20000040 returned -22 [ 478.119979] binder: 16565:16577 unknown command 0 14:16:11 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) shutdown(0xffffffffffffffff, 0x0) recvmmsg(r1, &(0x7f0000002100)=[{{0x0, 0x0, 0x0}}], 0x3ffffffffffff5a, 0x10100, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 14:16:11 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$KVM_SET_DEBUGREGS(r1, 0x4080aea2, &(0x7f0000000040)={[0x10004, 0x2000, 0x4000, 0x6000], 0x3, 0x60}) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) [ 478.145006] binder: 16573:16579 unknown command 0 [ 478.148351] binder: 16565:16577 ioctl c0306201 20000180 returned -22 [ 478.155869] binder: 16573:16579 ioctl c0306201 20000180 returned -22 [ 478.181876] binder: 16565:16569 unknown command -1518865535 14:16:11 executing program 4: r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/fscreate\x00', 0x2, 0x0) write$binfmt_misc(r0, &(0x7f0000000040)={'syz1'}, 0x4) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f00000006c0)='/selinux/status\x00', 0x0, 0x0) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000700)={{{@in=@dev, @in6=@loopback}}, {{@in6=@empty}, 0x0, @in=@remote}}, &(0x7f0000000840)=0xe8) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) getresgid(&(0x7f0000000400)=0x0, &(0x7f0000000440), &(0x7f0000000480)) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f00000004c0)={{{@in=@dev, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in=@remote}}, &(0x7f00000005c0)=0xe8) r5 = getuid() syz_mount_image$nfs(&(0x7f0000000800)='nfs\x00', &(0x7f0000000880)='./file0\x00', 0x48, 0x7, &(0x7f0000002e00)=[{&(0x7f00000008c0)="3e0068b24653d934171e28deb95a332329bbc08b730045e01c6bf24f7008cbb50016527516843bb3e715a3651ed9de5693d452e0db2ced1c088499aa4ff05bfe8ab66a64e7d3c8e9f25432d815bc5b50644402c60173d9991c090b4a49115d46dd60505715e96241f16785de5fca40347fb8e81ea736afe0672aa0b54e94115a98656c8745d344ca02d0cc72cedd750bf2a735add914353f8780d1d71e269abd4598460472a131a669250f0c6abb23a48c6f71def640e96a933f76359fa6835ebe6776ae1465e8da6007b1c4403c08eee9e722259662d0d4bff2fb9927ca07e24e5449f09202b4338cb096d22071df05741bc737adea6a0aef5384a1e2015c1658bc3fe0ebaf246365b35e0959067619d57e3216f616f78c6d9c7307d4ca396ae953939b17cc63707005c61907762e8ed445b139082e0cb5d05a5d399d4290d17e0a8c5eed603b34628cea7690e7a1c9f07f551f95ebc8cc8e72e03f5105b5ba4d3845ff6a7aecad196bab8458b63f3cf6ac8b2efc4fafb55b2fea67e207b79f9ee8a725c6f674048acbd3236d426e912d1a7da293f76e3f6a819fc85e33086c3efc2a8fe6350bb27051a351c9fc88b4901939b1bffa16f1008d267de10097d2041f91c7f8f85b33bd866d50c9d3d4ac67cf6d22c0918ed853aba4c0d89804104a112f5a2f9c7644a6898dfa3dfbbebc917678e4720b914475a0619363fcf46898a78d54789b7eb1f5eae9cbd2df4f8e556907cbf76606d5873e8df8dbd1ab90d4c4bd78447dda467100987dd4e23857f68d6c72837b23af8b04b2aa8d7473064ad4e086f8311b8c36ae141c2fa1dd018c150925f51c5a4c1948e17a0323bfe0ca59319b726f1fdfeab6519a9a8529df760dc4b800b05a08190cbb1b8c246b3f524922a1b3380397cbff940841c15e4b73f1c98252b4137c8823752213c941f848977f64765ce160949d59b585ba846cb040c22c03bfce27bc7c9cec6327426615e0704f9a213c0859856c86472134168bed3d39fea7d9c35e5e3cbce4da2e6c12d457b3f5055c90a8201d739d4da4f6b780bf096e65dbfec57760ab20d7b90454d87aeb86a4b2fa6a84accc4e87a081d70a858494610511f16b1f8872563e0df5cb171b30df4166dd3903cd34e4c09477f7ea54db15519a386d9ac047dcc487ac407eff7438afb06022d6d21c6c7ae721110b8e70623b0ae0ba50f61d8bb736becbf6f5d41a80bf0078513a80793d945efd7027b16afb8d7b5dbe2564d3ef123209a9db846421cb0edf26c391bbb3408403822acfbfedd3f22838314ad292dc55ff4fb7e38de87509729a0509b59332789db614503e286fd374dcabbb3a75d2a5f5402da6ef6de8936700f5a2a2633912a00f6d9f4ad6973743ed4e8dffc0d2ff3313032f72ab638e3181aaff526c5b879076ebab6445c61148e87ca7a6bae2f3e20fa53e7a174c5068c92aa7a98b4a1d8e8939e59c95b28890028ecce65aa5a068d17d7df094c2985fbce95c4603a5dd63eed8adbfb8951182f9db6538f40aa5a75219f15159f823c667d7bc069855fd2424f10a067d2450c1b53acf11d5128faf65832aef1431f4c98622d66c1a0d9fc597ed5cdbef07fd8d702d0c2b0912591c75b5a58cb16d8d14db93079d2be5a09e7c2d57a813accfc08ab43705c1fd14658a7a5beb4c2481064467d228d31ef25f2444d33dda02bdeaed9d29c8955e8baa3829846f1d1326250f7730e41aebe069ae41de01f886f54e828d190ee2b6823441c2a5a2e1a296cb4c2e0fec4a34c4c8b665b842ee348704549573404bb4f306f4ec478cc4d9646bfe6d362c126b23b60e13650da1d3c8ec542c51ea0fa02b8ddd245b22a5ee37f4164ab000fce693dea2cf2556b3f221d41ca0c38ab316793517e4dd095061b52ff69728092fac8b65b0c17ecd501e70847188af750aed2d7710aa95bc01e7a9fc8e04c27092ac1c1434f9e42f00069d1452f87914790fd9b6e1c8cd9d41cd41005ba411ccc0810a437150caf626e9da28d42270cb24d7251f9ef165065974cfa693a621b1ece30e20f4fbdc97f52ddfd2fd61f38a5f91e9e854f95e54fdda7a0f256d17675df45bfcd2ea947ffd9971e44a734a20f74df5894433a5ffcc07661c121448cc4e67ba055e11829275d3cbcffd9701a1c99f34137f99f2a0b8f7a621095d4a0672c351aa1b452a70fc984e4117b9a8abfeb76163e4b402d3f6353bc9e1f7cfb42421413afa7d6e32b9dc322542a44971d3fb19a6e1d141d0b94223a27f1bf330e53ba6f020c24823d062aa9dab9e3de2ec228e9b0aef3b9619a08739ae18313ac0287bb6b1f6472b6f8978ab8b5bea1c163315ee92b1e979f2996559fdae3f7cb95773c78f8e878632534f3adcc1dd06d766285c5d62a223ef4aaf41ff9129092022fc4a11a8f8e22ba93684e063b7f6c47c9374a41eeaf1c8eaf665f5d3ce0d97fe5680d5b0d44e5cfb68eb3d3199217ab611d1b1777645ec8aae4c785111760697ec72b69cdcb8ac9bc7f0d049190aca63cc447fbafdceb7f7da1037cfbfd4bfbbfe595753d6cca375e293bf3326e065fe6e8ad49fb4488422bd5db8489ec396de210fa5c2b5fb59eb84bd56fb06b26ba75683fca01f50d450a87e54519193a597c4cf0b9a14300441467837f25c3ee4d9429bdc684f0dfc35cda80be1ca504e0fd99cae70fcdd6ae28ddc66ff0341dbebb659da0d18ed1aa77e8ff63b5ce602a911b8bdb7079d6b136e82f9c138f292338d8aab6c98d7e7e88346d104ca0db262cbd81ddc2ff3425fcf21c9ae0734f64e9a0cf5a765fac9d5a6c488a2d34aa3e191c76d884eebf765fe495e6ee7481d70b53749a34e161b9dfcc3904ffd5aa284f983217b6e9d2fc6b2836fe81d364d2bb78a631ba3352c7b415b97f1fb06edd883c1405b52f2fb96c9d7712b5a1e66a9a45352b5a7d4a61d850701d69b84d5c0fa4074681fb2e2f60708d1036895108c6866434ac28102c00796d19fc7541926acb5957f3295249f1fa51555f35a33d9aa4468fe3bcc27ab6250d582f9ce0236835ee007d94ca54b76e561b48dc808af73bd50b143f212a5ac6fd336b427631d25b1d6493fd2c94dccc0333fac30e21c4ff389ff88c1df8fb6ed9decf11e2e3823ad4df38f683992862fe40fe7b72f40fdd6c759724994c9987d3afbe9c75c71044b023dd2d5834281311f72bfe97eb9cf2378570241845dbffbf79deba19f913844c6d029816a6bd8d8846d55d4c0cae157e5c49f5de8df08b21499f13e584a76c8335bfecfdf62ff22be4fe8c082804d27df2a4c1bdcf2fbbeaa4039f21dbd2a7904270303d00f08c3389bf7153ae691acb8ebad0b3c90428059e2796e2cfcfe1e021f026e1dcab1d8e0eba991b8e66a2b6f924de98dfeaf5775d52ab216323202973fcade42093f2283fc625ecd70c057fe95505e6f63a92e2dff7723a729bf188006ac9dde9763026bd9e820ceb9a02251f599142271cb2112c5d352c7a6ec5b8d9e2f8d022607eee0f92bd6f770d400169d008c9d073a9111ae5f35c608dcac46c436dc2c21a5ff7d3d3cc5b213cadf591b2aed7c01d1776c7b59c2938f718cdb80f56e55f2dfb8bc30907dd42c1ce3b15ea71069edb2aadd4f7a07378ca3ff3315b7e1bdb700d2611bcde78cf2576b6f9956c8a4852788c5929a8ba11348bbb02e154481db3b5a2d91885663d2f5731d523d1fa1ccd2981236f59a9a346ab3282688ddd2ef14b2687718c79ae487623aa5552fe95e2548c9dbf1976a3ca7ab87c184498057d52182cff4905cba8585b73f1471fcc71041f81f80371ec7b135bf1d473254776b7a31959488b00f8f02634288af5de62e35a2322e01467b6e35a1838bbdb44217e176051f062b72ea5459c86a56396576dd70d9c82d0d7aceb407f0eaa6d814ec9c469e7768e43ac62d5d89b74982d891793531659fe2d7c4a02998edf33a49c205b719ab3cdee283fb8b6441d5fd0be07ca5ae4fbeb6f8da6ad641c7e1a2f01d96b9c406aa4835626b58a55f4bab55343ace4be32a59913e59a8426ed90a25b646fb847c18457037c013b36f99a140d633f7183227e89b17bb4346d3a88b79a55606680bb5657c8b4f77c78470bcdba2294b5ab5711110acbabd39743492e980e498b29b7318b86487d5d4dc613b7b167f61bbc1124d863489acbb43e480048a49dcf035bb1eb07469206d2984c397f7c55dab04c184ae2e922265b0a5790ebe0e204bc4e7e7b1a6ddc8ef6d18bc64998cb7a0b836385e75829424a6ac607887fadad338959ecdd2cc49584f590a8142199bbdc21f91a3534634092796e0e5dbfc531d51345883fa1596c2ad0f65066ad4ca8a6b73e2ca3e1099baf244fb05f9c076d185462f8bf8f108d7cd65e8dd822e4419facdb325e1a9308f828b6d5155b2780a10953d24719774d22febdbdc9d23c255470fa7b6fd13410821c48c80f9936488960754047ec81aeb573d963d2382a681704241087cbf652fa94128bdad034519424163687c1b53130118bab9724677323d3d87607315b5ea185d3c77d64311ea1225e442fa51dceadbe4b0539d9d7fd28bd0f088639c90a84bfc73d8495f3d76729ea50b10693778959a049f5788ea11e32f238f5c2e9f4d38ee6f91851b5cac3114f0bde42cc1a896a37471ba80195b0b575d4f0292ea908aa3d175fc74af3045722f21a6b688bcb8847c0e1a7d2f821f98afc7b89c99228061527de8e1d9ea9096e6cd1f97d903112baa72e36a993fff92c1fd3f00e2f27da679d479c8cdbc81df0879533e33e8d80564ffcb8ae3ddaaf36d01c59a3062c66a349ee1543c6e9125f22ab1897782dd1fd06cfd9f42b3464dff2f6f5509e1ccf92db3d3dd47ac2bb877a474d464c57b54975cf87b4e28449bd3a2c2255dc1ed0c3e71006ecaf34a82adbf2186c82584ba9d13abcd5b4412fac0fcfe3e97b092665e56aaa4058a87f04c7bd8db63151908d7150195baf2e784af52c6cea2acad27848583ef3a8685fbe7881631027cae746a8511e7d61ebe7e9b244791e8058d17a7ffba96714e162a07d1b9230013144e3bc83b5920b3f2ca215db3c91c396232933b1d3ac9f469074956a5818b073a3dc5eb099f819120c8f55b50b4bc80b071a4326cbd3ed2d49d6093ca8958314c8727bcee15868fdb13825bbf87485a7eb9ea3ffc1ea83511037667175c5dde722c709f72acdea7e274f0313b4b4469c7d924ca2d7470c7fa76d8f821772cd747b4d7b0e218f64179dfde594da464e750e8a6ec0f70865ebd82c0443937f88dacc9e8db94c2c31103f239aad2628fe9ea113a97a60f55f24b66ff3fc41829eeed28a482d8502676cdc9f9c83a3e0a0d5641c5851946affc344bec2b6d19e2a4c567e0f7cbfb2178c30d5c5b9dcc1c1bdaebeb40c923d1e943a3c19576237bc3ea3e6a459d3a68fc1e06b36b6e4acc4b0f8826852778d0925298d632c7eb41b1d466d1ebc3074cac248d96a58444cec3f5aacf4b07664bb3a61086d988115d522325e35eb386194a2932ed6226b41ae3d41dfd23319d45cb020a352912484401dffbc705bc2ba1c7cdc1ca2f03b07ede3fc4aa58804c966f3ec84210c8144f5595714b0835c7b36f59bb7418f8036aaa7ec1895078afd5782081583198808c3cecb5e87176f34e30512a8485de6a99bef7e168c92fd1315437f61ceb344ae56c09ba7e3836e9c39c3f4a966e94cefaf6e81bdc775f20fc512f456e6d9d9f038662ee9ebd00676ef39807edaf50cbdbd0b003d8e06595ee6bfb70cc7d", 0x1000, 0x81}, {&(0x7f00000018c0)="2567e3e3039fc0d30dd30e2a48", 0xd, 0x33}, {&(0x7f0000003ec0)="8c46d25fe553e69e271ae26bb71701ea9c006a98eed958eb55dbfe8dd2a80c15add787c17d375f30e033de8409324135cd6a7117ea69cb259df424d430743004a68626c82f310fe5397d515038962368e9f22f81a6347336e43f86200acf17176fb08eb7b81b05b0b4f702deb738342492c5859500c739a3b7c67399880cba4f3ea1", 0x82}, {&(0x7f0000002ec0)="3eb08ba3dd18b9e1da0bf5d7f4e4901f286033c8929be13b480beb6880db760e7913c92827583678b4ac462e84abaca6b0bd121842b7e6c1a642abbfcbbe90556276310d9ebb120187546e08daad2e87c62b76584b27e64859879a98df6da328a7f25e341b9fe0714fdcb2100fa5a66317b24ae34264d9fdfcc137ceca6d65101991bae534bdca51dfb627186cb76ecade9f03032d58b5e30e5d55b94fb650fc7650df0467b27af4a29b68239ff90405c7c7acf4d7abf1e6350129d411c2d85d21f337279c72f15271d8b757950db24de4a2d06c552fd533e1550d055efaec8c32459866bc9bb47e52ac63ea51b71a43b584c8be0eaca422d7b825ab97563ddfbdc2bbfa1c76f3bb3409d42fc8ae15abca41bbc1cdf060fee2b906bddcb11031e7f621fef7964b5f1a88d096c000270d7db8db0b39f06d85ce491e9136b9725f160a7986303bba506b24033410446d65cd83f8893f363c9f3e7309577a51a07cb81856fade2a927f07516802620f3fd47ddfe97a204fe9c6de59973148458e690057fde151d733d3f3e4dc1346298d626248d72853d25dcdd741a4c6d66d1edcbe76a7f1b27e2491b3be612e9ab54c3f6871c1ac824a186d95781367baad1f6be9abcb4bb4abb9c4f45f49bde8fb659c4e0e5fb9b3e2445037c5be567fafef1e05fba4bb09569a6d22baaef95a39f8795eda51ad13942375fb8a0b93cb85959e4de7c6fe8c791ebb0d41834a498c7b120f32f3bfa0a29cbcea6619ba69450065e4606423aabf20e1a5162d3ca21c37303cb60e396ea7240218358e804ab80206c4b5ec009efe7502859682c149fc2d0ce823c4c9c5d18cee079eca81ac7542ac165926d5a2f91816aa344bfe3b0a70c9ddece0e995c066db8bf3b9e9ddd81eb8e8460711d356c89e7324871cdcf4ec3f2713703f983798da169ea4a8d1d67fefd8935675e466d4e422464a7f7404f4e50834cff31999c77d194d57409c3eddf431c6a6dd4b62bb684a4888230d6010361d348e0db08da9b5852c2e142b4e0b7f2e08f493777e3424065fde2b0ded7acebd08ffd114bf39a8ca7874feb0aa366ec93edfb9608e88c51164adaa8dcf8b5d66f9db9ea97d5f53bc3615940d21ea9c0646598f3292f50e94a2beaec81b92e408b5cdba537ff30137b21c8b378ea86975d41ccad5222677ae7b20e03764fbb88b8c74faad42214dbaab411a1887dceacea31de13fb98dc1f8dbcd9230c1210cedd11af4c602f7fad0b1f227af4b3b57c0ffead77fe01f80635b8979e905e59b70c352410140dc96e791b5bed54f540249a09aa07b538804ff19d3b4ec3e3c4d72d01d95ac200512582c9dc4d01581acfd5f2ead1dab19cfce8150b950dc135bd31b41c62d352899c1e179d1689bca118e1b15e0e5e3619c9a623f753db8b06ec706314765d44c0b65ab25b4982cca384565fab2503850ed672ca70fb3fce99fe08aea610379fb1d3e24cc6757ac3a740831458f4a634254b306f4fe9073be38aa66000d7277e22cd353f83d5eb73998dfac70d610edec16bbe5ac76c52f080744c782305ff8982101b90feb66cd02489f518b0174cbfe2f8e3ef68aa6939aec1cc263be84db757727119537d83027056d51f4c5b4e6e49c11fdee9443e67c770ece38587ea3e338b5f2dbd432ec0baa515dc4f0407743622c6a53ffbb035b3d250d695f7208428fa2c99b802a2fea52a699a6bf8ec437b046a32ad9ce41df5f98dd48c46d8387a4c3886b2d926e94fba1da2c151cf5d39bbe49fd56c555dbf124fe5bae187dbd773b3e0b104bbda889011e7b16ad39b96e52af2a99b98c11d26c1458134b18b6693abe6d434d90f01b66866735c4bfe24566c747d9c868e358a8963ff51df319c880e21a1f4c9cf2ed419ef9788ba69be98cb17e052bd886f7a1df7e85954a96b78e30e35c21fb9ed1452380e3bee7bea986ae649dbbf12a68427bf0347fd41fba66a3d304ab9130a0337652955079e90919e5bf5d536b1430ba3a0c4844a8e71b4f2e892523ec4ff24c2a990d7ba41b91b4d6d213382ea49637c658713361c4fd0e6e846b8697ed2ae043efa919ffc93a6b705ccb424b3bd823c18e6dc286bf086138cbd92409999f5e83b5c7a48d03ea004d015432780a05bff41c2d55f98cba2d7407d3a51a582492be9fd601a082bc910ff3f74f880a1b591fb32836b34c129aef74fbaf3a390e319ac275bf64e785eb8b77bd1f60ecc436a84c946aed58a327df98b07592797273be7724d97e90b32ac05758d8fc0abaf373e65f4dd8b20194b1661632f510cb5d9b91cfbde537fde3353f96580b9b7e5c3084845cba05fcce5216bb4af665329a880b3a98c128d2c15aa263776ac9da063484c40c32a6bd5d12231d158d03f4dc2b101d3631bea300fba54e542bf494bace5af80513c61c4bc4c239e03b7743e8c2c7cc3c3191533c04f82bff20830aec430173848e76f14b00a735fb6a51a92a18874253a723d10550cd0fbfa181a76e96db346b88c6b9dddc2134403e225c6383e55ca4985cb9248073c2d601577e32fc1e11de433024862c8f1d263adab1b500df42ed6d6393b6c5c8423c8e99d1ec7a5e30f94709aa0d56b9092cb45c8d9f62bd698a3d8817ed25355e0550849d70ce6c8fa297f6cbf236d1a31681850cd86f899399074605b1bf4b1fa343c87cdfb5afdce7744e72bb50798c2749260104c46549433e006bc3162cde242d4e0ec9d97e282db18aa9b5db7aee006a570b7900ac0f6ba81c326fdb174ef59b84a4d35bb0a567cce94dd3e458c64af3fd3ab83ab219e0c3bd4dcbaf617d2a0aa3babfd8f747a05becf7f71008a4bc2fc1b6813fd951ec6e9890d60b5efaa00f9a0ce33661ccea3bc272ff8f75f1fb0f94cdd108a456d9861a7a8fb0ef5962e4d45a22bbf418be69966a27a9ecf95ac42b38c121a53710a87e9b94e2f7d1696212fe73446da1c8ad75c5cc819eed4cd62ef855a14103bdfd310af80faaec8136ba1b82bb90136216f8b68bf4f8db785e74175c0fa56d30245388dae62d202b209ddf2c8c98bf46e619e1f425bafb5adc52fa17a12b6f41cef939fd320e99ed130d5da95159d0369ce2284b5bc7a1719da0c2cc40fe57a7be64b5690c3453eb0b254b7e5f60fae71ea9b1e4d5f24a440567e240642a6e8b9ec9cc82127bb1d1e571596a3cbf0ed3e5c08c9fe16bab738f3d3d42ca128f09c92ead529974800e860ac8eb0504e584932bf5a2fa287487a4047637f35397fda9dfc36ea5ddca1cf0a44e9b2c00aa6a9fa3653e51e9d094da28bc1cea8831494fbcd36f1fd5eb1adecf187cc2952ac58799c99b3c17f33bbb0b3d17fa86c149eb7e7b1599905e8fcd7d9c8e30d5ac8c83b60fe61944eb2aa4931e9e671735abbfcf1d36feb7cfdcd0dca7137a2183b16048d9b46a04545b06d253e00bce852daa79cfa7bd67f789f4ae3f7476d125b64b790790b63c3a4e49a1acc066bae40ebfb3cf4d81bacdf1f53b119138d0a0ee9d8957eb3baf4ad47117fdba07f3fa012e235a7030f4958e0c824697ef4111e2d911841dfc9fa2faf8e7761ed086024dd45084a2ccc08fd9c29d0717c0f340409373e389cc8874ea669184c897156f8da0c59ad1ba481e100c49d7d2e799bb63e6f6b3a8c66b28bd192a5c894d45e16e28ed6e15a0cf13da3894e7951332298d3547b3e378c4921bdb945057551481985e1770d5fa37b803d5c7ef7378c671fd0b5e7e0a8a8a8c6e239a4fa43387af33a6fe46bfd673a6d0fefeb5d99380d59f4229f6c723f8119408089dc8b9b1312c2ffbddbcac3b6eb76e0445974ead9732a36f455145abb3cdb7ec03e1b5798f22e85571173ba2bd710864236851791dfa07753ec4455c322b660d972036a600c44225643d185bda6b7151448a52c73ae01a10187f2b2b4f71e00699e8c35f83e0dc130fb62c958cb6085690c778a1bc9e30fc9ce0696d312d7984694815189afea548ddefbd1f747f0fb10fe42992fd8e3651a970c3048d2477ee8a3cfc56245a2cb379c523773d0d2f739599485c18c62eb48d50814c42a31876d6b2a7a33bf2bbe3994d57f8d31826a380555b3a9814c454ba6afd6fbf5d074cfee2c70fc31addcfcd23e855a77d1272367ba5ddf24ed60b3d98a8a60780f9bb1ba062c4ca255b1698169c0f12ef632184605de377b8c5f9971ad3a07729c3ab1b3f1d10f682b11f84dfe2a43a804b547b34b6620513d8f73c8b5b26cd620426038b7f8725dcca24ac3c7b153903070d201142ba57610d1cdacf426db7e13dc4324f59d7f5e459eab7d6e722b4431f207a0fbae815ce5ae4a4c5f366e3d657b517f7815caf7b5200491d9a365f27688a15a218b5063888fd34189f08f4e5970d6b17d723932bb291c2da64589299a6be867a7d0e38fe6bb0d17565c57236f5a591651f4baaec17b2565911112504401f8d97a5e8e4cf659f6c66d5cce239aaab6c176acbc839da5f2674b31b7fcca6de1fe67c8272aa119077938f1012c1a76efb84c0864b1a3c4521dd67bc814014e1502ed28b51006c0ffa10db2e2aed84b379da74df7cd5d036ce91528ca34df0b21e93058f0d02e12f2a0f6a6e125e1b9af9aebc6595ac121fb713fe01f7cc60ba00960c55266805c1ebcf358da9410ca5d6dac373e6875cead8870ab02425e5825b80fdf00a98539f3bfd819af06c2f23013089490bfe24ccfbdf68b1d8ec3b7b1d68719e56b6f090c58f79cd62c53400ab4b48197a495eed3b4c747a736637db97bede1203ae3cca10ed05b4c9739f40a74ad901ef15127a67fd0bf27b7b8d856c0a06dbe9dbe8b393c0c6423e9f88aa67a3af3fe78a17438f2a86494cf2eaba8f95a9675aff8b84cfe9794040f7bb311a1c3ca1dc9f5e8a569a0bcd1e41343c0743e0d94d7acfc996a229aa5f99b6eb93f8d20e7d0de3055c5109ae4751910408d5140df4402a8aa1cc0111e9aa9aef95e6a3c9aaead2ae53136412ec24d051169f8caeb46bb74fb760b90682f0877b5b625bd67a827e9ed788de477d0c62900534bd3a2cac81f305ac2782d9e7d001c17990f373bbb8d87f1da1bc1b3cc0ab57b8928f5de3f6615756063613dd133f079def967a20db9dcd40a4b3d069d35511ee05a07a876539bc7dba2b5bb02b692bf195d3f65d98f4a0f710b9f7e9931a506133efcf49f9b6405a64efc9d331a47dee66b6573bdb32d02df7256aa72a9e4d8059b67770874b5b2e327a2fe3ff56d166b93d930c904d5e34420bdae6b642ab982a75a0484f2fffbb607e0413e7c6a2268f8bc6642d2522a7b44faea0b9448238e1b6dde3ac506b321eebe8f1fcfd1c72a0dd46cf9f50fe54e881de9088b9d511681574bb7b4942e32376d39392ccd5d725d8c9f0b1d92c1f1c3a4697d1d8aa2dedacd6e79178afb3b6093501bfdc6b7a143910fce350855738cbcfc99aef95c7089ef654eae2e7ea8cb31a36d7b95a131e273b6f03ad745558fd02749714d613f315ff80e1c76c02ce4ef4dc0eaa2fd461ec27d6723ec0c72ddf50413387e928e1a06c4afdd4f121920125270c944ad9ab3eedf416f496a90b3cdc044f4f0cee8cbc6d47cca0c14afa59eb9fa7d6e9959ad4ffd65ec298cfa8a6e166bf9714b078bdebcfd6a13b63e80c7f79265d8c84991a8bb2c3b72c0baddcf9919953d0a8027866ae18c0e6e8e9f3ef374b21e83178c940f4273b7af17c6addd2ac8b93c6dafbddd1536e3a7795287899c1a3d512b345b5d245d1e44db042b807d09910b6b0735298ba477c56c97cd4fc8264d0", 0x4c0, 0x4}, {&(0x7f0000002cc0)="cab861fd5bc706c7b1808708793a87841c8669217569b92fd53890b289c8033ef54bfc78d7eb88ed58e6c2d293f3bebb0d2e5bdaee8af0f37731ea6e977e1eb94f4b4a4b5a576d14deed0f8e99a8ca78eae84a06c72142f49be3017a1b555b24227cf192deae3de6d2634ddc690822e4566d4b9cdf1f19ef4357ec9f2b88c5fd6e2d80e173a1f8a1f3fc8507dd49e599e165fdcac2bef4b9c4ef35145b640f1b3f53fb04570cd0ea88aa846f1a83c377994c1ddff5139476bec07469648469031290fa77af2a351641365f59b442e1e9eedd0e549a1ad598a141e7ef39c740826aac6cab4edd297df24c036d076e1fb1a27c836f0e2edb6c3c0088538e043a20c545f0f39f1bc218a825f140a4c4d823", 0x110, 0x4}, {&(0x7f0000002ac0)="9fce72c09f932fd880bedcee30a6781c8d41059db233194f660a5821e9a449ef57c4223a525dcdd8198a85d8040747b2fe228f403e4e046e0411452119c2cf0c69b75dc57ebe8bc344ccebda2a69a272c0629a2164de", 0x56, 0x800}, {&(0x7f0000002b40)="4c1a33d88ef2261f8b7cf850cf23b319d06110d7bc091912aa46070a667e46f8e5149f2c776b03a5782591cac3a39ae193b104196ae0128487bf10519cafb4f2a7d168248e26dc5debcea3d0e26d324b458a93ba126a4af0b91857b5992c4e430702a8de506afe625e7a79ffac1dcdd67bff794204cef3cda081e3a234e836f9", 0x80, 0x9}], 0x96ffa6e6fd0894cf, &(0x7f0000002c80)='syz1') syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000140)='./file0\x00', 0x80000001, 0x3, &(0x7f0000000380)=[{&(0x7f0000000180)="03a067a4977200ce8ebd48d236a1a6eba5967920c28a289bf6dbaea675e777edf045cecb2fef46a66da309b03697e1d09ebc37585a925a45c170eb394ccfbb7f19a13e258cda8126916b687b467c83747ea6b97da72bba5e5b6a9ea209888b85e095de4be04dc220ba7c26693c64763f2732", 0x72, 0x8}, {&(0x7f0000000200)="62b32a9fd98591dc2b39730cff0d8327f6e950e397dc4e07af2dd995cdf8babe92c808e5dfab84b3a87cfff88b390a5f52617035379dcad8d25f08568eeb66a2357644cc6735571ba24dfba315062bc03ad4e136be4c7923cccf35647b3e748c6b9978430b371214abe002d303c328426712bc4b8349ec168d356aa279230476e986fd3f31ad43cfa4b2388454dff510de36c529d7db8b58622a8fe95a26b80626c31f459ae79218887a1c7347953723b6f22776b70b0d840e46458465dce697b16ef2f59eb43103f403a5808b0c79", 0xcf, 0x7f}, {&(0x7f0000000300)="78d4804fa1790d6c2ddfb0ce2adea539c653193d82e203a8ed5e6a69ee3ca84e3d54aa63a882b8f4d980d28217350bb29afaa07ecffbeb642af7320a8259385bf67c31c92280f2dd621ad3d4a16abb8874c05924006ed595dcaf6092225519011b4a53f32ed994342e29081106ab127d29f0784b9d0e1358", 0x78}], 0x20000, &(0x7f0000000600)={[{@quiet='quiet'}, {@gid={'gid', 0x3d, r3}}, {@umask={'umask', 0x3d, 0x566}}, {@dir_umask={'dir_umask', 0x3d, 0x2}}], [{@context={'context', 0x3d, 'system_u'}}, {@fowner_eq={'fowner', 0x3d, r4}}, {@uid_gt={'uid>', r5}}]}) ioctl$TIOCGISO7816(r2, 0x80285442, &(0x7f0000000080)) ioctl$FICLONE(r0, 0x40049409, r2) [ 478.189863] binder: 16565:16569 ioctl c0306201 20000040 returned -22 14:16:11 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x80000, 0x0) ioctl$DRM_IOCTL_GET_MAP(r2, 0xc0286404, &(0x7f00000000c0)={&(0x7f0000002000/0x1000)=nil, 0x800, 0x7, 0x80, &(0x7f0000000000/0x4000)=nil, 0xe1f2}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:16:11 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r2 = socket$bt_rfcomm(0x1f, 0x3, 0x3) ioctl$sock_SIOCBRDELBR(r2, 0x89a1, &(0x7f0000000080)='vxcan1\x00') r3 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r3}], 0x0, 0x0, 0x0}) [ 478.282418] binder: 16595:16596 unknown command 0 [ 478.303468] binder: 16597:16601 unknown command 0 [ 478.316519] binder: 16595:16596 ioctl c0306201 20000180 returned -22 [ 478.316667] binder: 16597:16601 ioctl c0306201 20000180 returned -22 [ 478.349407] binder: 16597:16605 unknown command 0 [ 478.355977] binder: 16597:16605 ioctl c0306201 20000180 returned -22 [ 478.366462] binder: 16595:16596 unknown command 0 [ 478.375880] binder: 16595:16596 ioctl c0306201 20000180 returned -22 14:16:12 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba0000", @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x3}}, 0x0) 14:16:12 executing program 5: r0 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/policy\x00', 0x0, 0x0) write$sndseq(r0, &(0x7f00000000c0)=[{0x0, 0x1, 0x6, 0x100, @time={0x77359400}, {0x1, 0x3}, {0x2, 0x3}, @control={0x5, 0x29ea, 0x7}}, {0x0, 0x101, 0x6136, 0x7fffffff, @time={0x0, 0x989680}, {0x8001, 0x80000001}, {0x1, 0xffffffffffffffe0}, @note={0x4, 0x3, 0x6, 0x10000, 0x80}}, {0x30cbcdde, 0x9, 0xed, 0xffffffffffffff01, @tick=0xffffffffffffffff, {0x8, 0x3b182fe3}, {0x8, 0x7}, @addr={0x7f, 0x74}}, {0x80, 0x3, 0x7ff, 0x8000, @time={0x0, 0x989680}, {0x7, 0x200}, {0x8, 0x1ff}, @time=@tick=0x6}, {0x80000001, 0x401, 0x8, 0x401, @tick=0x3, {0x30000000, 0xfff}, {0x5, 0x80}, @quote={{0x7, 0xbe}, 0x81, &(0x7f0000000080)={0x15b1, 0x800, 0x4, 0x6, @tick=0x8a7, {0x7, 0x3}, {0x1f, 0x9}, @note={0x7fff, 0x0, 0x5, 0x100, 0x5}}}}], 0xf0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = fcntl$dupfd(r1, 0x0, r1) bind$bt_rfcomm(r2, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) bind$alg(r0, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'morus640-sse2\x00'}, 0x58) ioctl$SG_GET_TIMEOUT(r2, 0x2202, 0x0) getgid() 14:16:12 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x2001f, r0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r3 = socket$pptp(0x18, 0x1, 0x2) getsockopt$sock_timeval(r3, 0x1, 0x42, &(0x7f0000000080), &(0x7f00000000c0)=0x10) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) 14:16:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080)='/dev/zero\x00', 0x0, 0x0) ioctl$VIDIOC_ENUMAUDIO(r2, 0xc0345641, &(0x7f00000000c0)={0xfffffffffffffffa, "4bb208764482de96008e421642206d7bdbfca12f4709573f22f233b6988478c4", 0x1, 0x1}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:16:12 executing program 4: r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000080)='/proc/thread-self/attr/keycreate\x00', 0x2, 0x0) write$binfmt_misc(r0, &(0x7f0000000540)=ANY=[@ANYBLOB="bf8496020000000000000050ec"], 0x4) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) fstat(r1, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0}) getresuid(&(0x7f00000003c0), &(0x7f0000000400)=0x0, &(0x7f0000000440)) ioctl$KDSETLED(r1, 0x4b32, 0x8001) syz_mount_image$btrfs(&(0x7f0000000000)='btrfs\x00', &(0x7f00000000c0)='./file0\x00', 0x1f, 0x2, &(0x7f0000000300)=[{&(0x7f0000000140)="f91f7e886b83a47b4b554eaa03a6795f9ce7fb0e4a14e547119db57505b6468db92c73fa6d877f94342ec0a615dc95494877da8b29d966f5bab9732046b4e8c59c8c3de7c6bf56663e8ad5d116861bc40832b3f9b8e7fbb5af6351714bd5b3ca2d4d17aa5ae3f8fee8b2db24720056a9a7336a7e167dac4a28653f7e986f55cebf4bb1d0f07b0634d57b1bcceb06da2f81d32cbeaf8500506a1e05b53c4ff9", 0x9f, 0xaf}, {&(0x7f0000000200)="a3ec8255a9bedd2b4181dd3cafbddfdef82a471207d9f8623a5f86b21aa54fc36656ecca91e25a7979e81cc3cbe0fac2e54b7620ff859a39ab2a18f3070b751c37b6e3d3b9e497d91ade80f727a618d1255d512aa7ebf3a516183203879bcac776d1c401db6522bcc962c1f048ce1ec6e02916a3d3fa74e665f16748297dec743a37bc40f2fe0616b06d46445b7e5f3b9e4e406aec1ce6fcc78e70bfa0c906dd60be5feb46d77fab68366dd099cad9c146510f5d9026d7b774bc245aca210c8adc8cc03c40eea5963760995d34ee9d0a6933a2953cca", 0xd6, 0x80000000}], 0x4a0c4, &(0x7f0000000480)={[{@space_cache='space_cache'}, {@space_cache='space_cache'}, {@rescan_uuid_tree='rescan_uuid_tree'}, {@flushoncommit='flushoncommit'}, {@compress_algo={'compress', 0x3d, 'zstd'}}, {@space_cache='space_cache'}, {@discard='discard'}], [{@smackfshat={'smackfshat', 0x3d, 'syz1'}}, {@euid_eq={'euid', 0x3d, r2}}, {@euid_lt={'euid<', r3}}]}) 14:16:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x1b, 0x0, 0x6) setsockopt$bt_l2cap_L2CAP_OPTIONS(r3, 0x6, 0x1, &(0x7f0000000080)={0x9, 0xffffffffffffffc1, 0x4, 0x401, 0x3, 0x80000000, 0x8}, 0xc) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) [ 478.792229] binder_alloc: 16616: binder_alloc_buf, no vma [ 478.798585] binder: 16618:16622 unknown command 0 [ 478.803801] binder: 16618:16622 ioctl c0306201 20000180 returned -22 [ 478.815202] binder: 16616:16625 unknown command 0 [ 478.824604] binder: 16616:16625 ioctl c0306201 20000180 returned -22 14:16:12 executing program 5: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x2000, 0x0) sendmsg$kcm(r0, &(0x7f0000000480)={&(0x7f0000000080)=@isdn={0x22, 0x9000000000, 0x5, 0x800, 0x3f}, 0x80, &(0x7f0000000300)=[{&(0x7f0000000100)}, {&(0x7f0000000140)="e5e2ab3e05f9740a28b46799fd1ab12e263ed762382ddef33267188e0f7280431d528d9cb3f7bb9af8b9d93fa1d746c2635b524ef01dbf096e3894fb21dcebbc7ffc012773a254bfe344b3a63e77d1b6f0788be1244a428cf7be5baff17ded2bdf0d697e7d8974cf833d21a98848bea215971956cf3b70d88cdf724101", 0x7d}, {&(0x7f00000001c0)="9ccfed33ff5853074bee7a7ef75e9b0f9ff0dc20d8451136a97782f3d779b99ca20b0ec22333080865bf3b1bee1d12fe5b7662b94cab243903407c9378e9db56a1dc620d43258a02ed3e8588233ca948ebbab3d920f8d3160ad8cd9cbab0017af6585bcbef6ffb702f5d49a4cd01e805e51117560555d2b68d11c61e397d8ca3bd610967bef119c0fd21b59d8e594c6f80706f31d51e09a906614236c5b30b8b905951ea771c08", 0xa7}, {&(0x7f0000000280)="5b6138ee962ac938b953703fd1349b67391bf7130d2579e5edf56ea238de8cfd089b3e48be21cadcbc140157eed99707a00e755f6e41ed71bc2c654bd267c9faac9174459576ecb735b9d6033a9fd63250833309006c6f852f8ebe11dfce4f6556bd85f94e8aeab1df4bc2d0", 0x6c}], 0x4, &(0x7f0000000340)=[{0x68, 0x105, 0xff, "91c1c3b54a0d1d2eef97768510d5ac9854c1bc1d6b0949340414867e75a053c8939466e57c6edb822f3f9f52c0a042ee078c355748c0fae128e2253165404983fafda2907fae09ab3314ad2465f6a75c1bf16aec8896f2"}, {0xb8, 0x0, 0x8, "14ee035b04c1bae1dc5f8f7b886dc25e7901e9c1565fb23b5975e478feaa172d9d52d56c2a9d06f93d56ace55fe4772035296bc82c47b74d1a80d16467f099ee1c62a443b84269692c866e4b84ba4385744e6c514d082a0830e5c6a303761bc10e7662178dfea19e28278d9480c5d4f459443f05cfe189bc04f488b3c87a53e9b1919d3358b071f15a79cc63c8c1d420ab7d1a4e07e360789a71b5ce87ecd952ee"}], 0x120}, 0x4010) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = fcntl$dupfd(r1, 0x0, r1) bind$bt_rfcomm(r2, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) [ 478.919703] binder: 16630:16638 unknown command 0 [ 478.935954] binder_alloc: 16616: binder_alloc_buf, no vma [ 478.943424] binder: 16616:16642 unknown command 0 [ 478.946496] binder: 16630:16638 ioctl c0306201 20000180 returned -22 [ 478.948390] binder: 16616:16642 ioctl c0306201 20000180 returned -22 14:16:12 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) shutdown(0xffffffffffffffff, 0x0) recvmmsg(r1, &(0x7f0000002100)=[{{0x0, 0x0, 0x0}}], 0x3ffffffffffff5a, 0x10100, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 14:16:12 executing program 4: r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/fscreate\x00', 0x2, 0x0) write$binfmt_misc(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="52f213ddac54590b0000169e55f822277778"], 0x4) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x800, 0x0) ioctl$SNDRV_TIMER_IOCTL_PVERSION(r1, 0x80045400, &(0x7f00000000c0)) r2 = syz_genetlink_get_family_id$team(&(0x7f0000000180)='team\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000003c0)={{{@in6=@loopback, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in=@local}}, &(0x7f00000004c0)=0xe8) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000500)={{{@in=@initdev, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in=@loopback}}, &(0x7f0000000600)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000640)={{{@in6=@empty, @in6=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @empty}}, 0x0, @in6=@local}}, &(0x7f0000000740)=0xe8) accept4$packet(r1, &(0x7f0000000780)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000007c0)=0x14, 0x80000) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000fc0)={0x0, @multicast1, @broadcast}, &(0x7f0000001000)=0xc) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000001040)={'vcan0\x00', 0x0}) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000001700)={{{@in6=@ipv4={[], [], @multicast2}, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in6=@mcast2}}, &(0x7f0000001800)=0xe8) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000001900)={'vcan0\x00', 0x0}) getsockopt$inet_mreqn(r1, 0x0, 0x23, &(0x7f00000019c0)={@dev, @rand_addr, 0x0}, &(0x7f0000001a00)=0xc) getsockname$packet(r1, &(0x7f0000001a40)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001a80)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000001b40)={{{@in6=@mcast1, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in6=@dev}}, &(0x7f0000001c40)=0xe8) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001c80)={{{@in=@multicast2, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in=@multicast1}}, &(0x7f0000001d80)=0xe8) getsockname$packet(r1, &(0x7f0000001dc0)={0x11, 0x0, 0x0}, &(0x7f0000001e00)=0x14) accept$packet(r1, &(0x7f0000001e40)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001e80)=0x14) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000002040)={0x0, @multicast1, @empty}, &(0x7f0000002080)=0xc) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000002180)={'vcan0\x00', 0x0}) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f00000021c0)={{{@in6, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@loopback}}, &(0x7f00000022c0)=0xe8) accept4$packet(r1, &(0x7f0000002bc0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000002c00)=0x14, 0x800) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000002d00)={'team0\x00', 0x0}) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000002d40)={0x0, @initdev, @empty}, &(0x7f0000002d80)=0xc) getsockopt$inet_mreqn(r1, 0x0, 0x27, &(0x7f0000003100)={@multicast1, @broadcast, 0x0}, &(0x7f0000003140)=0xc) accept4$packet(r1, &(0x7f0000003300)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000003340)=0x14, 0x80800) accept(r1, &(0x7f00000033c0)=@can={0x1d, 0x0}, &(0x7f0000003440)=0x80) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000003540)={{{@in=@local, @in6=@ipv4={[], [], @multicast1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@initdev}, 0x0, @in6=@initdev}}, &(0x7f0000003640)=0xe8) sendmsg$TEAM_CMD_OPTIONS_GET(r1, &(0x7f0000003e40)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x81003}, 0xc, &(0x7f0000003e00)={&(0x7f0000003680)={0x758, r2, 0x100, 0x70bd2a, 0x25dfdbfb, {}, [{{0x8, 0x1, r3}, {0x3c, 0x2, [{0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x8}}}]}}, {{0x8, 0x1, r4}, {0x44, 0x2, [{0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x7}}, {0x8, 0x6, r5}}}]}}, {{0x8, 0x1, r6}, {0x12c, 0x2, [{0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x7}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x5}}, {0x8, 0x6, r7}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x5}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x7}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x7fffffff}}, {0x8, 0x6, r8}}}]}}, {{0x8, 0x1, r9}, {0x44, 0x2, [{0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0xfff}}, {0x8, 0x6, r10}}}]}}, {{0x8, 0x1, r11}, {0x258, 0x2, [{0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'loadbalance\x00'}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r12}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x7}}, {0x8, 0x6, r13}}}, {0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}, {0x4c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x1c, 0x4, [{0x6, 0x1, 0x0, 0x400}, {0xfffffffffffffffa, 0x8, 0xffffffff7fffffff, 0x1}, {0x0, 0x7fffffff, 0x7, 0x4}]}}}, {0x4c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x1c, 0x4, [{0x9, 0x7, 0x36268cad, 0x40}, {0x12000000, 0x0, 0x2, 0x6}, {0x1f, 0x0, 0x6, 0x1}]}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r14}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x6}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x9}}, {0x8, 0x6, r15}}}]}}, {{0x8, 0x1, r16}, {0x7c, 0x2, [{0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x2}}, {0x8, 0x6, r17}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r18}}}]}}, {{0x8, 0x1, r19}, {0xfc, 0x2, [{0x44, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x14, 0x4, 'activebackup\x00'}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r20}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r21}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r22}}}]}}, {{0x8, 0x1, r23}, {0x144, 0x2, [{0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r24}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r25}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r26}}}, {0x5c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x2c, 0x4, [{0x7, 0x0, 0x1ff, 0x4}, {0x900000000000000, 0x3, 0x8000, 0x3}, {0x40, 0x4, 0x2, 0x4f}, {0x2, 0xffffffffffff78f3, 0x8, 0x7}, {0x2, 0x5, 0x75c2, 0x4}]}}}]}}]}, 0x758}, 0x1, 0x0, 0x0, 0x4}, 0x880) creat(&(0x7f0000000100)='./file0\x00', 0x0) 14:16:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x17c, 0x0, 0x0}) 14:16:12 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) close(r0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r1, 0xc4c85512, &(0x7f0000000040)={{0x0, 0x6, 0x6, 0x0, 'syz0\x00'}, 0x0, [0x4, 0x3, 0x6, 0x7, 0xc4, 0xff, 0x68adb6ca, 0x7, 0x1, 0x8, 0x31d, 0x3, 0x40, 0x1, 0x8001, 0x3, 0x0, 0x1, 0x1, 0x6, 0xa3, 0x0, 0x9, 0x5, 0x80000001, 0x4, 0x9, 0xffffffffffffdf28, 0x0, 0x787, 0xad, 0xffffffff, 0x1f, 0x0, 0x1, 0x7, 0x5, 0x100000000, 0x6, 0x8000000000, 0x38000000000000, 0x7fff, 0x8, 0x800, 0x1000, 0x245, 0x2, 0x1, 0x80000000, 0x7b8b, 0x81, 0xf, 0x8000, 0x9, 0x72a, 0x3, 0x404, 0x3, 0x7fff, 0xff, 0x6, 0x2, 0x7, 0x4, 0x5, 0xffffffffffffd40e, 0x3f, 0xfffffffffffffeff, 0x200, 0x9, 0xfffffffffffffff9, 0x9, 0x4d, 0x3ff, 0x5, 0x8, 0xb374, 0x9, 0x53c, 0x2, 0x1, 0x1, 0x2, 0x7, 0x1, 0x81, 0x9, 0x2, 0x3, 0x0, 0xa, 0x6, 0x8000, 0x8, 0xb0, 0x40, 0xc0, 0x100000001, 0x5, 0x81, 0xdb, 0x73ed, 0xffffffff, 0x101, 0x8001, 0x2, 0x2f0, 0x2, 0x1ff, 0x101, 0x4, 0x7, 0x5, 0xd24, 0x1e27, 0x8, 0x80000001, 0x0, 0x140, 0x10000, 0x5, 0x3, 0x4, 0x10001, 0x3, 0x0, 0x6, 0x5d], {0x77359400}}) 14:16:12 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) [ 479.029047] SELinux: Context RòÝ is not valid (left unmapped). [ 479.041962] binder: 16648:16651 unknown command 0 [ 479.058742] binder: 16648:16651 ioctl c0306201 20000180 returned -22 [ 479.087600] binder: 16655:16659 unknown command 0 [ 479.095045] binder: 16655:16659 ioctl c0306201 20000180 returned -22 [ 479.121804] binder: 16655:16661 unknown command 0 [ 479.126732] binder: 16655:16661 ioctl c0306201 20000180 returned -22 14:16:13 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba0000", @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x3}}, 0x0) 14:16:13 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r2, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r2, 0x29, 0x30, &(0x7f0000d4b000)=ANY=[@ANYBLOB="01000000000000000a00000000000000ff010000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000a00000000000000ff02000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff0100000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e2ffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e0000000000000000000000000000000000000000000000000000000000a00000000000000ff02000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff010000000000000000000000000001000000000000000000000000000000000000000000000000000000000400"/784], 0x310) setsockopt$inet6_MCAST_MSFILTER(r2, 0x29, 0x30, &(0x7f0000000000)={0x1, {{0xa, 0x0, 0x0, @mcast1}}}, 0x90) r3 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r3, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) 14:16:13 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000340)='/dev/ubi_ctrl\x00', 0x2, 0x0) r3 = inotify_add_watch(0xffffffffffffffff, &(0x7f0000000380)='./file0\x00', 0xa0) inotify_rm_watch(r2, r3) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair(0xb, 0x4, 0xffffffffffffffff, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = syz_genetlink_get_family_id$nbd(&(0x7f0000000100)='nbd\x00') sendmsg$NBD_CMD_RECONFIGURE(r4, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x40040000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x50, r5, 0x700, 0x70bd2a, 0x25dfdbfd, {}, [@NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x20}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x8213}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x7fff}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x8}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x4000) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$SO_TIMESTAMP(r2, 0x1, 0x3f, &(0x7f00000003c0), &(0x7f0000000400)=0x4) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) syz_open_dev$swradio(&(0x7f0000000300)='/dev/swradio#\x00', 0x1, 0x2) 14:16:13 executing program 4: r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/fscreate\x00', 0x2, 0x0) write$binfmt_misc(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="f3797a31"], 0x4) creat(&(0x7f0000000100)='./file0\x00', 0x0) 14:16:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) [ 479.644031] binder: 16669:16674 unknown command 0 [ 479.653236] binder: 16669:16674 ioctl c0306201 20000180 returned -22 [ 479.654859] SELinux: Context óyz1 is not valid (left unmapped). [ 479.676950] binder: 16668:16671 unknown command 0 [ 479.677415] binder: 16669:16677 unknown command 0 [ 479.683208] binder: 16668:16671 ioctl c0306201 20000180 returned -22 14:16:13 executing program 4: r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000080)='/proc/thread-self/attr/fscreate\x00', 0x2, 0x0) write$binfmt_misc(r0, &(0x7f0000000040)={'syz1'}, 0x4) creat(&(0x7f0000000100)='./file0\x00', 0x0) 14:16:13 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634097"], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) [ 479.690566] binder: 16669:16677 ioctl c0306201 20000180 returned -22 14:16:13 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) shutdown(0xffffffffffffffff, 0x0) recvmmsg(r1, &(0x7f0000002100)=[{{0x0, 0x0, 0x0}}], 0x3ffffffffffff5a, 0x10100, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 14:16:13 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$RTC_IRQP_SET(r1, 0x4008700c, 0xf60) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r1, 0x2) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) 14:16:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x2) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) 14:16:13 executing program 4: r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/fscreate\x00', 0x2, 0x0) write$binfmt_misc(r0, &(0x7f0000000080)={'syz1'}, 0x4) creat(&(0x7f0000000100)='./file0\x00', 0x0) 14:16:13 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) r3 = syz_open_dev$vbi(&(0x7f0000000080)='/dev/vbi#\x00', 0x1, 0x2) openat$cgroup_procs(r3, &(0x7f0000000100)='tasks\x00', 0x2, 0x0) open(&(0x7f00000001c0)='./file0\x00', 0x4000, 0x103) ioctl$TUNGETIFF(r3, 0x800454d2, &(0x7f00000000c0)) [ 479.795777] binder: 16687:16689 unknown command -1757388032 [ 479.805631] binder: 16687:16689 ioctl c0306201 20000040 returned -22 [ 479.814016] binder: 16687:16689 unknown command 0 [ 479.818972] binder: 16687:16689 ioctl c0306201 20000180 returned -22 [ 479.896843] binder: 16695:16699 unknown command 0 [ 479.913887] binder: 16694:16703 unknown command 0 [ 479.916813] binder: 16695:16699 ioctl c0306201 20000180 returned -22 [ 479.923807] binder: 16694:16703 ioctl c0306201 20000180 returned -22 [ 479.966049] binder: 16695:16710 unknown command 0 [ 479.977822] binder: 16695:16710 ioctl c0306201 20000180 returned -22 14:16:14 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00000000000000", @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x3}}, 0x0) 14:16:14 executing program 5: r0 = accept4$tipc(0xffffffffffffffff, &(0x7f0000000040), &(0x7f0000000080)=0x10, 0x800) ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f00000000c0)="b8e42672746d4e5d0fa4a67181a2f0a864e73ae4baeb343b0089d6452fdf9df925db6881042a53e34ba0d4fded2aae9e3929ac90f67ee91f5755a03b0c4686bea1fec69fcc6af2a0b7cbcbc9f93978875c4fb0024afb575a47891dc1ebfece6ea2348b3f84fd470370a3f4a9d3c57ed4f1a5848002fdff415a2a4e7229952e203eef82084136200ba16d1e4362a3aa0065828b4de66d2f1bc3a761ce47cc70b45f3cf532b6a0c1de9aee63461280d168d38a20b35ac35ea1ceb397002f7a2775990428fb55cf48ffbfb353371226a33af3998eb7962316e4ad15c916c23a3de47e237a353049675b8ae660e8bf46e325e4b1fc255ef32c5f1aa859e6cb39ce9c") r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = fcntl$dupfd(r1, 0x0, r1) bind$bt_rfcomm(r2, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) accept4$bt_l2cap(r2, 0x0, &(0x7f0000000200), 0x80800) write$binfmt_misc(r2, &(0x7f00000001c0)={'syz1', "bf3babe3fc99a9bc7aec17d0cca3bf838408e28dd96364efd915ad984306d5cb71640de54da82eff802d4fdb"}, 0x30) 14:16:14 executing program 4: r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/fscreate\x00', 0x2, 0x0) write$binfmt_misc(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="73d1660b6d69fd5b23"], 0x4) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dsp\x00', 0x0, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000340)=@mangle={'mangle\x00', 0x1f, 0x6, 0x728, 0x0, 0x228, 0x318, 0x0, 0x318, 0x658, 0x658, 0x658, 0x658, 0x658, 0x6, &(0x7f00000002c0), {[{{@ipv6={@initdev={0xfe, 0x88, [], 0x0, 0x0}, @initdev={0xfe, 0x88, [], 0x0, 0x0}, [0xff, 0x0, 0x0, 0xffffffff], [0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff], 'veth0_to_team\x00', 'syzkaller0\x00', {0xff}, {0xff}, 0x33, 0x0, 0x1, 0x11}, 0x0, 0xc8, 0xf0}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0xffffffff00000001, 0x1, 0xdf}, {0xe84a, 0x896, 0x8900}}}}, {{@ipv6={@ipv4={[], [], @rand_addr=0x3}, @empty, [0xffffff00, 0xff000000, 0xff0000ff, 0xffffff00], [0xffffffff, 0x9d563e7c133b1499, 0xffffffff, 0xffffffff], 'ip6_vti0\x00', 'lapb0\x00', {}, {0xff}, 0x32, 0x8, 0x2, 0x4}, 0x0, 0x110, 0x138, 0x0, {}, [@common=@hbh={0x48, 'hbh\x00', 0x0, {0xfffffffeffffffff, 0x1, 0x1, [0x8d, 0xa2, 0x80, 0x4, 0x581, 0x401, 0x4, 0x0, 0x7fff, 0x80, 0x19d, 0x8, 0xeb2, 0xb105, 0x0, 0x9], 0xd}}]}, @inet=@TOS={0x28, 'TOS\x00', 0x0, {0x4, 0x9}}}, {{@uncond, 0x0, 0xc8, 0xf0}, @common=@unspec=@MARK={0x28, 'MARK\x00', 0x2, {0x119e, 0x7fffffff}}}, {{@uncond, 0x0, 0x200, 0x228, 0x0, {}, [@common=@rt={0x138, 'rt\x00', 0x0, {0x1000, 0x7, 0x66e11b7f, 0x2, 0x2, 0x2, [@mcast1, @rand_addr="8040e0507b61246debcdc4a37c6630e3", @empty, @dev={0xfe, 0x80, [], 0x17}, @mcast2, @mcast2, @dev={0xfe, 0x80, [], 0x17}, @ipv4={[], [], @multicast2}, @empty, @empty, @mcast2, @remote, @empty, @loopback, @local, @empty], 0xb}}]}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@uncond, 0x0, 0xf0, 0x118, 0x0, {}, [@inet=@rpfilter={0x28, 'rpfilter\x00', 0x0, {0x8}}]}, @HL={0x28, 'HL\x00', 0x0, {0x3, 0x8}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x788) statx(r1, &(0x7f00000000c0)='./file0\x00', 0x1000, 0x7ff, &(0x7f0000000140)) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000240), 0x111, 0xd}}, 0x20) creat(&(0x7f0000000100)='./file0\x00', 0x0) 14:16:14 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$dmmidi(&(0x7f0000000200)='/dev/dmmidi#\x00', 0x6, 0x2000) ioctl$LOOP_GET_STATUS64(r4, 0x4c05, &(0x7f0000000300)) open_by_handle_at(r2, &(0x7f0000000100)=ANY=[@ANYBLOB="1640000001000000c16716d2cc14937a924fd4d3ac4e"], 0x44083) fcntl$addseals(r3, 0x409, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r5 = openat$cgroup_ro(r4, &(0x7f0000000000)='cpuacct.stat\x00', 0x0, 0x0) sendto$rxrpc(r5, &(0x7f00000004c0)="e02badb38eb45142defed0675f23a37c353a6b4e65c76f4b66a0ed30935333ce8174b8e84eda6c3b0168db16487ec1f94da2d98c09facbbcb71d472378fa2b5d54a92a38ba111736691f5aad4972b9660536b57fc07c28469bdecf919b1e0b3522308e6820e111c469fcd99c24694c3d6ab7995bd5f5f4ecf531f98cc90bfbc954d2aab7e3459eb1b41f2a2e59e29cc5bdcee43cd31fd78d9ee4085a4ef5f1d333", 0xa1, 0x20004000, &(0x7f0000000240)=@in4={0x21, 0x2, 0x2, 0x10, {0x2, 0x4e24, @multicast2}}, 0x24) getrandom(&(0x7f0000000680)=""/4096, 0x1000, 0x2) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r4, 0x6, 0x1d, &(0x7f00000000c0)={0x322, 0x2, 0x100000001, 0x3, 0xfff}, 0xa6) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(r5, 0x84, 0xb, &(0x7f00000001c0)={0x0, 0x46, 0x2000008000, 0x7, 0x9, 0x1, 0x2, 0x5ccb, 0x7, 0x7, 0x100000010}, 0xb) syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="0363084085f10d6d8c5cbc925e81f106a96a31c075c16fb26c2369fb1d913dda9119974dd5893e64306d11f68ccf30b02bcb14ff506c82c7eacb66776d3150939bb0276bcccd6b206d0a0000000000003f459025b792c87c58efc547de5e43fbdbb390b450d0fc53de705bcbf50565bcd7c891ca079882dad28b2f68dfd8bb77bf79871c87e6d122efc57110ab881c786a238bf90045833b5cbf09a91f4b26386c2d4dc9e3fad585d320906706580424a4f2694f21cb04a358ac4c8ebfd9a4f2466de26bcfef02bf8ef45b7442f8b811d560c4cb94034378baeddae517b330e407a3d3443800000000000000", @ANYRES64=0x0], 0x0, 0x0, 0x0}) 14:16:14 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) r3 = syz_open_dev$usbmon(&(0x7f0000000080)='/dev/usbmon#\x00', 0x8, 0x40) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r3, 0x10e, 0x8, &(0x7f00000000c0)=0x4, 0x4) 14:16:14 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$SIOCRSSCAUSE(r1, 0x89e1, &(0x7f0000000040)=0x1) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0xfff, 0x2, 0x400000}}, 0xa) [ 480.525836] binder: 16717:16719 unknown command 0 [ 480.532801] SELinux: Context sÑf is not valid (left unmapped). [ 480.533325] binder: 16716:16722 unknown command 116490590 [ 480.551117] binder: 16717:16719 ioctl c0306201 20000180 returned -22 [ 480.566878] binder: 16716:16722 ioctl c0306201 20000180 returned -22 [ 480.582645] binder: 16717:16726 unknown command 0 14:16:14 executing program 4: r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/fscreate\x00', 0x2, 0x0) openat$apparmor_task_exec(0xffffffffffffff9c, &(0x7f0000000100)='/proc/self/attr/exec\x00', 0x2, 0x0) write$binfmt_misc(r0, &(0x7f0000000040)={'syz1'}, 0x4) r1 = syz_open_dev$sndpcmp(&(0x7f00000000c0)='/dev/snd/pcmC#D#p\x00', 0x6, 0x80) ioctl$TCSBRK(r1, 0x5409, 0x0) r2 = creat(&(0x7f0000000080)='./file0\x00', 0x7) ioctl$KVM_SET_ONE_REG(r2, 0x4010aeac, &(0x7f0000000140)={0x8001, 0x4}) [ 480.603217] binder: 16717:16726 ioctl c0306201 20000180 returned -22 14:16:14 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) shutdown(r1, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000002100)=[{{0x0, 0x0, 0x0}}], 0x3ffffffffffff5a, 0x10100, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 14:16:14 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000540)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000440)='/dev/sequencer2\x00', 0x400, 0x0) r3 = syz_open_dev$vbi(&(0x7f00000004c0)='/dev/vbi#\x00', 0x2, 0x2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x5) r4 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$TIOCGPGRP(r4, 0x540f, &(0x7f0000000400)) getsockopt$EBT_SO_GET_INIT_ENTRIES(r4, 0x0, 0x83, &(0x7f0000000240)={'filter\x00', 0x0, 0x4, 0xb0, [], 0x6, &(0x7f00000001c0)=[{}, {}, {}, {}, {}, {}], &(0x7f0000000300)=""/176}, &(0x7f00000003c0)=0x78) ioctl$VFIO_IOMMU_UNMAP_DMA(r4, 0x3b72, &(0x7f00000000c0)={0x20, 0x2, 0x0, 0x6, 0x8}) ioctl$IMHOLD_L1(r4, 0x80044948, &(0x7f0000000100)=0xde1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) ioctl$KDDISABIO(r2, 0x4b37) 14:16:14 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x3, &(0x7f0000000080)='$\'\x00'}, 0x30) fcntl$lock(r0, 0x7, &(0x7f0000000100)={0x0, 0x1, 0xfffffffffffffffe, 0x4, r1}) r2 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) r4 = dup2(r3, r2) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000a00)={0x8, 0x0, &(0x7f0000000840)=[@release], 0x0, 0x0, 0x0}) r5 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r5, &(0x7f0000000040)={0x1f, {0x34, 0x5, 0x2000000000000, 0x54, 0x3, 0x2}, 0xfffffffffffffff9}, 0xa) bind$bt_rfcomm(r5, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) 14:16:14 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r3 = syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0x1, 0x2) ioctl$CAPI_REGISTER(r3, 0x400c4301, &(0x7f00000000c0)={0x2, 0x4, 0x7}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) 14:16:14 executing program 4: r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/fscreate\x00', 0x2, 0x0) write$binfmt_misc(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="73797a91"], 0x4) creat(&(0x7f0000000100)='./file0\x00', 0x0) [ 480.734359] binder: BINDER_SET_CONTEXT_MGR already set [ 480.740345] binder: 16741:16746 unknown command 0 [ 480.745644] binder: 16742:16749 unknown command 0 [ 480.746460] SELinux: Context syz‘ is not valid (left unmapped). [ 480.754386] binder: 16741:16746 ioctl c0306201 20012000 returned -22 [ 480.757810] binder: 16739:16747 ioctl 40046207 0 returned -16 [ 480.772468] binder: 16742:16749 ioctl c0306201 20000180 returned -22 [ 480.779741] binder_alloc: 16741: binder_alloc_buf, no vma [ 480.786282] binder: 16742:16751 unknown command 0 [ 480.806200] binder: 16739:16747 unknown command 0 [ 480.806209] binder: 16742:16751 ioctl c0306201 20000180 returned -22 [ 480.824897] binder: 16739:16747 ioctl c0306201 20000180 returned -22 [ 480.849161] binder: 16739:16756 unknown command 0 [ 480.854214] binder: 16739:16756 ioctl c0306201 20000180 returned -22 14:16:15 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00000000000000", @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x3}}, 0x0) 14:16:15 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) shutdown(r1, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000002100)=[{{0x0, 0x0, 0x0}}], 0x3ffffffffffff5a, 0x10100, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 14:16:15 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair(0x3, 0x80807, 0x2, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$IPT_SO_GET_REVISION_MATCH(r2, 0x0, 0x42, &(0x7f00000000c0)={'ipvs\x00'}, &(0x7f0000000100)=0x1e) r3 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r3}], 0x0, 0x0, 0x0}) r4 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r4, 0xab07, 0x5a5) 14:16:15 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) syz_open_dev$vbi(&(0x7f0000000040)='/dev/vbi#\x00', 0x1, 0x2) 14:16:15 executing program 4: r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/fscreate\x00', 0x2, 0x0) r1 = dup3(r0, r0, 0x80000) ioctl$TIOCMIWAIT(r1, 0x545c, 0x0) write$binfmt_misc(r0, &(0x7f0000000040)={'syz1'}, 0x4) creat(&(0x7f0000000100)='./file0\x00', 0x0) 14:16:15 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x0, 0x0) ioctl$sock_bt_bnep_BNEPCONNADD(r4, 0x400442c8, &(0x7f00000000c0)={r2, 0x5, 0x6d00000, "bc12545eff1eed23f3e77e1176541018dd9cbb3641fca170adea8120db2372aa7cdd9c8d09cd20b8031d81ac485713a8bee8709abb5d61323f918fca8465e5995d90a4c2ab7e6729668d03473c426235626d047d17a5be2eee51d7465d7d5d6eb2ae33c0ed9b0467a9311479285d83e4ed93"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:16:15 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$ASHMEM_GET_SIZE(r1, 0x7704, 0x0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xffffffffffffffb1) 14:16:15 executing program 4: r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/fscreate\x00', 0x2, 0x0) r1 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000140)='/dev/cachefiles\x00', 0x84000, 0x0) accept$inet6(r1, &(0x7f0000000180)={0xa, 0x0, 0x0, @mcast1}, &(0x7f00000001c0)=0x1c) r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x80000, 0x0) ioctl$TUNGETIFF(r2, 0x800454d2, &(0x7f00000000c0)) write$binfmt_misc(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="73ddbd8c659e4889e17c1c7a5c797a31"], 0x4) creat(&(0x7f0000000100)='./file0\x00', 0x0) 14:16:15 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) shutdown(r1, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000002100)=[{{0x0, 0x0, 0x0}}], 0x3ffffffffffff5a, 0x10100, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 14:16:15 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/sequencer\x00', 0x0, 0x0) connect$rds(r1, &(0x7f0000000200)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="6a1127d86008a6a1ff4739d7296dc0d6edbfb4e87e42a3e3c5b62d81d8d0189ea455572925f61e25a67c2ea2e6ad4fa7523b7d5673facd1908a25c8cc0eba41386ffaf58728dfacb76db9a354c7db0d0811b0362178e5e5e1c22e6e21b792d0887844200972607c1854ec92de334b2681e0164906e910703bae27919016f19294632230f9a0d4ad440e2e52ad1fa40cdf0929aadb6b31293f9c7e73a5f0d6d39848fbe9d94c208e4b3b3980bd402b474375e3331651dabcfd803a7a49cd1ff06143be55187"], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x400008, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$TIOCSTI(r1, 0x5412, 0xc6d8) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) r4 = syz_open_dev$adsp(&(0x7f0000000240)='/dev/adsp#\x00', 0x401, 0x100) ioctl$EVIOCSABS2F(r4, 0x401845ef, &(0x7f0000000280)={0x0, 0x10001, 0xb, 0x6, 0x9, 0x20000000000002}) [ 481.434941] binder: 16766:16773 unknown command 0 [ 481.445691] binder: 16766:16773 ioctl c0306201 20000180 returned -22 [ 481.456327] binder: 16763:16770 unknown command 0 [ 481.510472] binder: 16763:16770 ioctl c0306201 20000180 returned -22 [ 481.545334] binder: 16783:16787 unknown command -668528278 [ 481.552344] binder_alloc: 16763: binder_alloc_buf, no vma 14:16:15 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0xfffffffffffffffd) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) openat$ppp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ppp\x00', 0x101000, 0x0) 14:16:15 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) fcntl$dupfd(r0, 0x0, r0) [ 481.560172] binder: 16763:16780 unknown command 0 [ 481.568349] SELinux: Context sݽŒ is not valid (left unmapped). [ 481.575777] binder: 16763:16780 ioctl c0306201 20000180 returned -22 [ 481.579805] binder: 16783:16787 ioctl c0306201 20000040 returned -22 [ 481.594901] binder: 16783:16791 unknown command 0 [ 481.601886] binder: 16783:16791 ioctl c0306201 20000180 returned -22 [ 481.666012] binder: 16783:16787 unknown command -668528278 [ 481.683109] binder: 16783:16791 unknown command 0 [ 481.683679] binder: 16783:16787 ioctl c0306201 20000040 returned -22 [ 481.689388] binder: 16783:16791 ioctl c0306201 20000180 returned -22 14:16:15 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00000000000000", @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x3}}, 0x0) 14:16:15 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) shutdown(r1, 0x0) recvmmsg(r1, 0x0, 0x0, 0x10100, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 14:16:15 executing program 4: r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/fscreate\x00', 0x2, 0x0) write$binfmt_misc(r0, &(0x7f0000000040)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x4) creat(&(0x7f0000000100)='./file0\x00', 0x0) 14:16:15 executing program 1: epoll_create(0x158) r0 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vsock\x00', 0x0, 0x0) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000200)='nbd\x00') sendmsg$NBD_CMD_CONNECT(r0, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x280}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x24, r1, 0x232, 0x70bd2a, 0x25dfdbfc, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x24}, 0x1, 0x0, 0x0, 0x8000}, 0x20040004) ioctl$int_out(r0, 0x200005462, &(0x7f00000003c0)) r2 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x20014, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00800000ce8be5dfc2d8727bbbf48b846a3d863aa7f02c14508316edeb823ed7"], 0x0, 0x0, 0x0}) r4 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB, @ANYRES64=r4], 0x0, 0x0, 0x0}) 14:16:15 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) lstat(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0}) read(r1, &(0x7f0000000340)=""/47, 0x2f) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@empty, @in6=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in=@multicast1}}, &(0x7f0000000300)=0xe8) syz_mount_image$msdos(&(0x7f0000000080)='msdos\x00', &(0x7f00000000c0)='./file0\x00', 0x18aa, 0x0, &(0x7f0000000100), 0x2000000, &(0x7f0000000400)=ANY=[@ANYBLOB="6e9ed09a1c7e54c68888012cf31af2e36f646f749b2c030000007473056e6f646f74732c646f74732c6e6f6e6f74732cdf08000000000000686563b33d6e6f726d616c060069643c", @ANYRESDEC=r2, @ANYBLOB=',euid<', @ANYRESDEC=r3, @ANYBLOB=',subise,\x00']) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x3}, 0x3}, 0x278) getsockopt$inet_udp_int(r1, 0x11, 0x67, &(0x7f0000000380), &(0x7f00000003c0)=0x4) setsockopt$inet6_opts(r1, 0x29, 0x37, &(0x7f0000000100)=@fragment={0x89, 0x0, 0x1, 0x1000, 0x0, 0x54, 0x68}, 0x8) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000040)='/dev/btrfs-control\x00', 0x800, 0x0) 14:16:15 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00634040cb55c48c57a2002f232a773b19f82c5758adfd0babd563ea1dc2e4d004481916219d88eca773a226af0a78c39b093d8bb2db648a6c036ebd6cfacaaf15883d3e8718ab7e183ae655c22d29cb6aa364c9ae31aed5328aa482967d8c23c3224c14e755ea41ca520f673f29b4c1db4f21a7f86ba5f1cdce7249186a0ebd85f8d421b18437674954bb39fa9bfd2f5d569b428446604d87b5d0e5ff9ec8b8946bed1a3f76f57746d9d0a499fcdb4d9e7029ee25262157683010d4cb795274f8084930e20547102422f8908efc735dfed1943e3bc779dcbeb0b6c0d5af7e5d7d7001f3cfa36527a33d10e6"], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:16:15 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) shutdown(r1, 0x0) recvmmsg(r1, 0x0, 0x0, 0x10100, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 14:16:16 executing program 4: r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x400480, 0x1) fsetxattr$security_smack_transmute(r0, &(0x7f00000000c0)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000140)='TRUE', 0x4, 0x1) r1 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/fscreate\x00', 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000040)={'syz1'}, 0x4) creat(&(0x7f0000000100)='./file0\x00', 0x0) [ 482.329820] Unknown ioctl 21602 [ 482.344652] binder: 16812:16813 unknown command 32768 [ 482.350655] binder: 16808:16818 unknown command 0 [ 482.355698] binder: 16808:16818 ioctl c0306201 20000180 returned -22 [ 482.382360] binder: 16812:16813 ioctl c0306201 20000040 returned -22 [ 482.404236] binder: 16812:16825 unknown command 553635840 14:16:16 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00634040d21fc4cde21de6d86e2ec6ff763dfe67c0958de0377debb62e22150646f0811025051497022a133259a5ebb4e8ec928997e24304d13a54c67406b61e9b7fc656feb7a4b34a7db4b23592cd07071484556b23685812ec4c08cd800279e03c5e646a6d040d5e1b0fb71963202a40720777d6e520bb589fb502b00500a5475f91b453c84b953ca4f8e109579b9f211316d6ecd616fb38e08f6b159ee1ecfb0d63b84cb82f7191576bac5c4c14a28575073bbe28977b7db4103b2a87e909ec65"], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/qat_adf_ctl\x00', 0x2080, 0x0) ioctl$VT_OPENQRY(r3, 0x5600, &(0x7f00000000c0)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:16:16 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) 14:16:16 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) shutdown(r1, 0x0) recvmmsg(r1, 0x0, 0x0, 0x10100, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 14:16:16 executing program 4: r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio\x00', 0x400000, 0x0) getsockopt$ARPT_SO_GET_INFO(r0, 0x0, 0x60, &(0x7f0000000140)={'filter\x00'}, &(0x7f00000000c0)=0x44) r1 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/fscreate\x00', 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000040)={'syz1'}, 0x4) creat(&(0x7f0000000100)='./file0\x00', 0x0) [ 482.429733] binder: 16812:16825 ioctl c0306201 20000180 returned -22 [ 482.434546] FAT-fs (loop5): Unrecognized mount option "nžÐš~Tƈˆ" or missing value [ 482.444907] Unknown ioctl 21602 [ 482.448843] binder: 16812:16813 unknown command 32768 [ 482.464752] binder: 16812:16813 ioctl c0306201 20000040 returned -22 [ 482.501391] QAT: Invalid ioctl [ 482.505204] binder: 16835:16836 unknown command 0 [ 482.510982] binder: 16835:16836 ioctl c0306201 20000180 returned -22 [ 482.569227] binder: 16838:16840 unknown command 0 [ 482.613657] binder: 16838:16840 ioctl c0306201 20000180 returned -22 [ 483.128144] FAT-fs (loop5): Unrecognized mount option "nžÐš~Tƈˆ" or missing value 14:16:16 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/18, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x3}}, 0x0) 14:16:16 executing program 0: r0 = syz_open_dev$mice(&(0x7f0000000080)='/dev/input/mice\x00', 0x0, 0x800) ioctl$VHOST_SET_VRING_ENDIAN(r0, 0x4008af13, &(0x7f00000000c0)={0x3, 0x6}) r1 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$TCSETSW(r0, 0x5403, &(0x7f0000000100)={0x7fffffff, 0x20, 0xfffffffffffffe00, 0x60, 0x5, 0xb292b54, 0x2552fbfd, 0x0, 0x8, 0x800, 0x200000000, 0xd047}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:16:16 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) shutdown(r1, 0x0) recvmmsg(r1, &(0x7f0000002100), 0x0, 0x10100, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 14:16:16 executing program 4: r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/fscreate\x00', 0x2, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080)='/dev/zero\x00', 0x40, 0x0) socket$caif_seqpacket(0x25, 0x5, 0x3) setsockopt$inet6_MCAST_LEAVE_GROUP(r1, 0x29, 0x2d, &(0x7f0000000140)={0x0, {{0xa, 0x4e23, 0xffffffff, @loopback, 0x40}}}, 0x88) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000540)={r1, 0xc0, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)=0x1, 0x0, 0x0, 0x0, &(0x7f0000000380)={0x2, 0x1}, 0x0, 0x0, &(0x7f00000003c0)={0x1, 0xb, 0x800, 0x7fffffff}, &(0x7f0000000400)=0x1000, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=0x1}}, 0x10) write$binfmt_misc(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="73079f577a53e4d0797ac3"], 0x4) ioctl$SIOCX25SSUBSCRIP(r1, 0x89e1, &(0x7f0000000240)={'ip_vti0\x00', 0xfff, 0xa3f}) syz_open_dev$adsp(&(0x7f0000000200)='/dev/adsp#\x00', 0x1, 0x210003) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) ioctl$sock_bt_cmtp_CMTPCONNDEL(r2, 0x400443c9, &(0x7f0000000040)={{0x1ff, 0x4, 0xffff, 0x8, 0x7, 0x100}, 0x2}) 14:16:16 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PIO_FONTRESET(r2, 0x4b6d, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r3}], 0x0, 0x0, 0x0}) 14:16:16 executing program 5: fremovexattr(0xffffffffffffffff, &(0x7f00000000c0)=@known='system.advise\x00') r0 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/hash_stats\x00', 0x0, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(r0, 0x112, 0xa, &(0x7f0000000080)=0x6, 0x4) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_inet_SIOCSIFNETMASK(r1, 0x891c, &(0x7f0000000100)={'bond_slave_0\x00', {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0xd}}}) r2 = fcntl$dupfd(r1, 0x0, r1) r3 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) setsockopt$inet_mtu(r3, 0x0, 0xa, &(0x7f0000000180)=0x2, 0x4) bind$bt_rfcomm(r2, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x561d98}, 0x400000000}, 0xa) ioctl$KVM_GET_REG_LIST(r2, 0xc008aeb0, &(0x7f00000001c0)=ANY=[@ANYBLOB="01000000000000007f000000f7ff02008d89a952637c4c8310017d20a0a152fdd7163c420811fb39550700f5b0234445ac445b74782abaac0000f200000000000000000000000000d99230a6a73ca312c1a7cd8e70dfc344870a42c3246d22d92df27c831c7b714d56f0c58859a208f3e8d7e5e887de8ee6883bf9792671f9deb8622273abd30e68149f88fb1e6c370f21b4410ca549d08fbb6cfe20cd7814b3a6aaee64108a018e4f04de49b460ab36dde347d5e7bb4bb4bf32fbd6a32a57b6d78c4ebd8e9e6f74ee66053664580db114a48666046bc12356bb57d7ec43c32c7ec043d168eceb194bf535"]) 14:16:16 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) shutdown(r1, 0x0) recvmmsg(r1, &(0x7f0000002100), 0x0, 0x10100, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 14:16:16 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) write$P9_RUNLINKAT(r1, &(0x7f0000000200)={0x7, 0x4d, 0x2}, 0x7) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') sendmsg$IPVS_CMD_GET_SERVICE(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40200}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x9c, r2, 0x301, 0x70bd2d, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_DAEMON={0x38, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @ipv4={[], [], @remote}}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e22}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x3f}]}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x1}]}, @IPVS_CMD_ATTR_SERVICE={0x44, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@multicast2}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x43}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@multicast2}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x3f}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x33}]}]}, 0x9c}, 0x1, 0x0, 0x0, 0x40800}, 0x4000000) [ 483.248261] SELinux: Context sŸW is not valid (left unmapped). [ 483.259470] binder: 16861:16868 unknown command 0 [ 483.271421] binder: 16861:16868 ioctl c0306201 20000180 returned -22 [ 483.279500] binder: 16859:16870 unknown command 0 [ 483.285764] binder: 16859:16870 ioctl c0306201 20000180 returned -22 14:16:16 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x102, 0x0) setsockopt$netrom_NETROM_N2(r2, 0x103, 0x3, &(0x7f0000000080)=0x5a62, 0x4) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0463b440800b4048"], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$IOC_PR_REGISTER(r2, 0x401870c8, &(0x7f00000000c0)={0x8, 0x3}) [ 483.307505] binder: 16861:16873 unknown command 0 [ 483.312577] binder: 16861:16873 ioctl c0306201 20000180 returned -22 14:16:17 executing program 4: r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000180)='/proc/self/attr/exec\x00', 0x2, 0x0) write$binfmt_misc(r0, &(0x7f0000000040)={'syz1'}, 0x4) creat(&(0x7f0000000080)='./file0\x00', 0x0) 14:16:17 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) shutdown(r1, 0x0) recvmmsg(r1, &(0x7f0000002100), 0x0, 0x10100, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 14:16:17 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xc, 0x0, &(0x7f0000000080)=[@free_buffer], 0x0, 0x0, 0x0}) getsockname$unix(r2, &(0x7f00000000c0)=@abs, &(0x7f0000000000)=0x6e) [ 483.371918] binder: 16880:16885 unknown command 1085563652 [ 483.405090] binder: 16880:16885 ioctl c0306201 20000040 returned -22 [ 483.453215] binder: BINDER_SET_CONTEXT_MGR already set [ 483.457172] binder: 16880:16888 unknown command 1085563652 [ 483.464524] binder: 16880:16885 ioctl 40046207 0 returned -16 [ 483.484707] binder: 16880:16888 ioctl c0306201 20000040 returned -22 14:16:17 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/18, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x3}}, 0x0) 14:16:17 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x406, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) 14:16:17 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) shutdown(r1, 0x0) recvmmsg(r1, &(0x7f0000002100)=[{{0x0, 0x0, 0x0}}], 0x3ffffffffffff5a, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 14:16:17 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000080)=0x0) ptrace$getsig(0x4202, r2, 0x4, &(0x7f00000000c0)) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:16:17 executing program 4: r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/fscreate\x00', 0x2, 0x0) write$binfmt_misc(r0, &(0x7f0000000040)={'syz1'}, 0x4) creat(&(0x7f0000000100)='./file0\x00', 0x0) rename(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='./file0\x00') 14:16:17 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="90de7f32689cd6945db8a4d20300000016c7bf05f7937e64b8adac29d6d3cbf14399dd7ffe9e4b30a46cbd650910d2907365a1eb5cfb83d83415ffe7601ca2cadc9d"], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) 14:16:17 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) prctl$PR_SET_FPEXC(0xc, 0x40001) r1 = fcntl$dupfd(r0, 0x0, r0) r2 = syz_open_dev$vcsn(&(0x7f0000000040)='/dev/vcs#\x00', 0x4, 0x200) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000000080)={{{@in=@multicast2, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@initdev}, 0x0, @in6=@loopback}}, &(0x7f0000000180)=0xe8) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)={0x7, 0x1f, 0x7f, 0xfffffffffffffffa, 0x1, r2, 0x9, [], r3}, 0x3c) 14:16:17 executing program 4: r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/fscreate\x00', 0x2, 0x0) write$binfmt_misc(r0, &(0x7f0000000040)={'syz1'}, 0x4) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) io_setup(0x5, &(0x7f0000000080)=0x0) r3 = syz_open_dev$dspn(&(0x7f0000000680)='/dev/dsp#\x00', 0x0, 0x20000) io_submit(r2, 0x9, &(0x7f0000000880)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x8, 0x8001, r1, &(0x7f00000000c0)="baf278b9324e7a54cd2635fc635c353c0c0eb3444afbc02de8d5aa0491db069457393cb1898ccf2edfd55adfa23d0ca3e8b9ea2f88a26fd150cd5af07a", 0x3d, 0x6, 0x0, 0x0, r1}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0xb, 0x2, r0, &(0x7f0000000180)="fef940b6d32cef44f7effb3570347843d38ff3e1173b12774583f500b0f7d225dfadbd90d8", 0x25, 0x1, 0x0, 0x2, r1}, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x7, 0x0, r0, &(0x7f0000000200)="702294b5a373019f2719411372609a262e70fc59fe573dbeb155ea739fd4e1521c105fe34bb327e0583d78f77f3df08f6bbe29ac006e254b12003a89903cc80fffea556888aa4d140021684a66e8cdbeead30f302e2d6b0208a2ae03a7a70a2e2686c526a09558b127f7bd6b669afe9d1020ea0e38b2bf476e84d5408be23c14a124b69ed464fb32eb8fe40e176f0ee8f7398889ef262350fd3d6a86e6f88ba811c4de1f29f0de865d16c647ff0b3e91e612e161784b", 0xb6, 0x1ff, 0x0, 0x2, r1}, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x3, 0x8, r1, &(0x7f0000000300)="98d4a6804de0b82a0140c2982f26873fbf01d5b2d23c0603", 0x18, 0x8, 0x0, 0x3, r1}, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x6, 0x10000, r0, &(0x7f0000000380)="3f0c355cbaeab4f3a8b239bf1cf4a2ec334fd27a931114449c9aafa81f7829c1dcc269763fe78196051993551f433fc4cdf5d0b2a2aec9d987e84b9d2dca4f4b54fb680214fe615bb1cf6a2d20895d92b7f24d22ae949276a8e7bc326d954dd65fc8f4d8574447d9791d554ed5023dd0b517c4d4a4e041efcaa6e367deb3b17412f92f3288663689af6fb7e0d8bb6901059f8b4c725722912d36cf3ea8fd2f19c05edb7b61511ab8994c8ef24f3b2acf8dc1dd09cc48378e22b4415d3f0d898e15432462f60e22d588bf3571ebd4ed609957a44274e4b48f54111c29afad15a419f5dc8bcd92c60ffce21f613fe156bb", 0xf0, 0x0, 0x0, 0x1, r1}, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x8, 0xffff, r0, &(0x7f00000004c0)="4c35e47e1c1baa12a1b4d1ceb032ffd3c8cedb7846c276c98149bcdf6d3e9c019064d45308ed6c3f9879692bf94013af1b237e767018109fda312ce32d92a94a704d9e4c0b7763a6b5d27e45840da1212984acf905c08248bac1e6a540bb8aab53", 0x61, 0x81, 0x0, 0x3, r1}, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x8, 0x10000, r1, &(0x7f0000000580)="c3754d82c06e5076357404d73f8a26d06a226ee9f2343f160c653c66fd6b13ff37bb6e6282226b80413f5e722e88a7ed51c64a2d43a3cbe648ae0cc27a10fe55f713ea83b0443323c3fa3e5d0ad6e606d8ef7d65bcb283ccacc9dc9a0c50d3fd13e1837bc384583ad8d3da0248521d67b4d1bc393398a202956155d50f9238a4e75146c5624b76fde47635f29c6402ecf096dcf73fa3519108cc69a257b34db381f9dcb8095aa5f009887ce143f16f3d9768d81509cb6be5b11e34478a1dc53290dc2a2235b60f8d5cf4f1dac32ef13baf59d3a8c661179a5e84b805a102430d5cd47e7399d1978d575b954e6033b36c30c195c07a7c2ed09c7d7d2e20e3", 0xfe, 0xfffffffffffffffc, 0x0, 0x0, r3}, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x7, 0x3, r1, &(0x7f0000000700)="9886c7b5bff4216fd393b9ea5f00b046bac76945f95f95ad4731c578a2688a1fd224e5bbb0ee9274a12ec17367f0431c0c177bbcd333b11f36c640e80b787bcad814d415f9e2981b43097fedbd72bcfedd149e10d32561cd52847cecf576afc5057bd0312449a3b3141c1bc6ba2b76a8bc716d4c86a3aca6dd71526285483b1e6c2358e1e519e9935204c8f2cc76d568", 0x90, 0x4, 0x0, 0x1}, &(0x7f0000000840)={0x0, 0x0, 0x0, 0x2, 0xffffffff, r0, &(0x7f0000000800)="3aab48adaba891d0104cb4", 0xb, 0x0, 0x0, 0x2, r1}]) [ 484.133724] binder: 16909:16913 unknown command 847240848 [ 484.165813] binder: 16909:16913 ioctl c0306201 20000040 returned -22 [ 484.182868] binder: 16904:16916 unknown command 0 [ 484.185275] binder: 16909:16921 unknown command 0 [ 484.206635] binder: 16904:16916 ioctl c0306201 20000180 returned -22 [ 484.208763] binder: 16909:16921 ioctl c0306201 20000180 returned -22 14:16:17 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_open_dev$media(&(0x7f0000000080)='/dev/media#\x00', 0x8, 0x0) ioctl$VIDIOC_S_INPUT(r1, 0xc0045627, &(0x7f00000000c0)=0x3ff) r2 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$VIDIOC_G_PRIORITY(r2, 0x80045643, 0x1) r3 = fcntl$dupfd(r0, 0x2, r0) bind$bt_rfcomm(r3, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) 14:16:17 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r2 = dup2(r1, r1) ioctl$UI_SET_KEYBIT(r2, 0x40045565, 0x13b) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) ioctl$UI_SET_SNDBIT(r1, 0x4004556a, 0x0) fsetxattr$trusted_overlay_upper(r3, &(0x7f00000000c0)='trusted.overlay.upper\x00', &(0x7f00000001c0)={0x0, 0xfb, 0xd0, 0x4, 0x1, "a26ab09dcbc7b50b5f2aaec600332871", "08357462d888dd258caf88731271a3231dddf198c565264890fd0cf3902acb01a68b15ef8c995aa34dd8131f8f025dd1f3342d8c5f3cc6f0ffedd23a2cdb36f06b43bdec69862eee748f31961b353c769c19d8dbd762463bf62587052bbf1c6df6abc16afb5a21f87d3065b68fb6c252567e82caad344ef1c977cc39522c07c6f0e69fb2b4cb93529fb069a46026c5c384adc6e9d33398e117afaad121bc6f4df7f16a360a5990cf5a1d2c2c3c4a188ceb0ef18dce5202d0fc54e2"}, 0xd0, 0x66dfe95ed6273fbd) syz_genetlink_get_family_id$team(&(0x7f0000000080)='team\x00') [ 484.238496] binder: 16909:16921 unknown command 847240848 [ 484.247035] binder: 16909:16921 ioctl c0306201 20000040 returned -22 [ 484.263337] binder: 16909:16921 unknown command 0 14:16:17 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/dlm_plock\x00', 0x8680, 0x0) ioctl$KVM_ASSIGN_SET_MSIX_NR(r1, 0x4008ae73, &(0x7f0000000200)={0xd8, 0xd10a}) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000040)={0xffffffffffffff1e, 0x0, &(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000000280)=ANY=[@ANYPTR=&(0x7f0000000240)=ANY=[@ANYRESOCT=r2]], @ANYRES32=r0, @ANYRES16=r0, @ANYRES32=0x0, @ANYPTR=&(0x7f0000000100)=ANY=[@ANYPTR=&(0x7f0000000080)=ANY=[@ANYRESOCT=r2, @ANYPTR, @ANYBLOB="b175805e3b6cd230ae1c75f8657e1af3f4d7c6bc913dd17dab68a65707eb5e", @ANYPTR64, @ANYPTR64], @ANYRESOCT=r0], @ANYRES32=r2, @ANYRESDEC=r0], 0x0, 0x0, 0x0}) r3 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1, 0x11, r0, 0x100000000001) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r3}], 0x0, 0x0, 0x0}) 14:16:17 executing program 4: socket$bt_hidp(0x1f, 0x3, 0x6) r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/fscreate\x00', 0x2, 0x0) write$binfmt_misc(r0, &(0x7f0000000040)={'syz1'}, 0x4) creat(&(0x7f0000000100)='./file0\x00', 0x0) [ 484.288233] binder: 16909:16921 ioctl c0306201 20000180 returned -22 [ 484.336468] binder: 16932:16934 ioctl 40045565 13b returned -22 [ 484.379788] binder: 16932:16934 unknown command 0 [ 484.385523] binder: 16940:16942 unknown command 0 [ 484.403667] binder: 16932:16934 ioctl c0306201 20000180 returned -22 [ 484.420568] binder: 16940:16942 ioctl c0306201 20000180 returned -22 [ 484.430920] binder: 16932:16944 ioctl 4004556a 0 returned -22 [ 484.431356] binder: 16940:16945 unknown command 0 [ 484.466289] binder: 16940:16945 ioctl c0306201 20000180 returned -22 14:16:18 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/18, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x3}}, 0x0) 14:16:18 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) getpeername$netlink(r1, &(0x7f0000000040), &(0x7f0000000080)=0xc) 14:16:19 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) shutdown(r0, 0x0) recvmmsg(r0, &(0x7f0000002100)=[{{0x0, 0x0, 0x0}}], 0x3ffffffffffff5a, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) 14:16:19 executing program 4: r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/fscreate\x00', 0x2, 0x0) fchdir(r0) write$binfmt_misc(r0, &(0x7f0000000040)={'syz1'}, 0x4) creat(&(0x7f0000000100)='./file0\x00', 0x0) 14:16:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x121200, 0x0) ioctl$KVM_S390_UCAS_MAP(r3, 0x4018ae50, &(0x7f0000000080)={0x2, 0x5, 0x3}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0363084086e4b8ee2ed45bddf86c7d587ad48c06777dcc01aec658e8f5c351ac4716ca1b3503002700567bfb734f1d0a13ccc06e3a7062d521714ab7633c0f6cd003c908d4aabfea6af91432c9c05b29488a38c55ef421c49017de2710851019eb545111ba225578a0ec77dfa32c001c2b4bc2f11ecb394d790e8946dbdf991843907ee7ff6548d215d0795da7472371a8dc8ea70f9e4ce70144b71c38d788a3bf9cace3fb62ffe2eb2dc7e0ca51cb6e0000", @ANYRES64=0x0], 0x0, 0x0, 0x0}) 14:16:19 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x0) pwrite64(r0, &(0x7f0000000280)="6645886a234d74a352a32af38c494e4ceb41f31343eda058028c67b24959f0a7f00d6ff5bc37a0364ed38a0ab5fe6c04d8b811ca470443f6cb185e779af4efb5bc7a67cabe15dd85012c7c749e02efd29f460708167f8d793ee84339a9b8bf9c23274f37a098990bdadc586ea343cb58894034456586febd08fca1a88b08cdaf889fb9fec461a6f3a0bb5f88e2f322c810f5e7c43c8f42034d150dc5d6cb31896ace25767ec136", 0xa7, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm-monitor\x00', 0x20000, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r3, 0x40a85323, &(0x7f00000001c0)={{0x5, 0xffffffffffffffc0}, 'port0\x00', 0x85, 0x80408, 0x0, 0x2, 0x9, 0x4, 0x100, 0x0, 0x0, 0x800}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) 14:16:19 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0xf9, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) 14:16:19 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/19, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x3}}, 0x0) 14:16:19 executing program 4: r0 = syz_open_dev$audion(&(0x7f0000000080)='/dev/audio#\x00', 0x8, 0x10082) ioctl$KVM_GET_REG_LIST(r0, 0xc008aeb0, &(0x7f00000000c0)={0x3, [0x7ff, 0x3, 0xda85]}) r1 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000140)='/pr@\xb8\xbc\xb5hrea]\x8d\xb10d-self/attr/fscre', 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000040)=ANY=[@ANYBLOB="73796ce7"], 0x4) arch_prctl$ARCH_GET_CPUID(0x1011) creat(&(0x7f0000000100)='./file0\x00', 0x0) ioctl$RFKILL_IOCTL_NOINPUT(r0, 0x5201) [ 486.009103] binder: 16960:16970 unknown command 0 14:16:19 executing program 5: openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) 14:16:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) [ 486.035199] binder: 16958:16971 unknown command 1484614904 [ 486.041140] binder: 16958:16971 ioctl c0306201 20000180 returned -22 [ 486.046893] binder: 16960:16970 ioctl c0306201 20000180 returned -22 [ 486.073454] binder_alloc: 16960: binder_alloc_buf, no vma 14:16:19 executing program 4: r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/fscreate\x00', 0x2, 0x0) write$binfmt_misc(r0, &(0x7f0000000040)={'syz1'}, 0x4) r1 = syz_open_dev$vbi(&(0x7f0000000080)='/dev/vbi#\x00', 0x1, 0x2) ioctl$VT_RESIZEX(r1, 0x560a, &(0x7f00000000c0)={0xffffffff80000000, 0x7f, 0x7, 0x8001, 0x7, 0x6}) creat(&(0x7f0000000100)='./file0\x00', 0x0) 14:16:19 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vcs\x00', 0x200000, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) 14:16:19 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$DRM_IOCTL_RES_CTX(r0, 0xc0106426, &(0x7f0000000080)={0x7, &(0x7f0000000040)=[{}, {}, {}, {0x0}, {}, {}, {}]}) ioctl$DRM_IOCTL_DMA(r1, 0xc0406429, &(0x7f00000001c0)={r2, 0xa, &(0x7f00000000c0)=[0x5, 0x1ff, 0x79, 0x10001, 0x200, 0x4, 0x10000, 0x6, 0x5, 0x4], &(0x7f0000000100)=[0x5, 0x5ab513fd, 0x4, 0xd31f, 0xfffffffffffffffc], 0x27, 0x3, 0x80, &(0x7f0000000140)=[0x5, 0xe000000000000000, 0x9], &(0x7f0000000180)=[0x1f, 0x5, 0x7c13]}) ioctl$VIDIOC_S_CROP(r1, 0x4014563c, &(0x7f0000000200)={0x7, {0x3, 0x7, 0x4000000b, 0x100000000}}) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) [ 486.169123] binder: 16984:16987 unknown command 0 [ 486.203361] binder: 16990:16992 unknown command 0 [ 486.205804] binder: 16984:16987 ioctl c0306201 20000180 returned -22 [ 486.227546] binder: 16990:16992 ioctl c0306201 20000040 returned -22 [ 486.254656] binder: 16990:16997 unknown command 0 [ 486.277362] binder: 16990:16997 ioctl c0306201 20000180 returned -22 [ 486.316388] binder: 16990:16992 unknown command 0 [ 486.321989] binder: 16990:16992 ioctl c0306201 20000040 returned -22 14:16:21 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) shutdown(r0, 0x0) recvmmsg(r0, &(0x7f0000002100)=[{{0x0, 0x0, 0x0}}], 0x3ffffffffffff5a, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) 14:16:21 executing program 4: r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/fscreate\x00', 0x2, 0x0) write$binfmt_misc(r0, &(0x7f0000000040)={'syz1'}, 0x4) fadvise64(r0, 0x0, 0x6, 0x0) creat(&(0x7f0000000100)='./file0\x00', 0x0) 14:16:21 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = syz_open_dev$vcsn(&(0x7f0000000080)='/dev/vcs#\x00', 0x0, 0x9c3) ioctl$SNDRV_TIMER_IOCTL_TREAD(r3, 0x40045402, &(0x7f00000000c0)=0x1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:16:21 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm_plock\x00', 0x800, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000280)={0xffffffffffffffff}, 0x13f, 0xf}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r1, &(0x7f0000000300)={0x5, 0x10, 0xfa00, {&(0x7f0000000080), r2}}, 0x18) r3 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r3, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) 14:16:21 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0x0, 0x800) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) setsockopt$nfc_llcp_NFC_LLCP_MIUX(r0, 0x118, 0x1, &(0x7f0000000080)=0xfffffffffffffffe, 0x4) 14:16:21 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/19, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x3}}, 0x0) 14:16:21 executing program 4: r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/fscreate\x00', 0x2, 0x0) r1 = accept$ax25(0xffffffffffffffff, &(0x7f0000000080)={{0x3, @null}, [@default, @remote, @null, @bcast, @default, @remote, @remote, @rose]}, &(0x7f0000000140)=0x48) setsockopt$sock_void(r1, 0x1, 0x1b, 0x0, 0x0) write$binfmt_misc(r0, &(0x7f0000000040)={'syz1'}, 0x4) creat(&(0x7f0000000100)='./file0\x00', 0x0) 14:16:21 executing program 0: openat$ptmx(0xffffffffffffff9c, 0x0, 0x60101, 0x0) write$FUSE_WRITE(0xffffffffffffffff, 0x0, 0x0) gettid() openat$vimc0(0xffffffffffffff9c, &(0x7f0000000140)='/dev/video0\x00', 0x2, 0x0) ioctl$VIDIOC_ENUM_FRAMESIZES(0xffffffffffffffff, 0xc02c564a, 0x0) r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/snapshot\x00', 0x20601, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$FUSE_CREATE_OPEN(r0, 0x0, 0x0) close(r0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000002c0)='TIPCv2\x00') sendmsg$TIPC_NL_SOCK_GET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x14041ba167ab41b}, 0xc, &(0x7f0000000300)={&(0x7f0000000680)={0xc0, r1, 0x4, 0x0, 0x25dfdbfb, {}, [@TIPC_NLA_NODE={0x8, 0x6, [@TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_LINK={0x7c, 0x4, [@TIPC_NLA_LINK_PROP={0x14, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x180000}]}, @TIPC_NLA_LINK_PROP={0x44, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}, @TIPC_NLA_PROP_MTU={0x8}]}, @TIPC_NLA_LINK_PROP={0xc, 0x7, [@TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x80000000}, @TIPC_NLA_MON_REF={0x8}]}, @TIPC_NLA_MON={0xc, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x7fffffff}]}]}, 0xc0}}, 0x4004080) sync() recvfrom$inet6(0xffffffffffffffff, &(0x7f0000000000)=""/110, 0x6e, 0x2, &(0x7f0000000080)={0xa, 0x0, 0x101, @remote, 0x1000}, 0x1c) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, 0x0, 0x0) ioctl$KVM_PPC_ALLOCATE_HTAB(0xffffffffffffffff, 0xc004aea7, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:16:21 executing program 5: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_rfcomm(0xffffffffffffffff, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) [ 487.779291] binder: 17006:17009 unknown command 0 [ 487.792253] binder: 17006:17009 ioctl c0306201 20000040 returned -22 [ 487.806279] binder: 17007:17016 unknown command 0 [ 487.811394] binder: 17007:17016 ioctl c0306201 20000180 returned -22 14:16:21 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_open_dev$cec(&(0x7f0000000040)='/dev/cec#\x00', 0x2, 0x2) ioctl$KVM_SET_LAPIC(r1, 0x4400ae8f, &(0x7f0000000580)={"fbc4c596048d217efa6c9b2597f502502ca1add40cc27e1e8dc25bed48f0583b825573a668f1785b2c619d7685d8d409462c6615277d6fa398a93895b95e63e9a236a8712d9d02ebc96dbac100a432881baa9c0248e76f2691560a2663a8a9d32cc842317255a60bb600981f12bc33b8418fdf49aa2e922c42d94cb69fddcba02e8fce0b0c291310e188ecc5f0057194af6af70d2cbad9bd9468e4ed96a73e9bddc0fba62ac850a4d83f678547466e3f00481dcc54c97ea4d63e9b3bba1233376c0470ce9e4f66a1e0a31b5899145b67d893d44a9a20e8a9f13db1a50efc4f330e3563f12430146d1737cba954d7ad2ab78785f1b91a4f8d7ad01b2334c7e994603e59f295d9ed0eaebb26e6c67e5861aa184f6c9a19229b646d75d19da992be59cf0d6d981954e16ac072bb72e60f8c81553cbf3fa2ad70a9490005a6a6b9ee9389681577056475745bf0a14221af48da428eb5b84e2084beaf0334bb8a3a0ebffb39878a1a624e9b0db381f547bd28833a86c8b45fae1da0a9b46cbdd9940b2b408c33e679db972582e230c1e79d39d9c80fd5f12a4350a8b6b00ec0c8a691b0ed05ba5936a8bd94ae13f7d9fc96b143776042cad60bd08f0c5816da190660045c4350db05bbd394480f58d0a7ba2883e780676545bb15458f0a7de80e3cd7449c32a45eb6cf49d46dd095c961821b242d6537196616a9bdaa31d8a97cf38bb0ce1acc63f5e54632e1d8e1425cb5a594fb6dd3048f9bb6a6540fc78c5906aa9f7c9e1547a88437dc0bdceeb29e523496e6d0ba93ab0ad766aef3caabd152a1da5e6216625999af4e106d3aba1d74d564e22fff9f114e797817a263a79898ab0c9fd89242dacd1bf15ad49b2abdda67b06dcf45490838f010f6fafc714e833f7df6e0eeba2cbada7e3d1f394491e3da189c8f25d0407082393c73f4160dbe6378b0b2f351c13b4cf04ea2c95c39139ed4769f83d0c37a86a8d39771e1c2ea272c6bd20ed248f0e3a6ee7e6e31fdade0feaf359c47e9b751f28d9078559d9e3255fb835aa3ec413ba95e5f377364b1b95a663c08fd5fdc1fd390006aecefe82430791f18bcf3d4ce9a6e96e199bb85ce1d93f3769421aa04c90c236a317c5ac1aca8dbe7c1de3e73c73835305175758eb0eaeb02d2616afad8f5eba719220e315747a158fb0a29604f1c30b2e7137f6934a101a4b1d513bdd4c4d88c1ffd349ffe68e1fff943c45b0c73ab65753189662b7144bd7c3436beda685e9eeaa2b183b26de281da0495bab61f91689d63237f43c6dffe8076649fa7cdb816cc91cf31ff5abd3f6daa82fe37f28b9378d5bcc197333bed0211bd74d47a680517f847c71fcabe5cab53fd004f5c32468f816b9e94e9456719fd897c178d675a0657809011c096d3d521b2c727e4b7d4c9fe544f4116c32aeb5300"}) fcntl$dupfd(r0, 0x0, r0) mkdirat(0xffffffffffffffff, &(0x7f0000000280)='./file0\x00', 0x10) r2 = open$dir(&(0x7f00004daff8)='./file0\x00', 0x0, 0x10) r3 = add_key$user(0x0, &(0x7f0000000380)={'syz', 0x3}, &(0x7f0000000400)="a154c0c8", 0x4, 0xfffffffffffffff9) keyctl$set_timeout(0xf, r3, 0x0) fsetxattr$trusted_overlay_redirect(r2, 0x0, 0x0, 0x0, 0x0) r4 = socket$inet6(0xa, 0x400000000001, 0x0) r5 = dup(r4) setsockopt$inet6_tcp_int(r4, 0x6, 0xa, &(0x7f0000000000)=0x81, 0x4) setsockopt$inet_tcp_TCP_CONGESTION(r5, 0x6, 0xd, &(0x7f0000000100)='lp\x00', 0x3) bind$inet6(r4, &(0x7f00000000c0)={0xa, 0x8000000004e20}, 0x1c) ioctl$BLKROTATIONAL(0xffffffffffffffff, 0x127e, 0x0) ioctl$UI_DEV_SETUP(r1, 0x405c5503, 0x0) sendto$inet6(r4, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getgid() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_int(r5, 0x6, 0x1b, &(0x7f0000000200)=0x5, 0x4) setsockopt$inet6_opts(r4, 0x29, 0x3b, &(0x7f0000000440)=@fragment={0x0, 0x0, 0x5}, 0x8) r6 = open(&(0x7f0000000040)='./bus\x00', 0x141042, 0x0) r7 = semget(0x2, 0x3, 0x412) semctl$SEM_INFO(r7, 0x1, 0x13, &(0x7f0000000480)=""/194) ioctl$SNDRV_TIMER_IOCTL_GSTATUS(r6, 0xc0505405, &(0x7f0000000140)={{0x1, 0x2, 0x9, 0x2, 0x555}, 0xfa6, 0x2, 0x3}) ioctl$KVM_S390_UCAS_MAP(r5, 0x4018ae50, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000300)={0xa, 0x4e24, 0x7, @local, 0x8}, 0x1c) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000080)=0x4) ioctl$TIOCMBIC(r6, 0x5417, &(0x7f0000000240)=0x6) fsetxattr$security_ima(r6, &(0x7f00000002c0)='security.ima\x00', &(0x7f0000000340)=@sha1={0x1, "28d0493621dfee83f00d42d3460d389df3ad9aef"}, 0x15, 0x1) [ 487.878938] binder: BINDER_SET_CONTEXT_MGR already set [ 487.885646] binder: 17007:17016 ioctl 40046207 0 returned -16 [ 487.907584] binder: 17007:17031 unknown command 0 14:16:21 executing program 4: r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/fscreate\x00', 0x2, 0x0) write$binfmt_misc(r0, &(0x7f0000000040)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x4) creat(&(0x7f0000000100)='./file0\x00', 0x0) [ 487.955239] binder: 17007:17031 ioctl c0306201 20000180 returned -22 14:16:21 executing program 1: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/snapshot\x00', 0x402, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000400)={0x0, @local, @empty}, &(0x7f0000000440)=0xc) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000004c0)=r1) r2 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r3 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x101, 0x503080) ioctl$sock_bt_cmtp_CMTPGETCONNINFO(r3, 0x800443d3, &(0x7f00000000c0)={{0x3, 0x3f, 0x0, 0xb0, 0x1, 0x14}, 0xffffffff80000000, 0x7, 0x9}) r4 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_SET_MAX_THREADS(r2, 0x40046205, &(0x7f0000000080)=0xb587) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r5 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="046a68e25f6da78a295e96a0f937c5be2cb1e4be61da7b930e8f9f27e64c94ccbb26062af5345e7f00b6d1d2a5355e33d0c6cf27d677a833a24c7e0613106e75783822b654d3fb64357a065b2b73fdc8ec82013d3d08293298629258260a04cca9ba358e0e7fc753b43fee42d9788d08a099de1b5edb20ac62216cc1b98da304307d94f739684e8199552c18a49a9ba07f27fa7207da6a6f0d0ac6fbcaaf9d52207c50f2d2247cfcc1ff6233b091adc77a", @ANYRES64=r5], 0x0, 0x0, 0x0}) mmap(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1000002, 0x4000050, r3, 0x0) r6 = openat$qat_adf_ctl(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(r3, 0xc0206434, &(0x7f0000000100)={0x4, 0x0, 0x10001, 0x8}) ioctl$DRM_IOCTL_SG_FREE(r6, 0x40106439, &(0x7f0000000280)={0x7, r7}) ioctl$sock_x25_SIOCADDRT(r6, 0x890b, &(0x7f00000007c0)={@remote={[], 0x3}, 0x3, 'ip6erspan0\x00'}) ioctl$VIDIOC_QUERY_EXT_CTRL(r6, 0xc0e85667, &(0x7f00000002c0)={0x80000000, 0xd, "c86e60b0a28a907f853b79a7479a77fc10cc96826317def0c865d78f6d6e050e", 0x6, 0xffffffffffff3841, 0x1, 0x9, 0x3, 0x6, 0x4, 0x8, [0x8, 0x10001, 0xfffffffffffffffe, 0x9ee]}) [ 488.025238] binder: 17024:17027 unknown command 0 [ 488.031340] binder: 17024:17027 ioctl c0306201 20000180 returned -22 14:16:23 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) shutdown(r0, 0x0) recvmmsg(r0, &(0x7f0000002100)=[{{0x0, 0x0, 0x0}}], 0x3ffffffffffff5a, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) 14:16:23 executing program 4: r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/fscreate\x00', 0x2, 0x0) fsetxattr$security_selinux(r0, &(0x7f0000000080)='security.selinux\x00', &(0x7f00000000c0)='system_u:object_r:random_device_t:s0\x00', 0x25, 0x3) memfd_create(&(0x7f0000000040)='self#em0$bdev^vboxnet0\x00', 0x3) creat(&(0x7f0000000100)='./file0\x00', 0x0) 14:16:23 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = dup2(r1, r0) r3 = syz_open_dev$vcsa(&(0x7f0000000180)='/dev/vcsa#\x00', 0x2c, 0x4000) ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f00000001c0)={0x0, &(0x7f0000000000), 0xa, r3, 0xf}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="00634040566b0226b87a445f33cb1839a0d8f5589688676c30f6a574997ed56b49da0506d03ddc6e1f475388158f378e57cd284676b8bba1a3e135a31a207e659573159c6121836d68"], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) syz_open_dev$usb(&(0x7f0000000080)='/dev/bus/usb/00#/00#\x00', 0xffff, 0xc82316daf5e20f50) 14:16:23 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x200000, 0x0) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1b, &(0x7f00000002c0)={0x0, 0x65, "27550f685f4a646b8de7c0b6a69a219d1b06ebc6a6496a6fd652ae3c1238b86b078152848302ed5d13ce6691ea60ca29e4d999ab17de32b97c0dde7211062958802767c18542def1a798b36a1fef33da055468ca0da2ebd158b03417be6b78bb160c5738f0"}, &(0x7f0000000340)=0x6d) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r2, 0x84, 0xf, &(0x7f0000000380)={r3, @in6={{0xa, 0x4e23, 0x2, @mcast2, 0xb83}}, 0x81, 0x7ff, 0x6, 0x0, 0x7fff}, &(0x7f0000000440)=0x98) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r4 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r4}], 0x0, 0x0, 0x0}) r5 = accept$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @loopback}, &(0x7f00000000c0)=0x10) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000100)={0x0, 0x7ff, 0x775b}, &(0x7f00000001c0)=0x8) getsockopt$inet_sctp_SCTP_CONTEXT(r5, 0x84, 0x11, &(0x7f0000000200)={r6, 0x6}, &(0x7f0000000240)=0x8) set_tid_address(&(0x7f00000004c0)) 14:16:23 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'v&\x1e\xb3\xec\x00\x00\x00\x00\x00\xaa\x03\x00', 0x43732ed398416f9a}) r1 = socket$nl_route(0x10, 0x3, 0x0) pread64(r0, &(0x7f0000000000)=""/39, 0x74, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000010005fba00"/19, @ANYRES32=0x0, @ANYBLOB="030000000000000008001b000000000027832c19ffe6a3f48d73bc14056d692e5f8c2470550ffbfe68bdf895996e8c2c6e69d65db46c2df2a1fbffd6b4332ba82aef4d660170d88c4177984bb61a55d05f945e046946d0edce3c8835dd25a2965b"], 0x3}}, 0x0) 14:16:23 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) prctl$PR_SET_TSC(0x1a, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) prctl$PR_SET_SECUREBITS(0x1c, 0x10) renameat2(r1, &(0x7f0000000040)='./file0\x00', r1, &(0x7f0000000080)='./file0\x00', 0x4) ioctl$TIOCCONS(r1, 0x541d) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) 14:16:23 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(r1, 0x80045700, &(0x7f0000000080)) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2, 0x0, 0x0, 0xb}}, 0xa) connect$rds(r1, &(0x7f00000001c0)={0x2, 0x4e24, @loopback}, 0x10) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000040)={0x3, 0x2, 0x0, 0x2000, &(0x7f0000ffb000/0x2000)=nil}) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000100)={0xffffffffffffffff}, 0x106, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r1, &(0x7f0000000180)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000000c0), r2, 0x0, 0x1, 0x4}}, 0x20) 14:16:23 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_aout(r2, &(0x7f00000004c0)={{0x108, 0x198, 0x8, 0x202, 0x41, 0x4, 0x2c3, 0x2}, "cf7a35728300426c5a11f44dcb884464fc8ff4c96c09522595dc15e39c85a0137306600578450c126098a0e8967a11966eb8eb6d4046cfebbb55264fe6b7aa5c40433862e9859339dbe7100a61157ea57f19c4c17ff2dd0c6958b47b4f623b66d2e1ceafc6907de5cc3c489bf8dc3eb54b91e028b325ce119682334f0128833bb8bbba8210a1d07a016589873e21faf369512115df7f2cd5320e9b1cb180739bc111f8abdcfa01f495216225c0f3d5cf931fb837eeee807fa1f9a8a106e45713a970440d19d4e8200046ba46b6098690db1c4a90940592951761b8656322e2189dd35c1d9279973d655e5971029f3cbadaf3a2b36b60cf20b2f9206f06dcc6f6cfd30527e9cf2a08dccfda7fb83af6f382478e92c2d368b4bd6cfd6439fa9815c33c09670c931da9b1d4ab70da98d0111aaf43a98712b6e075d62864d88f716ac2858bf4add7a162c6b8ae11242f2754c5e15dd0984c9fce8eb6e230c58a453b049405c95b6631eb0c0d162783e53dc41a01a39f4a745e70f08cbb96a52fa1cef6a93f5fbcaa7b3a13bd3bae93605c4f54f25c9377693858e16e957f2cb2ba79c8d49afb1be65069b2a02de270399603d34f68c6d42271baaf36976192e3952bfee6a088cc91cfb523bb1a26079b586daf0a91c87b82d9460ccb5c89a90f92319e234a29f603aeec4143b918b28b4374235d598b1838aa5632f79be9f6485a7d285b8f371f99d371662003e6cacdf20105d540ecbdf33a2565d7dea9d21633101abbe345a93fd2d1bf7fc2255fa6bbc48f1f7608dc6a12ca129c6c2033a68e44f16ff367d8488e2e0b68586f5835f2480446a463fe6b4ba56b164dd49499c8f6cefb53e0d0dab9f9df8204aeb909ef41cbf95d71d2ad8cc7c822f0b2ac23f8b0ca7a061ce45786bf0990745210b7c61087e1167fa58c96378f390c21663ebc9c928d5445180ba3133ff178f794aa583a928d951aeef8f2bac2661b7c45aba068e5a2fe2f5751083ef6f8d2903dd199e1bddf0e54ad9aa36538570a1b4e8bd71029698da2694bfcdbac95539aaba302fb82c03929a922d9e0fadc5f6b99262704861c0836861a2d3f78951d5cddcc18ed9ce0937e259f19746a0fc20acb22e09b714ae35ac1a5143b6b1f1e95b359a60e2c644c774a3bd5e93277e5254742be5897eb3c098274a878286b0d6ebf7060683894225ec7a76840282cd85f4b1e2cc21b096e8e33297427744695060f8a8c4b3d5c8d16b4398f7666dde63da8511eb37ed4616a05ef573d9b7392ca4b7c34135f0e238e2f9a37fc9531f54ce18121889513d5c35747ef5cef3d4a30518d93827eef5dec92b8d932c922223e82d9e65cce9756f18120e3fec7d88e9f61836fbb69894149a4b5c1f8cab28e77bfdfa08f8afc3ecbfe29d4b62373069e7cabda2b0385fc050ba1a4de4a4115804c661dcbd01dbc540ff98c8b8127bfcfa5302afa53efe3dc59f8d4dd7610f6b04073f817d33c685f10f5553d2f8535caa5249090a602125edc9aec2107c7a9c7a4468a4432778e437bf828162cec9098b18ab6e2b6f17755412dcbda6fc45404b719ed88c4c8cc42f89a18cf612c13a32d3d1f32985cf62b816d4ed9fe53f0681c429ba70720a23655860b4ef6280246e36416aed2f4dd3ed417ba69da0893c670d9c126825375fcd6bdc94365eea14d81d3ca25cf3a77d42fa2ed5b733d12dfc91a83617dd2d02ec74bb2b9b4cdd0dc47711bb1562c09299f0de7ab20b88a3ac25a333a3570a526a02b74cb893e049f2e86ef2771a07ce458956164f02f956cdc38476db858cb1510afb5e4d0c339aa2aa4a0b0596637aa4c01b44ef19ca4047a45980f9d521e3a2d6136cbd648a13381d954b5f6e29116fab35b8d9439a184557d34b9f933a47caad97698b65a62556ba7420c046ca0386654d822f28c572abfd88e3cfebf27fe6f6f6c44708d2131d0cf0789685746f1e2120f83de2436dec60dd9907c7bb6b7d196a8baf91ce8a4c1c251c80c5398ec722a6f3dc6dc4e4988a1bdae9a0efd60b27d8fe3d4e7765236d142fabba5b23da43ffef26f3d4eec6cae96e52f3dc8aafda3c961a1094321695666c1be0ae8846856c218969b0b792e66249a85b7960e19f64b821fb382d5b7f76e934859fed4c1d82709fc7f8be520500f853a4664d32b47f250a13b60e7fa70bac55c16445dceeae17f06f202bb8311016f47b057b8cb30007b26803c0687ea000299df9bc3efef5a007d65bf61122269deb234ae8f3fcf697e019bd81d2f30a9383ff638b01e4eb7c1daccdaaebb8872122ac0c0b032f2df5a49b25bfc5ae9d3e22be29b80f6444ce254663d61a4c8e6dbc6d1b756e7374f3e0914eedc02569d7f938fda9352bdb7b082a3e48cea4b07843f9a9713e59a419c295674ffd43f84739f12643f8d7d58ffa729eb2e6c235a06c287e8aad8bd0f601f82e07b2a8be02e4225684a174c7dc8b49272606405fe6de261413e0b73a5b84199e2eedd4415f68f63f66b26d360258ab37af3af791ef1e7bd55d5928b1b8df89ecc0db9ea76debfb11a937619a2668eb41a2a017ed138972d440ca881a4964dd7cf4a2d9fc2579b51d9f7c6b2dc2133b1bbfe61bb2436723f063bee63bae43f8104eee7024ada7f2f190625a03359ad9707b555779d62900a0c4860d3328785137605525c38cb78616b0db2e641d1f7eeb6d642f2f970354a1cc9e22c0f232bf599bf3bf87edcbd57e7b20942c5e478aa98435a370f97b2380b856dc9566e0ae4f84f332c580cf0dfd3fd67bebd3328818033d7637b8232c710d4aef9c2c88cc85abcfd73adc35e0979cabde740ee845661a689031c5caaf9dc3ae0c00777e59c363322b5cd0ac17a4eb4687bb06c958fe36a909bf2af058dc3a8e8b5b7350d0106b0c5f174d99699faf915907e8aca468a38bb50d0a51c875c18373f7a446fd1d58481683f904280b1ac636a993b315850fdb0513a480f315ff2ed1135fcd4b68772f6cf4f6d8f7114c713166db763ca66253ff6878421e303454d18f1d5950e7e0225103dfa78d567da334252397a87cffa1654cc807bd01a363eb262675133f43ec043f59250d00d0cb93d2d8c88eb56ace1a4d731116ce7278273c0c77f50c7c87303704e8deae92ad4248a313ae593b4d8a63e83cdb19005ef461806e5847edb1dab45a765ce480618fbdc162eca2aff85e44e7494155f60010c254a03723264fc2682b0ec858c2ef89770891ac929207f2a390ca5588d334ea917dac3098fb7aa140e92c169cc502640b55e5ef92f72d41ff736617e44d2b625f19d0daac2b5c49b7e12ca85d17465b4072fd6e1323a897fd621f283bebd1f0923dbd413472e41c648c9ab059d85c64e37bfaf4eaa36ec14c0372ae447a6532fa365552fd72010b5d446363c77795ef07e7f8aaf388080f749d427bde10f5bd7d89f1049d1fc99d9ab67d155c7e0e81ad395190c3156fae57968d1560cfc6f74216d0d8cd93eae2b7f57612a720dc8b6cd6e5e87051d3f106500589a3349fd07ac1045b0eae6111072b7e438bf42ec31180ff59c5ac0cd161c7af181982a33271e070cc88965f804c10ccc7bc869a2c7f09ef49cb68c9c0cbe34e8f80af9f74e067b6e13185d4cd8362aec7855f5f20bdd3f5c433d671a26974159d23d7b49e8094227b9b52de681e2563fdb4901b9f71475f36e514bb8e1f8290ca6bfb1346c2ceccc0c1554ef5789979b40372738d075b86bb77ed7c934754e566eae853b7e8344c1b5ff6f2760ee57d025de5d37d1b96eace0689370e05bf1cd9355aeb8d834ed516033b9e8bf878b55d969457af5120af76047824ed422bb993148b5f21e17a84ca07f28254a5209dae51e2012dd2b843774b2183436b0a03a646fc025b98b627cdc892b2e7c0addd5c074678c5040269814aa013add91ed88ff6ffdf44e986942e9db1b04c3a96c4bff8d526860b3a7f363756b0ad035d378b3a34adc638e70eebb642a8f0c5b4c1fd222de1e8280406002c7f0048b5b03dc7c7e453b0b12c3c4da1f5a125fcdfc10a2d8567726ff370c52b83b1234f5766c9f3b4b0ddf4217e826d24e723b91e4ae99d5b749a5f646b6f62d957f29642ef0297486d14fab38c2fb6e29ecd8c737b823bed4c6f0dde13df128d38e1f9750d615f89583286ec7196e962d2eeff325769f07ba63c0070acf839abd39bee07a0f1396894e9ed1e71e3f8e8848979dcdc137b70f0429ddc6f7f7d66c3de6817dee228c714fb64281b40f95c2ce097ce7ddb1ddcdb0a3391611b55c09227751329ab7cfd03f64f05070691044dae645624350df5818c8e4b2757440d6017e2b7ac357fbfdc689cdc134cca124968a2797fdebc16b00a9d1ecf7f4d9a43bf40cb4e6531c1fe5ca92c5f14be8d8017643403c9bbf6a76531a075f1f9bec712fdabf7ea8cc0b7d962e0c0095b7b13fd341c1f23408de12fe7d36b39fb26f5a30707adcb893cc064f21655acf537a6db55451a7461e6692ae8f077c0062884f84192009f69e08bdcf32049bf31e0e557175d72b1f16b28d979e61356ab94e0f2718ffcc35513c278fadd417e5d88914c2567cba473ace5ac3573c9e9d1758bdbee5f33c6fbdf28d876d9f7cf666fecc2c3e52a2cc7fc3430924ef621da205a229fa4a7a326096a6e5918b76456f45c9aa02a60b04fc4ac5526fe8b1b7ec5f18fca1df948b06d17630713052f59d652153870560e1780edaf20e0536e6e5d65a472b61fb6dace6258c0b4ec9801f072046d2e2745bbaa87025f12ad99b4d22b69264cc3fab99b3b80fbd5df13b3a9fb01a9b25be0bfa356c313d21707500c28175a6ba75957fe441a16e6cf218c9427bb67c904dff97b14f8690826721c05706c9b930ce258c5a71a57153e19b5a75e81c812ac3e24c162fbd073f56542f30434be7e176676a2492cfae878808b82b8aa00bc798a2ed9ae11dd663ca457a58b378f147a62ecd0b1d05fb1a370dc6043084f69e16fb4483e36a69ab90a5caf51d647c14679b6202ecb1d03d5df84bd1f4964f70e981edc357aef0610f1002a804a92411b9a18d4ae996398d27404035f6b5ca63164b9a0afa54f668272961da4ca3d17527ed52c7c41d73c215cba8b4e0d62e0813d93b5d8a5ea21d04268a417e72786c99432bf90d60766194eae02809fbf5a71c1f03b27c9cc133d231113c1ddb955e7dba09c1be3af372ee1199974ca80ca4a536007f8e138e6661cbbc0537886a62e3691f7d7ce14c81cd4ffac1ce4a09f5cc8d8f03ae8cadd1737c88cca4c3dcffd390edcaac5ec907d50e056e04840dda167e467c230f0662263b77135cfa1be8802b6ef3ea038330321dbfe70e07c9998dc49460baad0c781a9a9515884aa50094b5040153166f049fafb31f66933ba8347e4def998a1306a817475af80d961ba63abd145204820746e89a166b5a26de59f470e80d40d3d72a3e98fef3dca907d2d33d289168f3735f8e272e068bf57342a7b095d0e90cd6e0b8d04bddda21a93b736fe1421bea1962736c53eb81198471958ef14b7c482719814af925abda893322f179e2edcd14286f97328fa4e1f640f5c8e3b3cc402958d4e8f3de780a0812521d250c996157e781d2dd4b0a6adebd9e118fa36d0c261d1b72b054321649a1654148136bea9e0dad1c38e640e99a0bcec55afcea7f397dd5d186e4ab3e826f9563871e927cf87af07df3c9d88a68e717ddbd7a7b85ea52f275c5b1c73897be191e06052b01ee13750f7e320a7468e2e0cc33bf5b55c558cee0f76a4e75b1", [[], [], [], [], [], [], [], [], [], []]}, 0x1a20) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) [ 489.656945] binder: 17056:17062 ioctl 4040ae79 200001c0 returned -22 [ 489.676489] binder: 17058:17064 unknown command 0 [ 489.691326] binder: 17058:17064 ioctl c0306201 20000180 returned -22 14:16:23 executing program 4: r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) write$binfmt_misc(r0, &(0x7f0000000040)={'syz1'}, 0x4) creat(&(0x7f0000000100)='./file0\x00', 0x0) [ 489.750572] binder: 17058:17064 unknown command 0 [ 489.757288] binder: 17058:17064 ioctl c0306201 20000180 returned -22 14:16:23 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xfffffffffffffffb, 0x10001, 0x2, 0xfffffffffffffffd, 0x0, 0x200000000000}}, 0xa) 14:16:23 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x2000000000000) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) ioctl$VIDIOC_QUERYMENU(r2, 0xc02c5625, &(0x7f00000001c0)={0x100000000, 0x8, @name="57a26d45e664fff1926bacefea3580a2156872c8e13b0774098e19220ffe7950"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r4 = syz_open_dev$radio(&(0x7f0000000080)='/dev/radio#\x00', 0x0, 0x2) ioctl$SNDRV_SEQ_IOCTL_CLIENT_ID(r4, 0x80045301, &(0x7f00000000c0)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r3}], 0x0, 0x0, 0x0}) [ 489.792465] binder: 17070:17074 unknown command 0 [ 489.797588] binder: 17070:17074 ioctl c0306201 20000180 returned -22 14:16:23 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x802) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="006321d5c982ea7ac00216572192fb13831829834592829f5d0fa4a99d47a1276ace2b89c5e12c4b0b2b2836c781327dfa29641c70fd1093d225ffdf7788850a6f6759b640afef0ef1d4ce2ceccdd956f43e8a49e4d6611a09e392bd"], 0x0, 0x0, 0x0}) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x0, 0x0) connect$rxrpc(r2, &(0x7f0000000200)=@in6={0x21, 0x4, 0x2, 0x1c, {0xa, 0x4e21, 0x9, @mcast1, 0x7}}, 0x24) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = getpgrp(0xffffffffffffffff) sched_getaffinity(r4, 0xfffffc7a, &(0x7f0000000240)) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) [ 489.893909] binder: 17088:17090 unknown command 0 [ 489.912720] binder: 17088:17090 ioctl c0306201 20000180 returned -22 [ 489.928427] binder: 17092:17094 unknown command -719232256 [ 489.943840] binder: 17088:17096 unknown command 0 [ 489.947573] binder: 17092:17094 ioctl c0306201 20000040 returned -22 [ 489.954278] binder: 17088:17096 ioctl c0306201 20000180 returned -22 [ 489.976285] binder: 17092:17094 unknown command 0 [ 489.988232] binder: 17092:17094 ioctl c0306201 20000180 returned -22 14:16:25 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) shutdown(r1, 0x0) recvmmsg(r1, &(0x7f0000002100)=[{{0x0, 0x0, 0x0}}], 0x3ffffffffffff5a, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) 14:16:25 executing program 4: r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/thread-self/attr/fsc\xc4eate\x00\xbdR\x18VF\xec\xe2^\xa4x\x8e\x1aoM\x91\xe9\xf41>\xab6S&\xfc@\xb0\x9ak\xb9\x97D\xff[\xcfv\x9f\xbb(\x10%\\$\xde_U\x8c\xb8\xd0\xad\x06\x9d\xf7\xd4\xc6-\x9bB/', 0x2, 0x0) write$binfmt_misc(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="73799e0010bb3d69ac6864f9e742ddf8fe6312c04e904ed0ad8befa91fe9944174ad2b8273abb5c84bce4ea159c06110e04d72362f7e0354549870ee95b4f81b91d7eb854f25816921916744f4c3e02e14c1bc433f4911a53900000000"], 0x4) r1 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x9, 0x0) ioctl$CAPI_SET_FLAGS(r1, 0x80044324, &(0x7f0000000040)) creat(&(0x7f0000000100)='./file0\x00', 0x0) 14:16:25 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_open_dev$mouse(&(0x7f0000000100)='/dev/input/mouse#\x00', 0xa154, 0x80000) ioctl$EVIOCGABS0(r1, 0x80184540, &(0x7f0000000140)=""/118) r2 = fcntl$dupfd(r0, 0x0, r0) r3 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dsp\x00', 0x0, 0x0) r4 = add_key$keyring(&(0x7f0000000280)='keyring\x00', &(0x7f00000002c0)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffb) keyctl$set_timeout(0xf, r4, 0x2) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r3, 0x40505412, &(0x7f0000000080)={0x2, 0xdcb, 0x3, 0x0, 0x4}) getsockopt$IP_VS_SO_GET_SERVICE(r0, 0x0, 0x483, &(0x7f00000001c0), &(0x7f0000000240)=0x68) bind$bt_rfcomm(r2, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) 14:16:25 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r2 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r2}], 0x0, 0x0, 0x0}) 14:16:25 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r2 = syz_open_dev$dspn(&(0x7f0000000100)='/dev/dsp#\x00', 0x5, 0x80080) ioctl$VIDIOC_CROPCAP(r2, 0xc02c563a, &(0x7f0000000380)={0xb, {0x80000001, 0x4b7, 0x7249, 0x1ff}, {0x5, 0x0, 0xbb}, {0x1, 0x702efcd7}}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)) r3 = syz_open_dev$sndpcmc(&(0x7f0000000080)='/dev/snd/pcmC#D#c\x00', 0x4000000020004, 0x101200) r4 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r4, 0x0, 0x87, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) shutdown(r4, 0x1) ioctl$EVIOCGREP(r3, 0x80084503, &(0x7f00000001c0)=""/118) r5 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/net/ipv4/vs/backup_only\x00', 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0xc, 0x0, &(0x7f00000003c0)=[@free_buffer], 0x0, 0x0, 0x0}) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000280)='TIPCv2\x00') sendmsg$TIPC_NL_MON_SET(r5, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000300)={&(0x7f00000004c0)={0x24c, r6, 0x10, 0x70bd2d, 0x25dfdbff, {}, [@TIPC_NLA_MEDIA={0xc0, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x54, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7fffffff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1ff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x10000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9549}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xc}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80000001}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffe}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}]}, @TIPC_NLA_LINK={0x48, 0x4, [@TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x24, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}]}]}, @TIPC_NLA_MON={0x24, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0xc20}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x2}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x5}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xffffffffffff8001}]}, @TIPC_NLA_MON={0x2c, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x3}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x5}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x1}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}]}, @TIPC_NLA_BEARER={0xac, 0x1, [@TIPC_NLA_BEARER_PROP={0xc, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x401}]}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e20, @multicast2}}, {0x14, 0x2, @in={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x1, 0x0}}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'ib', 0x3a, 'bcsf0\x00'}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1ff}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xff}, @TIPC_NLA_BEARER_PROP={0x14, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}]}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'eth', 0x3a, 'lapb0\x00'}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'eth', 0x3a, 'irlan0\x00'}}]}, @TIPC_NLA_SOCK={0x34, 0x2, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x96}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x2}]}]}, 0x24c}, 0x1, 0x0, 0x0, 0x4000001}, 0x20044805) 14:16:25 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r2, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r2, 0x29, 0x30, &(0x7f0000d4b000)=ANY=[@ANYBLOB="01000000000000000a00000000000000ff010000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000a00000000000000ff02000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff0100000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e2ffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e0000000000000000000000000000000000000000000000000000000000a00000000000000ff02000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff010000000000000000000000000001000000000000000000000000000000000000000000000000000000000400"/784], 0x310) setsockopt$inet6_MCAST_MSFILTER(r2, 0x29, 0x30, &(0x7f0000000000)={0x1, {{0xa, 0x0, 0x0, @mcast1}}}, 0x90) r3 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r3, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) 14:16:25 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vcs\x00', 0x7fd, 0x0) ioctl$VIDIOC_QUERYMENU(r2, 0xc02c5625, &(0x7f00000001c0)={0xd5, 0xffffffffffffff00, @name="e88b50fa122f92b5d1833a648a3ba19b3f737b4e335ce4c8bcf91cc9a0575c9a"}) ioctl$CAPI_GET_ERRCODE(r2, 0x80024321, &(0x7f00000000c0)) ioctl$FITRIM(r0, 0xc0185879, &(0x7f0000000100)={0x10000, 0x3, 0xe285}) r3 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r3}], 0x0, 0x0, 0x0}) 14:16:25 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r2, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r2, 0x29, 0x30, &(0x7f0000d4b000)=ANY=[@ANYBLOB="01000000000000000a00000000000000ff010000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000a00000000000000ff02000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff0100000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e2ffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e0000000000000000000000000000000000000000000000000000000000a00000000000000ff02000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff010000000000000000000000000001000000000000000000000000000000000000000000000000000000000400"/784], 0x310) setsockopt$inet6_MCAST_MSFILTER(r2, 0x29, 0x30, &(0x7f0000000000)={0x1, {{0xa, 0x0, 0x0, @mcast1}}}, 0x90) r3 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r3, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) 14:16:25 executing program 4: r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/fscreate\x00', 0x2, 0x0) pipe(&(0x7f0000000080)) write$binfmt_misc(r0, &(0x7f0000000040)={'syz1'}, 0x4) creat(&(0x7f0000000100)='./file0\x00', 0x0) lseek(r0, 0x0, 0x2) 14:16:25 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vga_arbiter\x00', 0x20840, 0x0) write$cgroup_int(r3, &(0x7f00000000c0)=0x7, 0x12) setsockopt$TIPC_IMPORTANCE(r3, 0x10f, 0x7f, &(0x7f0000000100)=0xd0, 0x4) [ 491.591276] binder: 17118:17126 ioctl c0185879 20000100 returned -22 [ 491.608166] binder: 17125:17129 unknown command 0 [ 491.625525] binder: 17118:17126 unknown command 0 14:16:25 executing program 4: r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/fscreate\x00', 0x2, 0x0) write$binfmt_misc(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="7379303acb9d36867e2030d96450071bbbec22cf6e19426b3fdcb77a"], 0x4) r1 = creat(&(0x7f0000000100)='./file0\x00', 0x0) accept$nfc_llcp(r1, &(0x7f0000000140), &(0x7f0000000040)=0x60) 14:16:25 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2, 0xfffffffffffffffc}, 0xfffffffffffffffe}, 0xa) [ 491.643834] binder: 17125:17129 ioctl c0306201 20000180 returned -22 [ 491.679215] binder: 17118:17126 ioctl c0306201 20000180 returned -22 [ 491.711001] binder: 17118:17137 ioctl c0185879 20000100 returned -22 [ 491.720192] SELinux: Context sy0: is not valid (left unmapped). [ 491.731712] binder: 17118:17137 unknown command 0 [ 491.742736] binder: 17118:17137 ioctl c0306201 20000180 returned -22 14:16:26 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) shutdown(r1, 0x0) recvmmsg(r1, &(0x7f0000002100)=[{{0x0, 0x0, 0x0}}], 0x3ffffffffffff5a, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) 14:16:26 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r2, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r2, 0x29, 0x30, &(0x7f0000d4b000)=ANY=[@ANYBLOB="01000000000000000a00000000000000ff010000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000a00000000000000ff02000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff0100000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e2ffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e0000000000000000000000000000000000000000000000000000000000a00000000000000ff02000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff010000000000000000000000000001000000000000000000000000000000000000000000000000000000000400"/784], 0x310) setsockopt$inet6_MCAST_MSFILTER(r2, 0x29, 0x30, &(0x7f0000000000)={0x1, {{0xa, 0x0, 0x0, @mcast1}}}, 0x90) r3 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r3, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) 14:16:26 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) openat$ashmem(0xffffffffffffff9c, &(0x7f0000b4508a)='/dev/ashmem\x00', 0x0, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000100)='/dev/dri/card#\x00', 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='cpuset.effective_mems\x00', 0x0, 0x0) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000200)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_RESET_STATS(r3, &(0x7f0000000440)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x42000}, 0xc, &(0x7f0000000400)={&(0x7f0000000500)=ANY=[@ANYBLOB="c0010000", @ANYRES16=r4, @ANYBLOB="00042dbd7000fbdbdf250a0000001c000200080002007f000000080002000010000004000400040004000c0006000400020004000200e80005000c000200080003001db200001c000000000008000300d2000000080004000600000008000100696200005400020008000300090000000800040000010000080001000f000000080001000a00000008000300c8ab0000080001001800000008000300ff030000080004006c080000080004000001000008000200090000002c0002499dc700080004000104000008000400ffffff7f080003000000000008000300ffffff7f080001001c0000002c00020008000400514600000800010016000000080001000700000008000200ff0f000008000200030000001c000700080002001c000000080003000100040008000300010000000c00010073797a30000000000c000700080002003c0000002c00070008000400ff7f000008000300ffffff7f08000400ff0700000800020000000000080002000900000038000200040086d2f054040008000100ffffffff0400040008000100000001000800020001800000040004000400040008000200ffb5339bfe6ea0ffc282ad64f2ce1431b75400"/453], 0x1c0}, 0x1, 0x0, 0x0, 0x20000004}, 0x20000810) ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(0xffffffffffffffff, 0x40505330, &(0x7f0000000040)={{}, {0x4}, 0x800000000008, 0x1}) openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ppp\x00', 0x0, 0x0) ioctl(r2, 0x22, &(0x7f0000000500)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2103001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x3) keyctl$join(0x1, 0x0) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000080)={'syz'}, &(0x7f00000000c0)='}\x00', 0x0) r5 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r5, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r5, 0x6, 0xd, &(0x7f0000000140)='veno\x00', 0x5) ioctl$DRM_IOCTL_AGP_ALLOC(r2, 0xc0206434, &(0x7f0000001580)={0x3, 0x0, 0x3, 0x3}) ioctl$DRM_IOCTL_SG_ALLOC(r2, 0xc0106438, &(0x7f00000015c0)={0x5, r6}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r3, 0xc00c642e, &(0x7f0000000480)={0x0, 0x80000, r3}) ioctl$DRM_IOCTL_GEM_OPEN(r2, 0xc010640b, &(0x7f00000004c0)={0x0, r7, 0x1}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r2, 0xc00c642e, &(0x7f0000001540)={r8, 0x0, r2}) ioctl$sock_inet6_tcp_SIOCINQ(r5, 0x541b, &(0x7f0000000000)) sendmmsg(r5, &(0x7f00000092c0), 0x800010b, 0x18) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r9, 0x8912, 0x400200) 14:16:26 executing program 4: r0 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/fscreate\x00', 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f00000002c0)='/dev/input/mice\x00', 0x0, 0x880) recvfrom$x25(r1, &(0x7f0000000300)=""/122, 0x7a, 0xaee9aa45feee95f6, &(0x7f0000000380)={0x9, @null=' \x00'}, 0x12) write$binfmt_misc(r0, &(0x7f0000000040)={'syz1'}, 0x4) creat(&(0x7f0000000100)='./file0\x00', 0x0) syz_mount_image$reiserfs(&(0x7f0000000080)='reiserfs\x00', &(0x7f00000000c0)='./file0\x00', 0x6, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000140)="f0eb81c7f02f12da764d4794431744b5791af297b6cb063802d577bd0b7fc2a6ed7d31cad96fa7e73ff79ebd38afd9b0fa06e3d0b2117b9b833bc9bba2102222f5433fd5c42f1acee86dc8c60733d7b381c06db2b2f67fe9b9ccf6962f484635157e", 0x62, 0x8}], 0x8000, &(0x7f0000000200)={[{@balloc_test4='block-allocator=test4'}, {@usrjquota='usrjquota'}, {@resize={'resize', 0x3d, 0x6016}}, {@noattrs='noattrs'}, {@errors_continue='errors=continue'}, {@tails_off='tails=off'}], [{@fscontext={'fscontext', 0x3d, 'system_u'}}, {@smackfshat={'smackfshat', 0x3d, 'syz1'}}, {@defcontext={'defcontext', 0x3d, 'unconfined_u'}}]}) 14:16:26 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) ioctl$ASHMEM_SET_NAME(r1, 0x41007701, &(0x7f0000000040)='+bdevwlan0wlan1\xc6ppp0ppp0)vmnet1\x11cwlan1!ppp0-+user@[(\x00') 14:16:26 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) llistxattr(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)=""/1, 0x1) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000300)='/dev/null\x00', 0x300, 0x0) write$P9_RLINK(r2, &(0x7f0000000340)={0x7, 0x47, 0x1}, 0x7) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) r3 = mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer={0x40086303, r3}], 0x0, 0x0, 0x0}) pipe2(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x84800) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f0000000240)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000200)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r4, &(0x7f0000000280)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x5, @mcast2, 0x60}, {0xa, 0x4e23, 0x5, @loopback, 0x5}, r5, 0xc55}}, 0x48) ioctl$TUNSETVNETLE(r4, 0x400454dc, &(0x7f00000001c0)=0x1) [ 493.240444] binder: 17146:17154 unknown command 0 14:16:26 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x802) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) [ 493.264115] binder: 17146:17154 ioctl c0306201 20000180 returned -22 [ 493.315262] ================================================================== [ 493.322878] BUG: KASAN: global-out-of-bounds in strscpy+0x20e/0x2c0 [ 493.329297] Read of size 8 at addr ffffffff8677bda0 by task syz-executor.4/17158 [ 493.337175] [ 493.338900] CPU: 1 PID: 17158 Comm: syz-executor.4 Not tainted 4.14.134 #30 [ 493.345998] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 493.355873] Call Trace: [ 493.355902] dump_stack+0x138/0x19c [ 493.355914] ? strscpy+0x20e/0x2c0 [ 493.355926] print_address_description.cold+0x5/0x1dc [ 493.355937] ? strscpy+0x20e/0x2c0 [ 493.355944] kasan_report.cold+0xa9/0x2af [ 493.355956] __asan_report_load8_noabort+0x14/0x20 [ 493.355966] strscpy+0x20e/0x2c0 [ 493.355980] prepare_error_buf+0x94/0x1aa0 [ 493.383925] ? save_trace+0x290/0x290 [ 493.383939] ? __lock_acquire+0x5f9/0x45e0 [ 493.383953] ? scnprintf_le_key+0x600/0x600 [ 493.383965] ? __lock_acquire+0x5f9/0x45e0 [ 493.383976] __reiserfs_warning+0x9f/0xb0 [ 493.383984] ? reiserfs_printk+0xd0/0xd0 [ 493.383998] ? trace_hardirqs_on+0x10/0x10 [ 493.384012] reiserfs_parse_options+0x153e/0x1820 [ 493.384027] ? reiserfs_sync_fs+0xe0/0xe0 [ 493.395411] ? trace_hardirqs_on+0x10/0x10 [ 493.395486] ? workqueue_sysfs_register+0x3c0/0x3c0 [ 493.439302] ? lockdep_init_map+0x9/0x10 [ 493.443376] ? debug_mutex_init+0x2d/0x5a [ 493.447536] reiserfs_fill_super+0x461/0x2b20 [ 493.452053] ? finish_unfinished+0x1010/0x1010 [ 493.456654] ? snprintf+0xa5/0xd0 [ 493.460119] ? set_blocksize+0x270/0x300 [ 493.464183] ? ns_test_super+0x50/0x50 [ 493.468077] mount_bdev+0x2be/0x370 [ 493.471712] ? finish_unfinished+0x1010/0x1010 [ 493.476301] get_super_block+0x35/0x40 [ 493.480190] mount_fs+0x97/0x2a1 [ 493.483582] vfs_kern_mount.part.0+0x5e/0x3d0 [ 493.488105] do_mount+0x417/0x27d0 [ 493.491666] ? copy_mount_options+0x5c/0x2f0 [ 493.496081] ? rcu_read_lock_sched_held+0x110/0x130 [ 493.501112] ? copy_mount_string+0x40/0x40 [ 493.505365] ? copy_mount_options+0x1fe/0x2f0 [ 493.509882] SyS_mount+0xab/0x120 [ 493.513361] ? copy_mnt_ns+0x8c0/0x8c0 [ 493.517255] do_syscall_64+0x1e8/0x640 [ 493.521143] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 493.525988] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 493.531174] RIP: 0033:0x45c27a [ 493.534370] RSP: 002b:00007f531f52ca88 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5 [ 493.542128] RAX: ffffffffffffffda RBX: 00007f531f52cb40 RCX: 000000000045c27a [ 493.549402] RDX: 00007f531f52cae0 RSI: 00000000200000c0 RDI: 00007f531f52cb00 [ 493.556699] RBP: 0000000000000001 R08: 00007f531f52cb40 R09: 00007f531f52cae0 [ 493.564489] R10: 0000000000008000 R11: 0000000000000206 R12: 0000000000000006 [ 493.571759] R13: 00000000004c8a7f R14: 00000000004df8b8 R15: 00000000ffffffff [ 493.579067] [ 493.580703] The buggy address belongs to the variable: [ 493.580791] __func__.31301+0x980/0x3a60 [ 493.580797] [ 493.591831] Memory state around the buggy address: [ 493.596764] ffffffff8677bc80: fa fa fa fa 00 03 fa fa fa fa fa fa 00 00 00 00 [ 493.604142] ffffffff8677bd00: 00 06 fa fa fa fa fa fa 00 03 fa fa fa fa fa fa [ 493.611523] >ffffffff8677bd80: 00 00 00 00 06 fa fa fa fa fa fa fa 00 03 fa fa [ 493.618895] ^ [ 493.623312] ffffffff8677be00: fa fa fa fa 00 00 00 00 05 fa fa fa fa fa fa fa [ 493.630674] ffffffff8677be80: 00 03 fa fa fa fa fa fa 00 00 00 01 fa fa fa fa [ 493.638032] ================================================================== [ 493.645386] Disabling lock debugging due to kernel taint [ 493.651169] Kernel panic - not syncing: panic_on_warn set ... [ 493.651169] [ 493.658544] CPU: 1 PID: 17158 Comm: syz-executor.4 Tainted: G B 4.14.134 #30 14:16:27 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0x0, 0x0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_inet_SIOCGIFBRDADDR(r2, 0x8919, &(0x7f0000000080)={'nlmon0\x00', {0x2, 0x4e24, @empty}}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xfffffe8e, 0x0, &(0x7f0000000000)=[@free_buffer], 0x0, 0x0, 0x0}) 14:16:27 executing program 3: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r1, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r1, 0x29, 0x30, &(0x7f0000d4b000)=ANY=[@ANYBLOB="01000000000000000a00000000000000ff010000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000a00000000000000ff02000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff0100000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e2ffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e0000000000000000000000000000000000000000000000000000000000a00000000000000ff02000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff010000000000000000000000000001000000000000000000000000000000000000000000000000000000000400"/784], 0x310) setsockopt$inet6_MCAST_MSFILTER(r1, 0x29, 0x30, &(0x7f0000000000)={0x1, {{0xa, 0x0, 0x0, @mcast1}}}, 0x90) bind$bt_rfcomm(0xffffffffffffffff, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) 14:16:27 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$IP_VS_SO_GET_DAEMON(r0, 0x0, 0x487, &(0x7f0000000040), &(0x7f0000000080)=0x30) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) [ 493.666873] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 493.676399] Call Trace: [ 493.678986] dump_stack+0x138/0x19c [ 493.682611] ? strscpy+0x20e/0x2c0 [ 493.686169] panic+0x1f2/0x426 [ 493.689367] ? add_taint.cold+0x16/0x16 [ 493.693362] kasan_end_report+0x47/0x4f [ 493.697343] kasan_report.cold+0x130/0x2af [ 493.701592] __asan_report_load8_noabort+0x14/0x20 [ 493.706534] strscpy+0x20e/0x2c0 [ 493.709921] prepare_error_buf+0x94/0x1aa0 14:16:27 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x0, r0) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0xffffffffffffffff, 0x1ff, 0x2}}, 0xa) socket$pppoe(0x18, 0x1, 0x0) [ 493.714162] ? save_trace+0x290/0x290 [ 493.717972] ? __lock_acquire+0x5f9/0x45e0 [ 493.722209] ? scnprintf_le_key+0x600/0x600 [ 493.726535] ? __lock_acquire+0x5f9/0x45e0 [ 493.730862] __reiserfs_warning+0x9f/0xb0 [ 493.735050] ? reiserfs_printk+0xd0/0xd0 [ 493.739118] ? trace_hardirqs_on+0x10/0x10 [ 493.743354] reiserfs_parse_options+0x153e/0x1820 [ 493.746600] kobject: 'loop5' (ffff8880a4a6c1e0): kobject_uevent_env [ 493.748230] ? reiserfs_sync_fs+0xe0/0xe0 [ 493.748242] ? trace_hardirqs_on+0x10/0x10 [ 493.748285] ? workqueue_sysfs_register+0x3c0/0x3c0 [ 493.768023] ? lockdep_init_map+0x9/0x10 [ 493.768162] kobject: 'loop5' (ffff8880a4a6c1e0): fill_kobj_path: path = '/devices/virtual/block/loop5' [ 493.772084] ? debug_mutex_init+0x2d/0x5a [ 493.772097] reiserfs_fill_super+0x461/0x2b20 [ 493.772111] ? finish_unfinished+0x1010/0x1010 [ 493.772122] ? snprintf+0xa5/0xd0 [ 493.772134] ? set_blocksize+0x270/0x300 [ 493.772143] ? ns_test_super+0x50/0x50 [ 493.772154] mount_bdev+0x2be/0x370 [ 493.772162] ? finish_unfinished+0x1010/0x1010 [ 493.772174] get_super_block+0x35/0x40 [ 493.818283] mount_fs+0x97/0x2a1 [ 493.821679] vfs_kern_mount.part.0+0x5e/0x3d0 [ 493.826257] do_mount+0x417/0x27d0 [ 493.829788] ? copy_mount_options+0x5c/0x2f0 [ 493.834188] ? rcu_read_lock_sched_held+0x110/0x130 [ 493.839196] ? copy_mount_string+0x40/0x40 [ 493.843423] ? copy_mount_options+0x1fe/0x2f0 [ 493.847910] SyS_mount+0xab/0x120 [ 493.851354] ? copy_mnt_ns+0x8c0/0x8c0 [ 493.855240] do_syscall_64+0x1e8/0x640 [ 493.859117] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 493.863969] entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 493.869152] RIP: 0033:0x45c27a [ 493.872328] RSP: 002b:00007f531f52ca88 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5 [ 493.880026] RAX: ffffffffffffffda RBX: 00007f531f52cb40 RCX: 000000000045c27a [ 493.888082] RDX: 00007f531f52cae0 RSI: 00000000200000c0 RDI: 00007f531f52cb00 [ 493.895349] RBP: 0000000000000001 R08: 00007f531f52cb40 R09: 00007f531f52cae0 [ 493.902615] R10: 0000000000008000 R11: 0000000000000206 R12: 0000000000000006 [ 493.909895] R13: 00000000004c8a7f R14: 00000000004df8b8 R15: 00000000ffffffff [ 493.918183] Kernel Offset: disabled [ 493.921807] Rebooting in 86400 seconds..