x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0xf, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x13, 0x0, [@loopback, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:56:54 executing program 4: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x509, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$f2fs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="1020f5f201000b0009000000030000000c000000090000000100000001000000000000000040000000000000180000001f0000000200000002000000020000000100000018000000000200000002000000060000000a0000000e000000100000030000000100000002", 0x69, 0x400}, {0x0, 0x0, 0x200000}], 0x0, &(0x7f0000000040)) 01:56:54 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000440)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000400)={0xffffffffffffffff}, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_BIND_IP(r0, &(0x7f0000000040)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x2, 0x0, @loopback}, r1}}, 0x30) [ 478.569506][T14990] binder: 14987:14990 unknown command 0 [ 478.591871][T14990] binder: 14987:14990 ioctl c0306201 20000200 returned -22 [ 478.621389][T14991] loop4: detected capacity change from 0 to 8192 [ 478.634072][T14990] binder: 14987:14990 unknown command 0 [ 478.657263][T14990] binder: 14987:14990 ioctl c0306201 20000200 returned -22 [ 478.685452][T14993] binder_alloc: 14987: binder_alloc_buf, no vma [ 478.836166][T14991] F2FS-fs (loop4): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 478.845392][T14991] F2FS-fs (loop4): Can't find valid F2FS filesystem in 2th superblock [ 478.884838][T14991] F2FS-fs (loop4): invalid crc_offset: 0 [ 478.912714][T14991] attempt to access beyond end of device [ 478.912714][T14991] loop4: rw=12288, want=8200, limit=8192 [ 478.935897][T14991] F2FS-fs (loop4): Failed to get valid F2FS checkpoint 01:56:57 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000140)="66530700ae897094e7b126b097eaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26f45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e05485", 0x46}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000080)={0x78}, 0x78) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 01:56:57 executing program 5: r0 = socket(0x10, 0x3, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f1, &(0x7f0000000040)={'gre0\x00', &(0x7f0000000100)={'syztnl2\x00', 0x0, 0x0, 0x0, 0x0, 0x0, {{0x6, 0x4, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x2f, 0x0, @multicast2, @rand_addr, {[@generic={0x0, 0x2}]}}}}}) 01:56:57 executing program 2: syz_emit_ethernet(0x66, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0xf, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x13, 0x0, [@loopback, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:56:57 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:56:57 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, 0xffffffffffffffff, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:56:57 executing program 4: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x509, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$f2fs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="1020f5f201000b0009000000030000000c000000090000000100000001000000000000000040000000000000180000001f0000000200000002000000020000000100000018000000000200000002000000060000000a0000000e000000100000030000000100000002", 0x69, 0x400}, {0x0, 0x0, 0x200000}], 0x0, &(0x7f0000000040)) [ 481.320844][T15014] binder: 15010:15014 unknown command 0 [ 481.343391][T15014] binder: 15010:15014 ioctl c0306201 20000200 returned -22 [ 481.362653][T15016] loop4: detected capacity change from 0 to 8192 01:56:57 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0xfffffecc) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r1, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000e66d1808b11342000d340000000109021b00010000d5a00904"], 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) [ 481.374797][T15014] binder: 15010:15014 unknown command 0 [ 481.382451][T15017] binder: 15011:15017 unknown command 0 [ 481.388120][T15017] binder: 15011:15017 ioctl c0306201 20000200 returned -22 01:56:57 executing program 2: syz_emit_ethernet(0x66, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0xf, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x13, 0x0, [@loopback, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 481.417866][T15014] binder: 15010:15014 ioctl c0306201 20000200 returned -22 [ 481.433832][T15021] binder_alloc: 15010: binder_alloc_buf, no vma [ 481.469481][T15017] binder: BINDER_SET_CONTEXT_MGR already set [ 481.497890][T15017] binder: 15011:15017 ioctl 40046207 0 returned -16 [ 481.540840][T15016] F2FS-fs (loop4): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 481.541479][T15017] binder: 15011:15017 ioctl c0306201 20000200 returned -22 [ 481.548716][T15016] F2FS-fs (loop4): Can't find valid F2FS filesystem in 2th superblock 01:56:57 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, 0xffffffffffffffff, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:56:57 executing program 0: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0xfffffecc) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r1, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000e66d1808b11342000d340000000109021b00010000d5a00904"], 0x0) syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000580)=ANY=[@ANYBLOB="1201000200000020ef0e01a04000010203010902240001014050090904000502030101010921faff620122480509058103000401039741980380a201400ec815d08ac91e0abe457e32d53eb78dc2842fb3ba32617823ec82885f901e43fe336ffafb8c188a1011f8dcbde199a7a5c0d412196c90b09ed64b699d432e1957440d5c7fa4fe2716ad128c38d7c1c416aa7bdd672edd95fba6869b14301d4618e927ac91d21c830188e14efecb88a1ba58a80c6b3e658f2d911e53760d5388e25ea258be890000000000ebae33754618e7eceb20982c13a646cb5dd4f87c49195bf84d6fa715170bb3718007a72e12df2a565509"], &(0x7f0000000200)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x110, 0x2, 0x81, 0x0, 0x10, 0x40}, 0x50, &(0x7f00000000c0)={0x5, 0xf, 0x50, 0x6, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x0, 0x8d, 0x72, 0x2}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x7, "a82ed34424fe499dd2cb35e2663eb62e"}, @ss_container_id={0x14, 0x10, 0x4, 0x9, "9e596909e0c1c4c9efabccfa38f499f4"}, @wireless={0xb, 0x10, 0x1, 0x4, 0x8, 0x4, 0x81, 0x5, 0x88}, @wireless={0xb, 0x10, 0x1, 0x4, 0x5, 0x1, 0xf0, 0x8, 0x20}]}, 0x2, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x42f}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x425}}]}) pipe(&(0x7f0000000240)) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) [ 481.693985][T15016] F2FS-fs (loop4): invalid crc_offset: 0 [ 481.722378][T15016] attempt to access beyond end of device [ 481.722378][T15016] loop4: rw=12288, want=8200, limit=8192 01:56:57 executing program 2: syz_emit_ethernet(0x66, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0xf, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x13, 0x0, [@loopback, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 481.776063][T15016] F2FS-fs (loop4): Failed to get valid F2FS checkpoint [ 481.814377][T15033] binder: 15032:15033 unknown command 0 [ 481.830168][T15033] binder: 15032:15033 ioctl c0306201 20000200 returned -22 [ 481.868069][T15033] binder: 15032:15033 unknown command 0 [ 481.895401][T15033] binder: 15032:15033 ioctl c0306201 20000200 returned -22 01:56:57 executing program 2: syz_emit_ethernet(0x66, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0xf, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x13, 0x0, [@loopback, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 481.948650][ T5] usb 6-1: new high-speed USB device number 19 using dummy_hcd [ 482.210599][ T5] usb 6-1: Using ep0 maxpacket: 8 [ 482.300489][T10740] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 482.336005][ T5] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 482.349652][ T5] usb 6-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=34.0d [ 482.368519][ T5] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 482.379618][ T5] usb 6-1: config 0 descriptor?? [ 482.443896][ T5] usb 6-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 482.580445][T10740] usb 1-1: Using ep0 maxpacket: 8 [ 482.740813][T10740] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 482.751088][T10740] usb 1-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=34.0d [ 482.760160][T10740] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 482.772915][T10740] usb 1-1: config 0 descriptor?? [ 482.832220][T10740] usb 1-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 483.035443][T15042] udc-core: couldn't find an available UDC or it's busy [ 483.043012][T15042] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 483.530400][T13821] usb 6-1: Failed to submit usb control message: -110 [ 483.537782][T13821] usb 6-1: unable to send the bmi data to the device: -110 [ 483.545995][T13821] usb 6-1: unable to get target info from device [ 483.552956][T13821] usb 6-1: could not get target info (-110) [ 483.559054][T13821] usb 6-1: could not probe fw (-110) [ 483.930478][ T257] usb 1-1: Failed to submit usb control message: -110 [ 483.937863][ T257] usb 1-1: unable to send the bmi data to the device: -110 [ 483.946164][ T257] usb 1-1: unable to get target info from device [ 483.952656][ T257] usb 1-1: could not get target info (-110) [ 483.958575][ T257] usb 1-1: could not probe fw (-110) 01:57:00 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000140)="66530700ae897094e7b126b097eaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26f45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e05485b4ff", 0x48}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000080)={0x78}, 0x78) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 01:57:00 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:57:00 executing program 2: syz_emit_ethernet(0x66, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0xf, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x13, 0x0, [@loopback, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:57:00 executing program 4: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x509, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$f2fs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="1020f5f201000b0009000000030000000c000000090000000100000001000000000000000040000000000000180000001f0000000200000002000000020000000100000018000000000200000002000000060000000a0000000e000000100000030000000100000002", 0x69, 0x400}, {0x0, 0x0, 0x200000}], 0x0, &(0x7f0000000040)) [ 484.380299][T15074] binder: 15070:15074 unknown command 0 [ 484.404310][T15074] binder: 15070:15074 ioctl c0306201 20000200 returned -22 [ 484.411002][T15075] loop4: detected capacity change from 0 to 8192 01:57:00 executing program 2: syz_emit_ethernet(0x66, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0xf, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x13, 0x0, [@dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 484.451062][T15074] binder: 15070:15074 unknown command 0 [ 484.470911][T15074] binder: 15070:15074 ioctl c0306201 20000200 returned -22 [ 484.497573][T15074] binder_alloc: 15070: binder_alloc_buf, no vma 01:57:00 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0xfffffecc) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r1, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000e66d1808b11342000d340000000109021b00010000d5a00904"], 0x0) syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000580)=ANY=[@ANYBLOB="1201000200000020ef0e01a04000010203010902240001014050090904000502030101010921faff620122480509058103000401039741980380a201400ec815d08ac91e0abe457e32d53eb78dc2842fb3ba32617823ec82885f901e43fe336ffafb8c188a1011f8dcbde199a7a5c0d412196c90b09ed64b699d432e1957440d5c7fa4fe2716ad128c38d7c1c416aa7bdd672edd95fba6869b14301d4618e927ac91d21c830188e14efecb88a1ba58a80c6b3e658f2d911e53760d5388e25ea258be890000000000ebae33754618e7eceb20982c13a646cb5dd4f87c49195bf84d6fa715170bb3718007a72e12df2a565509"], &(0x7f0000000200)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x110, 0x2, 0x81, 0x0, 0x10, 0x40}, 0x50, &(0x7f00000000c0)={0x5, 0xf, 0x50, 0x6, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x0, 0x8d, 0x72, 0x2}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x7, "a82ed34424fe499dd2cb35e2663eb62e"}, @ss_container_id={0x14, 0x10, 0x4, 0x9, "9e596909e0c1c4c9efabccfa38f499f4"}, @wireless={0xb, 0x10, 0x1, 0x4, 0x8, 0x4, 0x81, 0x5, 0x88}, @wireless={0xb, 0x10, 0x1, 0x4, 0x5, 0x1, 0xf0, 0x8, 0x20}]}, 0x2, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x42f}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x425}}]}) pipe(&(0x7f0000000240)) openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) [ 484.533891][T10740] usb 6-1: USB disconnect, device number 19 01:57:00 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) [ 484.587034][T15075] F2FS-fs (loop4): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 484.613295][T15075] F2FS-fs (loop4): Can't find valid F2FS filesystem in 2th superblock 01:57:00 executing program 2: syz_emit_ethernet(0x66, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0xf, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x13, 0x0, [@dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 484.701511][T15075] F2FS-fs (loop4): invalid crc_offset: 0 [ 484.737650][T15075] attempt to access beyond end of device [ 484.737650][T15075] loop4: rw=12288, want=8200, limit=8192 01:57:00 executing program 5: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0xfffffecc) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r1, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000e66d1808b11342000d340000000109021b00010000d5a00904"], 0x0) syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000580)=ANY=[@ANYBLOB="1201000200000020ef0e01a04000010203010902240001014050090904000502030101010921faff620122480509058103000401039741980380a201400ec815d08ac91e0abe457e32d53eb78dc2842fb3ba32617823ec82885f901e43fe336ffafb8c188a1011f8dcbde199a7a5c0d412196c90b09ed64b699d432e1957440d5c7fa4fe2716ad128c38d7c1c416aa7bdd672edd95fba6869b14301d4618e927ac91d21c830188e14efecb88a1ba58a80c6b3e658f2d911e53760d5388e25ea258be890000000000ebae33754618e7eceb20982c13a646cb5dd4f87c49195bf84d6fa715170bb3718007a72e12df2a565509"], &(0x7f0000000200)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x110, 0x2, 0x81, 0x0, 0x10, 0x40}, 0x50, &(0x7f00000000c0)={0x5, 0xf, 0x50, 0x6, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x0, 0x8d, 0x72, 0x2}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x7, "a82ed34424fe499dd2cb35e2663eb62e"}, @ss_container_id={0x14, 0x10, 0x4, 0x9, "9e596909e0c1c4c9efabccfa38f499f4"}, @wireless={0xb, 0x10, 0x1, 0x4, 0x8, 0x4, 0x81, 0x5, 0x88}, @wireless={0xb, 0x10, 0x1, 0x4, 0x5, 0x1, 0xf0, 0x8, 0x20}]}, 0x2, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x42f}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x425}}]}) pipe(&(0x7f0000000240)) openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) [ 484.764246][T15094] binder: 15091:15094 unknown command 0 [ 484.799039][T15094] binder: 15091:15094 ioctl c0306201 20000200 returned -22 [ 484.808727][T15075] F2FS-fs (loop4): Failed to get valid F2FS checkpoint [ 484.839720][T15094] binder: 15091:15094 unknown command 0 [ 484.857021][T15094] binder: 15091:15094 ioctl c0306201 20000200 returned -22 [ 484.871995][T15094] binder_alloc: 15091: binder_alloc_buf, no vma 01:57:00 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:57:00 executing program 2: syz_emit_ethernet(0x66, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0xf, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x13, 0x0, [@dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:57:00 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) [ 484.955326][ T4886] usb 1-1: USB disconnect, device number 5 [ 485.070388][T15110] binder: 15108:15110 unknown command 0 [ 485.086320][T15110] binder: 15108:15110 ioctl c0306201 20000200 returned -22 [ 485.123069][T15110] binder: 15108:15110 unknown command 0 [ 485.144198][T15110] binder: 15108:15110 ioctl c0306201 20000200 returned -22 [ 485.175695][T15110] binder_alloc: 15108: binder_alloc_buf, no vma [ 485.210647][ T5] usb 6-1: new high-speed USB device number 20 using dummy_hcd [ 485.510180][ T5] usb 6-1: Using ep0 maxpacket: 8 [ 485.640298][ T5] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 485.651025][ T5] usb 6-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=34.0d [ 485.668857][ T5] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 485.680866][ T5] usb 6-1: config 0 descriptor?? [ 485.754654][ T5] usb 6-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 485.973948][T15100] udc-core: couldn't find an available UDC or it's busy [ 485.987089][T15100] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 486.820025][T13821] usb 6-1: Failed to submit usb control message: -110 [ 486.827412][T13821] usb 6-1: could not get target info (-110) [ 486.835128][T13821] usb 6-1: could not probe fw (-110) 01:57:03 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:57:03 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000140)="66530700ae897094e7b126b097eaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26f45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e05485b4ff", 0x48}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000080)={0x78}, 0x78) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 01:57:03 executing program 4: perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x509, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$f2fs(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="1020f5f201000b0009000000030000000c000000090000000100000001000000000000000040000000000000180000001f0000000200000002000000020000000100000018000000000200000002000000060000000a0000000e000000100000030000000100000002", 0x69, 0x400}, {0x0, 0x0, 0x200000}], 0x0, &(0x7f0000000040)) 01:57:03 executing program 2: syz_emit_ethernet(0x56, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x48, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:57:03 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, 0x0, 0x0, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) [ 487.422880][T15141] loop4: detected capacity change from 0 to 8192 [ 487.452744][T15141] F2FS-fs (loop4): Magic Mismatch, valid(0xf2f52010) - read(0x0) [ 487.470002][T15141] F2FS-fs (loop4): Can't find valid F2FS filesystem in 2th superblock [ 487.483605][T15148] binder: 15140:15148 unknown command 0 [ 487.494995][T15148] binder: 15140:15148 ioctl c0306201 20000200 returned -22 [ 487.499907][T15149] binder: 15143:15149 unknown command 0 [ 487.507711][T15141] F2FS-fs (loop4): invalid crc_offset: 0 [ 487.516086][T15149] binder: 15143:15149 ioctl c0306201 20000200 returned -22 01:57:03 executing program 2: syz_emit_ethernet(0x56, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x48, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 487.525226][T15141] attempt to access beyond end of device [ 487.525226][T15141] loop4: rw=12288, want=8200, limit=8192 [ 487.551834][T15148] binder: 15140:15148 unknown command 0 [ 487.557518][T15148] binder: 15140:15148 ioctl c0306201 20000200 returned -22 [ 487.566516][T15141] F2FS-fs (loop4): Failed to get valid F2FS checkpoint [ 487.579993][T15148] binder_alloc: 15140: binder_alloc_buf, no vma [ 487.593738][T15149] binder: 15143:15149 unknown command 0 [ 487.612518][T15149] binder: 15143:15149 ioctl c0306201 20000200 returned -22 01:57:03 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, 0x0, 0x0, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) [ 487.663331][T15149] binder_alloc: 15143: binder_alloc_buf, no vma 01:57:03 executing program 2: syz_emit_ethernet(0x56, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x48, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 487.813319][T15158] binder: 15157:15158 unknown command 0 [ 487.835065][T15158] binder: 15157:15158 ioctl c0306201 20000200 returned -22 [ 487.867018][T15158] binder: 15157:15158 unknown command 0 [ 487.876416][T15158] binder: 15157:15158 ioctl c0306201 20000200 returned -22 [ 487.896047][T15158] binder_alloc: 15157: binder_alloc_buf, no vma [ 487.937241][T11900] usb 6-1: USB disconnect, device number 20 01:57:03 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = dup(r0) connect$unix(r1, &(0x7f0000000000)=@abs, 0x6e) 01:57:03 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup(r0) write$eventfd(r1, 0x0, 0x0) 01:57:03 executing program 2: syz_emit_ethernet(0x66, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0xf, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0xf, 0x0, [@empty=0x1000000, @remote, @multicast2]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:57:03 executing program 4: r0 = socket$packet(0x11, 0x2, 0x300) r1 = dup(r0) mmap$perf(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x11, r1, 0x0) 01:57:03 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, 0x0, 0x0, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) [ 488.160502][T15176] binder: 15175:15176 unknown command 0 [ 488.187199][T15176] binder: 15175:15176 ioctl c0306201 20000200 returned -22 [ 488.214570][T15176] binder: 15175:15176 unknown command 0 [ 488.226048][T15176] binder: 15175:15176 ioctl c0306201 20000200 returned -22 [ 488.240210][T15176] binder_alloc: 15175: binder_alloc_buf, no vma 01:57:06 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000140)="66530700ae897094e7b126b097eaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26f45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e05485b4ff", 0x48}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000080)={0x78}, 0x78) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 01:57:06 executing program 2: syz_emit_ethernet(0x66, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0xf, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0xf, 0x0, [@empty=0x1000000, @remote, @multicast2]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:57:06 executing program 4: r0 = socket$packet(0x11, 0x2, 0x300) r1 = dup(r0) write$P9_RSTAT(r1, 0x0, 0x0) 01:57:06 executing program 0: open$dir(&(0x7f0000000040)='./file0\x00', 0x98140, 0x0) 01:57:06 executing program 5: r0 = socket$packet(0x11, 0x2, 0x300) r1 = dup(r0) write$eventfd(r1, 0x0, 0x0) 01:57:06 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) [ 490.498744][T15204] binder: 15196:15204 unknown command 0 [ 490.512967][T15204] binder: 15196:15204 ioctl c0306201 20000200 returned -22 01:57:06 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup(r0) getsockname$netlink(r1, 0x0, &(0x7f0000000080)) 01:57:06 executing program 2: syz_emit_ethernet(0x66, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0xf, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0xf, 0x0, [@empty=0x1000000, @remote, @multicast2]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:57:06 executing program 0: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.pending_reads\x00', 0x40140, 0x100) [ 490.550235][T15204] binder: 15196:15204 unknown command 0 [ 490.569176][T15204] binder: 15196:15204 ioctl c0306201 20000200 returned -22 [ 490.589101][T15204] binder_alloc: 15196: binder_alloc_buf, no vma 01:57:06 executing program 4: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$cgroup_netprio_ifpriomap(r0, 0x0, 0x7) 01:57:06 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:57:06 executing program 2: syz_emit_ethernet(0x66, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0xf, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0xf, 0x0, [@empty=0x1000000, @remote, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 490.833103][T15221] binder: 15219:15221 unknown command 0 [ 490.851579][T15221] binder: 15219:15221 ioctl c0306201 20000200 returned -22 [ 490.880089][T15221] binder: 15219:15221 unknown command 0 [ 490.895080][T15221] binder: 15219:15221 ioctl c0306201 20000200 returned -22 [ 490.922020][T15221] binder_alloc: 15219: binder_alloc_buf, no vma 01:57:09 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000140)="66530700ae897094e7b126b097eaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26f45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e05485b4ff15", 0x49}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000080)={0x78}, 0x78) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 01:57:09 executing program 5: r0 = socket$packet(0x11, 0x2, 0x300) r1 = dup(r0) write$P9_RLERROR(r1, 0x0, 0x0) 01:57:09 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup(r0) setsockopt$inet_tcp_TCP_ULP(r1, 0x6, 0x1f, 0x0, 0x0) 01:57:09 executing program 4: r0 = socket$packet(0x11, 0x2, 0x300) r1 = dup(r0) setsockopt$inet_tcp_int(r1, 0x6, 0x0, 0x0, 0x0) 01:57:09 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:57:09 executing program 2: syz_emit_ethernet(0x66, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0xf, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0xf, 0x0, [@empty=0x1000000, @remote, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:57:09 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) sendto$packet(r1, 0x0, 0x0, 0x0, 0x0, 0x0) [ 493.649970][T15242] binder: 15238:15242 unknown command 0 [ 493.682245][T15242] binder: 15238:15242 ioctl c0306201 20000200 returned -22 01:57:09 executing program 5: r0 = socket$l2tp6(0xa, 0x2, 0x73) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x46, 0x0, 0x0) 01:57:09 executing program 4: r0 = socket$l2tp6(0xa, 0x2, 0x73) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x35, 0x0, 0x0) 01:57:09 executing program 2: syz_emit_ethernet(0x66, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0xf, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0xf, 0x0, [@empty=0x1000000, @remote, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 493.725891][T15242] binder: 15238:15242 unknown command 0 [ 493.753195][T15242] binder: 15238:15242 ioctl c0306201 20000200 returned -22 [ 493.777330][T15251] binder_alloc: 15238: binder_alloc_buf, no vma 01:57:09 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:57:09 executing program 5: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000001080)={0xffffffffffffffff, 0xffffffffffffffff}) write$nbd(r0, &(0x7f0000000040)={0x67446698, 0x0, 0x0, 0x0, 0x0, "e8910933af0a2e2e1a09dbf1cca68c54788c6e6812120e96fd4f8e2afa6ca75bb00ba4eef7f7d835ad0517fa574c6c69285ae9677ee324d0a9321fa46ebdc148d668e20968a8fe87f92697620241320656b540d2afb2604f6b77acbd190bd019378dcc0ad0ab530d8b980f9d6acd644af101fe7a174297a884675da93be434783698ba0a6f65da90a9244d0c1fa84a6dc694522c6d65cd8a4777b49517d81d351aa9b640302d87348f2ffbf1c4d2336cb80d7680ea73c0c1592e66df0668e4d798db2acac7964b196a07b91665091ace998b8a0f8b4583b3ad76957dd331a539961c8dd53501ebd9dd7e6486b9f3d0d7a93295eb355cf8558d63d71f5934c84f4568bbae3dfea701e71358ab0d4389fbf5934c1aacbd1baef2cc7d4ecf63de6ee1308e7c805a358ba1e56f100d8bf70051a010c0c880898c4b2a430280c3e1db7f3bcd7e4756f46b7b9cef5c785206712edd6b14de48f58bed5d3806190e01077d8efa696da2745b8c227aaad317a223c36eba2d9d71ee681067fd19efb4cc90bb9a8f9e63306faa05bfaa289b5f51120df5becba7881e7b9d6912f47a695a90eee3a9d651a0e25ed6ade30b4d196be2dcd2497f6b41a166b72116475d1d46d6cc14ba635a80eb812509324350b862c9afaad26dcb31206bcf7f8df1d374c845c64c9adeb53fa321818b33de9194c285dcf7c8f2a3301c06000934450f3477a7e56c357ae55da643720d8853fbd3746490044705bb5002a800c9a387e607b2f434126c2eb8cc50398719780f3e3157afb34f267d902da4667e33715b40564f96420d99a8b054a175accb92c2c8f4508766f1b352bf5a0bbb3881443a7d4d87ee0238111b1f0d760f94c94f04ada5627a93ecf70c7c7b3871ab1a4c74177b72522f675cb22575a69c6e276154655c1ef4eba4020e82880118dc246319e55da7287af0ff2673a61017a234cb1435ad70b1452fb65988b2ef4dd6836bfc171d33a370a8dd192bbe4f2dffc7bf8115c16838d8cb8fd1a6f1296fe882b36d28843099626ab442d2a5c2c98f1d8bad991ee28fda1878074383caeb9935204bb6aecadc2e9237f9202b65ab35fcfbf91843a030b55cec1feea51eff72d9ec8fbcdfab0c40bbce0e9c06696cb0b9df089000d64b80bf21f8733b80fdb01d964c40e36aedcb40255b7f7c0682e4e3ba2a4f102df9c9d7f8cf04a9a92ed984eaecf7914496f021a0f151665cf2cf902c517d06497c824f52bdd93abb68db11181e688b1344ab21687767b106da571a2b59000e7cc4f33f282533ae01f1c7b129e11747379d2fb822496476f37cb4cc81db6becced505e605dd6e6831fe74da3be52337b5ed403f9923fbfd0d7b70502e3f13b941f6112bd57a8a19265f94fce0af35e15223d26869f302169c2e2f93ab4ecd79973e8e20355ccaf0215f33a2110617f4aed07384eecaa826e2a1997c416e652291a6af7812a33ac1911ccd4c4358175f1a6d4570c046a0da274408a41c3c471fa95bb612289940bc7139ec3eabb37d59469c981a9dd738175d0188e4fb27e0036947e49333c98c9c82078c1928ca5ec7b81365fe52dd2cabec1c3b61d8e5bf6bf5d49a38275b42530f5dbc731812592ffb7d8eef7e0b8a2974438254215650bf3ac794d19ff9a50b18850dc8766bb050a5bed18de7d879d424aebc5974f2d668cf9d8fe30be1a470312cfdf907fe29f2dad10e160224eae578c5c7c3dee88a86b148da374c169f336fb996bcc545ba860b705e6eddfbf031b69586f651460b54d53dc8d576eb7b032e795392ac90ac74a2122f8d46a902da07c393feb647b487a5f40029dd777c9874b8250479588b98c5014e8c913d6189ef90e48cce591a8097f338d4426737c94a0fc7bb1245c178b80bc56b55fa3f0285015677ec44d25fe821b51022e15b0203f637a92fb2d6aadf98da1c8d53f4f148b8038713400dfff76e70511e40834bab5ff528f194c56a7836906947c362acc0c0169c7ca913307b7b3dafe7f2470a27256118a0623abaad0507b92d1f75ab8efc68c7f3c67cdd496e95c95cec812202fd32a7456c831afec0bf2fd55c48006301bd2a4b8405736e5d2160d4db5fa64e53d7dfe246739eca5c6a43afb3c8a50ec6d3c216c654364bffaf869310a9f2237e47b0d8698e42f105f6eb1eda616f80e345d46e187c7a4aa7f8346bb51133d87b9dcee3da7e6975e534994dd8748a13e40953448c12cc8ed62c24071c5788e8848dc43b043a6ca46a5ba1c7447dd3f779a2720adfbf59b7472bfbc71feb6062b8a3677d033981305ba5a4dbca073da49c73791795d467518e10ecbfc715860e150447e02b9f286c3cde3197be1aaa90b403126538b46ec52e49b803877fd4e5adffc250f9035acc1396db871f0aa40baf095d408165a40292993b82b9bbf8b31a169091528d34f1ae6de8a689976e3f3e5f0a8c05d879ef99f8e78b18b0585d1f74d53da5b400f1fd4ca06c5e04d3ead0a8f9363206ae655e2e093c54bfe02b1b8f4a2dc616f9f51c8c975f0ce5cda0e0d7bca2afd15de080e801cdc34b939b7edd4dd3980a574c58befb59569a8af9a03f7cb76e6030b14f1d81afec0ce343aaa1ce98fe131d3ded440a1ff74d0d1d6f7bde0b475810aa6c3fd18d4248ac4c4a0b4f03b654616be6d572a4c9faf224f6b75aae318ade753085831c57627cf5c9a1ecd1a32d9a689f1ba22921500516f2a2d3a0faab371ba5112098cf8865b95870165726b16c798b9a9eb3438a05d53c24eb072258eb7c8224b9bce2220d9b43593910172c453cdcae268f76ab03b0b6a22ad19f5285a361008c282ad542cd3466509f526f50af7f023faaedc4711874bbf07e51d52f7c2ead3492b3692bf94be9485c71edb3b36d185b29b2004edd93e38210a9a460678ae6e983e12fe8cbd3871d2826c9d01e9fb0be5e15c3ae9558a829d1d80b79b46eb992d6b8fde8ded18021c22b0d2b8d1b92cc3477921aaa176cb795ec355e1dec73d81bc9ea718c6420534799894915a0585eabefb2c890921f7a677f319e09641b4027b6fdd36ec1c59b342d9bffc4a9c9d25b91e17660fe1ce579e370bc7195c423bf81a93989a4b7ded7db664fa17647d86516a37fde5ccb7af6178068b3a48661be9ea3edbe79a3a2ee40a388472226ff84c41fc6a90ebc70cee47e7dd44dc86eeda5fcba19b5fe825571c8bec28192974a43d465f7d146cc8953c0357ff83806c72ac1aa1e17360bea82aca242120934539c5875db02a92acac115ef464da89a14e4aab369f32475d59ede950ed5728d721b4f6e262ade1422009fb86916873bd60f6e21cd0a2de6ce85d8fc76010e25f1db8ce7b886cbb754c9d97289bb25cf21f458bd363a629a7eabe62a7baa84d3e400968b516321c20219f769cafda22521f6834d476edff21372d77ef7c75f7497c140f773ad3d7c0a955d4c4fe12b79bf6874252102cdb5e48c01ada9b69fe41a0d8fc6a90482c3252feb11bce147d41badc3efcaeaacce314a78eb4e88162b2bb891c8e376d352d4791e18b8cda54256e741158f4bfa8e14fb7fe71df0eff28f3eaa13adbb889e7d00a8e463d3a12b66d3a88ebe67e89ef33ac039c11997ec49523097e643023e2d426d282466cbc61675a9f3b8343bb941f60752cbf4743711c0e85b6a0c1ef515272481f70e619bb7485e1da38d7b7e6692514f376c5631299b80869689fbac37a3b4542b2335a1d95a078533a1cf2728417d8de0a1164e812243355019bd7244230b4eb5619308b414e8625ed88149e9cce916097abb013be5a518a5ef97b1ca1eec8cecb15a352c95aa1ec8f4cf00a717c0ea68e2ae60f051821f3c8dba62a21aeb1f9a1d8ebaad057e1b2bc958ca5dae7900b2143ff3c4cd765382e964144e62e9824f6ac93ee2298cff89a81208806f78e3c282a001d3385da214ac30747285b8f07de113af74387833b76599607ae4504a5aaaac0741095286eb89e1deb573a274de487b558aed3fef118ae6f17ed1cbb54a4b664f8b353c530275a5099ec073db9f946362dc0d7a0110688e7366dde6e6038aa6acdf8bae55efea5904d226c8d14870721d5ceb459f9ecd94e52ee346f7673558893d31d0e288dccc99e93d31c3db883c2b332cd5ac29758e921123b81a2328ee062304830f8c3deda44a8984522d91b69210a9077222d3d56636a31b638dfbd74c11b97c63a593ab23c9818a4aa68eb1cf54480fb8599e28380e884466c91ef073bb4490cf7f4d8c5be3551843fe553961ea471bbdc262db778625e0e149aede61ff222000adc7241c9eddbcc8c4edfb5f69485d7fa4e1611400743261a61cc52dbc03ff21383a28be8f65f50c2ba27fc8b405f91d70985812292e5ef1fdf573a70e1cb52266e4ddbb6a9de98383f08ebc36cc4bcb9efc03b9051da890cc8f87f3a1872127bd99070c730fc149baa5b50d7f881a6cbcd7884d3e936089ebdf5cbc708d832ce3a10bc2289c0c6b5d33fb6effe7248817c3960d90f08ffdb84fc04deb1c8740b8476ba4b935a4b02985c4a54e8221269c07bb53369cd8bcbe83c2e02d91309dfb1e800d0aebf84787c39cb0a7183eb00574bbd365470f6aecbddc33f1987e5fd216116c5c1ad6fac85c27a487a3a6efa800967527cc6b22beba5674468f60c0ad5a14a69672b1cd92a4e40af6aa41e9f47cc8cc345ec825aa724decb1ec689a0c5e44032eec93cd7f34d772333a1e2bea9004866d0966a7206b9643962b597c06d5aca67512b0ad5bc73355d09b1b3fca78ed5d2ae380ac0623f262f5946e5f77cf70753ebd0d2572df3efb2c19bad98c56f981f0c4591cf466acf717d20f06f69eb63ec0e1073fd26635e7a9af7c94b7c9928993f35257b7c38387a43b3b26fdbccd34cd03cc2f921bb19d5b661e98a947bad2819f1ca83acf31a431fdd81110f60c8e7aff6d202d31a11fcc7231ce6a9003aff050e25f7cdf4dd9e277fac68dd10ea411960aeaf328e81060c744a7d561a9228f1434fa23b6634ba80ab2332c95a4e1feac1f99b3754c671d4d02839482c04a49b2d53fc86af0f5c4730de67c9fa0914dbea96eb35c42a235c0a5c2383597528c73535cec6fa892b7c3099d7877ebe7db854d65fd59cc808bb1e81bdfe24d32cb55f4fa5c3a283378f19bc806ef958b3be7ab459a02835bab53131240d9e371e9711fb341380dfaff2b3bf213b51589e7e5d085bf742f60fd10ef809e4eb1df6d1ed30434460e44035fd1e2799484fd267d77d5474580ba54ef07da230176d251759498be190e52247c8ddb31b0532ee143e9d64df0ddb12c4c6995e899434b21db8958ff89ee12ac4f9f147076522b4cfcbb4093784d4cc106ff118a23de9e95a194c239b476d42ce708fdef4005625834c55e7fe75cb2cdca304f3ae8e9db7ed668de1c765579f94debfda11490ca3642f95c02641b970d0223125b377206d95c29952b9090343ab42077d949a1f36c636d1bb913142f365db2b19e0fec12b447a80b1f53ce1310eb719675f388e3a57d23879e40451eddbada8f45cfbbc9ea030d56b8e8ee344814ed207185dd125e7d3e9ee818ab40351d572683183b82924e8df0f055b8c58c568df5554af426f21dcc2fcb679bdfdf1f9e9c5b67f2afe0a7297df939a8764ec24e7fa99477b5905e9a0777fc153b6cdf561a322a3244f23a5fde3cf9e8f4833b525f339ed7032d281a5bbf357197c129e456de03ffe61f9f53720416fff287fd2dfdce5757aca261d026deeb52"}, 0x1001) [ 494.040410][T15266] binder: 15263:15266 unknown command 0 [ 494.054567][T15266] binder: 15263:15266 ioctl c0306201 20000200 returned -22 [ 494.084258][T15266] binder: 15263:15266 unknown command 0 [ 494.096787][T15266] binder: 15263:15266 ioctl c0306201 20000200 returned -22 01:57:12 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000140)="66530700ae897094e7b126b097eaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26f45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e05485b4ff15", 0x49}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000080)={0x78}, 0x78) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 01:57:12 executing program 4: r0 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) bind$llc(r0, &(0x7f0000000080)={0x1a, 0x1, 0x0, 0x0, 0x0, 0x3, @random}, 0x10) 01:57:12 executing program 2: syz_emit_ethernet(0x66, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0xf, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0xf, 0x0, [@empty=0x1000000, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:57:12 executing program 0: r0 = socket$l2tp6(0xa, 0x2, 0x73) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x38, &(0x7f00000000c0)=@filter={'filter\x00', 0xe, 0x4, 0x388, 0xffffffff, 0x1e8, 0x118, 0x0, 0xffffffff, 0xffffffff, 0x300, 0x300, 0x300, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@remote, @remote, [], [], 'veth0\x00', 'veth1_to_bond\x00'}, 0x0, 0xa8, 0xd0}, @REJECT={0x28}}, {{@ipv6={@local, @loopback, [], [], 'gretap0\x00', 'ip6_vti0\x00'}, 0x0, 0xa8, 0xd0}, @REJECT={0x28}}, {{@ipv6={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @remote, [], [], 'lo\x00', 'gre0\x00'}, 0x0, 0xa8, 0x118}, @common=@unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, "32114e988a3da0bc29db15c195c576eda02ecf9b50b48efad132b221eb5c18daedda75c10c720169d9f946cda28fc1e7b6e122b4f546a50926aa60d7a22cef9c"}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3e8) 01:57:12 executing program 5: r0 = socket$l2tp6(0xa, 0x2, 0x73) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x15, 0x0, 0x0) 01:57:12 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) [ 496.709054][T15286] binder: 15280:15286 unknown command 0 [ 496.727218][T15286] binder: 15280:15286 ioctl c0306201 20000200 returned -22 01:57:12 executing program 2: syz_emit_ethernet(0x66, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0xf, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0xf, 0x0, [@empty=0x1000000, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:57:12 executing program 5: r0 = socket$l2tp6(0xa, 0x2, 0x73) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x4b, 0x0, 0x0) 01:57:12 executing program 0: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) close(r0) r1 = socket(0xa, 0x5, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX(r1, 0x84, 0x6e, &(0x7f0000000300)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}], 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f0000000080)={0x1, [0x0]}, &(0x7f0000000180)=0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f00000000c0)={r2}, 0x8) 01:57:12 executing program 4: r0 = socket$l2tp6(0xa, 0x2, 0x73) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x31, &(0x7f00000000c0)=@filter={'filter\x00', 0xe, 0x4, 0x388, 0xffffffff, 0x1e8, 0x118, 0x0, 0xffffffff, 0xffffffff, 0x300, 0x300, 0x300, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@remote, @remote, [], [], 'veth0\x00', 'veth1_to_bond\x00'}, 0x0, 0xa8, 0xd0}, @REJECT={0x28}}, {{@ipv6={@local, @loopback, [], [], 'gretap0\x00', 'ip6_vti0\x00'}, 0x0, 0xa8, 0xd0}, @REJECT={0x28}}, {{@ipv6={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @remote, [], [], 'lo\x00', 'gre0\x00'}, 0x0, 0xa8, 0x118}, @common=@unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, "32114e988a3da0bc29db15c195c576eda02ecf9b50b48efad132b221eb5c18daedda75c10c720169d9f946cda28fc1e7b6e122b4f546a50926aa60d7a22cef9c"}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3e8) [ 496.769228][T15286] binder: 15280:15286 unknown command 0 [ 496.798103][T15286] binder: 15280:15286 ioctl c0306201 20000200 returned -22 01:57:12 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:57:12 executing program 5: r0 = socket$l2tp6(0xa, 0x2, 0x73) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x49, 0x0, 0x0) [ 497.094793][T15303] binder: 15302:15303 unknown command 0 [ 497.113781][T15303] binder: 15302:15303 ioctl c0306201 20000200 returned -22 [ 497.145450][T15303] binder: 15302:15303 unknown command 0 [ 497.163465][T15303] binder: 15302:15303 ioctl c0306201 20000200 returned -22 01:57:15 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000140)="66530700ae897094e7b126b097eaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26f45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e05485b4ff15", 0x49}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000080)={0x78}, 0x78) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 01:57:15 executing program 2: syz_emit_ethernet(0x66, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0xf, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0xf, 0x0, [@empty=0x1000000, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:57:15 executing program 4: r0 = socket$l2tp6(0xa, 0x2, 0x73) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x1a, &(0x7f00000000c0)=@filter={'filter\x00', 0xe, 0x4, 0x388, 0xffffffff, 0x1e8, 0x118, 0x0, 0xffffffff, 0xffffffff, 0x300, 0x300, 0x300, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@remote, @remote, [], [], 'veth0\x00', 'veth1_to_bond\x00'}, 0x0, 0xa8, 0xd0}, @REJECT={0x28}}, {{@ipv6={@local, @loopback, [], [], 'gretap0\x00', 'ip6_vti0\x00'}, 0x0, 0xa8, 0xd0}, @REJECT={0x28}}, {{@ipv6={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @remote, [], [], 'lo\x00', 'gre0\x00'}, 0x0, 0xa8, 0x118}, @common=@unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, "32114e988a3da0bc29db15c195c576eda02ecf9b50b48efad132b221eb5c18daedda75c10c720169d9f946cda28fc1e7b6e122b4f546a50926aa60d7a22cef9c"}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3e8) 01:57:15 executing program 5: r0 = socket$l2tp6(0xa, 0x2, 0x73) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x3c, &(0x7f00000000c0)=@filter={'filter\x00', 0xe, 0x4, 0x388, 0xffffffff, 0x1e8, 0x118, 0x0, 0xffffffff, 0xffffffff, 0x300, 0x300, 0x300, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@remote, @remote, [], [], 'veth0\x00', 'veth1_to_bond\x00'}, 0x0, 0xa8, 0xd0}, @REJECT={0x28}}, {{@ipv6={@local, @loopback, [], [], 'gretap0\x00', 'ip6_vti0\x00'}, 0x0, 0xa8, 0xd0}, @REJECT={0x28}}, {{@ipv6={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @remote, [], [], 'lo\x00', 'gre0\x00'}, 0x0, 0xa8, 0x118}, @common=@unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, "32114e988a3da0bc29db15c195c576eda02ecf9b50b48efad132b221eb5c18daedda75c10c720169d9f946cda28fc1e7b6e122b4f546a50926aa60d7a22cef9c"}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3e8) 01:57:15 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:57:15 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f00000010c0)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd120000000000008500000006000000b700000000000000950000000000000042da4f2aa3d9b18ed812a2e2c49e8020a6f4e0e4a9446c7670568982b4e020f698399df2d3349ee34e18b23aa0f3881f9c24aa56f15199fad0093c59d66b5ece0200c70d0f13905ea23c22624c9f87f9793f50bb546040677b0c5077da80fb982c1e9400e693146cea484a415b76966118b64f751a0f241b072e90080008002d75593a286cecc93e64c227c95aa0b784625704f07a72429184ff7f0000cef809606056fe5c34664c0af9360a1f7a5e6b607130c89f18c0c1089d8b8588d72ec29c48b45ef4adf634be763289d01aa27ae8b09e00e79ab20b0b8e1148f49faf2ad0000000000000006fa03c0125ebbc08dee510cb2364149215108333719acd0224edc5465a932b77e74e802a0d42bc6099ad2300000080006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942d62c96bc0bf3f9dbc89112f4ab87b1bfeda7be586602df8af54b5f75bfd8d985430cea0162ab3fcf4591c926abfb076719237c8d0e60b0eea24492a660583eecdbf5acd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366000000000084f9746336bf521a99000003926b81e3b59c2a2bc93d85e223d29b081d6a08000000ea2b1a52494b00d321e7da1eb8026dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d605ffff9c4d2ec7c32f2095e63c80aff9fa74fcd4cc4a0b5b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142ba11de6c5d50b83bae616b5054d1e7c13b1355d6f4a8245ffa4997da9c77af4c0eb97fca585ec6bf58351d564beb6d952aab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a326eea31ae4e0f7505ebf6c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57000000009700cf0b4b8bc2294133000000000000000000030000000000000000000000000010008bc0d9559711e6e8861c46495ba585a4b2d02edc3e28dd271c896249ed85b980680b6c4a000000002b435a48782447e669ea5c65b95a4e0bc4c15fc0288d9b2a169cdcacc413b48dafb7a2c8cb482bac0ac502d9ba96ffffff0000000000007d5ad897d73b7cda42013d53046da21b40216e14ba2d6ad5656bfff17addaedab25b30002abbba7fa725f38400be03f8a6ef2cd317902f19e385be9e48dc003913653282830689da6b53b263339863297771429d120000003341bf4a00fca0493cf29b33dcc9ffffffffffffffd39fec2271ff01589646efd1cf870cd7bb2366fde41f94e6932c1b6a17bc0cfd3467decb05cfd9fcb32c8ed1dbd9d10a64c108285e71b5565b1768ee58969c41595229df17bcad70fb4021428ce970275d13b78249788f11f761038b75d4fe32b561d46ea3abe0fa4d30dc94ef241875f3b4b6ab7929a57aff5d986356487bd41aa660e717a04becff0f719197724f4fce1093b62d7e8c7123d8ecbbc55bf404c4e1f74b7eed82571be54c72d978cf906df0042e36acd37d7f9e119f2c06f815312e0cfe222a06f56dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef2acd1fe582786105c7df8be5877050c91301bb997316dbf17866fb84d4173731efe895ffecd05560926e90109b598502d3e959efc71f665c4d75cf2458e3542c9062ece84c99a0618a7a20639b41c8c12ee86c50804042b3eac1f879b136345cf67ca3fb5aac518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad05573af403269b4a39ce40293947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457acf37331766e472391e358c3b377327ac9ecc34f24c9ae153ec65200694dc55bff9f5f6d04d6b2c5ea1393fdf24285bf16b99c9cc0ad1857216f1a985f369191ae954febb3df464bfe0f7f3ee9afe7befb89d20d9499f5874c553aeb3729cffe86e66964ae09bb6d163118e40cb68a919c32ba8f887d6116c6cc9d8046c21649f895778cb25122a2a998de44aeadea2a40da8daccf080842a486721737390cbf3a74cb2003016f1514216bdf57d2a40d40b51ab63e96ec8485b3b8a8c96a3d14f93100c2e0893862eef552fcde2981f48c482bdea6f26e4a4304e50c349f4f9ecee27defc93871c5f99b355b72d538ba4958ea8e4aa37094191e10096e7760fc3541a2c905a1a95e9571bf38ae1981c4238ecaee6f75cd0a6881bd1513a8250df98674152f94e32409e2a3bce109b60000000000000000d6d5210d7560eb92d6a97a27602b81f76386f1535bef1497f92186086e29c6bc5a1f9f59d4f21137abf9a404abde7750898b1bd627e87306703be8672d00d1ab5b075228a9f46e02001f08fb8191bbab2dc51de3a61f0868afc4264859323e7a45319f18101288a0268893373750d1a8fe64680b0a3fc22dd704e4214de5946912d6c98cd1a9fbe1e7d58c08acaf30235b928a31d2eca55f74a23641f61f2d5b308cf0d031b056237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff854356cb4906000000000000000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66418d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466ac96e0d497b0e9f810049209b085f1da1f68df75cf43f8ecc8d3726602111b40e761fd21081920382f14d12ca3c3431ee97471c7868dcda7eaa69eb7f7f80572fdd11bb1d0d1280fbc22bf73468788df51710d7d31c802fc5ed1762eb0b428ee751c4ff000000745a868404a0bf35f012bbb11008b722b1eaa6aedfa1bf2e7ccb2d61d5d76331945e20fa26b8471d42645288d7226be690cd628ab84875f2c50ba891cea599b079b4b4ba686fcdf240430a537a395dc73bda367bf12cb7d81691a5fe8c47be395656a297e9de93e4f96756ea5cce7daac4be290159f6bcd75f0dda9de5532e71ae9e48b0ed1254a83186c1526af6fbb869604d51a36a54c832e45b2569dc0d90b075225fde44c4e0973171ad47d6b70ebc660309e1e245b0fdf9743af930cd6db49a47613808bad959719c0000000000378a921c7f7f8433c2e24c7e800003c9e8095e02985f28e678f66422436f949e2ab8f162d7e3f855e378f4a1f40b0c1fb2d4b205aa00b6d713acebc5b014e61a543a5a194f9ac1cd76b5440e3b1a569e7397f6cafa86966d7ba19e720413267a6ccea9c439671d2c680f2753ca184eeeb843450368acb4383a01d25eb3d1e23e0f2645d1cdfa9fa410632f95a5f622f851c66ee7e30393cd7a4d67ff2a49c4f9360984b5c2d4523497e4d64f95f08493564a1df87111c9bf3194fef97dcecc467ace45feeb685c5870d05f88a0f463db88d377442e49ab63809f18b54a9d624778e1c4cba6e6390a9f302c6eb2df7766411bef0efecb0f477db103463af2847e6ade5b9e065ec0d0ba58fedae5f08818fca475b169469f9efd131925d98c34b3cb26fe26796dd43b87a1402a39f5cf21d2e80a64ac97e71cafc29bfb78db0905d12225efeda2e93bf7f6ba7865e9c375a780929dfa5a210bf5858e2ae8d1e8c9cceed07c6312b734c72510d335acc94f76e7078ce4066f1e0ac9429f80277a11e25b248b61180cb6207a0e26757f3f1bfc6c27f3720d1fb79c41f6a25ea02c294afb17f3b5239bc2243853d5414afb05ed6024e94dee34666c5b5522b54cb433efa54b4e9022533e6a4598b453c9e549847c89bdee957dfa9ded9f16fdcd1b681e4c72f32fa3334313e334cc140daec7dcb22f463457a1a5ac230bbded8625832a2b6dbf837704aa89a7543208debe71d934cedaf85f1bf43f23baa076b051342ab9651cc11d9b8b7e68e931ca4795a720797959d07a0fd82c770a0c0a2b1924bc8dca0c4ca73f4e8ca2de4a1689b1717d9d008131206bb60c09ffbd2b5bdb327f45a583073d0e2045ab7b9dacefd8921f9078fcc568aa1f9c419115c2042f506b50aef369859f67fe4044a6943d7c2b12d95f76bdbf5d5dabd3e8b9f9729caf7f85c826842fea43486e2bd1d66fdded6184965168ada42a2ed63f484f677dd4dd5858a39010aa9baddee202b1ea070e44b59d396a3a280379bec2d22cda1f4d3fd6768326578dad0e36b505c117ee65ab8f4dab871a0f19da9cf1cf2e4606c1d1761d6709e05483f2632dc94c7d0d5a64529bd8244f7849f559d31723263828419495ccd94a0e7f4d7393f0fcdc2b201748259f12a89d54138b0d5ef5e86c8665eba3ff4576b7a630c49c0c4490dd1ad354a5330a68b559ffa9ba4a2aeaefbbf2670d4b42246bd2cd088abca23528c19ca0310000000000000000000000000000000000000000000000b7548ab4acda49b43cba2f5a00297571804d1ba60dccc123f9299cd805a86ba037c1afd22f1a3fd2c1dd6f5611a2bfd4e8d6ab0ced838dbf3c46def734d39d027e274918567d0e3459b067ec94dab1dd846353c7e2e8a8671ee124b389d3e3d8230b2e586f3cbb480000000000000000000000000000695f2305ac82faab3ab89aa1a6ca88a5e4bfa1f66dde9926d9fadd27b13fce909bd25a815b7fe6d52df39a9fac5ea8aa4a07f142e04b6e63d88b26061266fe98fbe1d95c834bb436e3ea59e1f6bbc81eac1a270b1b51cc9d12e4b11351e9f807a14e30758be72b5dd3414b5a8835a2b6127696e1b88c949d797a4d74abdc692f418109e6016dbf9d071bdd5671a819c1f07689ed9488bb030fdbc5b135a291bf94407fff2abfcc420fdf68c301fd2916afef9e1ebe197ea39ee61d1fd3e69091c1e69ac73a5b821c71e4a8a3160a4e213cb4cca9de89b2f88c6ca4ce9e73e4bfba317e78acb1fb8d03e4619ef669801c6388e22a8b1672e943754e8ba5b7947ea662d376fef4f7fe11dc0a8f5fe04c94f0ef4a0c2a8cdb50c0856551ed0a59520d57d5d8a21167fb1e099a952c0b84c0fc21b6f1542fe26ea7d281d030271d9c2df734b77a39503fa63aa5e66fffe4a66f5af10d807069df791b7d46770c7d3ea565da474b30bfb96b24b51b704412318ed8000000000000000000000000003bee7c2f9ec98ad73c2b4ea31cadbfe7b388a760ff7d615747216c3927cf54ba6ee67becf4b63cfd57a5a08924a709bc7967a45c02e9f3af6ff16b112de2d9a7de5f435af769446d79174fc0d45dd7696463e296393c43f4911f4fff31a143e86907c12c5f7981930d252e99b9ab3ce07b6ad46293aa6006dda707b790229303927fe101fd8298f62bd400b22e9a48f53eae8480c92ad3044380d1e94bdf6276cc81dcde240bb3a727b9f0d26409b46011884356690385e06e4f7642761b8a8f8319bfb4446ac045c45bc247accc03122da39c2385d61d35932f2749ae6134799aa3c43d30b62c7b399bc08f053b290bdd411e1cd0a792f61d92b7e12175138d0ef27d982fbddb766730db1ba985125dd269efcb094e51d6b8efbe588c394631afeb43314fed7e64cd2df440eef93c93af2d4c8ed16d614d45df92b613349e01e53300000000000000004702bed19503c00221aa2d30cd56a08ca88522c488206a74ecd145cd88d10a68d5bc3cd058c9ed9e6a341d7c27d60ca74e946a225dbc259dcc9fae8a3db5d4400b8c9970b0abcbe6e718faf351cb19c7d584a60e09ba3d946aab424d1650e26811bb36e7c260d71bb70eb7523b8dd43e15fc9b8e9135185c1d1024cb54f47c16418a8656e2d5ad5e34d8f6db658258ef354bf730ec24983b3aaceecde7b2c00441a7b84bef609d60ba43ce76ed697c5585c20b6a47c75212ebd7a7b9bdcf474a08b0b0e1f3d8ffde9ebbabf7a9b83da176b398857dc0910650ff2cff9cb33388868aa2260e123e1e8d12ab9d5826cd626185df0bd30e562d4de419b74da6375ce301ba7092cab23874e18fdbaa8d80a7dea03afcbfc6db97c97464e17e352f713ffeddc17146ae8522ea295936e3565a0a47a5544a882ed32bbe9736146c0b311866ccb78216bf4bbd90dec719eb69f853c7f092d6435834d73e7d59208556465fc3e144c2a41d141a7871b5a86df49630604e407c676b15970db561d3f97c4a335e49ae89ff198451a2782abd9d0d477e8303da9e7597976d74a0fb88ce91545b0272d1b48d1f3be3675c72e1f921a5d9fd2140e451ee16f2a4bf02ce820535921a29757675dcbe0c5066239b58f04a470fb8fb5101a0b586612245b13569c84464f60e74a0fe69296a9dae107fdfc6ce61a9a5d2cda2caa489565b848e92b22375f2eaa000000000000000000000000000000000000000fdf9a705b44785ec9bc8e9c85cc40e1feaaa86c64b85ad6763033256901aa56c64f29cb6e59b642508a063f53ae037a27d05db0762867720be421a9ff049557044c0d5df93086319eece"], &(0x7f0000000100)='GPL\x00'}, 0x48) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000e80)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r1, 0x8912, 0x400308) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000001080)='sys_exit\x00', r0}, 0x10) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_ADDRFORM(r2, 0x29, 0x2, &(0x7f00000001c0), 0x4) 01:57:15 executing program 5: r0 = socket$l2tp6(0xa, 0x2, 0x73) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x21, &(0x7f00000000c0)=@filter={'filter\x00', 0xe, 0x4, 0x388, 0xffffffff, 0x1e8, 0x118, 0x0, 0xffffffff, 0xffffffff, 0x300, 0x300, 0x300, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@remote, @remote, [], [], 'veth0\x00', 'veth1_to_bond\x00'}, 0x0, 0xa8, 0xd0}, @REJECT={0x28}}, {{@ipv6={@local, @loopback, [], [], 'gretap0\x00', 'ip6_vti0\x00'}, 0x0, 0xa8, 0xd0}, @REJECT={0x28}}, {{@ipv6={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @remote, [], [], 'lo\x00', 'gre0\x00'}, 0x0, 0xa8, 0x118}, @common=@unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, "32114e988a3da0bc29db15c195c576eda02ecf9b50b48efad132b221eb5c18daedda75c10c720169d9f946cda28fc1e7b6e122b4f546a50926aa60d7a22cef9c"}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3e8) 01:57:15 executing program 4: r0 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, 0x0, 0x0) bind$llc(r0, &(0x7f0000000080)={0x1a, 0x1, 0x0, 0x0, 0x0, 0x3, @random}, 0x10) 01:57:15 executing program 2: syz_emit_ethernet(0x66, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0xf, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0xf, 0x0, [@remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 499.879363][T15330] binder: 15323:15330 unknown command 0 [ 499.902240][T15330] binder: 15323:15330 ioctl c0306201 20000200 returned -22 01:57:15 executing program 0: r0 = socket$l2tp6(0xa, 0x2, 0x73) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x1b, 0x0, 0x0) [ 499.991193][T15330] binder: 15323:15330 unknown command 0 [ 500.024935][T15330] binder: 15323:15330 ioctl c0306201 20000200 returned -22 [ 500.041705][T15332] binder_alloc: 15323: binder_alloc_buf, no vma 01:57:16 executing program 2: syz_emit_ethernet(0x66, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0xf, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0xf, 0x0, [@remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:57:16 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) [ 500.276577][T15348] binder: 15347:15348 unknown command 0 [ 500.289018][T15348] binder: 15347:15348 ioctl c0306201 20000200 returned -22 [ 500.326761][T15348] binder: 15347:15348 unknown command 0 [ 500.338283][T15348] binder: 15347:15348 ioctl c0306201 20000200 returned -22 [ 500.355869][T15348] binder_alloc: 15347: binder_alloc_buf, no vma [ 501.050327][ T3269] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.056661][ T3269] ieee802154 phy1 wpan1: encryption failed: -22 01:57:18 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f0000000140)="66530700ae897094e7b126b097eaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26f45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e05485b4ff15f7", 0x4a}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000080)={0x78}, 0x78) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 01:57:18 executing program 4: r0 = socket$l2tp6(0xa, 0x2, 0x73) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x11, 0x0, 0x0) 01:57:18 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000100), r0) sendmsg$NLBL_CIPSOV4_C_ADD(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB="54010000", @ANYRES16=r2, @ANYBLOB="01000000000000000000020000002c00048005000300010000000500030080ffffff0900030080ffffff0500030072000000050003000100000010000200030000000800020002000000ec00088024000780080006004b0000000800060049000000080006006000000008000600440000003c00078008000500710f637a080005009d752e5008000600370000000800050024e11e2808000500b712f827080006001900000008000600970000004400078008000500506a22600800050032fd7a4c0800050048a2d110080005001042495c080006006e000000080005001cfb632708000600a800000008000500f97c23790c0007800800050053040362040007803400078008000500b3b18b58080006006700000008000500626e036008000500f5734a1c080006000c00000008000600c2000000080001"], 0x154}}, 0x0) 01:57:18 executing program 0: r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(r0, &(0x7f00000022c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000002280)={&(0x7f0000000040)={0x1ec4, 0x12, 0x0, 0x0, 0x0, {}, [@INET_DIAG_REQ_BYTECODE={0xbd, 0x1, "916b50d5779e2e3cab9b15e1f2a3d875f86b80d379ac714269a7de985a3dde910d90c75b83d81ec604d2abbdda94e52cd101da24b83535da76310d9742a398aca145283f4b04e36623379a50aa4d32e5b0a581f53d4a4c4fb996178737fee4e76a523d4eea7cf43a4fe80a19cdf2c8b3e4402ac8810e0a0ba860eb364cf67b591ea179e82b326a31f5d6b0c7d27fbd223638103b6b2485e3d97829ce56814de2c1491e7bc9915b9899d3e75c23e327257fe77011d7955cf992"}, @INET_DIAG_REQ_BYTECODE={0x9, 0x1, "89138c2e58"}, @INET_DIAG_REQ_BYTECODE={0x1001, 0x1, "0dc68196faa7b4948f954980b493f1c1dddeb501319fb60965a4445eb8be2a06428a6df11b59bc919f7e01bd8905a59e4c5b1a88cd53482119177d65fc4c32d8496859a1ff80a01f6d3a9d80d052b1e04ec71a91eb0bedc5d9fd19a1681bac22ebb1b010b9fb570c89ddad157884ea69e935669f7fff878ebdfa99c1dd220c626e63d97c1a6c12a6d34cf0b43b1f50d697a9d696b2672c9c38bf617fbe1e330fe907dd245ae28c3f6adbd2f1d8e9edda737f97402c7ddc48f4a69a8e83ee0b16c8600a13756a690453a67b9a066bd070e95b50137a037f0be0f896fe422126caa0144cb5687f667041c302151691deacb2b734c159369d32619c15e96d06feafe62c611c8bc752438b45c8f984790398422b0f709f88d1ef2523b57e499d9e2ef3b65580a9c732ab9350a075715f9c02158dadaab99b982139b8b27604d495dfc91b2926cb477ceda34c6683b66e5f1a7856d850e9df7042a7d3ee99bd1dc2e443ca5026ed8b30a8e92a11b22339bcabc3d6a89705da6c27a12a1289fa1f8de3f1a1a4d447dc75c0a750631d7e9ac33ceea81d6be86a418a4502889b5051014279701ecf01323aa649aa01cb269db68e4dc899ebb5213d0f1788a1d7c484a7c86f58ac694206a1947d2a8010bf91864dba610cac599eaab408370c9fd1a1bc7abd1b4001b8fcf9bd562d4750945aa85ec884fcb608a6ce50ec36fd51fe21abab9e7a6b190184ff1f406ca8bd49583d4aa661867fbe04af7e75f677bdd03440d517004e46a9b0c33d13ab068ef7726cf4af409816cac842fc3defe9394958bcbfe63cb32d912aac70b795b245c512cc76210721b2395876d5c77528b20ada716de1f9ecd3f79e73ffd7f054a32cafdea0c2f8cb82c6a395964c2e88ca704d40fe3631c8c3f0c16c0ba5a2e79c8f9fbdd93f0c2a71278ffd8ed825b65f6ab0720ca448491ceb8889afc5e28258ee01314f0a93020adaeff813a3624b6ae7d2c0a13ffdd852e60d2ec6edc59e195baeed90fdd6f82b68ca955f8f16eb5e33ccf3f5b094dd26186c447e00f8ec48be2177542494b1f368e499317cb8ac066ec8699265a5a9569994e5382cbf27d63aecfc1f2b35bb9796ddccf4c5dafa2bac546f05aab175fcea27080325f1907e29a1a529316813c84a28bca435aaa949b01e3c0c09fcf60196303984bf3f05ffcb27046e771afe0d642f5c0e0ccd7f1f4bc3c2b2a28323ac7a8c9b011a906fac2c0d73b498f16a8c5cc98d99228d6f9d41caddd2561879744af94f29e6eca3f9290d4f558ce4db825f89e3a5c45819ec71257f87f56932f5b9a47da0db3fa96ccec9cbeb637d9832fc5cca3182b47c4076b1e675195bb9ef950b97e13eb5156ea3a37e8378e794dd2d5234cff1004f9839e992df31a2ab3f07dd8a3daff2346af8f608e29dceffc5905af68a8088943c9abf64f0c44264b325a28ae2dc7e83d3a32556b65afe905e78d7a4fdc0cd96eb5ae1b46b78d79efe9d3771491e46ebbabd32a12a67b75dce9a94dc113b3190611fe51b6245726acbc543e512d17cfb3ea4597c049105b3fea7648026babc91032176d3a3e9e233ff91634e9c7ab58bc878890e68142802e1b12a0b11f8924d40e16de28bb4e737133c1f06a144291c670fadbf8d13ee2f433d8df58c18cf26ed52e6cc35923f116cac0cf99b3b779ddffe3d9ba18e161c6b4d3079451603f1b3474036ade54f5090d0705ba221d757a8ef5551a96de4dd80932aa1e40fc67f86bce4a1b4b541ab859f995eda72d89cdf38f7c2d1eb5b13d2cf056c636366529e1a6b03ad2ae6eaeb4e1a0abb6c03e1823ecb0f6f83c64d3ea31db62d4428e96aa663c795b43351766ba69e92c35fe7f2994871b242710306c8339601600aa41e87b02852bf44dd763adf12dd09277a4f8396393ff7f765d2af5e7562ca7e8369070debe1a93a5b4c938d9cade5e193ccf01e96ffd8a579cadd5d58147775e1371de88fb8198924ec09ba2e3002881077e1869713f4c7b0813cf9c43b4bee73cc854bbac88909f0c5737611b4cc1dcff21556554450904c769c081a0668ba96e9a3c0ef3e24b2c396f8e93294d586af1ec0bbf4cf9e50dbac595e097e3091749873cd28a7c1e6592779e25487d0b3c0a9930c392d9890c30b0f823e23338cc40d04b77eb73a1e51cd774ca547a20cd22068e657662ac319e747194b8d6fe8445833254128ca3db6e24a3bfff4e25a978c0e25e73f7d49107ec9a0768f9213f820db2b28a354edb10be4537046f394749d159092c520bf0a6ed0316993669e64140fe887fe825baa8a753a4051e14e52278e5dc446e03a98d424388b5d7a7bcdedaea48a0ed677a317024fa7765a62309e6abf12f66f7658bf81e5cb696292e9305cfde9dc855e9275c5220b95b8462d1725014f4bce3c08972af49ccc715d21f169e8fa3f268490ddd9eaa595bbf3830f72b1290467269375c003fa2a2623c7918ba347a8b7d56318cc60ff4ea84cf88345335a3b96f02996b56e6f6c57f7a0128f6042cc6daafd6f17081e799ad06bc34aa0580dce568a9efdf092bc4a94c01a619f933cb67b53ea57a3bb6d64c79133ae84ceae0da8be490deb1f0eba62e05371afda9c8129ceaf17287ae8682ef331179dfd14ff68c0801050b6d3ac46338f08183ebdac0baa5989dbecd6964720a2e01e570bc4cf9a4ea82b67857acab8f98b56f3787931b1037ac2ca4fbd626d66361f56cc7fda7e6c4a99500780ff81b74e9211d23b4ded929e93c2d591dce26dc6963de1d3eb3041d33a84d6143cb0342511e2f9862a899c25c6a181ae0429110fffe7d3e4a04e6d3b32ff1c0b9d2ba0f70269428d8c139d2fef33fdb2379aa81722b73b6f6757a011909b4b3d1c197dcf00fbe34586b69d0cc7233b8a26eab569e4a4925cb9209978320e873430ba0e843ade7dbf92ed82882f846743fab280d6556f328c9228ad496122ecfed85f0501d62c909566d0372c6173f0c17a0b7460aadd732d4434de32564bae742d3bf7e996553832503537cdb69759e07f679b755f7f6880c6f2f272d5685cbedaa054c7214722497bb2e589a71f4ae01157c61e739571c189b07aa3f0525c62b58248925ec3abb930e562c0bbdf449cf49c9748e158329146bcbec307262973f5f0f1554e94bf3d7e75a67b148c662466633f92e958c3331ffeadd4b1241cfd7bf2d7b6990ebe4a88b750bce2a8597f3b3b96600af8d9b9e54b9482fb5895909c67f7a601fe3d9902dc1cc21d2654926b333f7e1e4cca204e1ee091a8939599ab17539e6323cb16ec96fa841dc8ca7ab7402cbfae3e45a45307ad85835aaa8a0a8b3d241dfe2607f0aaf50d49b0cb39f75ba5385b12c280bffd85a69ccecae8628c9ad5a2764a1d2bb44ce650d0e57ee0f1869741a3248ebcef33275f72e2eda09ac83a099c35e4d4b04a962e43cc23500e4fd896d054ca07c5c0d0a8b6daacc165c876f810179a9039c8a31ed9ba8a56e69ae68f72c2137ab1f5b2768f8c8ad083a5af869e043d3c9f4599b0ddbd719397d10fad59598fd7cc1ed1e39a0630dd5fee958562d1f5e422796f9f00e17e6ae228f70d658d98c8f502e90dea285801f38a2871dc3426a678e92745d0e97272092e8de3e2d228ca44b05747f33a90429f59516118d2f4a9eb43a6322a4299c3bd27538536086b655ad22c8339d367a658382f29f0ccd1b7f0379db9810ce124b2a35fdc586d8d5f90bc85a994eee752742aa6343f5849365c0a4cc9d759f1d217f57f7a35d3043ec42c7ef4d7041639ee75c076bf62b67c3e7763abc6b5dd9f21701ea93c29c70d81faacb91a42a483550f26052666bb9b3ef12243987755b735c573546b3d5bcf6e6b1eefcc4ee7c64dcf313cc7a41249b17eac4ad06f0bf16bf9052eef1fca302e111b010d9c9711e75ff256cfa2d542bc56c6f12d7a1888a47e622bf6245ba55fc66ac1fb639701b37486bbb81fbe7d2bb5bec851871df5983c6c80a46e7ae2643cf04e6f43de63635f7c22a31f519e70bfc5e4ad18a1f3823143a9254bf2f356bff4cb4e27be8c9b74c06144809023b517b4d5ddb80fa33cb9422702a9b11c4c7332f54f11a8491c59a45e19f2706a7c53d9acfd26591b92f349f2fe5fa76717eeb3e05e70040925b659a2454cbf9a39494946be52bc5766ae23ffbb63b6be2ac4fbbd5651c069dd468d1ccf431972038f435c84533900298d6b39c7a726b820e58df10e80dae2520b68ea9f89680f1c55bceed54b2fd84ce511d4615661017cd9de1f2dbd10a5baa603a164d4f37b7ac53f5ecd31eda661c0f5c3aa9aaa9a038dfe7cccda3c7d501b77724291b5956d02e5447b86b97d9c9a04f97dcc996f73dd2c4e54db57a19a47c20a85e1aa1928feedce0be0d77634720cd67c33f71dbd42a35febdef501e218b7a57b1a30156cc65ef5accd92a0b4938126efdc4986269e249ffd35b9032d652a1f5b29502a0574b902dfc183b277aa3c863142bdb41bd39acde68e69f974e35561c5f30892abbe20dd22f834c230783b8fabb1b11a6d65cd831a26f8158f95d714cb8d1aa6f5c77e7cca3876730c3d22e58a5da3aa2f8938d74b6ca6ae2bcfc1aa9111de82c36dae654aff53f1d8d1859ebda3c82d3c9a4994f3eb841d4e0d5bd13718d2a079e085a5d50a5d3215d8503fca2ce17575267e5aa071b442b587c51c296635e98c25d197f421927242c46fe3af9e6124018cf2b292634d074dcdd7cb9e90154bee1f28fcbd60cdc39aa076b1294f11d92b43fffa6aa3f1bed627c9db785175b3738333d1da0366997f4443aecad7bf8fdbd6875a5843ce45153b4e3a46ae5a753be46775261b2b523f99e5cf8dd60bb566f6c22845be24e711f4ccdfa582e12e74e0b848e58782ec2bb78d7aadb7e65f529f896f04e184cf36f1da80103cd46731213aaa3c29c935ced1bcd9be7da9671927bccd8d728192ccb19b3cd8fac71ffe083536fea48738a275c1c0093978f571764d0dd64f0878a73174cbeb7d3e017785e108e6af42eacb720d1734edd6fc65749ddbf695733a78a2f42083e49ee404b88303aeda72ddd020c08dc34f1f55ce1a17df18ce04e47dabae0f6c18ad7d79bd7ac7fdc13c99ec5fa23822ff929224cd3e55bace0587699e41db851dca8c9e6ba1cc2b5749527fcbea747623ec794172ff00ab1680b7b5f7b686407f6c2d92c11a03e112c16ae01934cb06df1ece526832bc517ebcc69901a46ab037ef33b353c4ce081c34585a1dca49129ca09e701740a326db886504e25d0895ddcc5325b195363d97813962b817c95d5ac2fa0555c138e0f62cf69af9f118020fa8afdbd2299c8e1125f93c0837cd7f95aee3f398d61bc4679efc1cf7d787b312cb24b3925370060a1139f1e3c1207c9d97ab674408fc2edfc5d27fa387d8a44f94cbc3e3f167146c0880779a887f7d268fcd6d3d8fcf6f54889dac91cb529fa1d2e2c27d7f61de6bc0dcb603496bb23546e918c3516db382df8aa74830d950f4a00b72a972135f17001b60b9dd0c0767923fb31dc5423ee09affda45e814daab0c789f120af4213e88c37b24da6624a1a36db98473ad672e190f38b8e5d35c1c2a0cee7b64f01c1f41576610b3cebac2101b77b24e2f71fadb0a7f23f9439b88501421a4e91ba68d7508a9479127df556da82aad0bed7a0bdd9775b0f25d77b8cffedf6dcbe7540b486b9080c87fef0ec40fa59dfb6f5ab3f936ed08e8dd4f60c422c3abe1bca34753c9b3a972843e9a721ec43d0158518bd9482acb64"}, @INET_DIAG_REQ_BYTECODE={0x49, 0x1, "26f71593a43c7d45564eb6adf380b07fda96fed43113d7607945468dd6a3738e73f78d2b136e51d58b18974358108b56b0e7e4680e2bce35e9f036bd6ffacc381df66dabfd"}, @INET_DIAG_REQ_BYTECODE={0xd59, 0x1, "0580108568a9d35178be54da61f1a64c97f83720741cb1bd6a209ad3ab64f901da92b6f122c22622066e2a33477fd21f1d2b344c716fa3c8066fdaf107d2eeae4fd92dd01fbf22a6abf5a7eb39ec844eaf86197f7987bb4d5bd66a976f668701928621a4953227452aff60ced1a64c82ff6a45b0edff3b76bdb0a97cf93d9586226611291d6610d1e26d35eb79b7df4278636a6b038c8f0c5354b752fa7af0fe353a044f07972cac58ac10b108620bed97cf59733fefd3c43c004295c12b1e4b0a1e8edbcf3b52eeaf8d95557f54fefd91801c1c3f90ff8f3adc69e056f628283926adbf38f611f3a923eaf505e8573c4ad6ac819160c221d54ccf4b4bd2809c9d0178f6fa18e2c8ed4e848d04b45bf3b4e971789ad4b154c91346d457878074bad4870690c8a54e6afcebec724d36dcc4581217d08d8202d909b895e67cc5bc37e07ca1fff34f2d704e9fb342fc73f921f84b413036bf3d0665d3b4f2a17ec402cc4c5bbe5922ba27a1be7e721b72ffa0a49115c6d3bbeac14fdac7f2734ab93c84ddf2171b184bae76967dd81568a2749dcb02453ca76838f22104a53bc7fab92bb199ddfd67998c774efaed83cb041fd9231ff6950d35559f3d38915dcfb41744db46ed4acd6a39ecf2a00d79fb1c2a77ea762fdb83be7f305514458e190da32f7b8c76f389367d43c54630b6ba4bece50769627f4adba753956e349f5a750088d804d21c3a0a4ba1b0a0a89cd6496940f0bd1cf22d766c2acbcae4526b09e6349af05230d38586dceaa74e9dce0e4b5d47167a8856d062d84ec1788ae47a34d4e369c8b872eb1105d8ee7fd7b3832b31acb5bff561fa2b25ae057b69ed787a317eb4ea048838fc5b3f34a599ed15bc39edc0786f178cdbc1746ae26c1c4d925696b3d7ecf6c159eb822147c59268e470d04f62bae41fba88679e50c6c4b77ca16deac167e3535de0dd5af02a8a7780d3aa2a21984ac370f60fbd6174845d8b417eb8511ddb3835b66d0fdfdde0cf1e5cf5c84629c18a1be368ebdda3ff1d823ca007dc40ac652cb51bcecb24d091700d9b7f1805ffdd8a3495bfc120b4ef85f0340f018f2ba287b8059ed13f8cf24459fb17f4a6e0760a8e3671ccc6e7e067f71bbff96fe1dd0302804b1ee350fc8a0351d98152c00d62efbd409d77c50834f81c800c8c7b00f34cce53a9cfc72f50e05574ca8ad94737e05124c0ff735184a428a7cda2bd4e49afb2b3b9d65ca262ecaa18899b58524b423097bc260da8e9443f7e891ebe8189c7aee7b81948e0a5a56e67415aefcfcb1281699e0c81c9486112cf43b1e8546d5a3ca99ac3c0e6b0c8e29d2180a5eab93194d0fb6fef8c43cd2f6984435372642f7581d8d37424021c56458c0c089c870f7e608229971c53fc4f0ce45f746f01b1604101464574ba4e3ee54484a8e5584db9c109931f8abc21a7787c809f8c54d82f82438c24d4c9a90f2ba50fc58141c4f097fba0f4a43620a0e861c1101a63fd2e44ebc7e31258526e4a9b7c2e610d5916c5d938f0f32b068fc7cd0b893d512736edf757c2b2ed3b627fff5667225389bb02f20344c7b728e52891049525e9e781f9c09749dc917562459afb182a78147a970525e042d6fcddfc485c21de2e36e97e348a345806315ab906dfef205ad78826729c947db4880e3720b34500d5a4000040518fadfbf516d2c4a4ab14791c5fb712883c3b182e7ccda1a9b8a246f8653a69e984acc5318da7d89bcf2f33d89a57eef521067b99d02d3282ce62870a31c52514917c8d244bb1c7c87e2ff86850b008c6fdc2162838ff4d28d806c536a7a9eb940b9f5d674cc811c7431082639690f7c7eab015486261488047fa38afd3cf75db6f12012ce8e612224c2cfecce90ce7eae5664ef85a4a8b48e25b162827e2e9aac96101c685a7cdcde91372e7e7f70dab4648a2224a630f2af8eedb58278c427ff58920b33fdace727b9fb320594ec0a878b1d4ac355bb57cd81b2cf860987a56216a4528d65f4f086a83ceec7687f5fa92685123b1674681dfe26c292a31f539cce45d0afdd9c2fafb7de126c8c100b3a21451249de47482f2f5c32ccf198e6f2a9e27c2460568fafb04e4768f226077926ef105af16c6971d59f6e2c0527036d5c6acea011188225199750973d0d2a7dddadda0f38e63b01ceb893511ea74c8acad8af9c65980f31291375906a318db204f6d8cd0d10b6539a73ff7e56f646becedcc6c8dee6d511cce0ab61055f90cf8c30f5139cd4586924ddd5e0dea522c5f9fb48cde9ecf332d3ba8cfea317609348683a83f02276c593deca16a2a8432800ff1b14def72d4ac3ab3cbf0232c37242ca9c19ca19cdf8cdf9ce2644416a3bad00342f7d0d8e4dde67443be3ad16b494d70d4efa36ad846bbab04d96edeb8ac80a4b3a3b1bdada4336c272c1d353a00840d43338ede571fe565631f885849903389b46a38df8cac6b0a3dc3d53e6eb1019a04bf8e628ad92a3acef5c4ac95cf98a04bbfb5f6b5b778307f0832ef04b38a4fbb2121c5ce23273d7509b3216254d9d0f472b8330fc49508e9ec2373b003c4db07c66703399559899d94708d9d87e580fa34a96ddb946d80d94fd364867267869c9ac0703bb3a4d83c7c366a8b8986e75a020095c3b68bb52d0f15b14fef75c7ec8c2cc6a73af2715079d5c582a992edd07150c96a7ddba1833261f26fe2965753129670bacfe4ea879b65fe9c49255992a7aec4e80b8aab85ef4b2ffb0909c85d8d8218bb3ff30f9c26a8e49acc4a14f57cbd7053ecb8a293fce71925004ea2ef17b2dcb59b7f8c94b36f9c2bc421374d1d010059f6d305beb1df31d0fa64e0bf0f1fb4b8a8d8646ad63e2b60d8f72970640e97cc0da716b155ebbf3ffe21bb52b20537d69824a25ab0fe6bbbe911944d94e31bc14b044d05360a66c477a6fd6dd9e63b250488c2d7037a939d4e2b87220d2f62fe3e7ad019bff4e71f0c78eb2f11fb408b348b4f402cc00a394c1e5187ae22e2c2d529ad4b0c4fdd47666726dbe966b1b2af40c0c71883de5dfd796e8d460c1fd938724b78f392b0e5d1161ebda17db60312bcd386f397cdde5caf02e54180e88c88d99bfadd9471f7605976925fed355736e9e9b97041788e9abd95a6fc5cb645f6e7c3f9ce9cb119204ff353f8a32ac991d9590cbe81199a35f100f0df8a8788ef4f4b7cb7e0a6c0586ee2d3efb9e08d3893b66902c783eba0fea7d78fe703929e1d1b22a4a7a974ad48cc1914cee7dd87b9acf01f34a36bbfa2d45e0370b2db09054bce77e6386b3ff754c7db723a3ba6b0686d8e8f53f6f8015a67a6b973e7910ec685ad42e9449fe93046b06fb93b297849c6de6c8ab7b7acc4aae507b0f703650a58731bc5bec49cda73a873f005e9129eb7fe2db13221365b99931c757547b829adeb8c33e122d98135f54946b533c20fe0e8802f38cb511153670e584a719396225a581d3f46e24c9ca6b2bc9c31601517304720fa7d47b37992f5b1ebe3ec16f9ce2191670462aa22d2c204f03767373cce931f5aab0d2064a4c20ea7a5325c8c6eb0f0fc308d4513874f44566dd9d6e6e1b67df0e6b1018a81b4a2ec17e419a5b432c28cf4695b3559a7a24385adba42ca894275bfc23e49d68522d3952a4da9d83959a3ba6292eb11e0254e5b9599ff3d1411fc8d774572c9dccb310fab6e1a4dbf5f4e5bd8c06a875a711cc0f5799cc3d8a2c13cc95a9455483bc7e3402a9fb19dab88d873ff77b01cde491ca6c0bb56ded7afcf58e96e56c4343c0a3718d5c265f229d91ea4357fce4279fd0a902d287e29820daafb8e645848842f03dbcfd4d0a03cb0b781224ea79a8dd6c1d4c2e264916a5e9869fbbe887491c5dfac21660d8e8761a3229ddf44a7612ba3b42f7cad7f8fe073f0f12ff29c3c6383df2bcf7f79f070cacbc1e15ac5216379b950233b8f4dac327287936fdccc3008d4b37b53addd495c436177b60bd9d5019d8ae72cc05d4a8a0f57920fed982a49a688df7ca363c5b21536ec004fb3acef370b2bf2d38f95ba5371769869159da61250e0e4d4696a704a352baa6904c5c51471e2d0ab004d03af4f518bec1039dc181d446d4d500a09e26e633c26c38090314ad355096b2badd203e762f8e74e677438a18e4a16a62420c5e091ffdbec72a4a765165cea2a33864aeef3b6d387c48f3d6f11c3c96c3df0acfe1d9472fd79c9ba3b5f8857e97462672aff9f9df3e01947dda8235606380b126faf8d5ea46497ab4f1840b0bdbd3cb6b954b9ef1955509fbbb08fa26862a8e63b75a7d0fe7363c8acffb74542811e32d03aa537b4fa9b13a8417bd52ff9ce1939500b0d2d452004fa9b4e2a25fdd6d65628a2eec6ecfa6cab7894c4c0f5ade21a960024006286751cfed64f71e517baf9fba8f4e6097ba5bc1cef041cdacedac1baefd6ef738cf3065dd4ba1b6bfacbe9ce9681e9df6bc9a4a45da069a93809f7f4ce72bef31ee3a787e20d134952b9f48510bbedce3a09842df9c3cebe99e3e30db1537de867b24cb38bd78dec96e9a1acc30f865b8cf267c465b7c2ea9d0ea5600f77c90060531512d2ff92c6d146f43ae477b228187b57e7e761cbe8ec12830848bb44b39b6f25b457f2aef0a762d7a4eb9895bd3a5910414119cf62f2bc85fcceb7f9a982791de5339c4c63f00c3e83fad7d3da4238984c3b68fcc4a46cda6ac87bf889bc7e783aabd96d99f48da1aee1d0edda6787128922b0ce479ab61afe89cd927a1b76192a077437b0e6ddd5b7d263a8e08e55f596ee47193ca7f814bf1c0c6e9f599fe14b699b368f6162499e87"}]}, 0x1ec4}}, 0x0) 01:57:18 executing program 2: syz_emit_ethernet(0x66, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0xf, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0xf, 0x0, [@remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:57:18 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) [ 502.893071][T15367] binder: 15362:15367 unknown command 0 [ 502.926673][T15367] binder: 15362:15367 ioctl c0306201 20000200 returned -22 [ 502.938588][T15368] netlink: 'syz-executor.5': attribute type 2 has an invalid length. [ 502.969831][T15371] binder: 15362:15371 unknown command 0 [ 502.975248][T15368] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.5'. [ 502.990855][T15371] binder: 15362:15371 ioctl c0306201 20000200 returned -22 01:57:18 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt(r0, 0x0, 0x1, &(0x7f0000000080)="98", 0x1) [ 503.016240][T15367] binder_alloc: 15362: binder_alloc_buf, no vma 01:57:18 executing program 4: futex(0x0, 0x8b, 0x0, 0x0, &(0x7f0000001140), 0x0) 01:57:18 executing program 2: mq_getsetattr(0xffffffffffffffff, &(0x7f0000001100)={0x3}, &(0x7f0000001140)) 01:57:19 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:57:19 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$inet_group_source_req(r0, 0x0, 0x2a, &(0x7f0000000000)={0x0, {{0x4, 0x0, @multicast1}}, {{0x2, 0x0, @empty}}}, 0x5000) 01:57:19 executing program 2: r0 = epoll_create(0x8001) pipe(&(0x7f0000000a00)={0xffffffffffffffff}) epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r1) [ 503.266830][T15387] binder: 15381:15387 unknown command 0 [ 503.325238][T15387] binder: 15381:15387 ioctl c0306201 20000200 returned -22 01:57:21 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f0000000140)="66530700ae897094e7b126b097eaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26f45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e05485b4ff15f7", 0x4a}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000080)={0x78}, 0x78) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 01:57:21 executing program 4: perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0xffffffffffffffff, 0xa, 0xffffffffffffffff, 0x0) 01:57:21 executing program 0: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$PTP_ENABLE_PPS(r0, 0x40103d02, 0x400000) 01:57:21 executing program 5: r0 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$link(0xc, 0x0, r0) 01:57:21 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:57:21 executing program 2: msgctl$MSG_STAT_ANY(0x0, 0xd, &(0x7f0000001400)=""/111) [ 506.096831][T15411] binder: 15406:15411 unknown command 0 [ 506.121363][T15411] binder: 15406:15411 ioctl c0306201 20000200 returned -22 01:57:22 executing program 2: syz_mount_image$vfat(&(0x7f0000002700), &(0x7f0000002740)='./file0\x00', 0x0, 0x0, &(0x7f00000029c0), 0x2a04, &(0x7f0000002a40)) 01:57:22 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=@getspdinfo={0x14, 0x25, 0x1}, 0x14}}, 0x0) 01:57:22 executing program 0: syz_mount_image$fuse(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x50580, 0x0) 01:57:22 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) recvmmsg(r0, &(0x7f0000003e80)=[{{&(0x7f0000000180)=@hci, 0x80, 0x0, 0x0, &(0x7f0000000340)=""/110, 0x6e}}], 0x1, 0x0, &(0x7f0000003f40)={0x0, 0x3938700}) syz_genetlink_get_family_id$nl80211(&(0x7f0000004500), r0) 01:57:22 executing program 5: syz_open_dev$sg(&(0x7f00000001c0), 0x0, 0x20041) 01:57:22 executing program 2: r0 = getpid() r1 = getpgrp(0xffffffffffffffff) tgkill(r0, r1, 0x12) 01:57:25 executing program 2: syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x22, &(0x7f0000000440)) 01:57:25 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f0000000140)="66530700ae897094e7b126b097eaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26f45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e05485b4ff15f7", 0x4a}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000080)={0x78}, 0x78) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 01:57:25 executing program 0: syz_mount_image$vfat(&(0x7f0000002700), &(0x7f0000002740)='./file0\x00', 0x300, 0x0, &(0x7f00000029c0), 0x0, &(0x7f0000002a40)) 01:57:25 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) getsockname(r0, 0x0, &(0x7f0000006bc0)) 01:57:25 executing program 4: get_mempolicy(0x0, &(0x7f00000000c0), 0x8, &(0x7f0000ffc000/0x1000)=nil, 0x2) 01:57:25 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:57:25 executing program 4: syz_mount_image$msdos(0x0, 0x0, 0x0, 0x4, &(0x7f0000000480)=[{&(0x7f00000000c0)='y', 0x1}, {&(0x7f0000000100)="e7", 0x1}, {&(0x7f0000000140)="ad", 0x1}, {&(0x7f0000000300)='0', 0x1}], 0x0, 0x0) 01:57:25 executing program 0: syz_io_uring_setup(0x7fb8, &(0x7f0000000000), &(0x7f0000b94000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000080), 0x0) mbind(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x3, &(0x7f0000000180)=0x3, 0x2, 0x3) 01:57:25 executing program 5: socketpair(0x10, 0x2, 0x0, &(0x7f0000000800)) [ 509.261752][T15462] binder: 15456:15462 unknown command 0 [ 509.297120][T15462] binder: 15456:15462 ioctl c0306201 20000200 returned -22 01:57:25 executing program 2: mq_open(&(0x7f0000000040)='.(#\xa7)$\\*(%}@\x034\xf46|K\xddo\xaf\xf8\x11\xb5q\n\xc5\xc4\xb3\xbc\x98\xf9&\xa2\x9b\x96\xa9b\xc7\x91', 0x40, 0x0, 0x0) 01:57:25 executing program 5: syz_io_uring_setup(0x523c, &(0x7f0000000580), &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000600), &(0x7f0000000640)) 01:57:25 executing program 4: creat(&(0x7f0000005c40)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x88d001, 0x0) 01:57:25 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)={0x2, 0x5, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 01:57:28 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f0000000140)="66530700ae897094e7b126b097eaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26f45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e05485b4ff15f7", 0x4a}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000080)={0x78}, 0x78) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 01:57:28 executing program 0: creat(&(0x7f00000000c0)='./file0\x00', 0x0) mount$9p_unix(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f00000004c0), 0x0, &(0x7f0000000540)={'trans=unix,', {[{@msize={'msize', 0x3d, 0x4000000000000000}}, {@msize}]}}) 01:57:28 executing program 5: r0 = socket(0x1, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r0, 0x541b, &(0x7f0000000000)) 01:57:28 executing program 2: creat(&(0x7f0000005c40)='./file0\x00', 0x0) mount$9p_xen(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000000340)={'trans=xen,', {[{@version_u}]}}) 01:57:28 executing program 4: socketpair(0x11, 0xa, 0xe, &(0x7f0000000240)) 01:57:28 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:57:28 executing program 4: process_vm_writev(0x0, &(0x7f0000000040)=[{&(0x7f0000000000)=""/26, 0x1a}], 0x1, &(0x7f0000000340)=[{&(0x7f0000000080)=""/54, 0x36}, {0x0}], 0x2, 0x0) 01:57:28 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$inet_group_source_req(r0, 0x0, 0x2e, &(0x7f0000000000)={0x3, {{0x2, 0x0, @multicast1}}, {{0x2, 0x0, @empty}}}, 0x108) [ 512.341826][T15504] binder: 15498:15504 unknown command 0 [ 512.355013][T15503] 9pnet: Could not find request transport: xen [ 512.361924][T15504] binder: 15498:15504 ioctl c0306201 20000200 returned -22 [ 512.418012][T15504] binder: 15498:15504 ioctl c0306201 0 returned -14 01:57:28 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCDARP(r0, 0x8955, &(0x7f0000000000)={{0x2, 0x0, @empty}, {0x1, @remote}, 0x2, {0x2, 0x0, @multicast1}, 'syz_tun\x00'}) 01:57:28 executing program 2: r0 = fanotify_init(0x0, 0x0) fanotify_mark(r0, 0x12, 0x8, 0xffffffffffffffff, 0x0) 01:57:28 executing program 4: r0 = getpid() rt_tgsigqueueinfo(0x0, r0, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x6}) 01:57:28 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000000), 0x4) 01:57:31 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f0000000140)="66530700ae897094e7b126b097eaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26f45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e05485b4ff15f7", 0x4a}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000080)={0x78}, 0x78) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 01:57:31 executing program 2: r0 = add_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x1}, &(0x7f0000000080)='h', 0x1, 0xfffffffffffffffe) r1 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$KEYCTL_MOVE(0x1e, r0, 0xfffffffffffffffe, r1, 0x0) 01:57:31 executing program 0: socketpair(0x1d, 0x0, 0x10001, &(0x7f0000000080)) 01:57:31 executing program 4: pipe(&(0x7f0000000a00)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) 01:57:31 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) setsockopt$sock_timeval(r0, 0x1, 0x2b, &(0x7f0000000000)={0x0, 0xea60}, 0x10) 01:57:31 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) [ 515.422920][T15541] binder: 15536:15541 unknown command 0 [ 515.450798][T15541] binder: 15536:15541 ioctl c0306201 20000200 returned -22 01:57:31 executing program 5: futex(0x0, 0x8b, 0x0, &(0x7f0000001100), &(0x7f0000001140), 0x0) 01:57:31 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) getsockopt$sock_int(r0, 0x1, 0x15, 0x0, &(0x7f00000000c0)) 01:57:31 executing program 2: request_key(&(0x7f0000000100)='logon\x00', &(0x7f0000000140)={'syz', 0x0}, &(0x7f0000000180)='^\n\x00', 0x0) [ 515.503244][T15541] binder: 15536:15541 ioctl c0306201 0 returned -14 01:57:31 executing program 4: sendmsg$NLBL_MGMT_C_ADD(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) prctl$PR_GET_PDEATHSIG(0x2, &(0x7f0000000040)) 01:57:31 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$inet_group_source_req(r0, 0x0, 0x30, &(0x7f0000000000)={0x0, {{0x2, 0x0, @multicast1}}, {{0x2, 0x0, @empty}}}, 0x20000108) 01:57:31 executing program 5: syz_mount_image$msdos(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)={[], [{@smackfsdef={'smackfsdef', 0x3d, '%+).'}}, {@defcontext={'defcontext', 0x3d, 'root'}}, {@smackfsfloor={'smackfsfloor', 0x3d, '/))^^'}}, {@smackfsdef={'smackfsdef', 0x3d, '\x00'}}]}) 01:57:34 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f0000000140)="66530700ae897094e7b126b097eaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26f45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e05485b4ff15f7", 0x4a}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000080)={0x78}, 0x78) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 01:57:34 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$IP_VS_SO_GET_INFO(r0, 0x0, 0x481, 0x0, 0x0) 01:57:34 executing program 4: syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x0, 0x0, &(0x7f0000000380), 0x1000040, &(0x7f0000000a80)=ANY=[@ANYBLOB='dmask=0']) 01:57:34 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$inet_mreqsrc(r0, 0x0, 0x22, 0x0, &(0x7f00000000c0)) 01:57:34 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) getsockopt$sock_int(r0, 0x1, 0x13, 0x0, &(0x7f00000000c0)) 01:57:34 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:57:34 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) recvmmsg(r0, &(0x7f0000001b80)=[{{0x0, 0x0, &(0x7f0000001ac0)=[{0x0}, {&(0x7f00000015c0)=""/37, 0x25}, {&(0x7f0000001600)=""/207, 0xcf}], 0x3}, 0xa9}], 0x1, 0x0, &(0x7f0000001c00)) syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), r0) [ 518.579117][T15585] binder: 15577:15585 unknown command 0 [ 518.587422][T15584] FAT-fs (loop4): bogus number of reserved sectors [ 518.605483][T15584] FAT-fs (loop4): Can't find a valid FAT filesystem 01:57:34 executing program 0: statx(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0, &(0x7f0000000180)) [ 518.623537][T15585] binder: 15577:15585 ioctl c0306201 20000200 returned -22 01:57:34 executing program 5: syz_io_uring_setup(0x2105, &(0x7f0000000380), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, 0x0) execveat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0) [ 518.668276][T15590] binder: 15577:15590 ioctl c0306201 0 returned -14 [ 518.678487][T15584] FAT-fs (loop4): bogus number of reserved sectors [ 518.692274][T15584] FAT-fs (loop4): Can't find a valid FAT filesystem 01:57:34 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:57:34 executing program 4: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_MGMT_C_ADDDEF(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)={0x28, 0x0, 0x0, 0x0, 0x0, {}, [@NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @remote}]}, 0x28}, 0x25}, 0x0) 01:57:34 executing program 2: msgsnd(0x0, &(0x7f0000001680)={0x2}, 0x8, 0x0) [ 518.946573][T15607] binder: 15603:15607 unknown command 0 [ 518.964785][T15607] binder: 15603:15607 ioctl c0306201 20000200 returned -22 01:57:37 executing program 5: process_vm_writev(0x0, &(0x7f0000000040)=[{&(0x7f0000000000)=""/26, 0x1a}], 0x1, 0x0, 0x0, 0x0) 01:57:37 executing program 0: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000000b40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) 01:57:37 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f0000000140)="66530700ae897094e7b126b097eaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26f45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e05485b4ff15f7", 0x4a}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000080)={0x78}, 0x78) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 01:57:37 executing program 4: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), r0) sendmsg$NLBL_MGMT_C_ADDDEF(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)={0x44, r1, 0x1, 0x0, 0x0, {}, [@NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @remote}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @empty}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x5}]}, 0x44}}, 0x0) 01:57:37 executing program 2: r0 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$link(0x11, r0, r0) 01:57:37 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:57:37 executing program 5: mprotect(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x1000003) 01:57:37 executing program 2: syz_mount_image$msdos(0x0, 0x0, 0x0, 0x3, &(0x7f0000000500)=[{&(0x7f0000000340)="7f", 0x1}, {&(0x7f0000000440)="be", 0x1, 0xfffffffffffffffe}, {&(0x7f00000004c0)="e7", 0x1}], 0x0, 0x0) [ 521.692381][T15633] binder: 15628:15633 unknown command 0 [ 521.716226][T15633] binder: 15628:15633 ioctl c0306201 20000200 returned -22 01:57:37 executing program 4: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000100)) [ 521.829678][T15641] loop2: detected capacity change from 0 to 16383 01:57:37 executing program 5: recvmsg(0xffffffffffffffff, 0x0, 0xefde1ff5cb114211) [ 521.914902][T15641] loop2: detected capacity change from 0 to 16383 01:57:37 executing program 4: r0 = msgget$private(0x0, 0x0) msgrcv(r0, 0x0, 0x0, 0x0, 0x0) 01:57:37 executing program 2: memfd_create(&(0x7f0000000180)='\\(#\xa7)$\\*(%}@\x03\x12\xf46|K\xddo\xaf\xf8\x11\xb5q\n\xc5\xc4\xb3\xbc\x98\xf9&\xa2\x9b\x96\xa9b\xc7\x91\x81\xcc\x89Y\xf1E+\x88\xb1\v\xea\xab0C:p8\x0f\xab\x03\xf5\xf4\xe0\xa0T\x18\b\x8bn\x11OxJ\xa9i\xa1\xdb\n\xfc\xbe\xa1l\x93]\xe2\xf6\xa2J,_\x915~?+\x83\x84X\x92\xe91f\xd4W[c\x8d\x8d\x11SS\xbe\x98\xaf\xb0K\xa6\xabDI\xfax\xe9\x8a\x9f\xa0\x93\xd0\xd7fj\xf3G\x86\xe4\xd9\x01\x92\xa6\x9bz\x8c\t\xf4f6i\x1cb\xce\x89sD\xec\xf7\xf2\xfc\xe4\x916\x953\xa9H\x9f\xf0\xcc\t\xea;\x16\x9d\xce>\br\x02\xa6\xb9*\x1f\xd1\xf3\xedZ@)E\xdf\x95wA>\ti\xae\xd5\xb5\xd09\"\xd4\x84\x87l\xbb\xa6\x9bNq\xbd\xa4\xb7\xb9\xc0\xa7e\x17\xdb\xcd\xfb\x86\xf8`\x8fpg\x82\v\x82\xca\x82\xb4R\x82\xces\xdc\x8c\x84\x88\xd2\xe0,\x0f\xfav\xa6o\v\xf9\xd54HB\x98\xdf9H', 0x0) 01:57:37 executing program 5: pipe(&(0x7f0000000a00)={0xffffffffffffffff}) epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r0) 01:57:38 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001100)={0xffffffffffffffff}) write(r0, 0x0, 0x0) 01:57:40 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f0000000140)="66530700ae897094e7b126b097eaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26f45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e05485b4ff15f7", 0x4a}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000080)={0x78}, 0x78) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 01:57:40 executing program 5: socket$inet6(0xa, 0x3, 0x3a) 01:57:40 executing program 2: r0 = socket$packet(0x11, 0x2, 0x300) r1 = dup(r0) setsockopt$netlink_NETLINK_PKTINFO(r1, 0x10e, 0x3, &(0x7f0000000000), 0xffffffffffffff91) 01:57:40 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:57:40 executing program 0: r0 = openat$zero(0xffffffffffffff9c, &(0x7f00000012c0), 0x80241, 0x0) write$P9_RCLUNK(r0, 0x0, 0x0) 01:57:40 executing program 4: syz_emit_ethernet(0x66, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0xf, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0xf, 0x0, [@empty=0x1000000, @remote, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:57:40 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) [ 524.841134][T15687] binder: 15680:15687 unknown command 0 [ 524.880568][T15687] binder: 15680:15687 ioctl c0306201 20000200 returned -22 01:57:40 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:57:40 executing program 0: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0xfffffecc) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r1, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000e66d1808b11342000d340000000109021b00010000d5a00904"], 0x0) syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000580)=ANY=[@ANYBLOB="1201000200000020ef0e01a04000010203010902240001014050090904000502030101010921faff620122480509058103000401039741980380a201400ec815d08ac91e0abe457e32d53eb78dc2842fb3ba32617823ec82885f901e43fe336ffafb8c188a1011f8dcbde199a7a5c0d412196c90b09ed64b699d432e1957440d5c7fa4fe2716ad128c38d7c1c416aa7bdd672edd95fba6869b14301d4618e927ac91d21c830188e14efecb88a1ba58a80c6b3e658f2d911e53760d5388e25ea258be890000000000ebae33754618e7eceb20982c13a646cb5dd4f87c49195bf84d6fa715170bb3718007a72e12df2a565509"], &(0x7f0000000200)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x110, 0x2, 0x81, 0x0, 0x10, 0x40}, 0x50, &(0x7f00000000c0)={0x5, 0xf, 0x50, 0x6, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x0, 0x8d, 0x72, 0x2}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x7, "a82ed34424fe499dd2cb35e2663eb62e"}, @ss_container_id={0x14, 0x10, 0x4, 0x9, "9e596909e0c1c4c9efabccfa38f499f4"}, @wireless={0xb, 0x10, 0x1, 0x4, 0x8, 0x4, 0x81, 0x5, 0x88}, @wireless={0xb, 0x10, 0x1, 0x4, 0x5, 0x1, 0xf0, 0x8, 0x20}]}, 0x2, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x42f}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x425}}]}) pipe(&(0x7f0000000240)) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r3, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) 01:57:40 executing program 4: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0xfffffecc) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r1, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000e66d1808b11342000d340000000109021b00010000d5a00904"], 0x0) syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000580)=ANY=[@ANYBLOB="1201000200000020ef0e01a04000010203010902240001014050090904000502030101010921faff620122480509058103000401039741980380a201400ec815d08ac91e0abe457e32d53eb78dc2842fb3ba32617823ec82885f901e43fe336ffafb8c188a1011f8dcbde199a7a5c0d412196c90b09ed64b699d432e1957440d5c7fa4fe2716ad128c38d7c1c416aa7bdd672edd95fba6869b14301d4618e927ac91d21c830188e14efecb88a1ba58a80c6b3e658f2d911e53760d5388e25ea258be890000000000ebae33754618e7eceb20982c13a646cb5dd4f87c49195bf84d6fa715170bb3718007a72e12df2a565509"], &(0x7f0000000200)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x110, 0x2, 0x81, 0x0, 0x10, 0x40}, 0x50, &(0x7f00000000c0)={0x5, 0xf, 0x50, 0x6, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x0, 0x8d, 0x72, 0x2}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x7, "a82ed34424fe499dd2cb35e2663eb62e"}, @ss_container_id={0x14, 0x10, 0x4, 0x9, "9e596909e0c1c4c9efabccfa38f499f4"}, @wireless={0xb, 0x10, 0x1, 0x4, 0x8, 0x4, 0x81, 0x5, 0x88}, @wireless={0xb, 0x10, 0x1, 0x4, 0x5, 0x1, 0xf0, 0x8, 0x20}]}, 0x2, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x42f}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x425}}]}) pipe(&(0x7f0000000240)) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) [ 524.982100][T15692] binder: 15691:15692 unknown command 0 [ 524.993371][T15692] binder: 15691:15692 ioctl c0306201 20000200 returned -22 [ 525.042051][T15692] binder: 15691:15692 unknown command 0 [ 525.061519][T15692] binder: 15691:15692 ioctl c0306201 20000200 returned -22 [ 525.085961][T15697] binder: 15694:15697 unknown command 0 [ 525.099669][T15697] binder: 15694:15697 ioctl c0306201 20000200 returned -22 [ 525.119018][T15692] binder_alloc: 15691: binder_alloc_buf, no vma 01:57:41 executing program 2: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0xfffffecc) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r1, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000e66d1808b11342000d340000000109021b00010000d5a00904"], 0x0) syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000580)=ANY=[@ANYBLOB="1201000200000020ef0e01a04000010203010902240001014050090904000502030101010921faff620122480509058103000401039741980380a201400ec815d08ac91e0abe457e32d53eb78dc2842fb3ba32617823ec82885f901e43fe336ffafb8c188a1011f8dcbde199a7a5c0d412196c90b09ed64b699d432e1957440d5c7fa4fe2716ad128c38d7c1c416aa7bdd672edd95fba6869b14301d4618e927ac91d21c830188e14efecb88a1ba58a80c6b3e658f2d911e53760d5388e25ea258be890000000000ebae33754618e7eceb20982c13a646cb5dd4f87c49195bf84d6fa715170bb3718007a72e12df2a565509"], &(0x7f0000000200)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x110, 0x2, 0x81, 0x0, 0x10, 0x40}, 0x50, &(0x7f00000000c0)={0x5, 0xf, 0x50, 0x6, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x0, 0x8d, 0x72, 0x2}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x7, "a82ed34424fe499dd2cb35e2663eb62e"}, @ss_container_id={0x14, 0x10, 0x4, 0x9, "9e596909e0c1c4c9efabccfa38f499f4"}, @wireless={0xb, 0x10, 0x1, 0x4, 0x8, 0x4, 0x81, 0x5, 0x88}, @wireless={0xb, 0x10, 0x1, 0x4, 0x5, 0x1, 0xf0, 0x8, 0x20}]}, 0x2, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x42f}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x425}}]}) pipe(&(0x7f0000000240)) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) [ 525.185106][T15697] binder: 15694:15697 unknown command 0 [ 525.196337][T15697] binder: 15694:15697 ioctl c0306201 20000200 returned -22 [ 525.231958][T15697] binder_alloc: 15694: binder_alloc_buf, no vma 01:57:41 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) [ 525.403329][T15713] binder: 15711:15713 unknown command 0 [ 525.415330][ T20] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 525.418411][T15713] binder: 15711:15713 ioctl c0306201 20000200 returned -22 [ 525.463422][T15713] binder: 15711:15713 unknown command 0 [ 525.469320][ T5] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 525.484753][T15713] binder: 15711:15713 ioctl c0306201 20000200 returned -22 [ 525.510498][T15713] binder_alloc: 15711: binder_alloc_buf, no vma [ 525.656677][ T20] usb 1-1: Using ep0 maxpacket: 8 [ 525.667523][T10435] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 525.765516][ T5] usb 5-1: Using ep0 maxpacket: 8 [ 525.778033][ T20] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 525.798024][ T20] usb 1-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=34.0d [ 525.813537][ T20] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 525.839395][ T20] usb 1-1: config 0 descriptor?? [ 525.898805][ T20] ath10k_warn: 2 callbacks suppressed [ 525.898830][ T20] usb 1-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 525.916234][ T5] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 525.955252][T10435] usb 3-1: Using ep0 maxpacket: 8 [ 525.974146][ T5] usb 5-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=34.0d [ 526.000192][ T5] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 526.014045][ T5] usb 5-1: config 0 descriptor?? [ 526.085411][T10435] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 526.115202][T10435] usb 3-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=34.0d [ 526.128131][ T5] usb 5-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 526.138769][T15702] udc-core: couldn't find an available UDC or it's busy [ 526.148660][T15702] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 526.153862][T10435] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 526.182276][T10435] usb 3-1: config 0 descriptor?? [ 526.260415][T10435] usb 3-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 526.323889][T15703] udc-core: couldn't find an available UDC or it's busy [ 526.331225][T15703] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 526.478746][T15712] udc-core: couldn't find an available UDC or it's busy [ 526.485901][T15712] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 526.976072][T13825] usb 1-1: Failed to submit usb control message: -110 [ 526.983206][T13825] usb 1-1: unable to send the bmi data to the device: -110 [ 527.002420][T13825] usb 1-1: unable to get target info from device [ 527.013213][T13825] usb 1-1: could not get target info (-110) [ 527.023976][T13825] usb 1-1: could not probe fw (-110) [ 527.205275][ T10] usb 5-1: Failed to submit usb control message: -110 [ 527.212549][ T10] usb 5-1: unable to send the bmi data to the device: -110 [ 527.235048][ T10] usb 5-1: unable to get target info from device [ 527.241781][ T10] usb 5-1: could not get target info (-110) [ 527.258823][ T10] usb 5-1: could not probe fw (-110) [ 527.295176][T13821] usb 3-1: Failed to submit usb control message: -110 [ 527.302377][T13821] usb 3-1: could not get target info (-110) [ 527.323830][T13821] usb 3-1: could not probe fw (-110) 01:57:43 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:57:43 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {&(0x7f0000000140)="66530700ae897094e7b126b097eaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26f45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e05485b4ff15f7", 0x4a}], 0x3, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000080)={0x78}, 0x78) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 01:57:43 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000004c0), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) [ 527.910007][T15760] binder: 15756:15760 unknown command 0 [ 527.927906][T15760] binder: 15756:15760 ioctl c0306201 20000200 returned -22 [ 527.946793][T15761] binder: 15755:15761 unknown command 0 [ 527.952388][T15761] binder: 15755:15761 ioctl c0306201 20000200 returned -22 [ 527.985522][T15761] binder: 15755:15761 unknown command 0 [ 527.991499][T15761] binder: 15755:15761 ioctl c0306201 20000200 returned -22 [ 528.028647][T15761] binder_alloc: 15755: binder_alloc_buf, no vma 01:57:44 executing program 4: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0xfffffecc) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r1, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000e66d1808b11342000d340000000109021b00010000d5a00904"], 0x0) syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000580)=ANY=[@ANYBLOB="1201000200000020ef0e01a04000010203010902240001014050090904000502030101010921faff620122480509058103000401039741980380a201400ec815d08ac91e0abe457e32d53eb78dc2842fb3ba32617823ec82885f901e43fe336ffafb8c188a1011f8dcbde199a7a5c0d412196c90b09ed64b699d432e1957440d5c7fa4fe2716ad128c38d7c1c416aa7bdd672edd95fba6869b14301d4618e927ac91d21c830188e14efecb88a1ba58a80c6b3e658f2d911e53760d5388e25ea258be890000000000ebae33754618e7eceb20982c13a646cb5dd4f87c49195bf84d6fa715170bb3718007a72e12df2a565509"], &(0x7f0000000200)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x110, 0x2, 0x81, 0x0, 0x10, 0x40}, 0x50, &(0x7f00000000c0)={0x5, 0xf, 0x50, 0x6, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x0, 0x8d, 0x72, 0x2}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x7, "a82ed34424fe499dd2cb35e2663eb62e"}, @ss_container_id={0x14, 0x10, 0x4, 0x9, "9e596909e0c1c4c9efabccfa38f499f4"}, @wireless={0xb, 0x10, 0x1, 0x4, 0x8, 0x4, 0x81, 0x5, 0x88}, @wireless={0xb, 0x10, 0x1, 0x4, 0x5, 0x1, 0xf0, 0x8, 0x20}]}, 0x2, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x42f}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x425}}]}) pipe(&(0x7f0000000240)) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) 01:57:44 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) [ 528.092181][ T5] usb 5-1: USB disconnect, device number 2 [ 528.093140][ T4881] usb 1-1: USB disconnect, device number 6 01:57:44 executing program 0: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0xfffffecc) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r1, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000e66d1808b11342000d340000000109021b00010000d5a00904"], 0x0) syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000580)=ANY=[@ANYBLOB="1201000200000020ef0e01a04000010203010902240001014050090904000502030101010921faff620122480509058103000401039741980380a201400ec815d08ac91e0abe457e32d53eb78dc2842fb3ba32617823ec82885f901e43fe336ffafb8c188a1011f8dcbde199a7a5c0d412196c90b09ed64b699d432e1957440d5c7fa4fe2716ad128c38d7c1c416aa7bdd672edd95fba6869b14301d4618e927ac91d21c830188e14efecb88a1ba58a80c6b3e658f2d911e53760d5388e25ea258be890000000000ebae33754618e7eceb20982c13a646cb5dd4f87c49195bf84d6fa715170bb3718007a72e12df2a565509"], &(0x7f0000000200)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x110, 0x2, 0x81, 0x0, 0x10, 0x40}, 0x50, &(0x7f00000000c0)={0x5, 0xf, 0x50, 0x6, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x0, 0x8d, 0x72, 0x2}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x7, "a82ed34424fe499dd2cb35e2663eb62e"}, @ss_container_id={0x14, 0x10, 0x4, 0x9, "9e596909e0c1c4c9efabccfa38f499f4"}, @wireless={0xb, 0x10, 0x1, 0x4, 0x8, 0x4, 0x81, 0x5, 0x88}, @wireless={0xb, 0x10, 0x1, 0x4, 0x5, 0x1, 0xf0, 0x8, 0x20}]}, 0x2, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x42f}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x425}}]}) pipe(&(0x7f0000000240)) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) [ 528.310415][T15783] binder: 15779:15783 unknown command 0 [ 528.316391][T15783] binder: 15779:15783 ioctl c0306201 20000200 returned -22 [ 528.332997][T15783] binder: 15779:15783 unknown command 0 [ 528.339940][T15783] binder: 15779:15783 ioctl c0306201 20000200 returned -22 01:57:44 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:57:44 executing program 2: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0xfffffecc) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r1, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000e66d1808b11342000d340000000109021b00010000d5a00904"], 0x0) syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000580)=ANY=[@ANYBLOB="1201000200000020ef0e01a04000010203010902240001014050090904000502030101010921faff620122480509058103000401039741980380a201400ec815d08ac91e0abe457e32d53eb78dc2842fb3ba32617823ec82885f901e43fe336ffafb8c188a1011f8dcbde199a7a5c0d412196c90b09ed64b699d432e1957440d5c7fa4fe2716ad128c38d7c1c416aa7bdd672edd95fba6869b14301d4618e927ac91d21c830188e14efecb88a1ba58a80c6b3e658f2d911e53760d5388e25ea258be890000000000ebae33754618e7eceb20982c13a646cb5dd4f87c49195bf84d6fa715170bb3718007a72e12df2a565509"], &(0x7f0000000200)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x110, 0x2, 0x81, 0x0, 0x10, 0x40}, 0x50, &(0x7f00000000c0)={0x5, 0xf, 0x50, 0x6, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x0, 0x8d, 0x72, 0x2}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x7, "a82ed34424fe499dd2cb35e2663eb62e"}, @ss_container_id={0x14, 0x10, 0x4, 0x9, "9e596909e0c1c4c9efabccfa38f499f4"}, @wireless={0xb, 0x10, 0x1, 0x4, 0x8, 0x4, 0x81, 0x5, 0x88}, @wireless={0xb, 0x10, 0x1, 0x4, 0x5, 0x1, 0xf0, 0x8, 0x20}]}, 0x2, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x42f}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x425}}]}) pipe(&(0x7f0000000240)) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r4, r7, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) [ 528.367281][ T9674] usb 3-1: USB disconnect, device number 3 01:57:44 executing program 4: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0xfffffecc) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r1, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000e66d1808b11342000d340000000109021b00010000d5a00904"], 0x0) syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000580)=ANY=[@ANYBLOB="1201000200000020ef0e01a04000010203010902240001014050090904000502030101010921faff620122480509058103000401039741980380a201400ec815d08ac91e0abe457e32d53eb78dc2842fb3ba32617823ec82885f901e43fe336ffafb8c188a1011f8dcbde199a7a5c0d412196c90b09ed64b699d432e1957440d5c7fa4fe2716ad128c38d7c1c416aa7bdd672edd95fba6869b14301d4618e927ac91d21c830188e14efecb88a1ba58a80c6b3e658f2d911e53760d5388e25ea258be890000000000ebae33754618e7eceb20982c13a646cb5dd4f87c49195bf84d6fa715170bb3718007a72e12df2a565509"], &(0x7f0000000200)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x110, 0x2, 0x81, 0x0, 0x10, 0x40}, 0x50, &(0x7f00000000c0)={0x5, 0xf, 0x50, 0x6, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x0, 0x8d, 0x72, 0x2}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x7, "a82ed34424fe499dd2cb35e2663eb62e"}, @ss_container_id={0x14, 0x10, 0x4, 0x9, "9e596909e0c1c4c9efabccfa38f499f4"}, @wireless={0xb, 0x10, 0x1, 0x4, 0x8, 0x4, 0x81, 0x5, 0x88}, @wireless={0xb, 0x10, 0x1, 0x4, 0x5, 0x1, 0xf0, 0x8, 0x20}]}, 0x2, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x42f}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x425}}]}) pipe(&(0x7f0000000240)) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) 01:57:44 executing program 0: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0xfffffecc) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r1, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000e66d1808b11342000d340000000109021b00010000d5a00904"], 0x0) syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000580)=ANY=[@ANYBLOB="1201000200000020ef0e01a04000010203010902240001014050090904000502030101010921faff620122480509058103000401039741980380a201400ec815d08ac91e0abe457e32d53eb78dc2842fb3ba32617823ec82885f901e43fe336ffafb8c188a1011f8dcbde199a7a5c0d412196c90b09ed64b699d432e1957440d5c7fa4fe2716ad128c38d7c1c416aa7bdd672edd95fba6869b14301d4618e927ac91d21c830188e14efecb88a1ba58a80c6b3e658f2d911e53760d5388e25ea258be890000000000ebae33754618e7eceb20982c13a646cb5dd4f87c49195bf84d6fa715170bb3718007a72e12df2a565509"], &(0x7f0000000200)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x110, 0x2, 0x81, 0x0, 0x10, 0x40}, 0x50, &(0x7f00000000c0)={0x5, 0xf, 0x50, 0x6, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x0, 0x8d, 0x72, 0x2}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x7, "a82ed34424fe499dd2cb35e2663eb62e"}, @ss_container_id={0x14, 0x10, 0x4, 0x9, "9e596909e0c1c4c9efabccfa38f499f4"}, @wireless={0xb, 0x10, 0x1, 0x4, 0x8, 0x4, 0x81, 0x5, 0x88}, @wireless={0xb, 0x10, 0x1, 0x4, 0x5, 0x1, 0xf0, 0x8, 0x20}]}, 0x2, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x42f}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x425}}]}) pipe(&(0x7f0000000240)) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) [ 528.541668][T15797] binder: 15793:15797 unknown command 0 [ 528.574756][T15797] binder: 15793:15797 ioctl c0306201 20000200 returned -22 [ 528.609677][T15797] binder: 15793:15797 unknown command 0 [ 528.634443][T15797] binder: 15793:15797 ioctl c0306201 20000200 returned -22 01:57:44 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:57:44 executing program 2: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0xfffffecc) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r1, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000e66d1808b11342000d340000000109021b00010000d5a00904"], 0x0) syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000580)=ANY=[@ANYBLOB="1201000200000020ef0e01a04000010203010902240001014050090904000502030101010921faff620122480509058103000401039741980380a201400ec815d08ac91e0abe457e32d53eb78dc2842fb3ba32617823ec82885f901e43fe336ffafb8c188a1011f8dcbde199a7a5c0d412196c90b09ed64b699d432e1957440d5c7fa4fe2716ad128c38d7c1c416aa7bdd672edd95fba6869b14301d4618e927ac91d21c830188e14efecb88a1ba58a80c6b3e658f2d911e53760d5388e25ea258be890000000000ebae33754618e7eceb20982c13a646cb5dd4f87c49195bf84d6fa715170bb3718007a72e12df2a565509"], &(0x7f0000000200)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x110, 0x2, 0x81, 0x0, 0x10, 0x40}, 0x50, &(0x7f00000000c0)={0x5, 0xf, 0x50, 0x6, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x0, 0x8d, 0x72, 0x2}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x7, "a82ed34424fe499dd2cb35e2663eb62e"}, @ss_container_id={0x14, 0x10, 0x4, 0x9, "9e596909e0c1c4c9efabccfa38f499f4"}, @wireless={0xb, 0x10, 0x1, 0x4, 0x8, 0x4, 0x81, 0x5, 0x88}, @wireless={0xb, 0x10, 0x1, 0x4, 0x5, 0x1, 0xf0, 0x8, 0x20}]}, 0x2, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x42f}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x425}}]}) pipe(&(0x7f0000000240)) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r4, r7, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) 01:57:44 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000004c0), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) [ 528.828668][T15813] binder: 15811:15813 unknown command 0 [ 528.841266][T15813] binder: 15811:15813 ioctl c0306201 20000200 returned -22 [ 528.873526][T15813] binder: 15811:15813 unknown command 0 [ 528.873958][T15816] binder: 15814:15816 unknown command 0 [ 528.888973][T15813] binder: 15811:15813 ioctl c0306201 20000200 returned -22 [ 528.893365][T15816] binder: 15814:15816 ioctl c0306201 20000200 returned -22 [ 528.945020][ T9674] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 529.021990][ T4881] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 529.225081][T10740] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 529.250048][ T9674] usb 5-1: Using ep0 maxpacket: 8 [ 529.305014][ T4881] usb 1-1: Using ep0 maxpacket: 8 [ 529.386236][ T9674] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 529.416390][ T9674] usb 5-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=34.0d [ 529.443486][ T9674] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 529.452783][ T4881] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 529.463762][ T4881] usb 1-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=34.0d [ 529.475195][T10740] usb 3-1: Using ep0 maxpacket: 8 [ 529.480745][ T4881] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 529.492764][ T9674] usb 5-1: config 0 descriptor?? [ 529.511528][ T4881] usb 1-1: config 0 descriptor?? [ 529.605962][T10740] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 529.618905][T10740] usb 3-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=34.0d [ 529.628492][T10740] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 529.657025][T10740] usb 3-1: config 0 descriptor?? [ 529.854670][T15808] udc-core: couldn't find an available UDC or it's busy [ 529.861953][T15808] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 529.901251][T15803] udc-core: couldn't find an available UDC or it's busy [ 529.919871][T15803] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 530.000546][T15817] udc-core: couldn't find an available UDC or it's busy [ 530.012212][T15817] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 530.584819][T13825] usb 5-1: could not get target info (-110) [ 530.591186][T13825] usb 5-1: could not probe fw (-110) [ 530.654764][T13818] usb 1-1: could not get target info (-110) [ 530.661289][T13818] usb 1-1: could not probe fw (-110) [ 530.824743][ T8] usb 3-1: could not get target info (-110) [ 530.831182][ T8] usb 3-1: could not probe fw (-110) 01:57:46 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000140)="66530700ae897094e7b126b097eaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26f45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e05485b4ff15f7", 0x4a}], 0x4, 0x0) ptrace$setopts(0xffffffffffffffff, r0, 0x0, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000080)={0x78}, 0x78) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 01:57:46 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:57:46 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000004c0), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:57:46 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000140)="66530700ae897094e7b126b097eaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26f45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e05485b4ff15f7", 0x4a}], 0x4, 0x0) ptrace$setopts(0xffffffffffffffff, r0, 0x0, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000080)={0x78}, 0x78) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 530.952009][T15869] binder: 15865:15869 unknown command 0 [ 530.963624][T15868] binder: 15866:15868 unknown command 0 [ 530.966281][T15869] binder: 15865:15869 ioctl c0306201 20000200 returned -22 [ 530.987419][T15868] binder: 15866:15868 ioctl c0306201 20000200 returned -22 01:57:46 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000140)="66530700ae897094e7b126b097eaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26f45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e05485b4ff15f7", 0x4a}], 0x4, 0x0) ptrace$setopts(0xffffffffffffffff, r0, 0x0, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000080)={0x78}, 0x78) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 531.033073][T15868] binder: 15866:15868 unknown command 0 [ 531.054717][T15868] binder: 15866:15868 ioctl c0306201 20000200 returned -22 01:57:47 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000140)="66530700ae897094e7b126b097eaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26f45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e05485b4ff15f7", 0x4a}], 0x4, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000080)={0x78}, 0x78) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 01:57:47 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000140)="66530700ae897094e7b126b097eaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26f45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e05485b4ff15f7", 0x4a}], 0x4, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000080)={0x78}, 0x78) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 01:57:47 executing program 4: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0xfffffecc) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r1, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000e66d1808b11342000d340000000109021b00010000d5a00904"], 0x0) syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000580)=ANY=[@ANYBLOB="1201000200000020ef0e01a04000010203010902240001014050090904000502030101010921faff620122480509058103000401039741980380a201400ec815d08ac91e0abe457e32d53eb78dc2842fb3ba32617823ec82885f901e43fe336ffafb8c188a1011f8dcbde199a7a5c0d412196c90b09ed64b699d432e1957440d5c7fa4fe2716ad128c38d7c1c416aa7bdd672edd95fba6869b14301d4618e927ac91d21c830188e14efecb88a1ba58a80c6b3e658f2d911e53760d5388e25ea258be890000000000ebae33754618e7eceb20982c13a646cb5dd4f87c49195bf84d6fa715170bb3718007a72e12df2a565509"], &(0x7f0000000200)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x110, 0x2, 0x81, 0x0, 0x10, 0x40}, 0x50, &(0x7f00000000c0)={0x5, 0xf, 0x50, 0x6, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x0, 0x8d, 0x72, 0x2}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x7, "a82ed34424fe499dd2cb35e2663eb62e"}, @ss_container_id={0x14, 0x10, 0x4, 0x9, "9e596909e0c1c4c9efabccfa38f499f4"}, @wireless={0xb, 0x10, 0x1, 0x4, 0x8, 0x4, 0x81, 0x5, 0x88}, @wireless={0xb, 0x10, 0x1, 0x4, 0x5, 0x1, 0xf0, 0x8, 0x20}]}, 0x2, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x42f}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x425}}]}) pipe(&(0x7f0000000240)) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r4, r7, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) [ 531.536928][T10740] usb 5-1: USB disconnect, device number 3 01:57:47 executing program 0: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0xfffffecc) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r1, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000e66d1808b11342000d340000000109021b00010000d5a00904"], 0x0) syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000580)=ANY=[@ANYBLOB="1201000200000020ef0e01a04000010203010902240001014050090904000502030101010921faff620122480509058103000401039741980380a201400ec815d08ac91e0abe457e32d53eb78dc2842fb3ba32617823ec82885f901e43fe336ffafb8c188a1011f8dcbde199a7a5c0d412196c90b09ed64b699d432e1957440d5c7fa4fe2716ad128c38d7c1c416aa7bdd672edd95fba6869b14301d4618e927ac91d21c830188e14efecb88a1ba58a80c6b3e658f2d911e53760d5388e25ea258be890000000000ebae33754618e7eceb20982c13a646cb5dd4f87c49195bf84d6fa715170bb3718007a72e12df2a565509"], &(0x7f0000000200)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x110, 0x2, 0x81, 0x0, 0x10, 0x40}, 0x50, &(0x7f00000000c0)={0x5, 0xf, 0x50, 0x6, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x0, 0x8d, 0x72, 0x2}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x7, "a82ed34424fe499dd2cb35e2663eb62e"}, @ss_container_id={0x14, 0x10, 0x4, 0x9, "9e596909e0c1c4c9efabccfa38f499f4"}, @wireless={0xb, 0x10, 0x1, 0x4, 0x8, 0x4, 0x81, 0x5, 0x88}, @wireless={0xb, 0x10, 0x1, 0x4, 0x5, 0x1, 0xf0, 0x8, 0x20}]}, 0x2, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x42f}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x425}}]}) pipe(&(0x7f0000000240)) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r4, r7, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) 01:57:47 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000140)="66530700ae897094e7b126b097eaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26f45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e05485b4ff15f7", 0x4a}], 0x4, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000080)={0x78}, 0x78) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 531.697920][ T5] usb 1-1: USB disconnect, device number 7 01:57:47 executing program 2: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0xfffffecc) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r1, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000e66d1808b11342000d340000000109021b00010000d5a00904"], 0x0) syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000580)=ANY=[@ANYBLOB="1201000200000020ef0e01a04000010203010902240001014050090904000502030101010921faff620122480509058103000401039741980380a201400ec815d08ac91e0abe457e32d53eb78dc2842fb3ba32617823ec82885f901e43fe336ffafb8c188a1011f8dcbde199a7a5c0d412196c90b09ed64b699d432e1957440d5c7fa4fe2716ad128c38d7c1c416aa7bdd672edd95fba6869b14301d4618e927ac91d21c830188e14efecb88a1ba58a80c6b3e658f2d911e53760d5388e25ea258be890000000000ebae33754618e7eceb20982c13a646cb5dd4f87c49195bf84d6fa715170bb3718007a72e12df2a565509"], &(0x7f0000000200)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x110, 0x2, 0x81, 0x0, 0x10, 0x40}, 0x50, &(0x7f00000000c0)={0x5, 0xf, 0x50, 0x6, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x0, 0x8d, 0x72, 0x2}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x7, "a82ed34424fe499dd2cb35e2663eb62e"}, @ss_container_id={0x14, 0x10, 0x4, 0x9, "9e596909e0c1c4c9efabccfa38f499f4"}, @wireless={0xb, 0x10, 0x1, 0x4, 0x8, 0x4, 0x81, 0x5, 0x88}, @wireless={0xb, 0x10, 0x1, 0x4, 0x5, 0x1, 0xf0, 0x8, 0x20}]}, 0x2, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x42f}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x425}}]}) pipe(&(0x7f0000000240)) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r4, r7, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) write$binfmt_misc(r3, &(0x7f00000008c0)=ANY=[@ANYBLOB="f09ca33d97e962979fab500536f9c54da5ab360f638294f9f41a983f4d948e62d066b3a47c434adaa07f8eb698326b53a63f970c64b21d52a475b39f9fa68061fe4eb7e59d6b818277b1", @ANYBLOB="46a567426285417a720d3bef833d0801051c79d0751ec55d0ae8f30200000000000000a805f7538a22c3b5a355d65441fd95db3a86813ff77aa7c25943220d1d5a5499c28f4eaba1aee64871c2c08fc9833c2621707bdf8a89d4c3a682cb3f87deca4eb7271d9316c05f4c30503a84df952ad8faf9eec9318be5835d3d0de8771876979e20360838ede3269b2b238937d4eeb6533d00f927b98a5fdcff72221d466d88efe09876e5d6df7e88659531d0593c7608c5d0d631a532080915080b2ebf7a6b7540c078cf85431d4258719f0d89043b9ac7ea90df1816b1e7529a9bd1209dd62a130a8d10e11fba3aa2883e7ca6174e78a57b599ea881085707b3f8ca53ff68f5fecab553c65714f9043f1f08d53bd131eaa44e8a00fed51d38d685dbcda76f771031d7c1c1881ddc0afcfc3a06b944a1eba331f466c2cdddd40a02c0d5017e1f0d7e12c0ac13e28421078ebf80ad8f8713e0ca7d8b5f7e55994c2d53396476cd294983002700ea3bf77ad7c69ccfcdc19ff3e87db19633da93", @ANYRES32=r4, @ANYRES16=r6, @ANYRESDEC=r7, @ANYRES16], 0xfffffecc) 01:57:47 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000140)="66530700ae897094e7b126b097eaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26f45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e05485b4ff15f7", 0x4a}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(0x0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000080)={0x78}, 0x78) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 01:57:47 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:57:47 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:57:47 executing program 4: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0xfffffecc) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r1, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000e66d1808b11342000d340000000109021b00010000d5a00904"], 0x0) syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000580)=ANY=[@ANYBLOB="1201000200000020ef0e01a04000010203010902240001014050090904000502030101010921faff620122480509058103000401039741980380a201400ec815d08ac91e0abe457e32d53eb78dc2842fb3ba32617823ec82885f901e43fe336ffafb8c188a1011f8dcbde199a7a5c0d412196c90b09ed64b699d432e1957440d5c7fa4fe2716ad128c38d7c1c416aa7bdd672edd95fba6869b14301d4618e927ac91d21c830188e14efecb88a1ba58a80c6b3e658f2d911e53760d5388e25ea258be890000000000ebae33754618e7eceb20982c13a646cb5dd4f87c49195bf84d6fa715170bb3718007a72e12df2a565509"], &(0x7f0000000200)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x110, 0x2, 0x81, 0x0, 0x10, 0x40}, 0x50, &(0x7f00000000c0)={0x5, 0xf, 0x50, 0x6, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x0, 0x8d, 0x72, 0x2}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x7, "a82ed34424fe499dd2cb35e2663eb62e"}, @ss_container_id={0x14, 0x10, 0x4, 0x9, "9e596909e0c1c4c9efabccfa38f499f4"}, @wireless={0xb, 0x10, 0x1, 0x4, 0x8, 0x4, 0x81, 0x5, 0x88}, @wireless={0xb, 0x10, 0x1, 0x4, 0x5, 0x1, 0xf0, 0x8, 0x20}]}, 0x2, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x42f}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x425}}]}) pipe(&(0x7f0000000240)) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r4, r7, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) [ 531.962344][T10740] usb 3-1: USB disconnect, device number 4 01:57:47 executing program 0: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0xfffffecc) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r1, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000e66d1808b11342000d340000000109021b00010000d5a00904"], 0x0) syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000580)=ANY=[@ANYBLOB="1201000200000020ef0e01a04000010203010902240001014050090904000502030101010921faff620122480509058103000401039741980380a201400ec815d08ac91e0abe457e32d53eb78dc2842fb3ba32617823ec82885f901e43fe336ffafb8c188a1011f8dcbde199a7a5c0d412196c90b09ed64b699d432e1957440d5c7fa4fe2716ad128c38d7c1c416aa7bdd672edd95fba6869b14301d4618e927ac91d21c830188e14efecb88a1ba58a80c6b3e658f2d911e53760d5388e25ea258be890000000000ebae33754618e7eceb20982c13a646cb5dd4f87c49195bf84d6fa715170bb3718007a72e12df2a565509"], &(0x7f0000000200)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x110, 0x2, 0x81, 0x0, 0x10, 0x40}, 0x50, &(0x7f00000000c0)={0x5, 0xf, 0x50, 0x6, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x0, 0x8d, 0x72, 0x2}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x7, "a82ed34424fe499dd2cb35e2663eb62e"}, @ss_container_id={0x14, 0x10, 0x4, 0x9, "9e596909e0c1c4c9efabccfa38f499f4"}, @wireless={0xb, 0x10, 0x1, 0x4, 0x8, 0x4, 0x81, 0x5, 0x88}, @wireless={0xb, 0x10, 0x1, 0x4, 0x5, 0x1, 0xf0, 0x8, 0x20}]}, 0x2, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x42f}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x425}}]}) pipe(&(0x7f0000000240)) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r4, r7, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) [ 532.075427][T15926] binder: 15918:15926 unknown command 0 [ 532.081030][T15926] binder: 15918:15926 ioctl c0306201 20000200 returned -22 [ 532.107570][T15927] binder: 15922:15927 unknown command 0 [ 532.129767][T15927] binder: 15922:15927 ioctl c0306201 20000200 returned -22 [ 532.151503][T15932] binder: 15918:15932 unknown command 0 [ 532.170884][T15932] binder: 15918:15932 ioctl c0306201 20000200 returned -22 [ 532.173141][T15927] binder: 15922:15927 unknown command 0 [ 532.192267][T15927] binder: 15922:15927 ioctl c0306201 20000200 returned -22 01:57:48 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:57:48 executing program 2: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0xfffffecc) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r1, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000e66d1808b11342000d340000000109021b00010000d5a00904"], 0x0) syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000580)=ANY=[@ANYBLOB="1201000200000020ef0e01a04000010203010902240001014050090904000502030101010921faff620122480509058103000401039741980380a201400ec815d08ac91e0abe457e32d53eb78dc2842fb3ba32617823ec82885f901e43fe336ffafb8c188a1011f8dcbde199a7a5c0d412196c90b09ed64b699d432e1957440d5c7fa4fe2716ad128c38d7c1c416aa7bdd672edd95fba6869b14301d4618e927ac91d21c830188e14efecb88a1ba58a80c6b3e658f2d911e53760d5388e25ea258be890000000000ebae33754618e7eceb20982c13a646cb5dd4f87c49195bf84d6fa715170bb3718007a72e12df2a565509"], &(0x7f0000000200)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x110, 0x2, 0x81, 0x0, 0x10, 0x40}, 0x50, &(0x7f00000000c0)={0x5, 0xf, 0x50, 0x6, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x0, 0x8d, 0x72, 0x2}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x7, "a82ed34424fe499dd2cb35e2663eb62e"}, @ss_container_id={0x14, 0x10, 0x4, 0x9, "9e596909e0c1c4c9efabccfa38f499f4"}, @wireless={0xb, 0x10, 0x1, 0x4, 0x8, 0x4, 0x81, 0x5, 0x88}, @wireless={0xb, 0x10, 0x1, 0x4, 0x5, 0x1, 0xf0, 0x8, 0x20}]}, 0x2, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x42f}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x425}}]}) pipe(&(0x7f0000000240)) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r4, r7, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) write$binfmt_misc(r3, &(0x7f00000008c0)=ANY=[@ANYBLOB="f09ca33d97e962979fab500536f9c54da5ab360f638294f9f41a983f4d948e62d066b3a47c434adaa07f8eb698326b53a63f970c64b21d52a475b39f9fa68061fe4eb7e59d6b818277b1", @ANYBLOB="46a567426285417a720d3bef833d0801051c79d0751ec55d0ae8f30200000000000000a805f7538a22c3b5a355d65441fd95db3a86813ff77aa7c25943220d1d5a5499c28f4eaba1aee64871c2c08fc9833c2621707bdf8a89d4c3a682cb3f87deca4eb7271d9316c05f4c30503a84df952ad8faf9eec9318be5835d3d0de8771876979e20360838ede3269b2b238937d4eeb6533d00f927b98a5fdcff72221d466d88efe09876e5d6df7e88659531d0593c7608c5d0d631a532080915080b2ebf7a6b7540c078cf85431d4258719f0d89043b9ac7ea90df1816b1e7529a9bd1209dd62a130a8d10e11fba3aa2883e7ca6174e78a57b599ea881085707b3f8ca53ff68f5fecab553c65714f9043f1f08d53bd131eaa44e8a00fed51d38d685dbcda76f771031d7c1c1881ddc0afcfc3a06b944a1eba331f466c2cdddd40a02c0d5017e1f0d7e12c0ac13e28421078ebf80ad8f8713e0ca7d8b5f7e55994c2d53396476cd294983002700ea3bf77ad7c69ccfcdc19ff3e87db19633da93", @ANYRES32=r4, @ANYRES16=r6, @ANYRESDEC=r7, @ANYRES16], 0xfffffecc) [ 532.362237][T15945] binder: 15942:15945 unknown command 0 [ 532.379802][T15945] binder: 15942:15945 ioctl c0306201 20000200 returned -22 [ 532.406387][T15945] binder: 15942:15945 unknown command 0 [ 532.412149][T15945] binder: 15942:15945 ioctl c0306201 20000200 returned -22 [ 532.494718][T10739] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 532.594569][T10740] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 532.705772][ T4886] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 532.754545][T10739] usb 5-1: Using ep0 maxpacket: 8 [ 532.854679][T10740] usb 1-1: Using ep0 maxpacket: 8 [ 532.875620][T10739] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 532.911780][T10739] usb 5-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=34.0d [ 532.931421][T10739] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 532.944701][ T4886] usb 3-1: Using ep0 maxpacket: 8 [ 532.954175][T10739] usb 5-1: config 0 descriptor?? 01:57:48 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) [ 533.014967][T10740] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 533.045900][T10740] usb 1-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=34.0d [ 533.065527][ T4886] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 533.067230][T10740] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 533.086214][T10739] ath10k_warn: 14 callbacks suppressed [ 533.086236][T10739] usb 5-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 533.089097][ T4886] usb 3-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=34.0d [ 533.115041][ T4886] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 533.125338][ T4886] usb 3-1: config 0 descriptor?? [ 533.159616][T15969] binder: 15965:15969 unknown command 0 [ 533.168367][T15969] binder: 15965:15969 ioctl c0306201 20000200 returned -22 [ 533.183187][T15969] binder: 15965:15969 unknown command 0 [ 533.189811][T15969] binder: 15965:15969 ioctl c0306201 20000200 returned -22 [ 533.191048][T10740] usb 1-1: config 0 descriptor?? 01:57:49 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) [ 533.215939][ T4886] usb 3-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 533.278224][T15979] binder: 15977:15979 unknown command 0 [ 533.283529][T15935] udc-core: couldn't find an available UDC or it's busy [ 533.284131][T15979] binder: 15977:15979 ioctl c0306201 20000200 returned -22 [ 533.292442][T15935] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 533.322666][T10740] usb 1-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 533.360585][T15979] binder: BINDER_SET_CONTEXT_MGR already set [ 533.387407][T15979] binder: 15977:15979 ioctl 40046207 0 returned -16 [ 533.406907][T15986] binder: 15977:15986 unknown command 0 [ 533.414531][T15986] binder: 15977:15986 ioctl c0306201 20000200 returned -22 [ 533.426114][T15948] udc-core: couldn't find an available UDC or it's busy [ 533.433221][T15948] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 533.518052][T15941] udc-core: couldn't find an available UDC or it's busy [ 533.528743][T15941] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 01:57:49 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:57:50 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) [ 534.186179][T13825] usb 5-1: Failed to submit usb control message: -110 [ 534.193593][T13825] usb 5-1: unable to send the bmi data to the device: -110 [ 534.246132][T13825] usb 5-1: unable to get target info from device [ 534.264593][T13821] usb 3-1: Failed to submit usb control message: -110 [ 534.277000][T13821] usb 3-1: unable to send the bmi data to the device: -110 [ 534.279846][T13825] usb 5-1: could not get target info (-110) [ 534.301825][T13821] usb 3-1: unable to get target info from device [ 534.308274][T13825] usb 5-1: could not probe fw (-110) [ 534.320272][T16011] binder: 16009:16011 unknown command 0 [ 534.332686][T16011] binder: 16009:16011 ioctl c0306201 20000200 returned -22 [ 534.343217][T16012] binder: 16010:16012 unknown command 0 [ 534.349110][T13821] usb 3-1: could not get target info (-110) [ 534.358948][T16012] binder: 16010:16012 ioctl c0306201 20000200 returned -22 [ 534.370144][T13821] usb 3-1: could not probe fw (-110) [ 534.386119][T16012] binder: 16010:16012 unknown command 0 [ 534.391978][T16012] binder: 16010:16012 ioctl c0306201 20000200 returned -22 [ 534.400993][T16012] binder: 16010:16012 ioctl c0306201 0 returned -14 [ 534.414427][ T301] usb 1-1: Failed to submit usb control message: -110 [ 534.423091][ T301] usb 1-1: could not get target info (-110) [ 534.433842][ T301] usb 1-1: could not probe fw (-110) 01:57:50 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000140)="66530700ae897094e7b126b097eaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26f45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e05485b4ff15f7", 0x4a}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(0x0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000080)={0x78}, 0x78) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 01:57:51 executing program 4: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0xfffffecc) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r1, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000e66d1808b11342000d340000000109021b00010000d5a00904"], 0x0) syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000580)=ANY=[@ANYBLOB="1201000200000020ef0e01a04000010203010902240001014050090904000502030101010921faff620122480509058103000401039741980380a201400ec815d08ac91e0abe457e32d53eb78dc2842fb3ba32617823ec82885f901e43fe336ffafb8c188a1011f8dcbde199a7a5c0d412196c90b09ed64b699d432e1957440d5c7fa4fe2716ad128c38d7c1c416aa7bdd672edd95fba6869b14301d4618e927ac91d21c830188e14efecb88a1ba58a80c6b3e658f2d911e53760d5388e25ea258be890000000000ebae33754618e7eceb20982c13a646cb5dd4f87c49195bf84d6fa715170bb3718007a72e12df2a565509"], &(0x7f0000000200)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x110, 0x2, 0x81, 0x0, 0x10, 0x40}, 0x50, &(0x7f00000000c0)={0x5, 0xf, 0x50, 0x6, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x0, 0x8d, 0x72, 0x2}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x7, "a82ed34424fe499dd2cb35e2663eb62e"}, @ss_container_id={0x14, 0x10, 0x4, 0x9, "9e596909e0c1c4c9efabccfa38f499f4"}, @wireless={0xb, 0x10, 0x1, 0x4, 0x8, 0x4, 0x81, 0x5, 0x88}, @wireless={0xb, 0x10, 0x1, 0x4, 0x5, 0x1, 0xf0, 0x8, 0x20}]}, 0x2, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x42f}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x425}}]}) pipe(&(0x7f0000000240)) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r4, r7, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) write$binfmt_misc(r3, &(0x7f00000008c0)=ANY=[@ANYBLOB="f09ca33d97e962979fab500536f9c54da5ab360f638294f9f41a983f4d948e62d066b3a47c434adaa07f8eb698326b53a63f970c64b21d52a475b39f9fa68061fe4eb7e59d6b818277b1", @ANYBLOB="46a567426285417a720d3bef833d0801051c79d0751ec55d0ae8f30200000000000000a805f7538a22c3b5a355d65441fd95db3a86813ff77aa7c25943220d1d5a5499c28f4eaba1aee64871c2c08fc9833c2621707bdf8a89d4c3a682cb3f87deca4eb7271d9316c05f4c30503a84df952ad8faf9eec9318be5835d3d0de8771876979e20360838ede3269b2b238937d4eeb6533d00f927b98a5fdcff72221d466d88efe09876e5d6df7e88659531d0593c7608c5d0d631a532080915080b2ebf7a6b7540c078cf85431d4258719f0d89043b9ac7ea90df1816b1e7529a9bd1209dd62a130a8d10e11fba3aa2883e7ca6174e78a57b599ea881085707b3f8ca53ff68f5fecab553c65714f9043f1f08d53bd131eaa44e8a00fed51d38d685dbcda76f771031d7c1c1881ddc0afcfc3a06b944a1eba331f466c2cdddd40a02c0d5017e1f0d7e12c0ac13e28421078ebf80ad8f8713e0ca7d8b5f7e55994c2d53396476cd294983002700ea3bf77ad7c69ccfcdc19ff3e87db19633da93", @ANYRES32=r4, @ANYRES16=r6, @ANYRESDEC=r7, @ANYRES16], 0xfffffecc) [ 535.092677][ T5] usb 5-1: USB disconnect, device number 4 01:57:51 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:57:51 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:57:51 executing program 0: sendmsg$NL80211_CMD_STOP_P2P_DEVICE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x1c, 0x0, 0x800, 0x70bd2a, 0x25dfdbfb, {{}, {@val={0x8}, @void}}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x20000000) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800007, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r1 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000009000008250592d2070000000101090224fffffa0074980904e4ff11070103000905010200ffe0000009058202"], 0x0) syz_usb_control_io$printer(r1, 0x0, &(0x7f0000000280)={0x34, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={0x20, 0x0, 0xfffffffffffffe7a}}) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_connect(0x0, 0x24, 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) [ 535.290002][T10740] usb 1-1: USB disconnect, device number 8 01:57:51 executing program 4: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0xfffffecc) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r1, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000e66d1808b11342000d340000000109021b00010000d5a00904"], 0x0) syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000580)=ANY=[@ANYBLOB="1201000200000020ef0e01a04000010203010902240001014050090904000502030101010921faff620122480509058103000401039741980380a201400ec815d08ac91e0abe457e32d53eb78dc2842fb3ba32617823ec82885f901e43fe336ffafb8c188a1011f8dcbde199a7a5c0d412196c90b09ed64b699d432e1957440d5c7fa4fe2716ad128c38d7c1c416aa7bdd672edd95fba6869b14301d4618e927ac91d21c830188e14efecb88a1ba58a80c6b3e658f2d911e53760d5388e25ea258be890000000000ebae33754618e7eceb20982c13a646cb5dd4f87c49195bf84d6fa715170bb3718007a72e12df2a565509"], &(0x7f0000000200)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x110, 0x2, 0x81, 0x0, 0x10, 0x40}, 0x50, &(0x7f00000000c0)={0x5, 0xf, 0x50, 0x6, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x0, 0x8d, 0x72, 0x2}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x7, "a82ed34424fe499dd2cb35e2663eb62e"}, @ss_container_id={0x14, 0x10, 0x4, 0x9, "9e596909e0c1c4c9efabccfa38f499f4"}, @wireless={0xb, 0x10, 0x1, 0x4, 0x8, 0x4, 0x81, 0x5, 0x88}, @wireless={0xb, 0x10, 0x1, 0x4, 0x5, 0x1, 0xf0, 0x8, 0x20}]}, 0x2, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x42f}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x425}}]}) pipe(&(0x7f0000000240)) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r4, r7, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) write$binfmt_misc(r3, &(0x7f00000008c0)=ANY=[@ANYBLOB="f09ca33d97e962979fab500536f9c54da5ab360f638294f9f41a983f4d948e62d066b3a47c434adaa07f8eb698326b53a63f970c64b21d52a475b39f9fa68061fe4eb7e59d6b818277b1", @ANYBLOB="46a567426285417a720d3bef833d0801051c79d0751ec55d0ae8f30200000000000000a805f7538a22c3b5a355d65441fd95db3a86813ff77aa7c25943220d1d5a5499c28f4eaba1aee64871c2c08fc9833c2621707bdf8a89d4c3a682cb3f87deca4eb7271d9316c05f4c30503a84df952ad8faf9eec9318be5835d3d0de8771876979e20360838ede3269b2b238937d4eeb6533d00f927b98a5fdcff72221d466d88efe09876e5d6df7e88659531d0593c7608c5d0d631a532080915080b2ebf7a6b7540c078cf85431d4258719f0d89043b9ac7ea90df1816b1e7529a9bd1209dd62a130a8d10e11fba3aa2883e7ca6174e78a57b599ea881085707b3f8ca53ff68f5fecab553c65714f9043f1f08d53bd131eaa44e8a00fed51d38d685dbcda76f771031d7c1c1881ddc0afcfc3a06b944a1eba331f466c2cdddd40a02c0d5017e1f0d7e12c0ac13e28421078ebf80ad8f8713e0ca7d8b5f7e55994c2d53396476cd294983002700ea3bf77ad7c69ccfcdc19ff3e87db19633da93", @ANYRES32=r4, @ANYRES16=r6, @ANYRESDEC=r7, @ANYRES16], 0xfffffecc) [ 535.381913][T16039] binder: 16031:16039 unknown command 0 [ 535.427428][T16039] binder: 16031:16039 ioctl c0306201 20000200 returned -22 [ 535.443247][T16041] binder: 16033:16041 unknown command 0 [ 535.463872][T16042] binder: 16031:16042 unknown command 0 [ 535.468301][T16041] binder: 16033:16041 ioctl c0306201 20000200 returned -22 [ 535.490372][T16042] binder: 16031:16042 ioctl c0306201 20000200 returned -22 [ 535.513870][T16039] binder: 16031:16039 ioctl c0306201 0 returned -14 [ 535.524925][ T5] usb 3-1: USB disconnect, device number 5 01:57:51 executing program 2: write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000040)={'syz0', "c92fce8ab80c33879ed4629d296d7c40f71509a3deb6836bf1818bbc675536ebdc70d1234563b6bc05c9bf5591953821f0668b05bc3a4c2a27e916ede3abbe2eaea0fa3387704a23bc03894c8ba2cd6ef0ab9bcd320d91e2522368564d46f09ae19d7246a35581e8ede162dd8606b74a29b5fd"}, 0x77) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x8000000000006, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0xd) write$binfmt_aout(r0, &(0x7f0000000240)=ANY=[], 0xfffffd2d) r1 = dup(r0) ioctl$TCFLSH(r1, 0x5411, 0x0) 01:57:51 executing program 0: sendmsg$NL80211_CMD_STOP_P2P_DEVICE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x1c, 0x0, 0x800, 0x70bd2a, 0x25dfdbfb, {{}, {@val={0x8}, @void}}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x20000000) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800007, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r1 = syz_usb_connect$printer(0x0, 0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000009000008250592d2070000000101090224fffffa0074980904e4ff11070103000905010200ffe0000009058202"], 0x0) syz_usb_control_io$printer(r1, 0x0, &(0x7f0000000280)={0x34, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)={0x20, 0x0, 0xfffffffffffffe7a}}) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_connect(0x0, 0x24, 0x0, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) 01:57:51 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:57:51 executing program 2: write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000040)={'syz0', "c92fce8ab80c33879ed4629d296d7c40f71509a3deb6836bf1818bbc675536ebdc70d1234563b6bc05c9bf5591953821f0668b05bc3a4c2a27e916ede3abbe2eaea0fa3387704a23bc03894c8ba2cd6ef0ab9bcd320d91e2522368564d46f09ae19d7246a35581e8ede162dd8606b74a29b5fd"}, 0x77) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x8000000000006, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0xd) write$binfmt_aout(r0, &(0x7f0000000240)=ANY=[], 0xfffffd2d) r1 = dup(r0) ioctl$TCFLSH(r1, 0x5411, 0x0) [ 535.766246][T16065] binder: 16062:16065 unknown command 0 [ 535.779014][T16065] binder: 16062:16065 ioctl c0306201 20000200 returned -22 [ 535.797712][T16065] binder: 16062:16065 unknown command 0 [ 535.803597][T16065] binder: 16062:16065 ioctl c0306201 20000200 returned -22 [ 535.845197][T16065] binder: 16062:16065 ioctl c0306201 0 returned -14 [ 535.934147][T10740] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 536.034279][T10435] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 536.184221][T10740] usb 5-1: Using ep0 maxpacket: 8 01:57:52 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) [ 536.304253][T10740] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 536.314140][T10435] usb 1-1: Using ep0 maxpacket: 8 [ 536.334393][T10740] usb 5-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=34.0d [ 536.343482][T10740] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 536.372785][T16076] binder: 16075:16076 unknown command 0 [ 536.380516][T16076] binder: 16075:16076 ioctl c0306201 20000200 returned -22 [ 536.418663][T10740] usb 5-1: config 0 descriptor?? [ 536.446265][T10435] usb 1-1: config index 0 descriptor too short (expected 65316, got 36) [ 536.460565][T10435] usb 1-1: config 250 has too many interfaces: 255, using maximum allowed: 32 [ 536.486892][T10435] usb 1-1: config 250 has 1 interface, different from the descriptor's value: 255 [ 536.507183][T10435] usb 1-1: config 250 has no interface number 0 [ 536.515814][T10435] usb 1-1: config 250 interface 228 altsetting 255 endpoint 0x1 has invalid maxpacket 1792, setting to 1024 [ 536.529459][T10435] usb 1-1: config 250 interface 228 altsetting 255 bulk endpoint 0x1 has invalid maxpacket 1024 [ 536.552906][T10435] usb 1-1: config 250 interface 228 altsetting 255 endpoint 0x82 has invalid maxpacket 1280, setting to 1024 [ 536.578600][T10435] usb 1-1: config 250 interface 228 altsetting 255 bulk endpoint 0x82 has invalid maxpacket 1024 01:57:52 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) [ 536.610029][T10435] usb 1-1: config 250 interface 228 altsetting 255 has 2 endpoint descriptors, different from the interface descriptor's value: 17 [ 536.679075][T10435] usb 1-1: config 250 interface 228 has no altsetting 0 [ 536.755721][T16055] udc-core: couldn't find an available UDC or it's busy [ 536.762702][T16055] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 536.828586][T16094] binder: 16091:16094 unknown command 0 [ 536.834708][T10435] usb 1-1: New USB device found, idVendor=0525, idProduct=d292, bcdDevice= 0.07 [ 536.847777][T16094] binder: 16091:16094 ioctl c0306201 20000200 returned -22 [ 536.860426][T10435] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 536.888960][T10435] usb 1-1: SerialNumber: syz [ 536.899411][T16094] binder: 16091:16094 unknown command 0 [ 536.918717][T16094] binder: 16091:16094 ioctl c0306201 20000200 returned -22 [ 536.934647][T16061] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 536.941706][T16061] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 536.955281][T10435] hub 1-1:250.228: bad descriptor, ignoring hub [ 536.961596][T10435] hub: probe of 1-1:250.228 failed with error -5 [ 537.207656][T10435] usblp 1-1:250.228: usblp0: USB Bidirectional printer dev 9 if 228 alt 255 proto 3 vid 0x0525 pid 0xD292 [ 537.524123][T13821] usb 5-1: could not get target info (-110) [ 537.530523][T13821] usb 5-1: could not probe fw (-110) [ 537.544580][T10435] usb 1-1: USB disconnect, device number 9 [ 537.618275][T10435] usblp0: removed 01:57:54 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000140)="66530700ae897094e7b126b097eaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26f45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e05485b4ff15f7", 0x4a}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(0x0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000080)={0x78}, 0x78) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 01:57:54 executing program 2 (fault-call:0 fault-nth:0): syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:57:54 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:57:54 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:57:54 executing program 0 (fault-call:3 fault-nth:0): r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) [ 538.220599][T16126] FAULT_INJECTION: forcing a failure. [ 538.220599][T16126] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 538.240370][T16130] binder: 16123:16130 unknown command 0 [ 538.252000][T16128] binder: 16124:16128 unknown command 0 [ 538.263363][T16130] binder: 16123:16130 ioctl c0306201 20000200 returned -22 [ 538.274514][T16128] binder: 16124:16128 ioctl c0306201 20000200 returned -22 [ 538.283528][T16126] CPU: 1 PID: 16126 Comm: syz-executor.2 Not tainted 5.14.0-rc2-next-20210723-syzkaller #0 [ 538.293640][T16126] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 538.297534][T16130] binder: 16123:16130 unknown command 0 [ 538.303810][T16126] Call Trace: [ 538.303823][T16126] dump_stack_lvl+0xcd/0x134 [ 538.313127][T16128] binder: 16124:16128 unknown command 0 [ 538.317281][T16126] should_fail.cold+0x5/0xa [ 538.317321][T16126] prepare_alloc_pages+0x17b/0x580 [ 538.323054][T16128] binder: 16124:16128 ioctl c0306201 20000200 returned -22 [ 538.327381][T16126] __alloc_pages+0x12f/0x500 [ 538.327415][T16126] ? __alloc_pages_slowpath.constprop.0+0x21b0/0x21b0 [ 538.327463][T16126] ? __sanitizer_cov_trace_const_cmp2+0x22/0x80 [ 538.343231][T16128] binder_alloc: 16124: binder_alloc_buf, no vma [ 538.344332][T16126] alloc_pages+0x1a3/0x2d0 [ 538.344443][T16126] skb_page_frag_refill+0x262/0x570 [ 538.354972][T16130] binder: 16123:16130 ioctl c0306201 20000200 returned -22 [ 538.357497][T16126] tun_build_skb+0x1ff/0xf50 [ 538.385488][T16126] ? tun_xdp_act+0x8a0/0x8a0 [ 538.390107][T16126] ? __lock_acquire+0xbc2/0x54a0 [ 538.395154][T16126] tun_get_user+0x802/0x36d0 [ 538.399786][T16126] ? tun_build_skb+0xf50/0xf50 [ 538.404575][T16126] ? lock_downgrade+0x6e0/0x6e0 [ 538.409565][T16126] ? aa_file_perm+0x595/0x1180 [ 538.414431][T16126] tun_chr_write_iter+0xe1/0x1f0 [ 538.419477][T16126] new_sync_write+0x426/0x650 [ 538.424337][T16126] ? new_sync_read+0x6e0/0x6e0 [ 538.429119][T16126] ? lock_downgrade+0x6e0/0x6e0 [ 538.434092][T16126] ? down_read_nested+0x2a0/0x450 [ 538.439210][T16126] ? apparmor_file_permission+0x264/0x4e0 [ 538.445053][T16126] vfs_write+0x75a/0xa40 [ 538.449403][T16126] ksys_write+0x12d/0x250 [ 538.453752][T16126] ? __ia32_sys_read+0xb0/0xb0 [ 538.458531][T16126] ? syscall_enter_from_user_mode+0x21/0x70 [ 538.464582][T16126] do_syscall_64+0x35/0xb0 [ 538.469074][T16126] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 538.475025][T16126] RIP: 0033:0x4192cf [ 538.479000][T16126] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 fd ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 cc fd ff ff 48 [ 538.498704][T16126] RSP: 002b:00007f3e5d231150 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 538.507197][T16126] RAX: ffffffffffffffda RBX: 000000000056bf80 RCX: 00000000004192cf [ 538.515291][T16126] RDX: 000000000000006a RSI: 0000000020000080 RDI: 00000000000000f0 [ 538.523348][T16126] RBP: 00007f3e5d2311d0 R08: 0000000000000000 R09: 0000000000000000 [ 538.531404][T16126] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 [ 538.539388][T16126] R13: 00007ffcb324874f R14: 00007f3e5d231300 R15: 0000000000022000 01:57:54 executing program 4: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0xfffffecc) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r1, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000e66d1808b11342000d340000000109021b00010000d5a00904"], 0x0) syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000580)=ANY=[@ANYBLOB="1201000200000020ef0e01a04000010203010902240001014050090904000502030101010921faff620122480509058103000401039741980380a201400ec815d08ac91e0abe457e32d53eb78dc2842fb3ba32617823ec82885f901e43fe336ffafb8c188a1011f8dcbde199a7a5c0d412196c90b09ed64b699d432e1957440d5c7fa4fe2716ad128c38d7c1c416aa7bdd672edd95fba6869b14301d4618e927ac91d21c830188e14efecb88a1ba58a80c6b3e658f2d911e53760d5388e25ea258be890000000000ebae33754618e7eceb20982c13a646cb5dd4f87c49195bf84d6fa715170bb3718007a72e12df2a565509"], &(0x7f0000000200)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x110, 0x2, 0x81, 0x0, 0x10, 0x40}, 0x50, &(0x7f00000000c0)={0x5, 0xf, 0x50, 0x6, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x0, 0x8d, 0x72, 0x2}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x7, "a82ed34424fe499dd2cb35e2663eb62e"}, @ss_container_id={0x14, 0x10, 0x4, 0x9, "9e596909e0c1c4c9efabccfa38f499f4"}, @wireless={0xb, 0x10, 0x1, 0x4, 0x8, 0x4, 0x81, 0x5, 0x88}, @wireless={0xb, 0x10, 0x1, 0x4, 0x5, 0x1, 0xf0, 0x8, 0x20}]}, 0x2, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x42f}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x425}}]}) pipe(&(0x7f0000000240)) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r4, r7, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) write$binfmt_misc(r3, &(0x7f00000008c0)=ANY=[@ANYBLOB="f09ca33d97e962979fab500536f9c54da5ab360f638294f9f41a983f4d948e62d066b3a47c434adaa07f8eb698326b53a63f970c64b21d52a475b39f9fa68061fe4eb7e59d6b818277b1", @ANYBLOB="46a567426285417a720d3bef833d0801051c79d0751ec55d0ae8f30200000000000000a805f7538a22c3b5a355d65441fd95db3a86813ff77aa7c25943220d1d5a5499c28f4eaba1aee64871c2c08fc9833c2621707bdf8a89d4c3a682cb3f87deca4eb7271d9316c05f4c30503a84df952ad8faf9eec9318be5835d3d0de8771876979e20360838ede3269b2b238937d4eeb6533d00f927b98a5fdcff72221d466d88efe09876e5d6df7e88659531d0593c7608c5d0d631a532080915080b2ebf7a6b7540c078cf85431d4258719f0d89043b9ac7ea90df1816b1e7529a9bd1209dd62a130a8d10e11fba3aa2883e7ca6174e78a57b599ea881085707b3f8ca53ff68f5fecab553c65714f9043f1f08d53bd131eaa44e8a00fed51d38d685dbcda76f771031d7c1c1881ddc0afcfc3a06b944a1eba331f466c2cdddd40a02c0d5017e1f0d7e12c0ac13e28421078ebf80ad8f8713e0ca7d8b5f7e55994c2d53396476cd294983002700ea3bf77ad7c69ccfcdc19ff3e87db19633da93", @ANYRES32=r4, @ANYRES16=r6, @ANYRESDEC=r7, @ANYRES16], 0xfffffecc) 01:57:54 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000140)="66530700ae897094e7b126b097eaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26f45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e05485b4ff15f7", 0x4a}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000080)={0x78}, 0x78) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 01:57:54 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) 01:57:54 executing program 2 (fault-call:0 fault-nth:1): syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 538.744335][T10740] usb 5-1: USB disconnect, device number 5 [ 538.902937][T16155] FAULT_INJECTION: forcing a failure. [ 538.902937][T16155] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 538.976271][T16155] CPU: 0 PID: 16155 Comm: syz-executor.2 Not tainted 5.14.0-rc2-next-20210723-syzkaller #0 [ 538.986393][T16155] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 538.996468][T16155] Call Trace: [ 538.999771][T16155] dump_stack_lvl+0xcd/0x134 [ 539.004478][T16155] should_fail.cold+0x5/0xa [ 539.009011][T16155] copy_page_from_iter+0x35b/0x7c0 [ 539.014243][T16155] tun_build_skb+0x27c/0xf50 [ 539.018859][T16155] ? tun_xdp_act+0x8a0/0x8a0 [ 539.023468][T16155] ? __lock_acquire+0xbc2/0x54a0 [ 539.028443][T16155] tun_get_user+0x802/0x36d0 [ 539.033073][T16155] ? tun_build_skb+0xf50/0xf50 [ 539.037866][T16155] ? lock_downgrade+0x6e0/0x6e0 [ 539.042739][T16155] ? aa_file_perm+0x595/0x1180 [ 539.047553][T16155] tun_chr_write_iter+0xe1/0x1f0 [ 539.052527][T16155] new_sync_write+0x426/0x650 [ 539.057243][T16155] ? new_sync_read+0x6e0/0x6e0 [ 539.062029][T16155] ? lock_downgrade+0x6e0/0x6e0 [ 539.066898][T16155] ? down_read_nested+0x2a0/0x450 [ 539.071976][T16155] ? apparmor_file_permission+0x264/0x4e0 [ 539.077730][T16155] vfs_write+0x75a/0xa40 [ 539.081996][T16155] ksys_write+0x12d/0x250 [ 539.087234][T16155] ? __ia32_sys_read+0xb0/0xb0 [ 539.092026][T16155] ? syscall_enter_from_user_mode+0x21/0x70 [ 539.097951][T16155] do_syscall_64+0x35/0xb0 [ 539.102654][T16155] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 539.108583][T16155] RIP: 0033:0x4192cf [ 539.112594][T16155] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 fd ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 cc fd ff ff 48 [ 539.132330][T16155] RSP: 002b:00007f3e5d231150 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 539.140777][T16155] RAX: ffffffffffffffda RBX: 000000000056bf80 RCX: 00000000004192cf [ 539.148771][T16155] RDX: 000000000000006a RSI: 0000000020000080 RDI: 00000000000000f0 [ 539.156794][T16155] RBP: 00007f3e5d2311d0 R08: 0000000000000000 R09: 0000000000000000 [ 539.164782][T16155] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 [ 539.172857][T16155] R13: 00007ffcb324874f R14: 00007f3e5d231300 R15: 0000000000022000 01:57:55 executing program 4: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0xfffffecc) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r1, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000e66d1808b11342000d340000000109021b00010000d5a00904"], 0x0) syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000580)=ANY=[@ANYBLOB="1201000200000020ef0e01a04000010203010902240001014050090904000502030101010921faff620122480509058103000401039741980380a201400ec815d08ac91e0abe457e32d53eb78dc2842fb3ba32617823ec82885f901e43fe336ffafb8c188a1011f8dcbde199a7a5c0d412196c90b09ed64b699d432e1957440d5c7fa4fe2716ad128c38d7c1c416aa7bdd672edd95fba6869b14301d4618e927ac91d21c830188e14efecb88a1ba58a80c6b3e658f2d911e53760d5388e25ea258be890000000000ebae33754618e7eceb20982c13a646cb5dd4f87c49195bf84d6fa715170bb3718007a72e12df2a565509"], &(0x7f0000000200)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x110, 0x2, 0x81, 0x0, 0x10, 0x40}, 0x50, &(0x7f00000000c0)={0x5, 0xf, 0x50, 0x6, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x0, 0x8d, 0x72, 0x2}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x7, "a82ed34424fe499dd2cb35e2663eb62e"}, @ss_container_id={0x14, 0x10, 0x4, 0x9, "9e596909e0c1c4c9efabccfa38f499f4"}, @wireless={0xb, 0x10, 0x1, 0x4, 0x8, 0x4, 0x81, 0x5, 0x88}, @wireless={0xb, 0x10, 0x1, 0x4, 0x5, 0x1, 0xf0, 0x8, 0x20}]}, 0x2, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x42f}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x425}}]}) pipe(&(0x7f0000000240)) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r4, r7, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) 01:57:55 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:57:55 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:57:55 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0xa, 0x0}], 0x1, 0x0, 0x0, 0x0) 01:57:55 executing program 2 (fault-call:0 fault-nth:2): syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 539.396505][T16163] binder: 16159:16163 unknown command 0 [ 539.412999][T16163] binder: 16159:16163 ioctl c0306201 20000200 returned -22 01:57:55 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x2f, 0x0}], 0x1, 0x0, 0x0, 0x0) [ 539.443421][T16163] binder: 16159:16163 unknown command 0 [ 539.460761][T16163] binder: 16159:16163 ioctl c0306201 20000200 returned -22 [ 539.501686][T16167] binder: 16161:16167 unknown command 0 [ 539.533527][T16167] binder: 16161:16167 ioctl c0306201 20000200 returned -22 01:57:55 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) [ 539.562426][T16172] FAULT_INJECTION: forcing a failure. [ 539.562426][T16172] name failslab, interval 1, probability 0, space 0, times 1 [ 539.581692][T16173] binder: 16161:16173 unknown command 0 [ 539.618423][T16173] binder: 16161:16173 ioctl c0306201 20000200 returned -22 [ 539.630106][T16172] CPU: 0 PID: 16172 Comm: syz-executor.2 Not tainted 5.14.0-rc2-next-20210723-syzkaller #0 [ 539.631331][T16167] binder_alloc: 16161: binder_alloc_buf, no vma [ 539.640121][T16172] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 539.640141][T16172] Call Trace: [ 539.640151][T16172] dump_stack_lvl+0xcd/0x134 [ 539.640187][T16172] should_fail.cold+0x5/0xa [ 539.640213][T16172] ? __build_skb+0x21/0x60 [ 539.640310][T16172] should_failslab+0x5/0x10 [ 539.640410][T16172] kmem_cache_alloc+0x5e/0x4a0 [ 539.640446][T16172] __build_skb+0x21/0x60 [ 539.640475][T16172] build_skb+0x1e/0x190 [ 539.640506][T16172] __tun_build_skb+0x2c/0x260 [ 539.640535][T16172] tun_build_skb+0x5c9/0xf50 [ 539.640570][T16172] ? tun_xdp_act+0x8a0/0x8a0 [ 539.640598][T16172] ? __lock_acquire+0xbc2/0x54a0 [ 539.710980][T16172] tun_get_user+0x802/0x36d0 [ 539.715608][T16172] ? tun_build_skb+0xf50/0xf50 [ 539.720408][T16172] ? lock_downgrade+0x6e0/0x6e0 [ 539.725373][T16172] ? aa_file_perm+0x595/0x1180 [ 539.730171][T16172] tun_chr_write_iter+0xe1/0x1f0 [ 539.735127][T16172] new_sync_write+0x426/0x650 [ 539.739827][T16172] ? new_sync_read+0x6e0/0x6e0 [ 539.744609][T16172] ? lock_downgrade+0x6e0/0x6e0 [ 539.749472][T16172] ? down_read_nested+0x2a0/0x450 [ 539.754607][T16172] ? apparmor_file_permission+0x264/0x4e0 [ 539.760368][T16172] vfs_write+0x75a/0xa40 [ 539.764649][T16172] ksys_write+0x12d/0x250 [ 539.769086][T16172] ? __ia32_sys_read+0xb0/0xb0 [ 539.773870][T16172] ? syscall_enter_from_user_mode+0x21/0x70 [ 539.779805][T16172] do_syscall_64+0x35/0xb0 [ 539.784239][T16172] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 539.790129][T16172] RIP: 0033:0x4192cf [ 539.794020][T16172] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 fd ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 cc fd ff ff 48 [ 539.813791][T16172] RSP: 002b:00007f3e5d231150 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 539.822376][T16172] RAX: ffffffffffffffda RBX: 000000000056bf80 RCX: 00000000004192cf [ 539.830338][T16172] RDX: 000000000000006a RSI: 0000000020000080 RDI: 00000000000000f0 [ 539.838304][T16172] RBP: 00007f3e5d2311d0 R08: 0000000000000000 R09: 0000000000000000 [ 539.846278][T16172] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 [ 539.854276][T16172] R13: 00007ffcb324874f R14: 00007f3e5d231300 R15: 0000000000022000 01:57:55 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x4020ae46, 0x0}], 0x1, 0x0, 0x0, 0x0) [ 539.943843][T10435] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 540.012538][T16179] binder: 16176:16179 unknown command 0 [ 540.025422][T16179] binder: 16176:16179 ioctl c0306201 20000200 returned -22 [ 540.052025][T16179] binder: 16176:16179 unknown command 0 [ 540.064739][T16179] binder: 16176:16179 ioctl c0306201 20000200 returned -22 [ 540.213806][T10435] usb 5-1: Using ep0 maxpacket: 8 01:57:56 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0, 0x2}], 0x1, 0x0, 0x0, 0x0) [ 540.352294][T10435] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 540.385313][T10435] usb 5-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=34.0d [ 540.421344][T10435] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 540.457799][T10435] usb 5-1: config 0 descriptor?? [ 540.545188][T10435] ath10k_warn: 6 callbacks suppressed [ 540.545211][T10435] usb 5-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 540.718122][T16165] udc-core: couldn't find an available UDC or it's busy [ 540.733716][T16165] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 541.604227][T13821] usb 5-1: Failed to submit usb control message: -110 [ 541.611961][T13821] usb 5-1: unable to send the bmi data to the device: -110 [ 541.628423][T13821] usb 5-1: unable to get target info from device [ 541.643238][T13821] usb 5-1: could not get target info (-110) [ 541.690162][T13821] usb 5-1: could not probe fw (-110) 01:57:57 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000140)="66530700ae897094e7b126b097eaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26f45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e05485b4ff15f7", 0x4a}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000080)={0x78}, 0x78) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 01:57:57 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:57:57 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:57:57 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0, 0x3}], 0x1, 0x0, 0x0, 0x0) [ 541.885377][T16216] binder: 16213:16216 unknown command 0 [ 541.906915][T16216] binder: 16213:16216 ioctl c0306201 20000200 returned -22 [ 541.946521][T16216] binder: 16213:16216 unknown command 0 [ 541.971942][T16216] binder: 16213:16216 ioctl c0306201 20000200 returned -22 [ 542.019589][T16223] binder_alloc: 16213: binder_alloc_buf, no vma 01:57:58 executing program 4: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0xfffffecc) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r1, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000e66d1808b11342000d340000000109021b00010000d5a00904"], 0x0) syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000580)=ANY=[@ANYBLOB="1201000200000020ef0e01a04000010203010902240001014050090904000502030101010921faff620122480509058103000401039741980380a201400ec815d08ac91e0abe457e32d53eb78dc2842fb3ba32617823ec82885f901e43fe336ffafb8c188a1011f8dcbde199a7a5c0d412196c90b09ed64b699d432e1957440d5c7fa4fe2716ad128c38d7c1c416aa7bdd672edd95fba6869b14301d4618e927ac91d21c830188e14efecb88a1ba58a80c6b3e658f2d911e53760d5388e25ea258be890000000000ebae33754618e7eceb20982c13a646cb5dd4f87c49195bf84d6fa715170bb3718007a72e12df2a565509"], &(0x7f0000000200)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x110, 0x2, 0x81, 0x0, 0x10, 0x40}, 0x50, &(0x7f00000000c0)={0x5, 0xf, 0x50, 0x6, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x0, 0x8d, 0x72, 0x2}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x7, "a82ed34424fe499dd2cb35e2663eb62e"}, @ss_container_id={0x14, 0x10, 0x4, 0x9, "9e596909e0c1c4c9efabccfa38f499f4"}, @wireless={0xb, 0x10, 0x1, 0x4, 0x8, 0x4, 0x81, 0x5, 0x88}, @wireless={0xb, 0x10, 0x1, 0x4, 0x5, 0x1, 0xf0, 0x8, 0x20}]}, 0x2, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x42f}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x425}}]}) pipe(&(0x7f0000000240)) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r4, r7, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 01:57:58 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:57:58 executing program 2: syz_emit_ethernet(0xd, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:57:58 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0, 0x4}], 0x1, 0x0, 0x0, 0x0) [ 542.347580][ T20] usb 5-1: USB disconnect, device number 6 [ 542.471737][T16240] binder: 16233:16240 unknown command 0 [ 542.480640][T16240] binder: 16233:16240 ioctl c0306201 20000200 returned -22 01:57:58 executing program 2: syz_emit_ethernet(0xaa, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 542.527037][T16240] binder: 16233:16240 unknown command 0 [ 542.547554][T16240] binder: 16233:16240 ioctl c0306201 20000200 returned -22 01:57:58 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0, 0x5}], 0x1, 0x0, 0x0, 0x0) 01:57:58 executing program 4: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0xfffffecc) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r1, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000e66d1808b11342000d340000000109021b00010000d5a00904"], 0x0) syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000580)=ANY=[@ANYBLOB="1201000200000020ef0e01a04000010203010902240001014050090904000502030101010921faff620122480509058103000401039741980380a201400ec815d08ac91e0abe457e32d53eb78dc2842fb3ba32617823ec82885f901e43fe336ffafb8c188a1011f8dcbde199a7a5c0d412196c90b09ed64b699d432e1957440d5c7fa4fe2716ad128c38d7c1c416aa7bdd672edd95fba6869b14301d4618e927ac91d21c830188e14efecb88a1ba58a80c6b3e658f2d911e53760d5388e25ea258be890000000000ebae33754618e7eceb20982c13a646cb5dd4f87c49195bf84d6fa715170bb3718007a72e12df2a565509"], &(0x7f0000000200)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x110, 0x2, 0x81, 0x0, 0x10, 0x40}, 0x50, &(0x7f00000000c0)={0x5, 0xf, 0x50, 0x6, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x0, 0x8d, 0x72, 0x2}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x7, "a82ed34424fe499dd2cb35e2663eb62e"}, @ss_container_id={0x14, 0x10, 0x4, 0x9, "9e596909e0c1c4c9efabccfa38f499f4"}, @wireless={0xb, 0x10, 0x1, 0x4, 0x8, 0x4, 0x81, 0x5, 0x88}, @wireless={0xb, 0x10, 0x1, 0x4, 0x5, 0x1, 0xf0, 0x8, 0x20}]}, 0x2, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x42f}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x425}}]}) pipe(&(0x7f0000000240)) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r4, r7, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 01:57:58 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) [ 542.876624][T16258] binder: 16255:16258 unknown command 0 [ 542.882450][T16258] binder: 16255:16258 ioctl c0306201 20000200 returned -22 [ 542.927339][T16258] binder: 16255:16258 unknown command 0 [ 542.941993][T16258] binder: 16255:16258 ioctl c0306201 20000200 returned -22 [ 543.193495][T10740] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 543.443387][T10740] usb 5-1: Using ep0 maxpacket: 8 [ 543.563969][T10740] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 543.574532][T10740] usb 5-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=34.0d [ 543.585325][T10740] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 543.595739][T10740] usb 5-1: config 0 descriptor?? [ 543.658986][T10740] usb 5-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 543.840249][T16259] udc-core: couldn't find an available UDC or it's busy [ 543.847679][T16259] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 544.723320][ T257] usb 5-1: Failed to submit usb control message: -110 [ 544.730725][ T257] usb 5-1: unable to send the bmi data to the device: -110 [ 544.738071][ T257] usb 5-1: unable to get target info from device [ 544.744485][ T257] usb 5-1: could not get target info (-110) [ 544.750394][ T257] usb 5-1: could not probe fw (-110) 01:58:00 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000140)="66530700ae897094e7b126b097eaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26f45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e05485b4ff15f7", 0x4a}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000080)={0x78}, 0x78) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 01:58:00 executing program 2: syz_emit_ethernet(0xfdef, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:58:00 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0, 0x6}], 0x1, 0x0, 0x0, 0x0) 01:58:00 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:58:00 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) [ 545.035970][T16286] binder: 16281:16286 unknown command 0 [ 545.043521][T16287] binder: 16284:16287 unknown command 0 [ 545.061008][T16286] binder: 16281:16286 ioctl c0306201 20000200 returned -22 [ 545.072846][T16287] binder: 16284:16287 ioctl c0306201 20000200 returned -22 01:58:01 executing program 2: syz_emit_ethernet(0x200000ea, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 545.105308][T16293] binder: 16284:16293 unknown command 0 [ 545.107739][T16292] binder: 16281:16292 unknown command 0 [ 545.134929][T16293] binder: 16284:16293 ioctl c0306201 20000200 returned -22 [ 545.139020][T16292] binder: 16281:16292 ioctl c0306201 20000200 returned -22 01:58:01 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0, 0x7}], 0x1, 0x0, 0x0, 0x0) 01:58:01 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:58:01 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) [ 545.331625][T16301] binder: 16299:16301 unknown command 0 [ 545.351297][T16301] binder: 16299:16301 ioctl c0306201 20000200 returned -22 01:58:01 executing program 2: syz_emit_ethernet(0xfffffdef, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 545.393249][T16301] binder: 16299:16301 unknown command 0 [ 545.421100][T16301] binder: 16299:16301 ioctl c0306201 20000200 returned -22 [ 545.450483][T16305] binder: 16303:16305 unknown command 0 [ 545.464244][T16305] binder: 16303:16305 ioctl c0306201 20000200 returned -22 [ 545.514924][T16305] binder: 16303:16305 unknown command 0 [ 545.535985][T16305] binder: 16303:16305 ioctl c0306201 20000200 returned -22 01:58:01 executing program 4: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0xfffffecc) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r1, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000e66d1808b11342000d340000000109021b00010000d5a00904"], 0x0) syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000580)=ANY=[@ANYBLOB="1201000200000020ef0e01a04000010203010902240001014050090904000502030101010921faff620122480509058103000401039741980380a201400ec815d08ac91e0abe457e32d53eb78dc2842fb3ba32617823ec82885f901e43fe336ffafb8c188a1011f8dcbde199a7a5c0d412196c90b09ed64b699d432e1957440d5c7fa4fe2716ad128c38d7c1c416aa7bdd672edd95fba6869b14301d4618e927ac91d21c830188e14efecb88a1ba58a80c6b3e658f2d911e53760d5388e25ea258be890000000000ebae33754618e7eceb20982c13a646cb5dd4f87c49195bf84d6fa715170bb3718007a72e12df2a565509"], &(0x7f0000000200)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x110, 0x2, 0x81, 0x0, 0x10, 0x40}, 0x50, &(0x7f00000000c0)={0x5, 0xf, 0x50, 0x6, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x0, 0x8d, 0x72, 0x2}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x7, "a82ed34424fe499dd2cb35e2663eb62e"}, @ss_container_id={0x14, 0x10, 0x4, 0x9, "9e596909e0c1c4c9efabccfa38f499f4"}, @wireless={0xb, 0x10, 0x1, 0x4, 0x8, 0x4, 0x81, 0x5, 0x88}, @wireless={0xb, 0x10, 0x1, 0x4, 0x5, 0x1, 0xf0, 0x8, 0x20}]}, 0x2, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x42f}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x425}}]}) pipe(&(0x7f0000000240)) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r4, r7, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) 01:58:01 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) [ 545.870537][T10435] usb 5-1: USB disconnect, device number 7 [ 545.968562][T16327] binder: 16319:16327 unknown command 0 [ 545.983430][T16327] binder: 16319:16327 ioctl c0306201 20000200 returned -22 [ 546.009150][T16327] binder: 16319:16327 unknown command 0 [ 546.021849][T16327] binder: 16319:16327 ioctl c0306201 20000200 returned -22 01:58:03 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000140)="66530700ae897094e7b126b097eaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26f45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e05485b4ff15f7", 0x4a}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x34) ptrace$cont(0xffffffffffffffff, r0, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000080)={0x78}, 0x78) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 01:58:03 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0, 0x8}], 0x1, 0x0, 0x0, 0x0) 01:58:03 executing program 2: syz_emit_ethernet(0xfffffffffffffdef, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:58:03 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:58:03 executing program 4: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0xfffffecc) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r1, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000e66d1808b11342000d340000000109021b00010000d5a00904"], 0x0) syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000580)=ANY=[@ANYBLOB="1201000200000020ef0e01a04000010203010902240001014050090904000502030101010921faff620122480509058103000401039741980380a201400ec815d08ac91e0abe457e32d53eb78dc2842fb3ba32617823ec82885f901e43fe336ffafb8c188a1011f8dcbde199a7a5c0d412196c90b09ed64b699d432e1957440d5c7fa4fe2716ad128c38d7c1c416aa7bdd672edd95fba6869b14301d4618e927ac91d21c830188e14efecb88a1ba58a80c6b3e658f2d911e53760d5388e25ea258be890000000000ebae33754618e7eceb20982c13a646cb5dd4f87c49195bf84d6fa715170bb3718007a72e12df2a565509"], &(0x7f0000000200)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x110, 0x2, 0x81, 0x0, 0x10, 0x40}, 0x50, &(0x7f00000000c0)={0x5, 0xf, 0x50, 0x6, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x0, 0x8d, 0x72, 0x2}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x7, "a82ed34424fe499dd2cb35e2663eb62e"}, @ss_container_id={0x14, 0x10, 0x4, 0x9, "9e596909e0c1c4c9efabccfa38f499f4"}, @wireless={0xb, 0x10, 0x1, 0x4, 0x8, 0x4, 0x81, 0x5, 0x88}, @wireless={0xb, 0x10, 0x1, 0x4, 0x5, 0x1, 0xf0, 0x8, 0x20}]}, 0x2, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x42f}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x425}}]}) pipe(&(0x7f0000000240)) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r4, r7, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) 01:58:03 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) [ 548.074778][T16340] binder: 16335:16340 unknown command 0 [ 548.097881][T16340] binder: 16335:16340 ioctl c0306201 20000200 returned -22 [ 548.118944][T16342] binder: 16337:16342 unknown command 0 01:58:04 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x300, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 548.145876][T16342] binder: 16337:16342 ioctl c0306201 20000200 returned -22 [ 548.147484][T16340] binder: 16335:16340 unknown command 0 [ 548.182601][T16340] binder: 16335:16340 ioctl c0306201 20000200 returned -22 [ 548.185941][T16342] binder: 16337:16342 unknown command 0 01:58:04 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:58:04 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0, 0x300}], 0x1, 0x0, 0x0, 0x0) [ 548.235406][T16347] binder_alloc: 16337: binder_alloc_buf, no vma [ 548.256865][T16342] binder: 16337:16342 ioctl c0306201 20000200 returned -22 01:58:04 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:58:04 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x500, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 548.450681][T16361] binder: 16356:16361 unknown command 0 [ 548.476986][T16361] binder: 16356:16361 ioctl c0306201 20000200 returned -22 [ 548.482894][T10740] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 548.526025][T16361] binder: 16356:16361 unknown command 0 [ 548.548901][T16365] binder: 16362:16365 unknown command 0 [ 548.556995][T16361] binder: 16356:16361 ioctl c0306201 20000200 returned -22 [ 548.569082][T16365] binder: 16362:16365 ioctl c0306201 20000200 returned -22 01:58:04 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0, 0x500}], 0x1, 0x0, 0x0, 0x0) [ 548.604335][T16365] binder: 16362:16365 unknown command 0 [ 548.622296][T16365] binder: 16362:16365 ioctl c0306201 20000200 returned -22 [ 548.651724][T16365] binder_alloc: 16362: binder_alloc_buf, no vma [ 548.723014][T10740] usb 5-1: Using ep0 maxpacket: 8 [ 548.843268][T10740] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 548.859902][T10740] usb 5-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=34.0d [ 548.881413][T10740] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 548.903549][T10740] usb 5-1: config 0 descriptor?? [ 548.947922][T10740] usb 5-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 549.162286][T16348] udc-core: couldn't find an available UDC or it's busy [ 549.176414][T16348] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 550.012879][T13818] usb 5-1: Failed to submit usb control message: -110 [ 550.022453][T13818] usb 5-1: unable to send the bmi data to the device: -110 [ 550.032821][T13818] usb 5-1: unable to get target info from device [ 550.039330][T13818] usb 5-1: could not get target info (-110) [ 550.045917][T13818] usb 5-1: could not probe fw (-110) [ 551.106334][ T5] usb 5-1: USB disconnect, device number 8 01:58:07 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000140)="66530700ae897094e7b126b097eaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26f45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e05485b4ff15f7", 0x4a}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x34) ptrace$cont(0xffffffffffffffff, r0, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000080)={0x78}, 0x78) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 01:58:07 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:58:07 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x600, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:58:07 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:58:07 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0, 0x600}], 0x1, 0x0, 0x0, 0x0) 01:58:07 executing program 4: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0xfffffecc) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r1, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000e66d1808b11342000d340000000109021b00010000d5a00904"], 0x0) syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000580)=ANY=[@ANYBLOB="1201000200000020ef0e01a04000010203010902240001014050090904000502030101010921faff620122480509058103000401039741980380a201400ec815d08ac91e0abe457e32d53eb78dc2842fb3ba32617823ec82885f901e43fe336ffafb8c188a1011f8dcbde199a7a5c0d412196c90b09ed64b699d432e1957440d5c7fa4fe2716ad128c38d7c1c416aa7bdd672edd95fba6869b14301d4618e927ac91d21c830188e14efecb88a1ba58a80c6b3e658f2d911e53760d5388e25ea258be890000000000ebae33754618e7eceb20982c13a646cb5dd4f87c49195bf84d6fa715170bb3718007a72e12df2a565509"], &(0x7f0000000200)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x110, 0x2, 0x81, 0x0, 0x10, 0x40}, 0x50, &(0x7f00000000c0)={0x5, 0xf, 0x50, 0x6, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x0, 0x8d, 0x72, 0x2}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x7, "a82ed34424fe499dd2cb35e2663eb62e"}, @ss_container_id={0x14, 0x10, 0x4, 0x9, "9e596909e0c1c4c9efabccfa38f499f4"}, @wireless={0xb, 0x10, 0x1, 0x4, 0x8, 0x4, 0x81, 0x5, 0x88}, @wireless={0xb, 0x10, 0x1, 0x4, 0x5, 0x1, 0xf0, 0x8, 0x20}]}, 0x2, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x42f}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x425}}]}) pipe(&(0x7f0000000240)) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) [ 551.266741][T16408] binder: 16403:16408 unknown command 0 [ 551.285425][T16409] binder: 16405:16409 unknown command 0 [ 551.290735][T16408] binder: 16403:16408 ioctl c0306201 20000200 returned -22 [ 551.317117][T16409] binder: 16405:16409 ioctl c0306201 20000200 returned -22 [ 551.321007][T16408] binder: 16403:16408 unknown command 0 [ 551.333788][T16408] binder: 16403:16408 ioctl c0306201 20000200 returned -22 [ 551.344719][T16413] binder: 16405:16413 unknown command 0 01:58:07 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x700, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:58:07 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0, 0x700}], 0x1, 0x0, 0x0, 0x0) [ 551.374968][T16413] binder: 16405:16413 ioctl c0306201 20000200 returned -22 01:58:07 executing program 4: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0xfffffecc) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r1, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000e66d1808b11342000d340000000109021b00010000d5a00904"], 0x0) syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000580)=ANY=[@ANYBLOB="1201000200000020ef0e01a04000010203010902240001014050090904000502030101010921faff620122480509058103000401039741980380a201400ec815d08ac91e0abe457e32d53eb78dc2842fb3ba32617823ec82885f901e43fe336ffafb8c188a1011f8dcbde199a7a5c0d412196c90b09ed64b699d432e1957440d5c7fa4fe2716ad128c38d7c1c416aa7bdd672edd95fba6869b14301d4618e927ac91d21c830188e14efecb88a1ba58a80c6b3e658f2d911e53760d5388e25ea258be890000000000ebae33754618e7eceb20982c13a646cb5dd4f87c49195bf84d6fa715170bb3718007a72e12df2a565509"], &(0x7f0000000200)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x110, 0x2, 0x81, 0x0, 0x10, 0x40}, 0x50, &(0x7f00000000c0)={0x5, 0xf, 0x50, 0x6, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x0, 0x8d, 0x72, 0x2}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x7, "a82ed34424fe499dd2cb35e2663eb62e"}, @ss_container_id={0x14, 0x10, 0x4, 0x9, "9e596909e0c1c4c9efabccfa38f499f4"}, @wireless={0xb, 0x10, 0x1, 0x4, 0x8, 0x4, 0x81, 0x5, 0x88}, @wireless={0xb, 0x10, 0x1, 0x4, 0x5, 0x1, 0xf0, 0x8, 0x20}]}, 0x2, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x42f}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x425}}]}) pipe(&(0x7f0000000240)) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) 01:58:07 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:58:07 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:58:07 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x802, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 551.610175][T16428] binder: 16424:16428 unknown command 0 [ 551.635326][T16428] binder: 16424:16428 ioctl c0306201 20000200 returned -22 [ 551.636954][T16429] binder: 16427:16429 unknown command 0 [ 551.669321][T16429] binder: 16427:16429 ioctl c0306201 20000200 returned -22 [ 551.674621][T16428] binder: 16424:16428 unknown command 0 [ 551.698937][T16435] binder: 16427:16435 unknown command 0 [ 551.700131][T16428] binder: 16424:16428 ioctl c0306201 20000200 returned -22 [ 551.725869][T16435] binder: 16427:16435 ioctl c0306201 20000200 returned -22 [ 551.982540][ T4881] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 552.272541][ T4881] usb 5-1: Using ep0 maxpacket: 8 [ 552.400861][ T4881] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 552.411662][ T4881] usb 5-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=34.0d [ 552.422042][ T4881] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 552.433070][ T4881] usb 5-1: config 0 descriptor?? [ 552.493445][ T4881] usb 5-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 552.689683][T16431] udc-core: couldn't find an available UDC or it's busy [ 552.698207][T16431] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 553.532463][T13821] usb 5-1: Failed to submit usb control message: -110 [ 553.539772][T13821] usb 5-1: unable to send the bmi data to the device: -110 [ 553.550057][T13821] usb 5-1: unable to get target info from device [ 553.564383][T13821] usb 5-1: could not get target info (-110) [ 553.571767][T13821] usb 5-1: could not probe fw (-110) 01:58:10 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:58:10 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x803, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:58:10 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0, 0x1f00}], 0x1, 0x0, 0x0, 0x0) 01:58:10 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000140)="66530700ae897094e7b126b097eaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26f45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e05485b4ff15f7", 0x4a}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x34) ptrace$cont(0xffffffffffffffff, r0, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000080)={0x78}, 0x78) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 01:58:10 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) [ 554.372417][T16464] binder: 16459:16464 unknown command 0 [ 554.374307][T16463] binder: 16460:16463 unknown command 0 [ 554.396023][T16464] binder: 16459:16464 ioctl c0306201 20000200 returned -22 [ 554.408811][T16463] binder: 16460:16463 ioctl c0306201 20000200 returned -22 01:58:10 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x806, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 554.433806][T16469] binder: 16460:16469 unknown command 0 [ 554.441255][T16469] binder: 16460:16469 ioctl c0306201 20000200 returned -22 [ 554.446422][T16464] binder: 16459:16464 unknown command 0 [ 554.484732][T16464] binder: 16459:16464 ioctl c0306201 20000200 returned -22 [ 554.497297][T16468] binder: 16459:16468 ioctl c0306201 0 returned -14 01:58:10 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0, 0x2000}], 0x1, 0x0, 0x0, 0x0) 01:58:10 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:58:10 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:58:10 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x807, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:58:10 executing program 4: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0xfffffecc) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r1, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000e66d1808b11342000d340000000109021b00010000d5a00904"], 0x0) syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000580)=ANY=[@ANYBLOB="1201000200000020ef0e01a04000010203010902240001014050090904000502030101010921faff620122480509058103000401039741980380a201400ec815d08ac91e0abe457e32d53eb78dc2842fb3ba32617823ec82885f901e43fe336ffafb8c188a1011f8dcbde199a7a5c0d412196c90b09ed64b699d432e1957440d5c7fa4fe2716ad128c38d7c1c416aa7bdd672edd95fba6869b14301d4618e927ac91d21c830188e14efecb88a1ba58a80c6b3e658f2d911e53760d5388e25ea258be890000000000ebae33754618e7eceb20982c13a646cb5dd4f87c49195bf84d6fa715170bb3718007a72e12df2a565509"], &(0x7f0000000200)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x110, 0x2, 0x81, 0x0, 0x10, 0x40}, 0x50, &(0x7f00000000c0)={0x5, 0xf, 0x50, 0x6, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x0, 0x8d, 0x72, 0x2}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x7, "a82ed34424fe499dd2cb35e2663eb62e"}, @ss_container_id={0x14, 0x10, 0x4, 0x9, "9e596909e0c1c4c9efabccfa38f499f4"}, @wireless={0xb, 0x10, 0x1, 0x4, 0x8, 0x4, 0x81, 0x5, 0x88}, @wireless={0xb, 0x10, 0x1, 0x4, 0x5, 0x1, 0xf0, 0x8, 0x20}]}, 0x2, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x42f}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x425}}]}) pipe(&(0x7f0000000240)) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) [ 554.671845][T10435] usb 5-1: USB disconnect, device number 9 [ 554.686578][T16480] binder: 16477:16480 unknown command 0 [ 554.754180][T16488] binder: BINDER_SET_CONTEXT_MGR already set [ 554.757163][T16480] binder: 16477:16480 ioctl c0306201 20000200 returned -22 [ 554.788940][T16488] binder: 16477:16488 ioctl 40046207 0 returned -16 01:58:10 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0, 0xff00}], 0x1, 0x0, 0x0, 0x0) [ 554.820478][T16494] binder: 16477:16494 ioctl c0306201 20000200 returned -22 [ 554.825187][T16495] binder: 16485:16495 unknown command 0 01:58:10 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x808, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 554.862381][T16495] binder: 16485:16495 ioctl c0306201 20000200 returned -22 [ 554.895925][T16497] binder: 16485:16497 unknown command 0 [ 554.916383][T16497] binder: 16485:16497 ioctl c0306201 20000200 returned -22 [ 554.940810][T16495] binder: 16485:16495 ioctl c0306201 0 returned -14 01:58:13 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000140)="66530700ae897094e7b126b097eaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26f45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e05485b4ff15f7", 0x4a}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, 0x0, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000080)={0x78}, 0x78) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 01:58:13 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:58:13 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:58:13 executing program 4: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0xfffffecc) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r1, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000e66d1808b11342000d340000000109021b00010000d5a00904"], 0x0) syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000580)=ANY=[@ANYBLOB="1201000200000020ef0e01a04000010203010902240001014050090904000502030101010921faff620122480509058103000401039741980380a201400ec815d08ac91e0abe457e32d53eb78dc2842fb3ba32617823ec82885f901e43fe336ffafb8c188a1011f8dcbde199a7a5c0d412196c90b09ed64b699d432e1957440d5c7fa4fe2716ad128c38d7c1c416aa7bdd672edd95fba6869b14301d4618e927ac91d21c830188e14efecb88a1ba58a80c6b3e658f2d911e53760d5388e25ea258be890000000000ebae33754618e7eceb20982c13a646cb5dd4f87c49195bf84d6fa715170bb3718007a72e12df2a565509"], &(0x7f0000000200)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x110, 0x2, 0x81, 0x0, 0x10, 0x40}, 0x50, &(0x7f00000000c0)={0x5, 0xf, 0x50, 0x6, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x0, 0x8d, 0x72, 0x2}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x7, "a82ed34424fe499dd2cb35e2663eb62e"}, @ss_container_id={0x14, 0x10, 0x4, 0x9, "9e596909e0c1c4c9efabccfa38f499f4"}, @wireless={0xb, 0x10, 0x1, 0x4, 0x8, 0x4, 0x81, 0x5, 0x88}, @wireless={0xb, 0x10, 0x1, 0x4, 0x5, 0x1, 0xf0, 0x8, 0x20}]}, 0x2, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x42f}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x425}}]}) pipe(&(0x7f0000000240)) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r4, r5, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) 01:58:13 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x80b, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:58:13 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0, 0x1fffff}], 0x1, 0x0, 0x0, 0x0) [ 557.493523][T16526] binder: 16524:16526 unknown command 0 [ 557.506130][T16531] binder: 16525:16531 unknown command 0 [ 557.520727][T16526] binder: 16524:16526 ioctl c0306201 20000200 returned -22 [ 557.525113][T16531] binder: 16525:16531 ioctl c0306201 20000200 returned -22 01:58:13 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x848, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 557.554750][T16533] binder: BINDER_SET_CONTEXT_MGR already set [ 557.582992][T16533] binder: 16524:16533 ioctl 40046207 0 returned -16 [ 557.594832][T16535] binder: 16525:16535 unknown command 0 01:58:13 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0, 0x200000}], 0x1, 0x0, 0x0, 0x0) [ 557.607435][T16526] binder: 16524:16526 ioctl c0306201 20000200 returned -22 [ 557.619448][T16535] binder: 16525:16535 ioctl c0306201 20000200 returned -22 [ 557.646459][T16531] binder: 16525:16531 ioctl c0306201 0 returned -14 01:58:13 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:58:13 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:58:13 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x85c, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 557.820795][T16547] binder: 16542:16547 unknown command 0 [ 557.838561][T16549] binder: 16546:16549 unknown command 0 [ 557.842120][T10435] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 557.859995][T16547] binder: 16542:16547 ioctl c0306201 20000200 returned -22 [ 557.869629][T16549] binder: 16546:16549 ioctl c0306201 20000200 returned -22 [ 557.879178][T16550] binder: BINDER_SET_CONTEXT_MGR already set [ 557.897095][T16550] binder: 16542:16550 ioctl 40046207 0 returned -16 [ 557.913498][T16547] binder: 16542:16547 ioctl c0306201 20000200 returned -22 [ 557.916310][T16552] binder: 16546:16552 unknown command 0 [ 557.953971][T16552] binder: 16546:16552 ioctl c0306201 20000200 returned -22 01:58:13 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) [ 558.082052][T10435] usb 5-1: Using ep0 maxpacket: 8 [ 558.124515][T16558] binder: 16557:16558 unknown command 0 [ 558.130496][T16558] binder: 16557:16558 ioctl c0306201 20000200 returned -22 [ 558.155818][T16558] binder: 16557:16558 unknown command 0 [ 558.168620][T16558] binder: 16557:16558 ioctl c0306201 20000200 returned -22 [ 558.206636][T10435] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 558.225722][T10435] usb 5-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=34.0d [ 558.246665][T10435] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 558.266976][T10435] usb 5-1: config 0 descriptor?? [ 558.328245][T10435] usb 5-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 558.519491][T16532] udc-core: couldn't find an available UDC or it's busy [ 558.532097][T16532] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 559.371926][T13818] usb 5-1: Failed to submit usb control message: -110 [ 559.380856][T13818] usb 5-1: unable to send the bmi data to the device: -110 [ 559.388320][T13818] usb 5-1: unable to get target info from device [ 559.395026][T13818] usb 5-1: could not get target info (-110) [ 559.403633][T13818] usb 5-1: could not probe fw (-110) [ 560.449478][ T4886] usb 5-1: USB disconnect, device number 10 01:58:16 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000140)="66530700ae897094e7b126b097eaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26f45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e05485b4ff15f7", 0x4a}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, 0x0, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000080)={0x78}, 0x78) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 01:58:16 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:58:16 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0, 0x1000000}], 0x1, 0x0, 0x0, 0x0) 01:58:16 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x3400, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:58:16 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:58:16 executing program 4: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0xfffffecc) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r1, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000e66d1808b11342000d340000000109021b00010000d5a00904"], 0x0) syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000580)=ANY=[@ANYBLOB="1201000200000020ef0e01a04000010203010902240001014050090904000502030101010921faff620122480509058103000401039741980380a201400ec815d08ac91e0abe457e32d53eb78dc2842fb3ba32617823ec82885f901e43fe336ffafb8c188a1011f8dcbde199a7a5c0d412196c90b09ed64b699d432e1957440d5c7fa4fe2716ad128c38d7c1c416aa7bdd672edd95fba6869b14301d4618e927ac91d21c830188e14efecb88a1ba58a80c6b3e658f2d911e53760d5388e25ea258be890000000000ebae33754618e7eceb20982c13a646cb5dd4f87c49195bf84d6fa715170bb3718007a72e12df2a565509"], &(0x7f0000000200)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x110, 0x2, 0x81, 0x0, 0x10, 0x40}, 0x50, &(0x7f00000000c0)={0x5, 0xf, 0x50, 0x6, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x0, 0x8d, 0x72, 0x2}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x7, "a82ed34424fe499dd2cb35e2663eb62e"}, @ss_container_id={0x14, 0x10, 0x4, 0x9, "9e596909e0c1c4c9efabccfa38f499f4"}, @wireless={0xb, 0x10, 0x1, 0x4, 0x8, 0x4, 0x81, 0x5, 0x88}, @wireless={0xb, 0x10, 0x1, 0x4, 0x5, 0x1, 0xf0, 0x8, 0x20}]}, 0x2, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x42f}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x425}}]}) pipe(&(0x7f0000000240)) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r4, r5, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) [ 560.625760][T16593] binder: 16589:16593 unknown command 0 [ 560.661140][T16593] binder: 16589:16593 ioctl c0306201 20000200 returned -22 01:58:16 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x4000, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 560.674534][T16597] binder: 16588:16597 unknown command 0 [ 560.714400][T16599] binder: 16589:16599 unknown command 0 [ 560.722214][T16597] binder: 16588:16597 ioctl c0306201 20000200 returned -22 [ 560.747808][T16599] binder: 16589:16599 ioctl c0306201 20000200 returned -22 01:58:16 executing program 4: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0xfffffecc) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r1, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000e66d1808b11342000d340000000109021b00010000d5a00904"], 0x0) syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000580)=ANY=[@ANYBLOB="1201000200000020ef0e01a04000010203010902240001014050090904000502030101010921faff620122480509058103000401039741980380a201400ec815d08ac91e0abe457e32d53eb78dc2842fb3ba32617823ec82885f901e43fe336ffafb8c188a1011f8dcbde199a7a5c0d412196c90b09ed64b699d432e1957440d5c7fa4fe2716ad128c38d7c1c416aa7bdd672edd95fba6869b14301d4618e927ac91d21c830188e14efecb88a1ba58a80c6b3e658f2d911e53760d5388e25ea258be890000000000ebae33754618e7eceb20982c13a646cb5dd4f87c49195bf84d6fa715170bb3718007a72e12df2a565509"], &(0x7f0000000200)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x110, 0x2, 0x81, 0x0, 0x10, 0x40}, 0x50, &(0x7f00000000c0)={0x5, 0xf, 0x50, 0x6, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x0, 0x8d, 0x72, 0x2}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x7, "a82ed34424fe499dd2cb35e2663eb62e"}, @ss_container_id={0x14, 0x10, 0x4, 0x9, "9e596909e0c1c4c9efabccfa38f499f4"}, @wireless={0xb, 0x10, 0x1, 0x4, 0x8, 0x4, 0x81, 0x5, 0x88}, @wireless={0xb, 0x10, 0x1, 0x4, 0x5, 0x1, 0xf0, 0x8, 0x20}]}, 0x2, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x42f}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x425}}]}) pipe(&(0x7f0000000240)) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r4, r5, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) 01:58:16 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:58:16 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0, 0x2000000}], 0x1, 0x0, 0x0, 0x0) 01:58:16 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:58:16 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x4305, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 560.989908][T16614] binder: 16613:16614 unknown command 0 [ 561.017519][T16615] binder: 16610:16615 unknown command 0 [ 561.024578][T16614] binder: 16613:16614 ioctl c0306201 20000200 returned -22 [ 561.051997][T16615] binder: 16610:16615 ioctl c0306201 20000200 returned -22 [ 561.063832][T16619] binder: 16613:16619 unknown command 0 [ 561.078092][T16619] binder: 16613:16619 ioctl c0306201 20000200 returned -22 [ 561.301667][ T4881] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 561.561679][ T4881] usb 5-1: Using ep0 maxpacket: 8 [ 561.701715][ T4881] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 561.712299][ T4881] usb 5-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=34.0d [ 561.721330][ T4881] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 561.732093][ T4881] usb 5-1: config 0 descriptor?? [ 561.774808][ T4881] usb 5-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 561.978158][T16616] udc-core: couldn't find an available UDC or it's busy [ 561.985244][T16616] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 562.472124][ T3269] ieee802154 phy0 wpan0: encryption failed: -22 [ 562.478477][ T3269] ieee802154 phy1 wpan1: encryption failed: -22 [ 562.891536][T13821] usb 5-1: Failed to submit usb control message: -110 [ 562.898910][T13821] usb 5-1: unable to send the bmi data to the device: -110 [ 562.906720][T13821] usb 5-1: unable to get target info from device [ 562.913606][T13821] usb 5-1: could not get target info (-110) [ 562.919617][T13821] usb 5-1: could not probe fw (-110) 01:58:19 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:58:19 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000140)="66530700ae897094e7b126b097eaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26f45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e05485b4ff15f7", 0x4a}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, 0x0, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000080)={0x78}, 0x78) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 01:58:19 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x6000, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:58:19 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:58:19 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0, 0x3000000}], 0x1, 0x0, 0x0, 0x0) [ 563.738144][T16649] binder: 16645:16649 unknown command 0 [ 563.757824][T16649] binder: 16645:16649 ioctl c0306201 20000200 returned -22 [ 563.773743][T16653] binder: 16647:16653 unknown command 0 01:58:19 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x8035, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:58:19 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000140)="66530700ae897094e7b126b097eaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26f45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e05485b4ff15f7", 0x4a}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) [ 563.806232][T16649] binder: 16645:16649 unknown command 0 [ 563.807592][T16653] binder: 16647:16653 ioctl c0306201 20000200 returned -22 [ 563.839956][T16649] binder: 16645:16649 ioctl c0306201 20000200 returned -22 [ 564.003086][T10739] usb 5-1: USB disconnect, device number 11 01:58:19 executing program 4: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0xfffffecc) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r1, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000e66d1808b11342000d340000000109021b00010000d5a00904"], 0x0) syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000580)=ANY=[@ANYBLOB="1201000200000020ef0e01a04000010203010902240001014050090904000502030101010921faff620122480509058103000401039741980380a201400ec815d08ac91e0abe457e32d53eb78dc2842fb3ba32617823ec82885f901e43fe336ffafb8c188a1011f8dcbde199a7a5c0d412196c90b09ed64b699d432e1957440d5c7fa4fe2716ad128c38d7c1c416aa7bdd672edd95fba6869b14301d4618e927ac91d21c830188e14efecb88a1ba58a80c6b3e658f2d911e53760d5388e25ea258be890000000000ebae33754618e7eceb20982c13a646cb5dd4f87c49195bf84d6fa715170bb3718007a72e12df2a565509"], &(0x7f0000000200)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x110, 0x2, 0x81, 0x0, 0x10, 0x40}, 0x50, &(0x7f00000000c0)={0x5, 0xf, 0x50, 0x6, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x0, 0x8d, 0x72, 0x2}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x7, "a82ed34424fe499dd2cb35e2663eb62e"}, @ss_container_id={0x14, 0x10, 0x4, 0x9, "9e596909e0c1c4c9efabccfa38f499f4"}, @wireless={0xb, 0x10, 0x1, 0x4, 0x8, 0x4, 0x81, 0x5, 0x88}, @wireless={0xb, 0x10, 0x1, 0x4, 0x5, 0x1, 0xf0, 0x8, 0x20}]}, 0x2, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x42f}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x425}}]}) pipe(&(0x7f0000000240)) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r5 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r4, r6, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) 01:58:19 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(0xffffffffffffffff, r0) r1 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:58:19 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0, 0x4000000}], 0x1, 0x0, 0x0, 0x0) 01:58:19 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:58:19 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x8100, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 564.198221][T16676] binder: BINDER_SET_CONTEXT_MGR already set [ 564.210524][T16679] binder: 16674:16679 unknown command 0 [ 564.234881][T16676] binder: 16672:16676 ioctl 40046207 0 returned -16 [ 564.237145][T16679] binder: 16674:16679 ioctl c0306201 20000200 returned -22 [ 564.259026][T16681] binder: 16672:16681 ioctl c0306201 20000200 returned -22 [ 564.284424][T16682] binder: 16674:16682 unknown command 0 01:58:20 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x8847, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:58:20 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0, 0x5000000}], 0x1, 0x0, 0x0, 0x0) [ 564.310637][T16682] binder: 16674:16682 ioctl c0306201 20000200 returned -22 01:58:20 executing program 4: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0xfffffecc) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r1, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000e66d1808b11342000d340000000109021b00010000d5a00904"], 0x0) syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000580)=ANY=[@ANYBLOB="1201000200000020ef0e01a04000010203010902240001014050090904000502030101010921faff620122480509058103000401039741980380a201400ec815d08ac91e0abe457e32d53eb78dc2842fb3ba32617823ec82885f901e43fe336ffafb8c188a1011f8dcbde199a7a5c0d412196c90b09ed64b699d432e1957440d5c7fa4fe2716ad128c38d7c1c416aa7bdd672edd95fba6869b14301d4618e927ac91d21c830188e14efecb88a1ba58a80c6b3e658f2d911e53760d5388e25ea258be890000000000ebae33754618e7eceb20982c13a646cb5dd4f87c49195bf84d6fa715170bb3718007a72e12df2a565509"], &(0x7f0000000200)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x110, 0x2, 0x81, 0x0, 0x10, 0x40}, 0x50, &(0x7f00000000c0)={0x5, 0xf, 0x50, 0x6, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x0, 0x8d, 0x72, 0x2}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x7, "a82ed34424fe499dd2cb35e2663eb62e"}, @ss_container_id={0x14, 0x10, 0x4, 0x9, "9e596909e0c1c4c9efabccfa38f499f4"}, @wireless={0xb, 0x10, 0x1, 0x4, 0x8, 0x4, 0x81, 0x5, 0x88}, @wireless={0xb, 0x10, 0x1, 0x4, 0x5, 0x1, 0xf0, 0x8, 0x20}]}, 0x2, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x42f}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x425}}]}) pipe(&(0x7f0000000240)) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r5 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r4, r6, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) 01:58:20 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:58:20 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x8848, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 564.538404][T16695] binder: 16691:16695 unknown command 0 [ 564.544381][T16695] binder: 16691:16695 ioctl c0306201 20000200 returned -22 [ 564.558838][T16695] binder: 16691:16695 unknown command 0 [ 564.565349][T16695] binder: 16691:16695 ioctl c0306201 20000200 returned -22 01:58:20 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) [ 564.726398][T16703] binder: 16701:16703 unknown command 0 [ 564.732492][T16703] binder: 16701:16703 ioctl c0306201 20000200 returned -22 [ 564.746330][T16703] binder: 16701:16703 unknown command 0 [ 564.754572][T16703] binder: 16701:16703 ioctl c0306201 20000200 returned -22 [ 564.861428][ T4886] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 565.121341][ T4886] usb 5-1: Using ep0 maxpacket: 8 [ 565.255928][ T4886] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 565.270511][ T4886] usb 5-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=34.0d [ 565.293075][ T4886] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 565.314490][ T4886] usb 5-1: config 0 descriptor?? [ 565.373198][ T4886] usb 5-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 565.569124][T16696] udc-core: couldn't find an available UDC or it's busy [ 565.598914][T16696] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 566.401187][T13818] usb 5-1: Failed to submit usb control message: -110 [ 566.408650][T13818] usb 5-1: unable to send the bmi data to the device: -110 [ 566.428671][T13818] usb 5-1: unable to get target info from device [ 566.436664][T13818] usb 5-1: could not get target info (-110) [ 566.443908][T13818] usb 5-1: could not probe fw (-110) 01:58:22 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000140)="66530700ae897094e7b126b097eaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26f45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e05485b4ff15f7", 0x4a}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 01:58:22 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0, 0x6000000}], 0x1, 0x0, 0x0, 0x0) 01:58:22 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x8864, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:58:22 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:58:22 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(0xffffffffffffffff, r0) r1 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) [ 567.053406][T16733] binder: 16729:16733 unknown command 0 [ 567.060511][T16733] binder: 16729:16733 ioctl c0306201 20000200 returned -22 [ 567.097911][T16736] binder: BINDER_SET_CONTEXT_MGR already set [ 567.104505][T16733] binder: 16729:16733 unknown command 0 [ 567.124305][T16733] binder: 16729:16733 ioctl c0306201 20000200 returned -22 [ 567.126938][T16736] binder: 16731:16736 ioctl 40046207 0 returned -16 01:58:23 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x8906, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 567.150470][T16739] binder: 16731:16739 ioctl c0306201 20000200 returned -22 01:58:23 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x0, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:58:23 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0, 0x7000000}], 0x1, 0x0, 0x0, 0x0) [ 567.381691][T16748] binder: 16745:16748 unknown command 0 [ 567.394889][T16748] binder: 16745:16748 ioctl c0306201 20000200 returned -22 [ 567.410324][T16748] binder: 16745:16748 unknown command 0 [ 567.418035][T16748] binder: 16745:16748 ioctl c0306201 20000200 returned -22 01:58:23 executing program 4: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0xfffffecc) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r1, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000e66d1808b11342000d340000000109021b00010000d5a00904"], 0x0) syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000580)=ANY=[@ANYBLOB="1201000200000020ef0e01a04000010203010902240001014050090904000502030101010921faff620122480509058103000401039741980380a201400ec815d08ac91e0abe457e32d53eb78dc2842fb3ba32617823ec82885f901e43fe336ffafb8c188a1011f8dcbde199a7a5c0d412196c90b09ed64b699d432e1957440d5c7fa4fe2716ad128c38d7c1c416aa7bdd672edd95fba6869b14301d4618e927ac91d21c830188e14efecb88a1ba58a80c6b3e658f2d911e53760d5388e25ea258be890000000000ebae33754618e7eceb20982c13a646cb5dd4f87c49195bf84d6fa715170bb3718007a72e12df2a565509"], &(0x7f0000000200)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x110, 0x2, 0x81, 0x0, 0x10, 0x40}, 0x50, &(0x7f00000000c0)={0x5, 0xf, 0x50, 0x6, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x0, 0x8d, 0x72, 0x2}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x7, "a82ed34424fe499dd2cb35e2663eb62e"}, @ss_container_id={0x14, 0x10, 0x4, 0x9, "9e596909e0c1c4c9efabccfa38f499f4"}, @wireless={0xb, 0x10, 0x1, 0x4, 0x8, 0x4, 0x81, 0x5, 0x88}, @wireless={0xb, 0x10, 0x1, 0x4, 0x5, 0x1, 0xf0, 0x8, 0x20}]}, 0x2, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x42f}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x425}}]}) pipe(&(0x7f0000000240)) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r5 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r4, r6, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) [ 567.529799][ T20] usb 5-1: USB disconnect, device number 12 01:58:23 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x3, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:58:23 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0, 0x8000000}], 0x1, 0x0, 0x0, 0x0) 01:58:23 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x0, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) [ 567.638355][T16761] binder: 16758:16761 unknown command 0 [ 567.653994][T16761] binder: 16758:16761 ioctl c0306201 20000200 returned -22 [ 567.679774][T16761] binder: 16758:16761 unknown command 0 [ 567.704523][T16761] binder: 16758:16761 ioctl c0306201 20000200 returned -22 01:58:25 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000140)="66530700ae897094e7b126b097eaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26f45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e05485b4ff15f7", 0x4a}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 01:58:25 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x4, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:58:25 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x0, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:58:25 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0, 0x1f000000}], 0x1, 0x0, 0x0, 0x0) 01:58:25 executing program 4: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0xfffffecc) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r1, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000e66d1808b11342000d340000000109021b00010000d5a00904"], 0x0) syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000580)=ANY=[@ANYBLOB="1201000200000020ef0e01a04000010203010902240001014050090904000502030101010921faff620122480509058103000401039741980380a201400ec815d08ac91e0abe457e32d53eb78dc2842fb3ba32617823ec82885f901e43fe336ffafb8c188a1011f8dcbde199a7a5c0d412196c90b09ed64b699d432e1957440d5c7fa4fe2716ad128c38d7c1c416aa7bdd672edd95fba6869b14301d4618e927ac91d21c830188e14efecb88a1ba58a80c6b3e658f2d911e53760d5388e25ea258be890000000000ebae33754618e7eceb20982c13a646cb5dd4f87c49195bf84d6fa715170bb3718007a72e12df2a565509"], &(0x7f0000000200)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x110, 0x2, 0x81, 0x0, 0x10, 0x40}, 0x50, &(0x7f00000000c0)={0x5, 0xf, 0x50, 0x6, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x0, 0x8d, 0x72, 0x2}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x7, "a82ed34424fe499dd2cb35e2663eb62e"}, @ss_container_id={0x14, 0x10, 0x4, 0x9, "9e596909e0c1c4c9efabccfa38f499f4"}, @wireless={0xb, 0x10, 0x1, 0x4, 0x8, 0x4, 0x81, 0x5, 0x88}, @wireless={0xb, 0x10, 0x1, 0x4, 0x5, 0x1, 0xf0, 0x8, 0x20}]}, 0x2, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x42f}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x425}}]}) pipe(&(0x7f0000000240)) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) 01:58:25 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(0xffffffffffffffff, r0) r1 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:58:26 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x6, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 570.189297][T16791] binder: 16785:16791 unknown command 0 [ 570.190101][T16790] binder: BINDER_SET_CONTEXT_MGR already set [ 570.205341][T16791] binder: 16785:16791 ioctl c0306201 20000200 returned -22 [ 570.236658][T16790] binder: 16782:16790 ioctl 40046207 0 returned -16 [ 570.257222][T16796] binder: 16782:16796 ioctl c0306201 20000200 returned -22 [ 570.279791][T16791] binder: 16785:16791 unknown command 0 01:58:26 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0, 0xff000000}], 0x1, 0x0, 0x0, 0x0) [ 570.302453][T16791] binder: 16785:16791 ioctl c0306201 20000200 returned -22 01:58:26 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x8, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:58:26 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:58:26 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0xb, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 570.520856][T10740] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 570.543138][T16811] binder: 16809:16811 unknown command 0 01:58:26 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0, 0xffff1f00}], 0x1, 0x0, 0x0, 0x0) [ 570.574797][T16811] binder: 16809:16811 ioctl c0306201 20000200 returned -22 [ 570.596144][T16811] binder: 16809:16811 unknown command 0 [ 570.613850][T16811] binder: 16809:16811 ioctl c0306201 20000200 returned -22 [ 570.780847][T10740] usb 5-1: Using ep0 maxpacket: 8 [ 570.901519][T10740] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 570.916439][T10740] usb 5-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=34.0d [ 570.939477][T10740] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 570.951220][T10740] usb 5-1: config 0 descriptor?? [ 571.021090][T10740] usb 5-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 571.196929][T16793] udc-core: couldn't find an available UDC or it's busy [ 571.204224][T16793] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 572.090675][ T301] usb 5-1: Failed to submit usb control message: -110 [ 572.099252][ T301] usb 5-1: unable to send the bmi data to the device: -110 [ 572.108290][ T301] usb 5-1: unable to get target info from device [ 572.116496][ T301] usb 5-1: could not get target info (-110) [ 572.130473][ T301] usb 5-1: could not probe fw (-110) [ 573.139086][T10740] usb 5-1: USB disconnect, device number 13 01:58:29 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000140)="66530700ae897094e7b126b097eaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26f45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e05485b4ff15f7", 0x4a}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000080)={0x78}, 0x78) ptrace$setregs(0xffffffffffffffff, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 01:58:29 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:58:29 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0xc, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:58:29 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0, 0x20000000000000}], 0x1, 0x0, 0x0, 0x0) 01:58:29 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:58:29 executing program 4: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0xfffffecc) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r1, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000e66d1808b11342000d340000000109021b00010000d5a00904"], 0x0) syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000580)=ANY=[@ANYBLOB="1201000200000020ef0e01a04000010203010902240001014050090904000502030101010921faff620122480509058103000401039741980380a201400ec815d08ac91e0abe457e32d53eb78dc2842fb3ba32617823ec82885f901e43fe336ffafb8c188a1011f8dcbde199a7a5c0d412196c90b09ed64b699d432e1957440d5c7fa4fe2716ad128c38d7c1c416aa7bdd672edd95fba6869b14301d4618e927ac91d21c830188e14efecb88a1ba58a80c6b3e658f2d911e53760d5388e25ea258be890000000000ebae33754618e7eceb20982c13a646cb5dd4f87c49195bf84d6fa715170bb3718007a72e12df2a565509"], &(0x7f0000000200)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x110, 0x2, 0x81, 0x0, 0x10, 0x40}, 0x50, &(0x7f00000000c0)={0x5, 0xf, 0x50, 0x6, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x0, 0x8d, 0x72, 0x2}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x7, "a82ed34424fe499dd2cb35e2663eb62e"}, @ss_container_id={0x14, 0x10, 0x4, 0x9, "9e596909e0c1c4c9efabccfa38f499f4"}, @wireless={0xb, 0x10, 0x1, 0x4, 0x8, 0x4, 0x81, 0x5, 0x88}, @wireless={0xb, 0x10, 0x1, 0x4, 0x5, 0x1, 0xf0, 0x8, 0x20}]}, 0x2, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x42f}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x425}}]}) pipe(&(0x7f0000000240)) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) [ 573.380007][T16854] binder: 16851:16854 unknown command 0 [ 573.396566][T16858] binder: 16850:16858 unknown command 0 [ 573.413249][T16854] binder: 16851:16854 ioctl c0306201 20000200 returned -22 01:58:29 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x2, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 573.427677][T16858] binder: 16850:16858 ioctl c0306201 20000200 returned -22 [ 573.459853][T16862] binder: 16851:16862 unknown command 0 [ 573.481329][T16858] binder: 16850:16858 unknown command 0 [ 573.483138][T16862] binder: 16851:16862 ioctl c0306201 20000200 returned -22 01:58:29 executing program 4: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0xfffffecc) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r1, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000e66d1808b11342000d340000000109021b00010000d5a00904"], 0x0) syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000580)=ANY=[@ANYBLOB="1201000200000020ef0e01a04000010203010902240001014050090904000502030101010921faff620122480509058103000401039741980380a201400ec815d08ac91e0abe457e32d53eb78dc2842fb3ba32617823ec82885f901e43fe336ffafb8c188a1011f8dcbde199a7a5c0d412196c90b09ed64b699d432e1957440d5c7fa4fe2716ad128c38d7c1c416aa7bdd672edd95fba6869b14301d4618e927ac91d21c830188e14efecb88a1ba58a80c6b3e658f2d911e53760d5388e25ea258be890000000000ebae33754618e7eceb20982c13a646cb5dd4f87c49195bf84d6fa715170bb3718007a72e12df2a565509"], &(0x7f0000000200)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x110, 0x2, 0x81, 0x0, 0x10, 0x40}, 0x50, &(0x7f00000000c0)={0x5, 0xf, 0x50, 0x6, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x0, 0x8d, 0x72, 0x2}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x7, "a82ed34424fe499dd2cb35e2663eb62e"}, @ss_container_id={0x14, 0x10, 0x4, 0x9, "9e596909e0c1c4c9efabccfa38f499f4"}, @wireless={0xb, 0x10, 0x1, 0x4, 0x8, 0x4, 0x81, 0x5, 0x88}, @wireless={0xb, 0x10, 0x1, 0x4, 0x5, 0x1, 0xf0, 0x8, 0x20}]}, 0x2, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x42f}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x425}}]}) pipe(&(0x7f0000000240)) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) [ 573.512712][T16858] binder: 16850:16858 ioctl c0306201 20000200 returned -22 01:58:29 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0, 0x100000000000000}], 0x1, 0x0, 0x0, 0x0) 01:58:29 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:58:29 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:58:29 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x3, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 573.799291][T16878] binder: 16874:16878 unknown command 0 [ 573.802719][T16879] binder: 16872:16879 unknown command 0 [ 573.812068][T16878] binder: 16874:16878 ioctl c0306201 20000200 returned -22 [ 573.828792][T16879] binder: 16872:16879 ioctl c0306201 20000200 returned -22 [ 573.849585][T16878] binder: 16874:16878 unknown command 0 [ 573.871484][T16879] binder: 16872:16879 unknown command 0 [ 573.873393][T16878] binder: 16874:16878 ioctl c0306201 20000200 returned -22 [ 573.888977][T16879] binder: 16872:16879 ioctl c0306201 20000200 returned -22 [ 574.041133][ T5] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 574.301759][ T5] usb 5-1: Using ep0 maxpacket: 8 [ 574.431321][ T5] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 574.442110][ T5] usb 5-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=34.0d [ 574.453910][ T5] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 574.465343][ T5] usb 5-1: config 0 descriptor?? [ 574.541718][ T5] usb 5-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 574.740635][T16875] udc-core: couldn't find an available UDC or it's busy [ 574.747682][T16875] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 575.600574][T13818] usb 5-1: Failed to submit usb control message: -110 [ 575.608155][T13818] usb 5-1: unable to send the bmi data to the device: -110 [ 575.616855][T13818] usb 5-1: unable to get target info from device [ 575.623414][T13818] usb 5-1: could not get target info (-110) [ 575.629336][T13818] usb 5-1: could not probe fw (-110) 01:58:32 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000140)="66530700ae897094e7b126b097eaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26f45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e05485b4ff15f7", 0x4a}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000080)={0x78}, 0x78) ptrace$setregs(0xffffffffffffffff, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 01:58:32 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0, 0x200000000000000}], 0x1, 0x0, 0x0, 0x0) 01:58:32 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x6, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:58:32 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:58:32 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) 01:58:32 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x8, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 576.487537][T16916] binder: 16911:16916 unknown command 0 [ 576.494894][T16915] binder: 16910:16915 unknown command 0 [ 576.513087][T16916] binder: 16911:16916 ioctl c0306201 20000200 returned -22 [ 576.521707][T16915] binder: 16910:16915 ioctl c0306201 20000200 returned -22 [ 576.558170][T16917] binder: 16910:16917 unknown command 0 [ 576.577314][T16916] binder: 16911:16916 unknown command 0 [ 576.590782][T16917] binder: 16910:16917 ioctl c0306201 20000200 returned -22 [ 576.602713][T16916] binder: 16911:16916 ioctl c0306201 20000200 returned -22 [ 576.619647][T16918] binder: 16911:16918 ioctl c0306201 0 returned -14 01:58:32 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0, 0x300000000000000}], 0x1, 0x0, 0x0, 0x0) [ 576.729731][ T4886] usb 5-1: USB disconnect, device number 14 01:58:32 executing program 4: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0xfffffecc) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r1, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000e66d1808b11342000d340000000109021b00010000d5a00904"], 0x0) syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000580)=ANY=[@ANYBLOB="1201000200000020ef0e01a04000010203010902240001014050090904000502030101010921faff620122480509058103000401039741980380a201400ec815d08ac91e0abe457e32d53eb78dc2842fb3ba32617823ec82885f901e43fe336ffafb8c188a1011f8dcbde199a7a5c0d412196c90b09ed64b699d432e1957440d5c7fa4fe2716ad128c38d7c1c416aa7bdd672edd95fba6869b14301d4618e927ac91d21c830188e14efecb88a1ba58a80c6b3e658f2d911e53760d5388e25ea258be890000000000ebae33754618e7eceb20982c13a646cb5dd4f87c49195bf84d6fa715170bb3718007a72e12df2a565509"], &(0x7f0000000200)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x110, 0x2, 0x81, 0x0, 0x10, 0x40}, 0x50, &(0x7f00000000c0)={0x5, 0xf, 0x50, 0x6, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x0, 0x8d, 0x72, 0x2}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x7, "a82ed34424fe499dd2cb35e2663eb62e"}, @ss_container_id={0x14, 0x10, 0x4, 0x9, "9e596909e0c1c4c9efabccfa38f499f4"}, @wireless={0xb, 0x10, 0x1, 0x4, 0x8, 0x4, 0x81, 0x5, 0x88}, @wireless={0xb, 0x10, 0x1, 0x4, 0x5, 0x1, 0xf0, 0x8, 0x20}]}, 0x2, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x42f}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x425}}]}) pipe(&(0x7f0000000240)) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r3, r6, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) 01:58:32 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:58:32 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) 01:58:32 executing program 5: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, 0xffffffffffffffff) r1 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) [ 576.885623][T16938] binder: 16933:16938 unknown command 0 [ 576.906590][T16938] binder: 16933:16938 ioctl c0306201 20000200 returned -22 [ 576.938938][T16938] binder: 16933:16938 unknown command 0 [ 576.963891][T16942] binder: 16937:16942 unknown command 0 [ 576.972184][T16938] binder: 16933:16938 ioctl c0306201 20000200 returned -22 01:58:32 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x2, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 577.000612][T16942] binder: 16937:16942 ioctl c0306201 20000200 returned -22 [ 577.008977][T16944] binder: 16933:16944 ioctl c0306201 0 returned -14 01:58:35 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000140)="66530700ae897094e7b126b097eaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26f45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e05485b4ff15f7", 0x4a}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000080)={0x78}, 0x78) ptrace$setregs(0xffffffffffffffff, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 01:58:35 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0, 0x400000000000000}], 0x1, 0x0, 0x0, 0x0) 01:58:35 executing program 4: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0xfffffecc) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r1, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000e66d1808b11342000d340000000109021b00010000d5a00904"], 0x0) syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000580)=ANY=[@ANYBLOB="1201000200000020ef0e01a04000010203010902240001014050090904000502030101010921faff620122480509058103000401039741980380a201400ec815d08ac91e0abe457e32d53eb78dc2842fb3ba32617823ec82885f901e43fe336ffafb8c188a1011f8dcbde199a7a5c0d412196c90b09ed64b699d432e1957440d5c7fa4fe2716ad128c38d7c1c416aa7bdd672edd95fba6869b14301d4618e927ac91d21c830188e14efecb88a1ba58a80c6b3e658f2d911e53760d5388e25ea258be890000000000ebae33754618e7eceb20982c13a646cb5dd4f87c49195bf84d6fa715170bb3718007a72e12df2a565509"], &(0x7f0000000200)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x110, 0x2, 0x81, 0x0, 0x10, 0x40}, 0x50, &(0x7f00000000c0)={0x5, 0xf, 0x50, 0x6, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x0, 0x8d, 0x72, 0x2}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x7, "a82ed34424fe499dd2cb35e2663eb62e"}, @ss_container_id={0x14, 0x10, 0x4, 0x9, "9e596909e0c1c4c9efabccfa38f499f4"}, @wireless={0xb, 0x10, 0x1, 0x4, 0x8, 0x4, 0x81, 0x5, 0x88}, @wireless={0xb, 0x10, 0x1, 0x4, 0x5, 0x1, 0xf0, 0x8, 0x20}]}, 0x2, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x42f}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x425}}]}) pipe(&(0x7f0000000240)) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r3, r6, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) 01:58:35 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) 01:58:35 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x3, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:58:35 executing program 5: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, 0xffffffffffffffff) r1 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) [ 579.582824][T16969] binder: 16968:16969 unknown command 0 [ 579.597561][T16972] binder: 16966:16972 unknown command 0 [ 579.610192][T16969] binder: 16968:16969 ioctl c0306201 20000200 returned -22 [ 579.618709][T16972] binder: 16966:16972 ioctl c0306201 20000200 returned -22 01:58:35 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 579.662105][T16972] binder: 16966:16972 unknown command 0 [ 579.686623][T16972] binder: 16966:16972 ioctl c0306201 20000200 returned -22 01:58:35 executing program 5: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r0, 0xffffffffffffffff) r1 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:58:35 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0, 0x500000000000000}], 0x1, 0x0, 0x0, 0x0) [ 579.713127][T16977] binder: 16966:16977 ioctl c0306201 0 returned -14 01:58:35 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 01:58:35 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x2, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 579.896018][T16991] binder: 16984:16991 unknown command 0 [ 579.931716][T16991] binder: 16984:16991 ioctl c0306201 20000200 returned -22 [ 579.960960][T16993] binder: 16988:16993 unknown command 0 [ 579.969978][ T9674] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 579.976624][T16993] binder: 16988:16993 ioctl c0306201 20000200 returned -22 01:58:35 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0, 0x600000000000000}], 0x1, 0x0, 0x0, 0x0) [ 580.005738][T16993] binder: 16988:16993 unknown command 0 [ 580.027884][T16993] binder: 16988:16993 ioctl c0306201 20000200 returned -22 [ 580.259969][ T9674] usb 5-1: Using ep0 maxpacket: 8 [ 580.428673][ T9674] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 580.443253][ T9674] usb 5-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=34.0d [ 580.453005][ T9674] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 580.463838][ T9674] usb 5-1: config 0 descriptor?? [ 580.536428][ T9674] usb 5-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 580.727922][T16976] udc-core: couldn't find an available UDC or it's busy [ 580.744492][T16976] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 581.599832][T13825] usb 5-1: Failed to submit usb control message: -110 [ 581.607270][T13825] usb 5-1: unable to send the bmi data to the device: -110 [ 581.616299][T13825] usb 5-1: unable to get target info from device [ 581.624215][T13825] usb 5-1: could not get target info (-110) [ 581.630409][T13825] usb 5-1: could not probe fw (-110) [ 582.538764][T10740] usb 5-1: USB disconnect, device number 15 01:58:38 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000140)="66530700ae897094e7b126b097eaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26f45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e05485b4ff15f7", 0x4a}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000080)={0x78}, 0x78) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 01:58:38 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 01:58:38 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x3, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:58:38 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0, 0x700000000000000}], 0x1, 0x0, 0x0, 0x0) 01:58:38 executing program 5: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:58:38 executing program 4: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0xfffffecc) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r1, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000e66d1808b11342000d340000000109021b00010000d5a00904"], 0x0) syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000580)=ANY=[@ANYBLOB="1201000200000020ef0e01a04000010203010902240001014050090904000502030101010921faff620122480509058103000401039741980380a201400ec815d08ac91e0abe457e32d53eb78dc2842fb3ba32617823ec82885f901e43fe336ffafb8c188a1011f8dcbde199a7a5c0d412196c90b09ed64b699d432e1957440d5c7fa4fe2716ad128c38d7c1c416aa7bdd672edd95fba6869b14301d4618e927ac91d21c830188e14efecb88a1ba58a80c6b3e658f2d911e53760d5388e25ea258be890000000000ebae33754618e7eceb20982c13a646cb5dd4f87c49195bf84d6fa715170bb3718007a72e12df2a565509"], &(0x7f0000000200)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x110, 0x2, 0x81, 0x0, 0x10, 0x40}, 0x50, &(0x7f00000000c0)={0x5, 0xf, 0x50, 0x6, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x0, 0x8d, 0x72, 0x2}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x7, "a82ed34424fe499dd2cb35e2663eb62e"}, @ss_container_id={0x14, 0x10, 0x4, 0x9, "9e596909e0c1c4c9efabccfa38f499f4"}, @wireless={0xb, 0x10, 0x1, 0x4, 0x8, 0x4, 0x81, 0x5, 0x88}, @wireless={0xb, 0x10, 0x1, 0x4, 0x5, 0x1, 0xf0, 0x8, 0x20}]}, 0x2, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x42f}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x425}}]}) pipe(&(0x7f0000000240)) openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r5, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) [ 582.718287][T17041] binder: 17037:17041 unknown command 0 [ 582.733982][T17041] binder: 17037:17041 ioctl c0306201 20000200 returned -22 [ 582.738992][T17042] binder: 17033:17042 unknown command 0 01:58:38 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x6, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:58:38 executing program 4: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0xfffffecc) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r1, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000e66d1808b11342000d340000000109021b00010000d5a00904"], 0x0) syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000580)=ANY=[@ANYBLOB="1201000200000020ef0e01a04000010203010902240001014050090904000502030101010921faff620122480509058103000401039741980380a201400ec815d08ac91e0abe457e32d53eb78dc2842fb3ba32617823ec82885f901e43fe336ffafb8c188a1011f8dcbde199a7a5c0d412196c90b09ed64b699d432e1957440d5c7fa4fe2716ad128c38d7c1c416aa7bdd672edd95fba6869b14301d4618e927ac91d21c830188e14efecb88a1ba58a80c6b3e658f2d911e53760d5388e25ea258be890000000000ebae33754618e7eceb20982c13a646cb5dd4f87c49195bf84d6fa715170bb3718007a72e12df2a565509"], &(0x7f0000000200)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x110, 0x2, 0x81, 0x0, 0x10, 0x40}, 0x50, &(0x7f00000000c0)={0x5, 0xf, 0x50, 0x6, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x0, 0x8d, 0x72, 0x2}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x7, "a82ed34424fe499dd2cb35e2663eb62e"}, @ss_container_id={0x14, 0x10, 0x4, 0x9, "9e596909e0c1c4c9efabccfa38f499f4"}, @wireless={0xb, 0x10, 0x1, 0x4, 0x8, 0x4, 0x81, 0x5, 0x88}, @wireless={0xb, 0x10, 0x1, 0x4, 0x5, 0x1, 0xf0, 0x8, 0x20}]}, 0x2, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x42f}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x425}}]}) pipe(&(0x7f0000000240)) openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r5, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) [ 582.786727][T17042] binder: 17033:17042 ioctl c0306201 20000200 returned -22 [ 582.810394][T17046] binder: 17033:17046 unknown command 0 [ 582.826633][T17046] binder: 17033:17046 ioctl c0306201 20000200 returned -22 01:58:38 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0, 0x800000000000000}], 0x1, 0x0, 0x0, 0x0) 01:58:38 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 01:58:38 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x7, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 583.037928][T17061] binder: 17058:17061 unknown command 0 [ 583.046931][T17061] binder: 17058:17061 ioctl c0306201 20000200 returned -22 01:58:39 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x8, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 583.088813][T17061] binder: 17058:17061 unknown command 0 [ 583.103069][T17061] binder: 17058:17061 ioctl c0306201 20000200 returned -22 [ 583.299750][ T4886] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 583.549642][ T4886] usb 5-1: Using ep0 maxpacket: 8 [ 583.680564][ T4886] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 583.693570][ T4886] usb 5-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=34.0d [ 583.702909][ T4886] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 583.714218][ T4886] usb 5-1: config 0 descriptor?? [ 583.795604][ T4886] usb 5-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 583.975254][T17057] udc-core: couldn't find an available UDC or it's busy [ 583.983088][T17057] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 584.909613][T13818] usb 5-1: Failed to submit usb control message: -110 [ 584.917049][T13818] usb 5-1: unable to send the bmi data to the device: -110 [ 584.928997][T13818] usb 5-1: unable to get target info from device [ 584.936019][T13818] usb 5-1: could not get target info (-110) [ 584.949599][T13818] usb 5-1: could not probe fw (-110) 01:58:41 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000140)="66530700ae897094e7b126b097eaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26f45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e05485b4ff15f7", 0x4a}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000080)={0x78}, 0x78) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 01:58:41 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0x0, 0x0, &(0x7f0000001980), 0x0, 0x0, 0x0}) 01:58:41 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0, 0x1f00000000000000}], 0x1, 0x0, 0x0, 0x0) 01:58:41 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0xb, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:58:41 executing program 5: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) [ 585.795943][T17091] binder: 17089:17091 unknown command 0 [ 585.802049][T17093] binder: 17087:17093 unknown command 0 [ 585.822927][T17091] binder: 17089:17091 ioctl c0306201 20000200 returned -22 [ 585.833993][T17093] binder: 17087:17093 ioctl c0306201 20000200 returned -22 01:58:41 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x13, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 585.859863][T17100] binder: 17087:17100 unknown command 0 [ 585.865687][T17100] binder: 17087:17100 ioctl c0306201 20000200 returned -22 01:58:41 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0x0, 0x0, &(0x7f0000001980), 0x0, 0x0, 0x0}) 01:58:41 executing program 4: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0xfffffecc) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r1, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000e66d1808b11342000d340000000109021b00010000d5a00904"], 0x0) syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000580)=ANY=[@ANYBLOB="1201000200000020ef0e01a04000010203010902240001014050090904000502030101010921faff620122480509058103000401039741980380a201400ec815d08ac91e0abe457e32d53eb78dc2842fb3ba32617823ec82885f901e43fe336ffafb8c188a1011f8dcbde199a7a5c0d412196c90b09ed64b699d432e1957440d5c7fa4fe2716ad128c38d7c1c416aa7bdd672edd95fba6869b14301d4618e927ac91d21c830188e14efecb88a1ba58a80c6b3e658f2d911e53760d5388e25ea258be890000000000ebae33754618e7eceb20982c13a646cb5dd4f87c49195bf84d6fa715170bb3718007a72e12df2a565509"], &(0x7f0000000200)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x110, 0x2, 0x81, 0x0, 0x10, 0x40}, 0x50, &(0x7f00000000c0)={0x5, 0xf, 0x50, 0x6, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x0, 0x8d, 0x72, 0x2}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x7, "a82ed34424fe499dd2cb35e2663eb62e"}, @ss_container_id={0x14, 0x10, 0x4, 0x9, "9e596909e0c1c4c9efabccfa38f499f4"}, @wireless={0xb, 0x10, 0x1, 0x4, 0x8, 0x4, 0x81, 0x5, 0x88}, @wireless={0xb, 0x10, 0x1, 0x4, 0x5, 0x1, 0xf0, 0x8, 0x20}]}, 0x2, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x42f}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x425}}]}) pipe(&(0x7f0000000240)) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r5, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) 01:58:41 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0, 0x8000000000000000}], 0x1, 0x0, 0x0, 0x0) 01:58:41 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 586.022766][T11902] usb 5-1: USB disconnect, device number 16 [ 586.071815][T17106] binder: 17102:17106 unknown command 0 [ 586.078178][T17106] binder: 17102:17106 ioctl c0306201 20000200 returned -22 [ 586.142511][T17106] binder: 17102:17106 unknown command 0 [ 586.176614][T17106] binder: 17102:17106 ioctl c0306201 20000200 returned -22 01:58:42 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:58:42 executing program 4: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0xfffffecc) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r1, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000e66d1808b11342000d340000000109021b00010000d5a00904"], 0x0) syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000580)=ANY=[@ANYBLOB="1201000200000020ef0e01a04000010203010902240001014050090904000502030101010921faff620122480509058103000401039741980380a201400ec815d08ac91e0abe457e32d53eb78dc2842fb3ba32617823ec82885f901e43fe336ffafb8c188a1011f8dcbde199a7a5c0d412196c90b09ed64b699d432e1957440d5c7fa4fe2716ad128c38d7c1c416aa7bdd672edd95fba6869b14301d4618e927ac91d21c830188e14efecb88a1ba58a80c6b3e658f2d911e53760d5388e25ea258be890000000000ebae33754618e7eceb20982c13a646cb5dd4f87c49195bf84d6fa715170bb3718007a72e12df2a565509"], &(0x7f0000000200)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x110, 0x2, 0x81, 0x0, 0x10, 0x40}, 0x50, &(0x7f00000000c0)={0x5, 0xf, 0x50, 0x6, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x0, 0x8d, 0x72, 0x2}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x7, "a82ed34424fe499dd2cb35e2663eb62e"}, @ss_container_id={0x14, 0x10, 0x4, 0x9, "9e596909e0c1c4c9efabccfa38f499f4"}, @wireless={0xb, 0x10, 0x1, 0x4, 0x8, 0x4, 0x81, 0x5, 0x88}, @wireless={0xb, 0x10, 0x1, 0x4, 0x5, 0x1, 0xf0, 0x8, 0x20}]}, 0x2, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x42f}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x425}}]}) pipe(&(0x7f0000000240)) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r5, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) [ 586.689337][T10435] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 586.929438][T10435] usb 5-1: Using ep0 maxpacket: 8 [ 587.050127][T10435] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 587.066527][T10435] usb 5-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=34.0d [ 587.077824][T10435] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 587.089819][T10435] usb 5-1: config 0 descriptor?? [ 587.156843][T10435] usb 5-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 587.347674][T17128] udc-core: couldn't find an available UDC or it's busy [ 587.355030][T17128] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 588.259204][T13821] usb 5-1: Failed to submit usb control message: -110 [ 588.266667][T13821] usb 5-1: unable to send the bmi data to the device: -110 [ 588.277943][T13821] usb 5-1: unable to get target info from device [ 588.284770][T13821] usb 5-1: could not get target info (-110) [ 588.298535][T13821] usb 5-1: could not probe fw (-110) 01:58:44 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000007, 0x12, r3, 0x0) preadv(r3, &(0x7f0000000280), 0x100000000000008d, 0x4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0x0, 0x0, &(0x7f0000001980), 0x0, 0x0, 0x0}) 01:58:44 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000140)="66530700ae897094e7b126b097eaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26f45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e05485b4ff15f7", 0x4a}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000080)={0x78}, 0x78) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 01:58:44 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0, 0xff00000000000000}], 0x1, 0x0, 0x0, 0x0) 01:58:44 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:58:44 executing program 5: r0 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) [ 588.843606][T17156] binder: 17153:17156 unknown command 0 [ 588.865049][T17156] binder: 17153:17156 ioctl c0306201 20000200 returned -22 01:58:44 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x2, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 588.907249][T17156] binder: 17153:17156 unknown command 0 [ 588.910075][T17162] binder: 17158:17162 unknown command 0 [ 588.925402][T17162] binder: 17158:17162 ioctl c0306201 20000200 returned -22 [ 588.929338][T17156] binder: 17153:17156 ioctl c0306201 20000200 returned -22 01:58:44 executing program 3: r0 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$nl_crypto(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=@delrng={0x10, 0x14, 0x1}, 0x10}}, 0x0) 01:58:44 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0, 0xffff1f0000000000}], 0x1, 0x0, 0x0, 0x0) 01:58:45 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x3, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:58:45 executing program 3: r0 = socket(0xa, 0x3, 0x81) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000100)=0x2f1a, 0x4) setsockopt$SO_TIMESTAMP(r0, 0x1, 0x1d, &(0x7f0000000540)=0x4, 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r1, 0x0) preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0) sendmsg$unix(r0, &(0x7f0000002580)={&(0x7f0000000000), 0x6e, 0x0}, 0x0) recvmmsg(r0, &(0x7f0000001e40)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000480)=""/38, 0x26}}], 0x1, 0x0, 0x0) 01:58:45 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x6, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:58:45 executing program 4: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0xfffffecc) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r1, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000e66d1808b11342000d340000000109021b00010000d5a00904"], 0x0) syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000580)=ANY=[@ANYBLOB="1201000200000020ef0e01a04000010203010902240001014050090904000502030101010921faff620122480509058103000401039741980380a201400ec815d08ac91e0abe457e32d53eb78dc2842fb3ba32617823ec82885f901e43fe336ffafb8c188a1011f8dcbde199a7a5c0d412196c90b09ed64b699d432e1957440d5c7fa4fe2716ad128c38d7c1c416aa7bdd672edd95fba6869b14301d4618e927ac91d21c830188e14efecb88a1ba58a80c6b3e658f2d911e53760d5388e25ea258be890000000000ebae33754618e7eceb20982c13a646cb5dd4f87c49195bf84d6fa715170bb3718007a72e12df2a565509"], &(0x7f0000000200)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x110, 0x2, 0x81, 0x0, 0x10, 0x40}, 0x50, &(0x7f00000000c0)={0x5, 0xf, 0x50, 0x6, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x0, 0x8d, 0x72, 0x2}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x7, "a82ed34424fe499dd2cb35e2663eb62e"}, @ss_container_id={0x14, 0x10, 0x4, 0x9, "9e596909e0c1c4c9efabccfa38f499f4"}, @wireless={0xb, 0x10, 0x1, 0x4, 0x8, 0x4, 0x81, 0x5, 0x88}, @wireless={0xb, 0x10, 0x1, 0x4, 0x5, 0x1, 0xf0, 0x8, 0x20}]}, 0x2, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x42f}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x425}}]}) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r5, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) 01:58:45 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0, 0xffffffff00000000}], 0x1, 0x0, 0x0, 0x0) [ 589.417581][T10739] usb 5-1: USB disconnect, device number 17 01:58:47 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000140)="66530700ae897094e7b126b097eaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26f45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e05485b4ff15f7", 0x4a}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000080)={0x78}, 0x78) ptrace$setregs(0xd, r0, 0x0, 0x0) ptrace$cont(0x20, r0, 0x0, 0x0) 01:58:47 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x7, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:58:47 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x2, 0x0, 0x0, 0x0) 01:58:47 executing program 4: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0xfffffecc) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r1, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000e66d1808b11342000d340000000109021b00010000d5a00904"], 0x0) syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000580)=ANY=[@ANYBLOB="1201000200000020ef0e01a04000010203010902240001014050090904000502030101010921faff620122480509058103000401039741980380a201400ec815d08ac91e0abe457e32d53eb78dc2842fb3ba32617823ec82885f901e43fe336ffafb8c188a1011f8dcbde199a7a5c0d412196c90b09ed64b699d432e1957440d5c7fa4fe2716ad128c38d7c1c416aa7bdd672edd95fba6869b14301d4618e927ac91d21c830188e14efecb88a1ba58a80c6b3e658f2d911e53760d5388e25ea258be890000000000ebae33754618e7eceb20982c13a646cb5dd4f87c49195bf84d6fa715170bb3718007a72e12df2a565509"], &(0x7f0000000200)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x110, 0x2, 0x81, 0x0, 0x10, 0x40}, 0x50, &(0x7f00000000c0)={0x5, 0xf, 0x50, 0x6, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x0, 0x8d, 0x72, 0x2}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x7, "a82ed34424fe499dd2cb35e2663eb62e"}, @ss_container_id={0x14, 0x10, 0x4, 0x9, "9e596909e0c1c4c9efabccfa38f499f4"}, @wireless={0xb, 0x10, 0x1, 0x4, 0x8, 0x4, 0x81, 0x5, 0x88}, @wireless={0xb, 0x10, 0x1, 0x4, 0x5, 0x1, 0xf0, 0x8, 0x20}]}, 0x2, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x42f}}, {0x4, &(0x7f00000001c0)=@lang_id={0x4, 0x3, 0x425}}]}) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r5, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) 01:58:47 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:58:47 executing program 3: syz_mount_image$gfs2(&(0x7f0000000180), &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, &(0x7f0000001640), 0x0, &(0x7f00000017c0)={[{@acl}]}) 01:58:47 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x8, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 591.984457][T17220] binder: 17214:17220 unknown command 0 [ 592.023006][T17220] binder: 17214:17220 ioctl c0306201 20000200 returned -22 [ 592.038306][T17218] gfs2: not a GFS2 filesystem [ 592.054406][T17227] binder: 17214:17227 unknown command 0 [ 592.074097][T17227] binder: 17214:17227 ioctl c0306201 20000200 returned -22 01:58:48 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x3, 0x0, 0x0, 0x0) [ 592.113885][T17218] gfs2: not a GFS2 filesystem 01:58:48 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:58:48 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0xb, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:58:48 executing program 3: syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x955ed79eb88d1510, &(0x7f0000000180)) 01:58:48 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x5, 0x0, 0x0, 0x0) [ 592.318888][T11902] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 592.324850][T17243] binder: 17239:17243 unknown command 0 [ 592.351872][T17243] binder: 17239:17243 ioctl c0306201 20000200 returned -22 [ 592.390680][T17243] binder: 17239:17243 unknown command 0 [ 592.417183][T17243] binder: 17239:17243 ioctl c0306201 20000200 returned -22 [ 592.588824][T11902] usb 5-1: Using ep0 maxpacket: 8 [ 592.738929][T11902] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 592.758984][T11902] usb 5-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=34.0d [ 592.768063][T11902] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 592.808209][T11902] usb 5-1: config 0 descriptor?? [ 592.881863][T11902] usb 5-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 593.075810][T17226] udc-core: couldn't find an available UDC or it's busy [ 593.098542][T17226] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 593.918731][T13818] usb 5-1: Failed to submit usb control message: -110 [ 593.926135][T13818] usb 5-1: unable to send the bmi data to the device: -110 [ 593.942026][T13818] usb 5-1: unable to get target info from device [ 593.948400][T13818] usb 5-1: could not get target info (-110) [ 593.960794][T13818] usb 5-1: could not probe fw (-110) 01:58:50 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000140)="66530700ae897094e7b126b097eaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26f45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e05485b4ff15f7", 0x4a}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000080)={0x78}, 0x78) ptrace$setregs(0xd, r0, 0x0, 0x0) ptrace$cont(0x20, r0, 0x0, 0x0) 01:58:50 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x48, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:58:50 executing program 3: socketpair(0xa, 0x3, 0x7, &(0x7f0000000040)) [ 594.953893][ T4886] usb 5-1: USB disconnect, device number 18 01:58:50 executing program 4: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0xfffffecc) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r1, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000e66d1808b11342000d340000000109021b00010000d5a00904"], 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r5, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) 01:58:50 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x7, 0x0, 0x0, 0x0) 01:58:50 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:58:50 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x5c, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:58:51 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x3}, 0x40) [ 595.145331][T17287] binder: 17283:17287 unknown command 0 [ 595.171858][T17287] binder: 17283:17287 ioctl c0306201 20000200 returned -22 [ 595.208079][T17287] binder: 17283:17287 unknown command 0 [ 595.229950][T17287] binder: 17283:17287 ioctl c0306201 20000200 returned -22 01:58:51 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0xf0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:58:51 executing program 4: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0xfffffecc) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r1, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000e66d1808b11342000d340000000109021b00010000d5a00904"], 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r5, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) 01:58:51 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0xe, 0x0, 0x0, 0x0) 01:58:51 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) [ 595.493727][T17307] binder: BINDER_SET_CONTEXT_MGR already set [ 595.516465][T17307] binder: 17304:17307 ioctl 40046207 0 returned -16 [ 595.556438][T17307] binder: 17304:17307 ioctl c0306201 20000200 returned -22 [ 595.830391][ T9674] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 596.068808][ T9674] usb 5-1: Using ep0 maxpacket: 8 [ 596.188697][ T9674] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 596.203260][ T9674] usb 5-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=34.0d [ 596.214299][ T9674] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 596.247057][ T9674] usb 5-1: config 0 descriptor?? [ 596.340485][ T9674] usb 5-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 597.378437][T13821] usb 5-1: Failed to submit usb control message: -110 [ 597.387309][T13821] usb 5-1: unable to send the bmi data to the device: -110 [ 597.395926][T13821] usb 5-1: unable to get target info from device [ 597.403152][T13821] usb 5-1: could not get target info (-110) [ 597.409819][T13821] usb 5-1: could not probe fw (-110) 01:58:53 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000140)="66530700ae897094e7b126b097eaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26f45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e05485b4ff15f7", 0x4a}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000080)={0x78}, 0x78) ptrace$setregs(0xd, r0, 0x0, 0x0) ptrace$cont(0x20, r0, 0x0, 0x0) 01:58:53 executing program 3: socketpair$tipc(0x1e, 0x0, 0x0, &(0x7f0000000340)) 01:58:53 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x300, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:58:53 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x10, 0x0, 0x0, 0x0) 01:58:53 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:58:54 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x600, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:58:54 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x33, 0x0, 0x0, 0x0) 01:58:54 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x2}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x3, 0x9) recvmmsg(r0, &(0x7f0000002b40)=[{{0x0, 0x40000, 0x0, 0x0, 0x0, 0x40000000}}], 0x400000000000048, 0x0, 0x0) setsockopt$inet6_int(r0, 0x29, 0x4a, &(0x7f0000000480)=0x4000000000007, 0x4) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x0, 0x0, @empty}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) [ 598.234064][T17346] binder: BINDER_SET_CONTEXT_MGR already set [ 598.262455][T17346] binder: 17340:17346 ioctl 40046207 0 returned -16 [ 598.291830][T17349] binder: 17340:17349 ioctl c0306201 20000200 returned -22 01:58:54 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x700, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:58:54 executing program 4: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0xfffffecc) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r1, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r5, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) 01:58:54 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x3e, 0x0, 0x0, 0x0) [ 598.537099][ T20] usb 5-1: USB disconnect, device number 19 01:58:54 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0xb00, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:58:57 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000140)="66530700ae897094e7b126b097eaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26f45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e05485b4ff15f7", 0x4a}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000080)={0x78}, 0x78) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0xffffffffffffffff, r0, 0x0, 0x0) 01:58:57 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x500, 0x0, 0x0, 0x0) 01:58:57 executing program 4: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0xfffffecc) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r1, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r5, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) 01:58:57 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x1f00, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:58:57 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:58:57 executing program 3: socketpair(0x25, 0x0, 0x0, &(0x7f00000056c0)) 01:58:57 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x3f00, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 601.297803][T17397] binder: BINDER_SET_CONTEXT_MGR already set [ 601.310529][T17397] binder: 17394:17397 ioctl 40046207 0 returned -16 [ 601.333645][T17397] binder: 17394:17397 ioctl c0306201 20000200 returned -22 01:58:57 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'ipvlan0\x00', &(0x7f0000000000)=@ethtool_link_settings={0x3}}) 01:58:57 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0xff00, 0x0, 0x0, 0x0) 01:58:57 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x4000, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:58:57 executing program 3: bind$tipc(0xffffffffffffffff, 0x0, 0x0) 01:58:57 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x4800, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:00 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000140)="66530700ae897094e7b126b097eaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26f45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e05485b4ff15f7", 0x4a}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000080)={0x78}, 0x78) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0xffffffffffffffff, r0, 0x0, 0x0) 01:59:00 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x2, 0x0, 0x0) 01:59:00 executing program 3: r0 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_SET(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38}, 0x38}}, 0x0) 01:59:00 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x5c00, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:00 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:00 executing program 4: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0xfffffecc) ioctl$UI_DEV_CREATE(r0, 0x5501) syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) 01:59:00 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0xf000, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:00 executing program 3: r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000080), 0x82, 0x0) write$evdev(r0, 0x0, 0x0) [ 604.481794][T17440] binder: 17437:17440 unknown command 0 [ 604.516389][T17440] binder: 17437:17440 ioctl c0306201 20000200 returned -22 01:59:00 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:00 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x3, 0x0, 0x0) 01:59:00 executing program 3: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000380)={0x0, 0x1}, 0x4) syz_emit_ethernet(0xfdef, &(0x7f0000000000)=ANY=[], 0x0) 01:59:00 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0xffff, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 604.864983][T17463] binder: 17459:17463 unknown command 0 [ 604.898058][T17463] binder: 17459:17463 ioctl c0306201 20000200 returned -22 01:59:03 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000140)="66530700ae897094e7b126b097eaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26f45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e05485b4ff15f7", 0x4a}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000080)={0x78}, 0x78) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0xffffffffffffffff, r0, 0x0, 0x0) 01:59:03 executing program 3: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000040)=@file={0x0, './file0\x00'}, 0x6e) 01:59:03 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x4, 0x0, 0x0) 01:59:03 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:03 executing program 4: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0xfffffecc) ioctl$UI_DEV_CREATE(r0, 0x5501) syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) 01:59:03 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:03 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x2, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:03 executing program 3: bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000003b80)={0xffffffffffffffff, 0x0, 0x18}, 0xc) [ 607.622748][T17491] binder: 17487:17491 unknown command 0 [ 607.664557][T17491] binder: 17487:17491 ioctl c0306201 20000200 returned -22 01:59:03 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x5, 0x0, 0x0) 01:59:03 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:03 executing program 3: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_FILL_RING(r0, 0x10e, 0x5, 0x0, 0x0) 01:59:03 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x3, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 607.956363][T17510] binder: 17507:17510 ioctl c0306201 0 returned -14 [ 607.994313][T17510] binder: 17507:17510 unknown command 0 [ 608.015061][T17510] binder: 17507:17510 ioctl c0306201 20000200 returned -22 01:59:06 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000140)="66530700ae897094e7b126b097eaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26f45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e05485b4ff15f7", 0x4a}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000080)={0x78}, 0x78) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, 0x0, 0x0, 0x0) 01:59:06 executing program 3: syz_emit_ethernet(0xb7, &(0x7f00000003c0)={@multicast, @local, @val={@void}, {@ipv4={0x800, @udp={{0x6, 0x4, 0x0, 0x0, 0x65, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @rand_addr, {[@end]}}, {0x0, 0x0, 0x4d, 0x0, @gue={{0x2}, "b548f194e9fa00b6532836d478a78c95764092b26ab3a94128c1f982310375fb3c10e86b46f78c5087d3e6725e914cdae187f981609400870cefc987dd"}}}}}}, 0x0) 01:59:06 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x6, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:06 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x6, 0x0, 0x0) 01:59:06 executing program 4: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0xfffffecc) ioctl$UI_DEV_CREATE(r0, 0x5501) syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) 01:59:06 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) [ 610.688379][T17536] binder: 17533:17536 ioctl c0306201 0 returned -14 [ 610.726373][T17536] binder: 17533:17536 unknown command 0 01:59:06 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x7, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 610.752298][T17536] binder: 17533:17536 ioctl c0306201 20000200 returned -22 01:59:06 executing program 3: syz_emit_ethernet(0x56, &(0x7f00000006c0)={@local, @remote, @void, {@ipv4={0x800, @igmp={{0x10, 0x4, 0x0, 0x0, 0x48, 0x0, 0x0, 0x0, 0x2, 0x0, @remote, @dev, {[@cipso={0x86, 0xd, 0x0, [{0x0, 0x7, "e942105361"}]}, @generic={0x0, 0x9, "b7b22ba6f6419f"}, @rr={0x7, 0x13, 0x0, [@dev, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2]}]}}, {0x0, 0x0, 0x0, @private}}}}}, 0x0) 01:59:06 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:06 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x7, 0x0, 0x0) 01:59:06 executing program 3: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x0, 0x0, 0x0, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) 01:59:06 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x8, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 611.023837][T17557] binder: 17554:17557 ioctl c0306201 0 returned -14 [ 611.070041][T17557] binder: 17554:17557 unknown command 0 [ 611.094175][T17557] binder: 17554:17557 ioctl c0306201 20000200 returned -22 01:59:09 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000140)="66530700ae897094e7b126b097eaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26f45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e05485b4ff15f7", 0x4a}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000080)={0x78}, 0x78) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, 0x0, 0x0, 0x0) 01:59:09 executing program 3: r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="4c00000013001d07"], 0x4c}}, 0x0) 01:59:09 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x8, 0x0, 0x0) 01:59:09 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0xb, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:09 executing program 4: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0xfffffecc) ioctl$UI_DEV_CREATE(r0, 0x5501) ioctl$EVIOCSKEYCODE_V2(0xffffffffffffffff, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) 01:59:09 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) [ 613.863510][T17587] binder: 17582:17587 unknown command 0 [ 613.877216][T17587] binder: 17582:17587 ioctl c0306201 20000200 returned -22 01:59:09 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x300, 0x0, 0x0) 01:59:09 executing program 3: r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="4c00000012001d07"], 0x4c}}, 0x0) 01:59:09 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x48, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:10 executing program 3: syz_emit_ethernet(0x56, &(0x7f0000000040)={@remote, @link_local, @void, {@canfd={0xd, {{}, 0x0, 0x0, 0x0, 0x0, "ba2d2da95f22a9874b2600fcf4d78d0dea2020fd6488caa0b8b482c28ec533a8d4bc96b9f7f16990590f55fa610d92809a529a8d7d08b22ac2cd5d12800ec8c7"}}}}, 0x0) 01:59:10 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x5c, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:10 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x500, 0x0, 0x0) 01:59:12 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000140)="66530700ae897094e7b126b097eaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26f45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e05485b4ff15f7", 0x4a}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000080)={0x78}, 0x78) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, 0x0, 0x0, 0x0) 01:59:12 executing program 3: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_TSINFO_GET(r1, &(0x7f00000015c0)={0x0, 0x0, &(0x7f0000001580)={&(0x7f0000000240)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="01"], 0x28}}, 0x0) 01:59:12 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0xf0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:12 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x600, 0x0, 0x0) 01:59:12 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:12 executing program 4: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0xfffffecc) ioctl$UI_DEV_CREATE(r0, 0x5501) ioctl$EVIOCSKEYCODE_V2(0xffffffffffffffff, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) 01:59:12 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x300, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:13 executing program 3: syz_emit_ethernet(0x22, &(0x7f0000000000)={@local, @broadcast, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr=0x64010102, @remote}}}}}, 0x0) [ 617.035054][T17635] binder: 17629:17635 unknown command 0 [ 617.062555][T17635] binder: 17629:17635 ioctl c0306201 20000200 returned -22 01:59:13 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x700, 0x0, 0x0) 01:59:13 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:13 executing program 3: r0 = socket$netlink(0x10, 0x3, 0xa) sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)={0x28, 0x9, 0x6, 0x0, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_SKBPRIO={0x8}, @IPSET_ATTR_CADT_FLAGS={0x8}]}]}, 0x33fe0}}, 0x0) 01:59:13 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x600, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 617.384202][T17655] binder: 17653:17655 unknown command 0 [ 617.416137][T17655] binder: 17653:17655 ioctl c0306201 20000200 returned -22 01:59:15 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000800), 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:15 executing program 1: syz_genetlink_get_family_id$ethtool(&(0x7f0000000100), 0xffffffffffffffff) pipe(&(0x7f0000000d00)) 01:59:15 executing program 3: syz_emit_ethernet(0x36, &(0x7f00000003c0)={@multicast, @local, @val={@void}, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x6000, 0x0, 0x11, 0x0, @empty}, {0x0, 0x0, 0x10, 0x0, @gue={{0x2}}}}}}}, 0x0) 01:59:15 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x1f00, 0x0, 0x0) 01:59:15 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x700, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:15 executing program 4: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0xfffffecc) ioctl$UI_DEV_CREATE(r0, 0x5501) ioctl$EVIOCSKEYCODE_V2(0xffffffffffffffff, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) 01:59:16 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0xb00, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:16 executing program 1: syz_emit_ethernet(0x2e, &(0x7f00000006c0)={@local, @remote, @void, {@ipv4={0x800, @igmp={{0x6, 0x4, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x2, 0x0, @remote, @dev, {[@generic={0x7, 0x2}]}}, {0x0, 0x0, 0x0, @private}}}}}, 0x0) [ 620.134531][T17682] binder: 17674:17682 unknown command 0 [ 620.154884][T17682] binder: 17674:17682 ioctl c0306201 20000200 returned -22 01:59:16 executing program 3: r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)={0x54, 0x12, 0x1f437338616d081d, 0x0, 0x0, {}, [@INET_DIAG_REQ_BYTECODE={0x3}, @INET_DIAG_REQ_BYTECODE={0x4}]}, 0x54}}, 0x0) 01:59:16 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x2000, 0x0, 0x0) 01:59:16 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x1f00, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:16 executing program 3: syz_emit_ethernet(0xe81, &(0x7f0000000000)={@dev, @dev, @val, {@ipv6={0x86dd, @tcp={0x0, 0x6, "d459ea", 0xe43, 0x6, 0x0, @dev, @loopback, {[], {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}, {"623fbd6a2ccba34204481072ae0dc7f8783151ebe2f27092b99f7002856c7c3f6117602c7a84a803a72323204d6ab0d98987dc38021176121e013317bd26db35fb95c1e2ab7694a85a241bb52c8407c3ac0a1d27ca946ed174b16d070f6193ff6afc77d31b69f6f48c62b344f06c01206e66ebe51fdadce3547267c7a48feb2ec75ca935470ff532de1e3874fd898c8283ae9990e63189920897904550acd93f0cfca611907452b36494e92cd599b0bba1da3e692ed8ac3862909e24f79fd52ee230dc9a04a95df75e2bd5fdf5f740c66038d7865229d4d3b43e5cca1b81b175a8e05f031c31c2a9ee86625cacca2d6752a3a4f87804ea9ab057bcc5e8ac86f2f651b5c29cd1f05d4fa8c60b8934fab2c35bf60010ad02f8c02dae49cc753ef0c17328ece1c01e55437001a99ba80cf7636eae9efe7ae8b6324dd8a30461bdb0d9e5f9b407aec0cec0fd903137100b8c1a719c87a1649b1f513d5b6108443e6e7da44451405921124628041395e6d1088cc0702c43840f33e3eb29f5133c1a45125deef685169f300dc43fb79056d43720a4124b5e9eb9937898af574b93241c36e437e0ed6ceaaa4b2d7957e195900c7466d80dca804c1ef727f2238c400c5ba3b1acf644c977db8d2d35e6a6859e6be21280cfc49e8b808766a33e79a0c4af6d44e72b1fe345a7f67213b6b4b4081a03e1c947c99a993fc0bb95f426d19e6a81c3a4a7d779e9751f6614983970f2f34fe2d5aa952fa43463e0d1b5be806428e0a5e8f7d52cdbdb4242dac51186d0cc9ea9536e5286931a617eb78ff04746cf9cad3d0eecf8e1737dfd138e6be15c38624a6dcf47bfd44105c97941b92cac6dccd7dcc85345a79f6762af096fcf3cb69fcf902743b0ebdbb2b62a8a8012263220ecedeab0ec87b757060b7660c415a4cdee95f008fc29be3240dbfcde6b8bd0cde287bec1f24614b7934edbdb5256d126540c02745c3d5f5bb83588b97494fa09ec3af477c075d880aa6ce3908e617ac18f96ccd121adcc4ef5f4d97592b366c88c47c7dfb9d0699fc0dba1c80522475d07d4cd5da8754e3e87b764628ef41516a9f25abb1c4efed3a9e86a8dd78d4044bf2dd27f83b14b06be8a0c380f9fd5242c7dd954f226025f39ddc6adff47c460b82c3b21aa008f1a9e0cf547c2fc79acfead70a0142f81a1c4db645a1dae997341a6b512d79392ca39c3fb3bf1d35389170d0aa0381d24eaccd50376b4de70c9c2d8ec75553d67cc16ac7b7fadc0fd2ac8bc71e762052e4cb360c6338c0989a1ce8beb6599a2ba0430aa0fd81d75ef89c6a39d9fc8cbe9bcc271130de9f8a641696928225c12985113f5561f1ac0d4756ba54c5b966e838860cbcb6f8a7d20bb79187e7987f458c3a9a07f20abd374d8b0861ce27151ba908eac85304ac9d40adbd7a566984d48024e172634ed22592b95e8c23a4753c07cb8de98f9f29a687cefb7bcda073a4525c6cd74ab9a3331f1f1b6729cf65f3f783ba53091d77b82e7a4fb4177df73ae690378566671afb50947e34b1e6651f6022d54c1aa50ddff5a7645770a3953f03c36b80136f9882f5d17e87d2ffb4db3f8ded2fd6c2ee523365ec1a239456c8004bb829484dadcbf15b1baae1951307faaa7dbbd0250795fa67d370ef77b7d67ac0343500d7a5ba637dedc77e4470c20b718bf15f03556d73af795eb5c740ad0b335042b3fb957c57e1d31bc6dcafc7afa011d64265cd15fa30593e9fc46712139b3eb4bde95bd9d0da864c86a003e4c5ece200044364fa1636ea18e180b2f84fb6c8a8bf1bc1a96b692999998adad05dc502af3788bbe49ad38985c1e77a7ae78b141980d8eeda454b6e42f7d4fe0bbf091a95d020c15f4c088bd87934ac3ae346d151bc2453d440f2f6cdafa4849126e44a4405c89b90cbddd1540f494b4907dba92b64f9e65f4a94cd000935838279a25a146d9c439ccef8aea6701e147537282ea0b0c0c030950b33815955f48ccbae2813093cb9f3c7742eddb5819e14b1db79d2380fec9265d53edd72227fc1e2b87679d6ebc13cee7dd94ef4f78d9d7597b14fa06c488dfee470136237998f49d88397adf1e292087570aa712ab32c890a67d9c12e759fc285f767a4b0275bdd49a7a1ed7e71f5e6c9894c9620cba437c08def81eb925d967060b4057e3f5eb466c7f9874ea625cff20babcf5aa45fe19d2a74a0e386033b45384f3f38dfa300f437db1228bafa81d6c345db672a7a3659111ca08d681eda546a49ff9e504543ce1f345658b19481fe7d4d27348914c60856bd92d7ee2e4a2a59f4f88475430485c538ba9ea07e1e46109aa08ce9e5eed68994ce10cf52abea5fc865d6020bf8f17b27ce2888febae4bf4b0f5080db2cf3239e8a14281a8845a8d0c41aa0fe378727847735dfe239ca3caf81176183955e4899d96f6ec70e6cf5bc3eb9c2bd1b62c788028ece7be3eafea3b7c8ffa9db01f1cbd55bbde3fd1420523f8422adc6f6c647fec8c46007a5f6e6ef5c86922c118ea8898338e573c481078106e2c725b3c1ecf2d749060d0fdf168b562b4a8214b98bf51cbafe17a31dd2886f12440ff3636cea6e0980338473d813a64ae34e4fa8f5b46df29bc5181359f5ef4be0672869155005877e45c46d5bcab286a00c0c66ce4018022d0dab9806d7f204d6d9d8b78e364ebc7901c3a02bdc630f6cde28af46119968e5b98c89087fae88a8eef97c59c59f601b6b27b2d90d1210f552da53275c120cc9e1b1a26eff83e1a7bf7747395715a4f3e85999b82a0f63a8d9e0a28c8e6d851a8706da45e50499db25ef62b6362cfc3dbfbd0365ca532f09d53a138858d2cf5387276c57f9bc55bb57f314fb088f4f85581bf1e5e3cd98d48930c8fe47eb5b2a45367379195f2e795aa29b55844ac027534d1385ff0e94686ee6f362593b6547ea7d23415e24e5651305ac577de7beb373984d9efd4b8bab4e67dd249b5ffdcc163afc28984b02283ce5e186643663e9555e54a97ac19383b0f517eb00f2531dfeb67872ca0a013b06c405ee0ce64dd22f095757517c41f663f45d5861cc41e7ce4a12ef54bc16005105f3b17ecc83facc8cd2646f9a28cef200162ce72dae4a6fd571b2676d6754b3620ea9801db68eb85f0ec9a37898b7b01624da014543ff1e425e923caf42683eaf196d1b2edba36097918ac2defa78b1bf8420c7057fa8181f85794bdc5f280b5061d1b0d1c18a3846627ba87a8772be8b91af1f20a9d7cb00fcb60084cbd06ba0c5402427dd94f471e604807ae2c3c7a34c74c4f311de845909523fc1cbafdb366f05f117b75922e910db1a5ddeb07714d171b33bcbbbd793ea7d132ff952a204bfcbfd5fb005621d21db851eed2e49bb9e6b19ad1bd7ade655e5b06d98c93772d20ac249f8502ddddd03c8e554934fc0500b0ac7e465753cdbdfc673c041f9d76137b66b5c857c42123685af9f645ff9fbb81f71585902dfe6c853bb8a9fe75b1576226eabe40edd213c64ee0d63512a305ec1923ab43a4055d6cbb85f728067a46b28cdce45c2ce6e3b054c0c1080ddf52af67414952ff9a011295b77e9723e0949c02720eadfcae8828b5cc1a1f25e77cdf3bd9bb33beab5520f9a2246e9f5b4f8c4c424823164b916b5643d95c11e3d43adb942549bdec7db192a5618b32a597291c120c18b87ced3a55edb90e9eebec7d8c06b3e709f411a87600926b39c0fda0102b113d7c989de4abc0472937b02f7b7588a053be5863b3ab39837c0d51122b5d9c47f24c16c54f444d5f7a02ae52b363791e2dd412f2b38be5a67a8ec17cde2c97b57fdc2cbd91b422f0eb9c6fc0c97b43772c0787aaa7187d7cc5a31806ffe735abda767895189e73f3b84ff461668857caaaa874feb466629143767183d450f6459cd81a7b7431daec376edb016276aa59c8fe5adc2e72b4c6d26848f63f78a7ed111f26e0fab521a79e9985af0776e7180b0418d5fffe2b18514010807dbaa4c54023aa458da9851d26d1ecfb63e08c342d48006f5c607dc6c44da7b4872895ca2fc3d598aaa039317c8475b1088116948d100f11aa00486e6e15bc06f99aa4aa374e31ae9851ee2b7b2453b2f0aaada8c24c47f8a63069c702358bb272f84ed8e7721ea16a61d875feb0d59d615c7a848c82e13ac26bff4a12e1f30d632fd80b4cbfe2c3979076ec17c7a6ddb09ae8542fbe84feef904a4c1137992f95c47b9998fe2440fc95eb61187e8ac9a0d0a5b08940d5d39cf12b066ae56fa186060e5aa78778b18d09af968d4876222f52964e996a9616e3b036f989ae815768183f021dea21c2372868fac67224caee55fe381b0f8bab1cb25e201c4ff0e7d6f2352705dd17de24dfd4602af445fc99a165e8694680170012a1ae24a0179e8840c5e860132cb0c31d2286d4a3a0571cc871e7c9c9c4e82e621ed1555d1811b47a8fc3913c9938c7771b679356919b42d355d868e2a351a83a765dcbd673dffe32f3d1bf0edeb24ee90ac5d8e50ac68d061e9895d3efcf3310c263a8a348feba7469923d096f1b90b0250ee9fecd70996ae3c01540d08b3a9823e125d8c546eddcac25d0c75b68aab0d87383c16614a41d65cf57f161d8eb3519686f6a90b6263d1897fca0062418ea51a50918382305ff243b2eba792c3c72af29244fc4544fc708152ac62727cb05a12196f96e4ad2ab8f6b09a594c9dbb4a42d9ede7923b22400d9ae94a5a44a8fa5166f11b157702ebcdfd07adccc45867117d79b781a4d90e701c084c2f548dbfed91c00a17a1532998ee7baf05a2378e3f4ee1d9ae0d0c4b68207efaabf9e4f09bc6adb0c20889b929ac8a9129936f28f6ca7a3d60f56e69896fc132830fb2e589c2eb7d2d7c08a672019bf7d3a12ccb0ce13809a92ee23d04d5c6b6c9a706d423ee71d55507fd009f7a34d1a1a1cd81e9423a504c70b3e141a0e46ef69dd28c49e06798ab5f19a846e7118c001981477daa90f74d80df2f54c417592cc3ac4aa17184407f213a1c1a519dedac99017346486fc269b53dd0b71fa117d11bcb25fc7f1cb2c75ef371c38d3afc417b81551b3582f28030f4e44286a2ee5915ec716bdab29a71af457d48a1984674295759610fcdfb3385e7e8864"}}}}}}}, 0x0) 01:59:16 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000800), 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:16 executing program 1: r0 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r0, &(0x7f0000000080)={0x28, 0x0, 0x2711}, 0x10) 01:59:16 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0xff00, 0x0, 0x0) 01:59:16 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x3f00, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:16 executing program 3: bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={&(0x7f0000000240)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x4, [@enum={0x2, 0x0, 0x0, 0xc}]}, {0x0, [0x0, 0x5f]}}, &(0x7f0000001600)=""/166, 0x28, 0xa6, 0x1}, 0x20) 01:59:16 executing program 4: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, &(0x7f0000000000)=ANY=[], 0xfffffecc) r1 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r1, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r5, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) 01:59:16 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x4000, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:17 executing program 3: syz_emit_ethernet(0x27c, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaa0abbbbbbbbbbbb8864"], 0x0) 01:59:17 executing program 1: pipe(&(0x7f0000001cc0)={0xffffffffffffffff}) epoll_wait(r0, &(0x7f0000000000)=[{}], 0x1, 0x4) [ 621.119073][T17725] binder: 17723:17725 unknown command 0 [ 621.167276][T17725] binder: 17723:17725 ioctl c0306201 20000200 returned -22 01:59:17 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x1fffff, 0x0, 0x0) 01:59:17 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000800), 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:17 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x4800, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:17 executing program 3: bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={&(0x7f0000000240)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x4, [@enum={0x2}]}, {0x0, [0x0, 0x5f]}}, &(0x7f0000001600)=""/166, 0x28, 0xa6, 0x1}, 0x20) 01:59:17 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$XDP_UMEM_FILL_RING(r0, 0x10e, 0xc, 0x0, 0x0) 01:59:17 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x5c00, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:17 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x200000, 0x0, 0x0) 01:59:17 executing program 3: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000600)=ANY=[@ANYBLOB="9feb010018000000000000000c0100000c0100000a000000000000000800000d000000000c0000000300000006000000010000000d"], &(0x7f0000000300)=""/174, 0x12e, 0xae, 0x1}, 0x20) [ 621.553469][T17746] binder: 17741:17746 unknown command 0 [ 621.591015][T17746] binder: 17741:17746 ioctl c0306201 20000200 returned -22 01:59:18 executing program 4: pipe(&(0x7f0000000240)) r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) 01:59:18 executing program 1: socketpair(0x1, 0x80000, 0x0, &(0x7f0000000780)) 01:59:18 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(0xffffffffffffffff, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:18 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0xf000, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:18 executing program 3: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_TSINFO_GET(r1, &(0x7f00000015c0)={&(0x7f0000000f00)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000001580)={&(0x7f0000001380)={0x2c, r0, 0x1, 0x0, 0x0, {}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}]}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}]}, 0x2c}}, 0x0) 01:59:18 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x1000000, 0x0, 0x0) [ 622.272494][T17777] binder: 17767:17777 unknown command 0 [ 622.293313][T17777] binder: 17767:17777 ioctl c0306201 20000200 returned -22 01:59:18 executing program 1: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x0, 0x3, &(0x7f0000000000)=@framed, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) sendmsg$NL80211_CMD_DEL_TX_TS(0xffffffffffffffff, 0x0, 0x0) r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000880), 0xffffffffffffffff) socketpair(0x0, 0x0, 0x0, &(0x7f0000000ac0)) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_TSINFO_GET(r1, &(0x7f00000015c0)={&(0x7f0000000f00)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000001580)={&(0x7f0000001380)={0x28, r0, 0x1, 0x0, 0x0, {}, [@HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}]}, 0x28}}, 0x0) 01:59:18 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0xffff, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 622.329779][T17777] binder: BINDER_SET_CONTEXT_MGR already set [ 622.366575][T17777] binder: 17767:17777 ioctl 40046207 0 returned -16 01:59:18 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_PRIVFLAGS_SET(r0, &(0x7f00000016c0)={0xfffffffffffffffe, 0x0, &(0x7f0000001680)={&(0x7f0000000080)={0xec4, 0x0, 0x0, 0x0, 0x0, {}, [@ETHTOOL_A_PRIVFLAGS_HEADER={0x48, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'xfrm0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'geneve0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg0\x00'}]}, @ETHTOOL_A_PRIVFLAGS_FLAGS={0x10, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x1}]}, @ETHTOOL_A_PRIVFLAGS_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @ETHTOOL_A_PRIVFLAGS_FLAGS={0x244, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_MASK={0x33, 0x5, "6d520765303d5f24088ba79e8ef3003d103161bd2db26bdc4260c435599c1a715808d595bae556954feb1333557cb7"}, @ETHTOOL_A_BITSET_MASK={0x5e, 0x5, "dfe42aef43228f0621cdc68245c9145802c04c5087b7048d0dd5b39f85b8a21644957226d8e5f610ab060a3373cabbc350ea5869483b1dfb348413e7bd9ca7b23f09abcb7470fda55da616722bc7f73bbedc98a226ac68135c70"}, @ETHTOOL_A_BITSET_MASK={0x60, 0x5, "afb1641165f4488b7bf88737d5ded082e6d7fb260e44fe5d410dd5c0d033ff6ac397a330f74347a5a8b2d6797f1248e979712786ffde2bea94769edd2549391e2e3390703cb3de8bf0be44e171f70393affe865572fc1b5badb0ba28"}, @ETHTOOL_A_BITSET_VALUE={0xa3, 0x4, "bf39edaff3f8afc35807f96035921c4a78b5e1759d114ad4c9b5865cd8cf41eeb1d0ec3c6a1d54c00c5be164851a05ab69a243d95532e590616cf19a400dc6a458d621dcb2c2aba373cb7d6105444a15caa43818a6eb56e7c61827197512ac9028fda4e75b861540da4ed6d6463ec0d0aafc6d3c5597ec7864a9fc6446439aadb5dbabbd0cb430532e238221e27c2e06d9137fc0b4c702a972091fdc25c9f6"}, @ETHTOOL_A_BITSET_VALUE={0xa6, 0x4, "9896c13f074ccd0232d8a9bc91d1fb7205af0515e80f1244e0181a455c9898c7c615bc5c5e3e155de75fff4bbe8a36b1cd5084e11aa68d120e8912bfa22717db73d7b0943ad54b3472d06a514723fb5684ae89e3d50a51cfff47c9c4fabef182487092ba6d80520c629c3e7ed5fddd0e83c8ef23b5f48cf8d93a6d310ce3dae8d435d4cd6f35a6e0e512ad6988c9e0316d5cc050ff915116aceb6a581c21d797fec4"}]}, @ETHTOOL_A_PRIVFLAGS_FLAGS={0xc08, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x4}, @ETHTOOL_A_BITSET_VALUE={0xa8, 0x4, "e78ae80d8fce5a3902030024c2855518208d49b371d198b3a543754f8752500bb09403f9aa9c120ac0a396f1b25dd16d7f921e2c9a2ffca0eedf12886beeee751e537cc26059f61d360fc6d694c92bb7d23435288943c20eb93db5b06d4961c5bfeee346c74acf9476c80c1e0cb93988b2cad694cb71848e97b594fb4a28a319fae5c89cf00acbc02e87dc0e7466f60ce29dc9d0eb21b4e64e8f2b38e4ea27d23fefa8e3"}, @ETHTOOL_A_BITSET_VALUE={0x70, 0x4, "86d27c35c1b9b4dad3b5d643f0d23ebc4fc35545528ba080bdcffa3f6f76184483b6369e68a3c83d75724a62f431eb0fc47d4ad4b2f3b86fc50f18a21ea63ba86c222ba1a1c1f794e5c6ab71bfcb193c3244af7f35552674057050ac37b347a6a2beecf1ed19041c1c055807"}, @ETHTOOL_A_BITSET_VALUE={0x4e, 0x4, "f98b3adc75f85c8ba123a185ef0f60ca1093ae317035af09a4133f56e415d57c8214cac307bf9fe5d0f3061d7da1a2be2bdeba6bd72397c6d72afd2e35ddfa1cbe5be253d04846e2b8b2"}, @ETHTOOL_A_BITSET_VALUE={0xce, 0x4, "f04798389b062ca31671473cd0cb60f897716335edf90e7141804d304ba36ac44f784c263bdd61f6a3ca1e4a80e34edfb8e67016e80767c0437223ed0ef127c1fa23f1749f4121818de0c64db2ae7135d8911dd0ccf8bbeccf1c9f896a0582647fb1a391a1fd671ccf46fdf9acca12d33a18b90f31da4bff840a041b49c6829b2ddf0e883fede2967969e942a1922c1aab0f77ab12c6942d906f6c7dbc9b85a2d66aecb6a833d7a1afce813591562a6bad0fa6e2a5fdf557728a14671597744b1fc6fb708356dd6e380b"}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x7}, @ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_MASK={0x9b5, 0x5, "9989a0a49a25fa708de3968cbac78cc93aa44b82a1f6c0312795326400323501bda2137402e11afcb7b35165e6aa6b644b1d415348cd9fffd740287c07df67bd125668dee2c80b25a8a13d203b0f5e2cd5b33eee6a79b79fc24f99e7555946b9e3a8e39d434a1e30f1040680dd2bc4a1950b5be8b1628287e9cb5c743c15becc7eef111ad09ba28c875d54aa373ffe01cd8c23cb9e766a9958279b062c8188d9863a31249bacfbaa362139f053ab74ff668655b14e77e7d106cbf42025ae2864a94f6dc82b86e57b6a708041aa3a0b5edae729f68c366503d2e11f449a7a140d610916b36e1f1b6f3fba66bc0076da15bf20d1b9b4df4965f51057b1e712d243a85f2c218ad4684d8d0d33c8499d60bfc319bff6ca0f2b6bc13a1b49d3606a4ab52c926587be13c5892e196e13a04780fa48ddf0e9fa3da59eda54d654f50b3674decb73c37d7ca9a4ea7f7f601cb4e33f26202be5a268f1f69ca85b9dddb21d57b46ea9c58e117e77ec4dc81d325463773e8a376e8b9000e8a3456d76f1ef8e92dda39384b78f269e5b1299450875b764ef524707c9a914cd08ab84f5dba9c35145d849077bd8603c2245e5870fcf68916cab480da314bbeea84527ff44d236f98a78c9509099685ee69142d2d3205e3c3b6c3e952342d24b861009acb0bd6fde8c8bba97899e82d218de18f1658ce84879c325e5486b1af449be8205c7f976439f2e5af8a1c1e0de5ffa99537a3feceeb8d6d833506895ddfc79b185e42202962d05759ffee6cc1a90bc50db2a8ad5f8c5d2750a85b36b3814438184aa15929fc1444d733fd7acdea986bf3c7572c9c1d4720bf64a5f171da21ae0acdb304e6de0caba51e013f5d48c28622329a6edc2a33710a086bf3813a9504dfa533311068ab38c18888748b439082b18e1563babd430ec6024b76666c7d71a79adc5880dcccd350f13ee52b50b28e69454077f778f3443c3be1b9bb0d60a9b3fcec8b3107509ee932bd305c0f4292252c3e6684154722a2cd3188234bb5bce5791a09e4d4e553cd937b0ca309f304849aab28afc015829310123f6a96d1f0b997a3e12237a9d5ed2e0f3a23b2d3a122d7ac660fd98507dd1e072c8abd37f1f487cdee83b5c80015f19cbd3065d3d24ec9143fdeabf2391ac0501b9ae39d457cbf037ecdf0f79409426f5f3259fd043f85ec0d5b2717bf82dbca4cdbd355b6ed20fb81b28eef6fcdf5e97ec24516b647e0d9bf4672cd795c97c4bd430f0d6fcc28d745c195408bfceb44b49672d1763ee41d32e5ae37b9c87562d252309105d202417cb1a7747f469ddcd5c51e64638362e9005ae2ef7b3d87704e4ee5d67c6c346715f34e539fad1d43d9287fe9e28cd93323ff29bac7879242cbba805629f1342517946e5e8f7e2bcf9b6de4755a1d7cd48048ea0955d06834c7dd2db232623f26e04d0d54b5fa40a626019ef53a61a69e2d07ecec2aa01e69ce24b8054395700b1bfea7562a10d6a49d1ae3d1552f268da1b23a89a1625a2eb17591767e9d5a901228a757abb1b4a88d3d18c52c6bc57d87f65a2345f890040e93de421d50af1d50374e1cb7499ee9c832db8cfaee811fba7d3ffc6294c48f474e99e02f049a10f31226da17693b0496664ec41b1264d626d22ebca13448220845daaae9b0e04d472f09e31eedc5e020bcfaac84dd393eed8a08c823d3ec9f5eafe6cc6f314677dfde578e94993eb6dd97117bf8af06a3334036bf6da80910d503cd84b997b01a538caa527c400016ce1f5b1307b816a7dfd4d77d1491b9923607db661cf4e9c5556d15cd6a571f4d50189fbc2b87b2b71e59304190e1ec0a51337248a9375e31cf24588bd55d6d5eb5cd674a2a7fc3e68f2145da08f7525ed7d8d0a0c6ce49307286a79e5734dd56d1bb68a5fb0948734fd24e29eabbd3f413241f198ec40fa6afcf9030107407da27c1677f74f50d052d29cc45f9c540cb64856add7172ac7fa370454002642181bfbd226c2ee818c9ef9f145ff4e7c946af79f39430ca15e39427c9c2c5e39397546232deea6facfd987e36b965eab812cc0412a189b5d8cae17c69688619cd6b61a3c69d04500af5be52abd0eb3c5dfbf9dca4713821765c74c890c2ac48eccda747d533c3adb4e30ff1c4542ae1a2e2790ea060e51a099359774956b3b26e8f67446c4ee98fddfa20384c90fae1c76d9c45ff1c185feed8ba5cbcdfeeae35b522d11d64c5827a7230e8df1003779039194623914b6ea4eb7afd8fd55824b6fdcccc5e2abe33a2c9895c900d7ebf79a533ff7dab083a3028b04d36f4243b61fa05a229498b25622cae9cbbcad03eedc5fedfc6bb14e4f01903d48fe666d079dde65856bffca7f05e31de09e6a25c92e2f74123a10979882af296f6b011a9804683b84f2ffff647add9fe5b1fbb65f7a22b32a4403f898cfd24d69aee0304c4804597810d901ad583381168dbfd5aa914b9fb83e5a19e610e07d52cb34a1630f4523890bf839d07ad2ea38531f6f47ae50381f2cef4b3eb0c1209d4d341e0d1d3af63ab354e1e48e72d624f6d2aa041cd3f5e00db802ff7bdd887c6d12a3998a504adb1f7bb2f032218f11c1a77e7cf0ac8e055d6fc759cce0eeb3b5b50138e6e4864592b49521674b0526a946701c6fcf5a8226b2fa808f8369f19fa548e0cc9bdc3ab9922baf15e81f09ec7e60035b32d77ead280d9672150f71881184d8d93936619f13ad8cb8f4a59be88ddb93f51b6b7092d8e35d862d4d97c512b8fa364ae6ff72eaa51fcd80d30c0e16be5ada36aa2d1cde3fface77d7a2e6b83b3401f6392a229354c9eba16e12c94b343d03915b064f2704c8a79038d516b402eec58c1dc67a2ddba6850ad1c35119b036cd06e55dcd189a9809bd4e8664b259a9bdf573660dd2ea1a1837a48c34abe0a03add7b21534eb16d92a5396cac586f80bb36105fb052b8b25b6007458b20d78359271a92efa19317b87eaa9b3c86364b576429e241974a1689cbfc34f564d02f6076ce8d53e4552e57ffc09b91e46d5912e3161e70bfafd922930732014ec2beba91facefc3f91183abbb3ed08d761bb568844aecb054fb5ba81a20172bf8b87696e9b707556fdfc4467cca2f06ad94a6fc1e04e1b751210f51cf74d6eb109524e7641c1aff58da7abd254434e51ccdefa34583fc5cf3461c5b7429350eaa61894eef3a5dc70e3555a28e96d783653d21b6917c6061aa60aabc571d63f3c7d311d3a9f57d711c65e55ae793dc56cb2b59f098ad75ccc7c1475a8a2ff821b11d4cc7020b869066bb9ec65a1536c65f828a593558bfb54fb0aa113bbc62c820200cb5aee4eb9ca39c993d8b3d3792c84e6c87db1268b29720ee9a2b7fdbbaccde59b8f8356d28dd6fad7a96949681471ed6957b181e135c9e3a02d24b66e3ce9892d07c423d673be2bb6aa107544a5e84c0e056c1a49af2fc339c9cc749586545167e58ea11d925e1b95a83558b773f8716bf0b32e240b7765484a8d76"}]}]}, 0xec4}, 0x1, 0x0, 0x0, 0x40001}, 0x722f83585aaca956) 01:59:18 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x2000000, 0x0, 0x0) [ 622.381027][T17781] binder: 17767:17781 ioctl c0306201 20000200 returned -22 01:59:18 executing program 4: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) 01:59:18 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:18 executing program 3: sendmsg$NL802154_CMD_SET_SEC_PARAMS(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000), 0xc, 0x0}, 0x0) r0 = socket$netlink(0x10, 0x3, 0x9) sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[], 0x24}}, 0x0) 01:59:18 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$XDP_UMEM_FILL_RING(r0, 0x10e, 0x5, 0x0, 0x300) 01:59:19 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x2, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:19 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x3000000, 0x0, 0x0) 01:59:19 executing program 3: bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={&(0x7f00000001c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x24, 0x24, 0x2, [@func_proto={0x0, 0x3, 0x0, 0xd, 0x0, [{}, {0xe}, {0x5, 0x1}]}]}}, &(0x7f0000001600)=""/166, 0x3e, 0xa6, 0x1}, 0x20) 01:59:19 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(0xffffffffffffffff, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:19 executing program 1: socket$packet(0x11, 0x2, 0x300) syz_emit_ethernet(0x77, &(0x7f00000003c0)={@multicast, @local, @val={@void}, {@ipv4={0x800, @udp={{0x6, 0x4, 0x0, 0x0, 0x65, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @rand_addr, {[@end]}}, {0x0, 0x0, 0x4d, 0x0, @gue={{0x2}, "b548f194e9fa00b6532836d478a78c95764092b26ab3a94128c1f982310375fb3c10e86b46f78c5087d3e6725e914cdae187f981609400870cefc987dd"}}}}}}, 0x0) 01:59:19 executing program 4: r0 = syz_open_dev$evdev(0x0, 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) 01:59:19 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_WIPHY(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={0x0}}, 0x0) syz_genetlink_get_family_id$netlbl_calipso(&(0x7f00000026c0), 0xffffffffffffffff) 01:59:19 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x3, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 623.288607][T17825] binder: 17818:17825 unknown command 0 01:59:19 executing program 3: syz_emit_ethernet(0x36, &(0x7f00000003c0)={@multicast, @local, @val={@void}, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0xffff, 0x0, 0x11, 0x0, @empty}, {0x0, 0x0, 0x10, 0x0, @gue={{0x2}}}}}}}, 0x0) [ 623.330752][T17825] binder: 17818:17825 ioctl c0306201 20000200 returned -22 [ 623.353698][T17827] binder: BINDER_SET_CONTEXT_MGR already set [ 623.381074][T17827] binder: 17818:17827 ioctl 40046207 0 returned -16 [ 623.401611][T17825] binder: 17818:17825 ioctl c0306201 20000200 returned -22 01:59:19 executing program 4: r0 = syz_open_dev$evdev(0x0, 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) 01:59:19 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x4000000, 0x0, 0x0) 01:59:19 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(0xffffffffffffffff, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:19 executing program 1: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000380)={0x0, 0x7}, 0x4) syz_emit_ethernet(0xfdef, &(0x7f0000000000)=ANY=[], 0x0) 01:59:19 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x6, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:19 executing program 3: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_TSINFO_GET(r1, &(0x7f00000015c0)={0x0, 0x0, &(0x7f0000001580)={&(0x7f0000001380)={0x2c, r0, 0x1, 0x0, 0x0, {}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg2\x00'}]}]}, 0x2c}}, 0x0) [ 623.744610][T17848] binder: 17840:17848 unknown command 0 [ 623.780933][T17848] binder: 17840:17848 ioctl c0306201 20000200 returned -22 01:59:19 executing program 1: syz_emit_ethernet(0x3a, &(0x7f00000003c0)={@multicast, @local, @val={@void}, {@ipv4={0x800, @udp={{0x6, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @rand_addr, {[@end={0xa5}]}}, {0x0, 0x0, 0x10, 0x0, @gue={{0x2}}}}}}}, 0x0) [ 623.816108][T17853] binder: BINDER_SET_CONTEXT_MGR already set [ 623.841514][T17853] binder: 17840:17853 ioctl 40046207 0 returned -16 [ 623.864225][T17848] binder: 17840:17848 ioctl c0306201 20000200 returned -22 01:59:19 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x7, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:19 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x5000000, 0x0, 0x0) 01:59:19 executing program 3: syz_emit_ethernet(0x66, &(0x7f00000000c0)={@remote, @multicast, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x4, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}}}}}}, 0x0) [ 623.907716][ T3269] ieee802154 phy0 wpan0: encryption failed: -22 [ 623.914059][ T3269] ieee802154 phy1 wpan1: encryption failed: -22 01:59:19 executing program 4: r0 = syz_open_dev$evdev(0x0, 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) 01:59:19 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, 0xffffffffffffffff) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:20 executing program 1: socket$packet(0x11, 0x2, 0x300) syz_emit_ethernet(0xfdef, &(0x7f0000000000)=ANY=[], 0x0) 01:59:20 executing program 3: bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000500)=@bpf_lsm={0x1d, 0x3, &(0x7f00000002c0)=@framed, &(0x7f0000000340)='GPL\x00', 0x711c9372, 0x95, &(0x7f0000000380)=""/149, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) 01:59:20 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x8, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:20 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x6000000, 0x0, 0x0) [ 624.258869][T17871] binder: 17867:17871 unknown command 0 [ 624.291070][T17871] binder: 17867:17871 ioctl c0306201 20000200 returned -22 [ 624.333548][T17876] binder: BINDER_SET_CONTEXT_MGR already set [ 624.359163][T17876] binder: 17867:17876 ioctl 40046207 0 returned -16 [ 624.388207][T17871] binder: 17867:17871 ioctl c0306201 20000200 returned -22 01:59:20 executing program 3: r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)={0x4c, 0x14, 0x1f437338616d081d}, 0x4c}}, 0x0) 01:59:20 executing program 1: r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)={0x54, 0x12, 0x1f437338616d081d, 0x0, 0x0, {}, [@INET_DIAG_REQ_BYTECODE={0x4}, @INET_DIAG_REQ_BYTECODE={0x4}]}, 0x54}}, 0x0) 01:59:20 executing program 4: syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(0xffffffffffffffff, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) 01:59:20 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, 0xffffffffffffffff) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:20 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0xb, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:20 executing program 3: syz_emit_ethernet(0x37, &(0x7f00000003c0)={@multicast, @local, @val={@void}, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x25, 0x0, 0x6100, 0x0, 0x11, 0x0, @empty}, {0x0, 0x0, 0x11, 0x0, @gue={{0x2}, "b5"}}}}}}, 0x0) 01:59:20 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x7000000, 0x0, 0x0) [ 624.665894][T17892] binder: 17887:17892 unknown command 0 [ 624.696963][T17892] binder: 17887:17892 ioctl c0306201 20000200 returned -22 [ 624.732223][T17895] binder: BINDER_SET_CONTEXT_MGR already set 01:59:20 executing program 1: r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={&(0x7f0000000240)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@enum]}}, &(0x7f0000001600)=""/166, 0x26, 0xa6, 0x1}, 0x20) bpf$BPF_GET_BTF_INFO(0x17, &(0x7f0000000180)={r0, 0x0, 0x0}, 0x10) [ 624.773888][T17895] binder: 17887:17895 ioctl 40046207 0 returned -16 [ 624.783692][T17892] binder: 17887:17892 ioctl c0306201 20000200 returned -22 01:59:20 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x48, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:20 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, 0xffffffffffffffff) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:20 executing program 3: syz_emit_ethernet(0x27c, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaa0abbbbbbbbbbbb4305"], 0x0) 01:59:20 executing program 4: syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(0xffffffffffffffff, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) 01:59:20 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCGARP(r0, 0x8954, &(0x7f0000000040)={{}, {0x0, @multicast}, 0x0, {0x2, 0x0, @remote}, 'ip6_vti0\x00'}) 01:59:20 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x5c, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:21 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x8000000, 0x0, 0x0) [ 625.118189][T17913] binder: 17910:17913 unknown command 0 [ 625.138246][T17913] binder: 17910:17913 ioctl c0306201 20000200 returned -22 01:59:21 executing program 3: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000900)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000002c3f2cc2b7954244cef7baf48e6d2885a09a87507ebf4e43bc0609b199b6ed90e05b6acec976e57309ebcdac5f7a860c00269c781f6428457253e89ad528d985636a86ec0f60f5a6d11509ce9a2c2e85d726859a919cc9548a349980d1ccdce27f94bc074c27f81070545cab5d5b0d7ff0575cc2727e8d9749276764e8ff2d8621c3ac94712ed9cf6b40b3cf252a47db5af3a30d57cc3ed67d1867b54d24e2da18568c3b0f24b52616bf84d3b042d6e432cd0e3b57239f0127473e6ba922aff649609d40b47ec331ccba3ce8d530ffff19a6471bf3abc742d9cbcfb964b138310346947b2235dc99de9aa3e6b77c7a2877261ed72da90864987f30926c9013aaa80baa31fc2d108b26eda5dd7a48eec3b86836ae504479f60b0ec9204d2b85627aa5a79f670000000000000000000000008f02712c3d8fc4e2686e21a855e823887196d4f4e9f2013d2aef4a3b5092be4d6852b88317c5adbbdb0015f89e9939bc424d1bafe5725c8a4047b91da3768c1ca6a4410009f95d4baa1068285afa8d3b4a6893d3626ab5becbcdb887af2c85c2d9ab09b5dd7d3c00000064881c560c371a08e051374cf05c921af1fb78183e7e68de9dabe35f1a5d505780fc8dbdb754590b1e1298f431432010e100e122fa34ccaced97104203ba0d732b333efc43c4e14b858ddd9ea2a0e1c99a0c816dc46553b5d74f24c69f9e25b7872f9f092fa78e73e123540ab5bcf51789915884d60433fa7414d2f8780d7a9962ed202a265c3f6d522c9ce5ebccbb4ca10b02a79d197e3679879f4e401e8a854b2a56bcdb32d7f5092181619e386c71302379cd610000000000b3"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={r0, 0x20e, 0x5ee, 0xfd000000, &(0x7f00000004c0)="b91803b700030703009e40f086dd1fff06a005abec00008477fbac141434e0080001c699da153f0ae0e6e380f60107f683317585d7473ae0ab4439f0f570ff155bc5f73ba3f8bb99a6e8ded1ce485cf058105cd981b42493481cd659416a2e10c9119664f36eb00b333c20c9ec0c222d644bdcb178c1cc53d6960fbb842d6a33dfcde3a1e1848135214baf139753866cadcbe3ce52505e992818cc452bee339d9ab076f484020eaa348a21d7911e4c44905256ec2cc54cca47a198b00c10aff62a4bed43a2ebcad92743fb22c593f28fd4bb7c703cde9cae0569d4c8d9a823f2c12863f7a6c0cf88ed22aae4f6f084508833b61429a25773eedf63dd9f33d430f2a0a30a7761db16fe0f743b95ded898c28aac1256ce2751b3d738899b8b19d9052b7f13ff94", 0x0, 0x31, 0x6000000000000000, 0xfffffffffffffe7e, 0x1d4}, 0x28) [ 625.170130][T17913] binder: BINDER_SET_CONTEXT_MGR already set [ 625.209945][T17913] binder: 17910:17913 ioctl 40046207 0 returned -16 [ 625.234013][T17920] binder: 17910:17920 ioctl c0306201 20000200 returned -22 01:59:21 executing program 1: r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={&(0x7f0000000240)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@enum]}}, &(0x7f0000001600)=""/166, 0x26, 0xa6, 0x1}, 0x20) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000180)={r0, 0x700, 0x0}, 0x10) 01:59:21 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x0, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:21 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x1f000000, 0x0, 0x0) 01:59:21 executing program 4: syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(0xffffffffffffffff, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) 01:59:21 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_DELETE(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)={0x28, 0x2, 0x2, 0x401, 0x0, 0x0, {}, [@CTA_EXPECT_FN={0x13, 0xb, 'callforwarding\x00'}]}, 0x28}}, 0x0) 01:59:21 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:21 executing program 1: syz_emit_ethernet(0x66, &(0x7f00000000c0)={@multicast, @multicast, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x2f, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}}}}}}, 0x0) 01:59:21 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:21 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0xff000000, 0x0, 0x0) 01:59:21 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000300)=@filter={'filter\x00', 0xe, 0x4, 0xb40, 0xffffffff, 0x8e0, 0x0, 0x8e0, 0xffffffff, 0xffffffff, 0xaa8, 0xaa8, 0xaa8, 0xffffffff, 0x4, 0x0, {[{{@ip={@local, @empty, 0x0, 0x0, 'bridge_slave_1\x00', 'batadv_slave_0\x00'}, 0x0, 0x880, 0x8e0, 0x0, {}, [@common=@addrtype={{0x30}}, @common=@unspec=@u32={{0x7e0}, {[{[{0x800, 0x1}, {}, {}, {}, {}, {}, {}, {0x1f}, {0x6}, {0x6db8349b, 0x2}, {0xc974}], [{0x6}, {0x5, 0x7fffffff}, {0xffff387d, 0x6}, {0x0, 0xfffffeff}, {}, {}, {}, {}, {0xfffffffd, 0x2}, {0x8000, 0x7}, {0x1b76b301}]}, {[{}, {}, {}, {0x23}, {0x6, 0x1}, {0x0, 0x2}, {0x1}, {0x0, 0x2}], [{0x0, 0x9}, {}, {}, {}, {}, {0x7}, {0x4, 0x6}, {0xfffffff7, 0x6}, {0x7, 0xb5e7}], 0x6}, {[{0x2, 0x3}, {0x6, 0x1}, {0x0, 0x1}, {}, {}, {}, {}, {0x6}, {0xee3f, 0x1}, {0x0, 0x3}, {0xffffffff, 0x2}], [{}, {}, {0x3}, {0x5, 0x9}, {0x9, 0x100}, {0x8, 0x101}, {}, {}, {}, {}, {0x5}]}, {[{}, {}, {}, {0x5}, {0x2b72}, {0x8, 0x3}, {0x8001}, {0x0, 0x1}], [{}, {}, {}, {}, {0x2}, {0x3}, {0x6, 0x7}, {0x3, 0x4}, {0x0, 0x1c3}]}, {[{0x80000001, 0x3}, {0x0, 0x2}, {}, {}, {}, {}, {}, {}, {}, {}, {0x2808}], [{}, {0x2, 0x8}, {0x8, 0x7}, {0x3, 0x5}, {}, {}, {}, {}, {}, {0x0, 0x4}, {0x1, 0x10001}]}, {[{}, {}, {}, {}, {}, {}, {0xff}, {0x7, 0x2}, {0x1, 0x2}, {0x0, 0x1}], [{0x2, 0x20}, {0xbe, 0x8}, {0x0, 0x3f}, {}, {}, {}, {}, {0x1}, {0x7, 0x7ff}, {0x6}, {0x287e7323, 0x5}], 0xa}, {[{0x1}, {0xffffff4b}, {0xc65c, 0x2}, {0x0, 0x3}, {}, {}, {}, {}, {}, {}, {0x9, 0x2}], [{}, {}, {}, {0x1, 0x7ff}, {0x3, 0x7}, {0x83, 0x80000001}, {0x0, 0xfffffffb}]}, {[{}, {}, {}, {}, {}, {0x931c, 0x3}, {0x2, 0x1}, {0x0, 0x2}], [{0x400, 0x3}, {0x4}, {}, {}, {}, {}, {}, {0x7, 0xfff}, {0x34be, 0x7ff}, {0x6, 0x7}, {0x0, 0x4}]}, {[{}, {0x6, 0x2}, {0x8, 0x1}, {0x6, 0x1}, {}, {}, {}, {}, {}, {}, {0x7}], [{}, {}, {0x3, 0xfffffffc}, {0x2, 0x1}, {0x101, 0x3}, {0x0, 0x8}]}, {[{}, {}, {}, {}, {}, {0x7, 0x5d42b7d0faf1be8d}, {0xa641, 0x2}, {0x8c, 0x2}], [{0xffffffff, 0x7f}, {0x0, 0x5}, {}, {}, {}, {}, {}, {0xf7a4, 0xe065}, {0x8c, 0x9}, {0x8, 0x9}, {0x0, 0xe0}], 0x8, 0x5}, {[{0x6}, {0x5, 0x3}, {}, {}, {}, {}, {}, {0x2ed}, {0x6, 0x3}, {0x7}, {0x0, 0x1}], [{}, {}, {0xfffffffb, 0x7}, {0x4, 0x8}, {0x3948, 0x7b35}, {0x0, 0xa08}]}]}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x0, [0x5, 0x1, 0x1], 0x0, 0x4}, {0x4}}}}, {{@ip={@rand_addr, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 'vlan0\x00', 'team_slave_0\x00'}, 0x0, 0x98, 0xf8, 0x0, {}, [@common=@icmp={{0x28}, {0x0, "c95c"}}]}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@private2, [], 0x101, 0x4e24, 0x4e23, 0x4e22, 0x81a}}}, {{@ip={@broadcast, @broadcast, 0x0, 0x0, 'veth0_to_bridge\x00', 'ip6gre0\x00', {}, {}, 0x0, 0x2, 0x3a}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast, 0x4, 0x7, [0x30, 0x27, 0x37, 0x3a, 0x6], 0x2}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0xba0) 01:59:21 executing program 4: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) [ 626.083499][T17958] x_tables: duplicate underflow at hook 2 01:59:22 executing program 1: syz_emit_ethernet(0x3a, &(0x7f0000000440)={@random="010100000070", @local, @val={@void}, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @remote, @multicast1}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}, 0x0) 01:59:22 executing program 3: socket$packet(0x11, 0x2, 0x300) syz_emit_ethernet(0x26, &(0x7f0000000000)={@multicast, @random="ee897be665e8", @val, {@can={0xc, {{}, 0x0, 0x0, 0x0, 0x0, "b4bf1779444dd5be"}}}}, 0x0) syz_emit_ethernet(0x1e, &(0x7f0000000080)={@local, @empty, @val, {@llc={0x4, {@snap={0x0, 0x0, "a1", "c6a524"}}}}}, 0x0) [ 626.141436][T17961] binder: 17954:17961 unknown command 0 01:59:22 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x3, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:22 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0xffff1f00, 0x0, 0x0) [ 626.194463][T17965] binder: 17954:17965 unknown command 0 [ 626.200225][T17961] binder: 17954:17961 ioctl c0306201 20000200 returned -22 [ 626.216539][T17965] binder: 17954:17965 ioctl c0306201 20000200 returned -22 01:59:22 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:22 executing program 4: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) 01:59:22 executing program 1: syz_emit_ethernet(0x36, &(0x7f00000003c0)={@multicast, @local, @val={@void}, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0xe000, 0x0, 0x11, 0x0, @empty}, {0x0, 0x0, 0x10, 0x0, @gue={{0x2}}}}}}}, 0x0) 01:59:22 executing program 3: syz_emit_ethernet(0x66, &(0x7f00000000c0)={@link_local, @multicast, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0xfffffffffffffd80, 0x0, 0x0, 0x0, 0x2f, 0x0, @remote, @empty}}}}}, 0x0) 01:59:22 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x4, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 626.579996][T17979] binder: 17977:17979 unknown command 0 [ 626.609213][T17979] binder: 17977:17979 ioctl c0306201 20000200 returned -22 [ 626.638508][T17983] binder: 17977:17983 unknown command 0 [ 626.659314][T17983] binder: 17977:17983 ioctl c0306201 20000200 returned -22 01:59:22 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x20000000000000, 0x0, 0x0) 01:59:22 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:22 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000140)={0xf, 0x0, 0x0, 0x7}, 0x40) 01:59:22 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x5, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:22 executing program 1: syz_emit_ethernet(0x66, &(0x7f00000000c0)={@remote, @multicast, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x2f, 0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}}, {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x6558}}}}}}, 0x0) 01:59:22 executing program 4: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) 01:59:22 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_PRIVFLAGS_SET(r0, &(0x7f00000016c0)={0xfffffffffffffffe, 0x0, &(0x7f0000001680)={&(0x7f0000000080)={0xec4, 0x0, 0x0, 0x0, 0x0, {}, [@ETHTOOL_A_PRIVFLAGS_HEADER={0x48, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'xfrm0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'geneve0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg0\x00'}]}, @ETHTOOL_A_PRIVFLAGS_FLAGS={0x10, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x1}]}, @ETHTOOL_A_PRIVFLAGS_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @ETHTOOL_A_PRIVFLAGS_FLAGS={0x244, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_MASK={0x33, 0x5, "6d520765303d5f24088ba79e8ef3003d103161bd2db26bdc4260c435599c1a715808d595bae556954feb1333557cb7"}, @ETHTOOL_A_BITSET_MASK={0x5e, 0x5, "dfe42aef43228f0621cdc68245c9145802c04c5087b7048d0dd5b39f85b8a21644957226d8e5f610ab060a3373cabbc350ea5869483b1dfb348413e7bd9ca7b23f09abcb7470fda55da616722bc7f73bbedc98a226ac68135c70"}, @ETHTOOL_A_BITSET_MASK={0x5e, 0x5, "afb1641165f4488b7bf88737d5ded082e6d7fb260e44fe5d410dd5c0d033ff6ac397a330f74347a5a8b2d6797f1248e979712786ffde2bea94769edd2549391e2e3390703cb3de8bf0be44e171f70393affe865572fc1b5badb0"}, @ETHTOOL_A_BITSET_VALUE={0xa1, 0x4, "bf39edaff3f8afc35807f96035921c4a78b5e1759d114ad4c9b5865cd8cf41eeb1d0ec3c6a1d54c00c5be164851a05ab69a243d95532e590616cf19a400dc6a458d621dcb2c2aba373cb7d6105444a15caa43818a6eb56e7c61827197512ac9028fda4e75b861540da4ed6d6463ec0d0aafc6d3c5597ec7864a9fc6446439aadb5dbabbd0cb430532e238221e27c2e06d9137fc0b4c702a972091fdc25"}, @ETHTOOL_A_BITSET_VALUE={0xa5, 0x4, "9896c13f074ccd0232d8a9bc91d1fb7205af0515e80f1244e0181a455c9898c7c615bc5c5e3e155de75fff4bbe8a36b1cd5084e11aa68d120e8912bfa22717db73d7b0943ad54b3472d06a514723fb5684ae89e3d50a51cfff47c9c4fabef182487092ba6d80520c629c3e7ed5fddd0e83c8ef23b5f48cf8d93a6d310ce3dae8d435d4cd6f35a6e0e512ad6988c9e0316d5cc050ff915116aceb6a581c21d797fe"}]}, @ETHTOOL_A_PRIVFLAGS_FLAGS={0xc08, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_SIZE={0x8}, @ETHTOOL_A_BITSET_VALUE={0xa5, 0x4, "e78ae80d8fce5a3902030024c2855518208d49b371d198b3a543754f8752500bb09403f9aa9c120ac0a396f1b25dd16d7f921e2c9a2ffca0eedf12886beeee751e537cc26059f61d360fc6d694c92bb7d23435288943c20eb93db5b06d4961c5bfeee346c74acf9476c80c1e0cb93988b2cad694cb71848e97b594fb4a28a319fae5c89cf00acbc02e87dc0e7466f60ce29dc9d0eb21b4e64e8f2b38e4ea27d23f"}, @ETHTOOL_A_BITSET_VALUE={0x6d, 0x4, "86d27c35c1b9b4dad3b5d643f0d23ebc4fc35545528ba080bdcffa3f6f76184483b6369e68a3c83d75724a62f431eb0fc47d4ad4b2f3b86fc50f18a21ea63ba86c222ba1a1c1f794e5c6ab71bfcb193c3244af7f35552674057050ac37b347a6a2beecf1ed19041c1c"}, @ETHTOOL_A_BITSET_VALUE={0x4d, 0x4, "f98b3adc75f85c8ba123a185ef0f60ca1093ae317035af09a4133f56e415d57c8214cac307bf9fe5d0f3061d7da1a2be2bdeba6bd72397c6d72afd2e35ddfa1cbe5be253d04846e2b8"}, @ETHTOOL_A_BITSET_VALUE={0xcd, 0x4, "f04798389b062ca31671473cd0cb60f897716335edf90e7141804d304ba36ac44f784c263bdd61f6a3ca1e4a80e34edfb8e67016e80767c0437223ed0ef127c1fa23f1749f4121818de0c64db2ae7135d8911dd0ccf8bbeccf1c9f896a0582647fb1a391a1fd671ccf46fdf9acca12d33a18b90f31da4bff840a041b49c6829b2ddf0e883fede2967969e942a1922c1aab0f77ab12c6942d906f6c7dbc9b85a2d66aecb6a833d7a1afce813591562a6bad0fa6e2a5fdf557728a14671597744b1fc6fb708356dd6e38"}, @ETHTOOL_A_BITSET_SIZE={0x8}, @ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_MASK={0x9b5, 0x5, "9989a0a49a25fa708de3968cbac78cc93aa44b82a1f6c0312795326400323501bda2137402e11afcb7b35165e6aa6b644b1d415348cd9fffd740287c07df67bd125668dee2c80b25a8a13d203b0f5e2cd5b33eee6a79b79fc24f99e7555946b9e3a8e39d434a1e30f1040680dd2bc4a1950b5be8b1628287e9cb5c743c15becc7eef111ad09ba28c875d54aa373ffe01cd8c23cb9e766a9958279b062c8188d9863a31249bacfbaa362139f053ab74ff668655b14e77e7d106cbf42025ae2864a94f6dc82b86e57b6a708041aa3a0b5edae729f68c366503d2e11f449a7a140d610916b36e1f1b6f3fba66bc0076da15bf20d1b9b4df4965f51057b1e712d243a85f2c218ad4684d8d0d33c8499d60bfc319bff6ca0f2b6bc13a1b49d3606a4ab52c926587be13c5892e196e13a04780fa48ddf0e9fa3da59eda54d654f50b3674decb73c37d7ca9a4ea7f7f601cb4e33f26202be5a268f1f69ca85b9dddb21d57b46ea9c58e117e77ec4dc81d325463773e8a376e8b9000e8a3456d76f1ef8e92dda39384b78f269e5b1299450875b764ef524707c9a914cd08ab84f5dba9c35145d849077bd8603c2245e5870fcf68916cab480da314bbeea84527ff44d236f98a78c9509099685ee69142d2d3205e3c3b6c3e952342d24b861009acb0bd6fde8c8bba97899e82d218de18f1658ce84879c325e5486b1af449be8205c7f976439f2e5af8a1c1e0de5ffa99537a3feceeb8d6d833506895ddfc79b185e42202962d05759ffee6cc1a90bc50db2a8ad5f8c5d2750a85b36b3814438184aa15929fc1444d733fd7acdea986bf3c7572c9c1d4720bf64a5f171da21ae0acdb304e6de0caba51e013f5d48c28622329a6edc2a33710a086bf3813a9504dfa533311068ab38c18888748b439082b18e1563babd430ec6024b76666c7d71a79adc5880dcccd350f13ee52b50b28e69454077f778f3443c3be1b9bb0d60a9b3fcec8b3107509ee932bd305c0f4292252c3e6684154722a2cd3188234bb5bce5791a09e4d4e553cd937b0ca309f304849aab28afc015829310123f6a96d1f0b997a3e12237a9d5ed2e0f3a23b2d3a122d7ac660fd98507dd1e072c8abd37f1f487cdee83b5c80015f19cbd3065d3d24ec9143fdeabf2391ac0501b9ae39d457cbf037ecdf0f79409426f5f3259fd043f85ec0d5b2717bf82dbca4cdbd355b6ed20fb81b28eef6fcdf5e97ec24516b647e0d9bf4672cd795c97c4bd430f0d6fcc28d745c195408bfceb44b49672d1763ee41d32e5ae37b9c87562d252309105d202417cb1a7747f469ddcd5c51e64638362e9005ae2ef7b3d87704e4ee5d67c6c346715f34e539fad1d43d9287fe9e28cd93323ff29bac7879242cbba805629f1342517946e5e8f7e2bcf9b6de4755a1d7cd48048ea0955d06834c7dd2db232623f26e04d0d54b5fa40a626019ef53a61a69e2d07ecec2aa01e69ce24b8054395700b1bfea7562a10d6a49d1ae3d1552f268da1b23a89a1625a2eb17591767e9d5a901228a757abb1b4a88d3d18c52c6bc57d87f65a2345f890040e93de421d50af1d50374e1cb7499ee9c832db8cfaee811fba7d3ffc6294c48f474e99e02f049a10f31226da17693b0496664ec41b1264d626d22ebca13448220845daaae9b0e04d472f09e31eedc5e020bcfaac84dd393eed8a08c823d3ec9f5eafe6cc6f314677dfde578e94993eb6dd97117bf8af06a3334036bf6da80910d503cd84b997b01a538caa527c400016ce1f5b1307b816a7dfd4d77d1491b9923607db661cf4e9c5556d15cd6a571f4d50189fbc2b87b2b71e59304190e1ec0a51337248a9375e31cf24588bd55d6d5eb5cd674a2a7fc3e68f2145da08f7525ed7d8d0a0c6ce49307286a79e5734dd56d1bb68a5fb0948734fd24e29eabbd3f413241f198ec40fa6afcf9030107407da27c1677f74f50d052d29cc45f9c540cb64856add7172ac7fa370454002642181bfbd226c2ee818c9ef9f145ff4e7c946af79f39430ca15e39427c9c2c5e39397546232deea6facfd987e36b965eab812cc0412a189b5d8cae17c69688619cd6b61a3c69d04500af5be52abd0eb3c5dfbf9dca4713821765c74c890c2ac48eccda747d533c3adb4e30ff1c4542ae1a2e2790ea060e51a099359774956b3b26e8f67446c4ee98fddfa20384c90fae1c76d9c45ff1c185feed8ba5cbcdfeeae35b522d11d64c5827a7230e8df1003779039194623914b6ea4eb7afd8fd55824b6fdcccc5e2abe33a2c9895c900d7ebf79a533ff7dab083a3028b04d36f4243b61fa05a229498b25622cae9cbbcad03eedc5fedfc6bb14e4f01903d48fe666d079dde65856bffca7f05e31de09e6a25c92e2f74123a10979882af296f6b011a9804683b84f2ffff647add9fe5b1fbb65f7a22b32a4403f898cfd24d69aee0304c4804597810d901ad583381168dbfd5aa914b9fb83e5a19e610e07d52cb34a1630f4523890bf839d07ad2ea38531f6f47ae50381f2cef4b3eb0c1209d4d341e0d1d3af63ab354e1e48e72d624f6d2aa041cd3f5e00db802ff7bdd887c6d12a3998a504adb1f7bb2f032218f11c1a77e7cf0ac8e055d6fc759cce0eeb3b5b50138e6e4864592b49521674b0526a946701c6fcf5a8226b2fa808f8369f19fa548e0cc9bdc3ab9922baf15e81f09ec7e60035b32d77ead280d9672150f71881184d8d93936619f13ad8cb8f4a59be88ddb93f51b6b7092d8e35d862d4d97c512b8fa364ae6ff72eaa51fcd80d30c0e16be5ada36aa2d1cde3fface77d7a2e6b83b3401f6392a229354c9eba16e12c94b343d03915b064f2704c8a79038d516b402eec58c1dc67a2ddba6850ad1c35119b036cd06e55dcd189a9809bd4e8664b259a9bdf573660dd2ea1a1837a48c34abe0a03add7b21534eb16d92a5396cac586f80bb36105fb052b8b25b6007458b20d78359271a92efa19317b87eaa9b3c86364b576429e241974a1689cbfc34f564d02f6076ce8d53e4552e57ffc09b91e46d5912e3161e70bfafd922930732014ec2beba91facefc3f91183abbb3ed08d761bb568844aecb054fb5ba81a20172bf8b87696e9b707556fdfc4467cca2f06ad94a6fc1e04e1b751210f51cf74d6eb109524e7641c1aff58da7abd254434e51ccdefa34583fc5cf3461c5b7429350eaa61894eef3a5dc70e3555a28e96d783653d21b6917c6061aa60aabc571d63f3c7d311d3a9f57d711c65e55ae793dc56cb2b59f098ad75ccc7c1475a8a2ff821b11d4cc7020b869066bb9ec65a1536c65f828a593558bfb54fb0aa113bbc62c820200cb5aee4eb9ca39c993d8b3d3792c84e6c87db1268b29720ee9a2b7fdbbaccde59b8f8356d28dd6fad7a96949681471ed6957b181e135c9e3a02d24b66e3ce9892d07c423d673be2bb6aa107544a5e84c0e056c1a49af2fc339c9cc749586545167e58ea11d925e1b95a83558b773f8716bf0b32e240b7765484a8d76"}]}]}, 0xec4}, 0x1, 0x0, 0x0, 0x40001}, 0x722f83585aaca956) [ 627.017010][T18000] binder: 17994:18000 unknown command 0 [ 627.053735][T18000] binder: 17994:18000 ioctl c0306201 20000200 returned -22 01:59:23 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x100000000000000, 0x0, 0x0) 01:59:23 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_FEATURES_SET(r0, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000b40)={0x0}}, 0x0) sendmsg$NL80211_CMD_SET_WIPHY(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={0x0}}, 0x0) 01:59:23 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x6, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 627.093989][T18006] binder: 17994:18006 unknown command 0 [ 627.152716][T18006] binder: 17994:18006 ioctl c0306201 20000200 returned -22 01:59:23 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:23 executing program 3: r0 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000880), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_TSINFO_GET(r1, &(0x7f00000015c0)={&(0x7f0000000f00)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000001580)={&(0x7f0000000240)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="01000000000000000000190000001400018008000100"], 0x28}}, 0x0) 01:59:23 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x7, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:23 executing program 1: syz_emit_ethernet(0x3a, &(0x7f00000006c0)={@local, @remote, @void, {@ipv4={0x800, @igmp={{0x9, 0x4, 0x0, 0x0, 0x2c, 0x0, 0x0, 0x0, 0x2, 0x0, @remote, @dev, {[@generic={0x7, 0xd, "b7b22ba6f6419f861a9e39"}, @rr={0x7, 0x3}]}}, {0x0, 0x0, 0x0, @private}}}}}, 0x0) 01:59:23 executing program 4: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) 01:59:23 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x200000000000000, 0x0, 0x0) [ 627.500179][T18025] binder: 18022:18025 unknown command 0 [ 627.518544][T18025] binder: 18022:18025 ioctl c0306201 20000200 returned -22 [ 627.533182][T18027] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.3'. [ 627.559156][T18030] binder: 18022:18030 unknown command 0 [ 627.581841][T18030] binder: 18022:18030 ioctl c0306201 20000200 returned -22 [ 627.593720][T18032] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.3'. 01:59:23 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x8, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:23 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$SOCK_DESTROY(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001e0001"], 0x14}}, 0x0) 01:59:23 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:23 executing program 3: bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={&(0x7f0000000240)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@enum={0x0, 0x0, 0x0, 0x10}]}}, &(0x7f0000001600)=""/166, 0x26, 0xa6, 0x1}, 0x20) 01:59:23 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x300000000000000, 0x0, 0x0) 01:59:23 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x11, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:23 executing program 4: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) [ 627.911851][T18046] binder: 18041:18046 unknown command 0 [ 627.941957][T18046] binder: 18041:18046 ioctl c0306201 20000200 returned -22 01:59:23 executing program 3: sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, 0x0, 0x0) 01:59:23 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$XDP_UMEM_FILL_RING(r0, 0x10e, 0xb, 0x0, 0x0) [ 627.989243][T18046] binder: 18041:18046 unknown command 0 [ 628.024109][T18046] binder: 18041:18046 ioctl c0306201 20000200 returned -22 01:59:24 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:24 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x29, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:24 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x400000000000000, 0x0, 0x0) 01:59:24 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, 0x0, 0x0) 01:59:24 executing program 1: syz_emit_ethernet(0x62, &(0x7f0000000140)={@multicast, @local, @void, {@ipv6={0x86dd, @tipc_packet={0x0, 0x6, "939013", 0x2c, 0x6, 0x0, @ipv4={'\x00', '\xff\xff', @private}, @dev, {[], @payload_mcast={{{{{{0x2c, 0x0, 0x0, 0x0, 0x0, 0xb}}}}}}}}}}}, 0x0) 01:59:24 executing program 4: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) [ 628.436372][T18069] binder: 18066:18069 unknown command 0 [ 628.445871][T18069] binder: 18066:18069 ioctl c0306201 20000200 returned -22 01:59:24 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x2b, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 628.484871][T18069] binder: 18066:18069 unknown command 0 [ 628.516107][T18069] binder: 18066:18069 ioctl c0306201 20000200 returned -22 01:59:24 executing program 3: syz_emit_ethernet(0x22, &(0x7f0000000040)={@remote, @link_local, @void, {@arp={0x806, @generic={0x0, 0x0, 0x6, 0x0, 0x0, @dev, "", @remote}}}}, 0x0) 01:59:24 executing program 1: syz_emit_ethernet(0x27c, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaa0abbbbbbbbbbbb0806"], 0x0) 01:59:24 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:24 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x500000000000000, 0x0, 0x0) 01:59:24 executing program 4: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) 01:59:24 executing program 3: syz_emit_ethernet(0x36, &(0x7f00000003c0)={@multicast, @local, @val={@void}, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x11, 0x0, @empty}, {0x0, 0x0, 0x10, 0x0, @gue={{0x2}}}}}}}, 0x0) 01:59:24 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x2c, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 628.881317][T18092] binder: 18087:18092 unknown command 0 [ 628.909486][T18092] binder: 18087:18092 ioctl c0306201 20000200 returned -22 01:59:24 executing program 1: r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)={0x4c, 0x13, 0x1f437338616d081d}, 0x4c}}, 0x0) [ 628.945023][T18094] binder: 18087:18094 unknown command 0 [ 628.982974][T18094] binder: 18087:18094 ioctl c0306201 20000200 returned -22 [ 628.996825][T18092] binder_alloc: 18087: binder_alloc_buf, no vma 01:59:25 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:25 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x600000000000000, 0x0, 0x0) 01:59:25 executing program 4: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) 01:59:25 executing program 3: mprotect(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x3) mlock2(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0) 01:59:25 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:25 executing program 1: mknod(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) mknod$loop(&(0x7f0000000280)='./file0\x00', 0x0, 0x1) rename(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='./file1\x00') [ 629.329343][T18111] binder: 18105:18111 unknown command 0 [ 629.352334][T18111] binder: 18105:18111 ioctl c0306201 20000200 returned -22 [ 629.391734][T18111] binder: 18105:18111 unknown command 0 [ 629.415322][T18111] binder: 18105:18111 ioctl c0306201 20000200 returned -22 01:59:25 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x3a, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 629.441989][T18115] binder_alloc: 18105: binder_alloc_buf, no vma 01:59:25 executing program 4: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) 01:59:25 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000000)={0x0, @remote, @multicast1}, &(0x7f0000000040)=0xc) 01:59:25 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x700000000000000, 0x0, 0x0) 01:59:25 executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000580), 0x0, 0x0) ioctl$TUNGETIFF(r0, 0x800454d2, &(0x7f00000005c0)={'netpci0\x00'}) 01:59:25 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:25 executing program 3: mlock2(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0) madvise(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x4) 01:59:25 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x3c, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:25 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x800000000000000, 0x0, 0x0) [ 629.836646][T18133] binder: 18127:18133 unknown command 0 [ 629.862378][T18133] binder: 18127:18133 ioctl c0306201 20000200 returned -22 01:59:25 executing program 4: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r3, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) [ 629.912369][T18137] binder: 18127:18137 unknown command 0 01:59:25 executing program 1: mlock2(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x0) mremap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x1000, 0x3, &(0x7f0000ffe000/0x1000)=nil) 01:59:25 executing program 3: syz_open_dev$rtc(0x0, 0x0, 0x0) syz_io_uring_setup(0x78bc, &(0x7f0000000080)={0x0, 0xf064}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, 0x0, 0x0) fork() [ 629.958472][T18137] binder: 18127:18137 ioctl c0306201 20000200 returned -22 [ 629.962193][T18133] binder_alloc: 18127: binder_alloc_buf, no vma 01:59:26 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:26 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:26 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000200)={0x2, 0x4e20, @empty}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000000040)=0x2800, 0x4) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000400)={0x1, &(0x7f00000001c0)=[{0x6, 0x0, 0x0, 0x3654}]}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='dctcp\x00', 0x6) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x1c}}, 0x10) pipe(&(0x7f0000000100)={0xffffffffffffffff}) r2 = socket$netlink(0x10, 0x3, 0x4) splice(r1, 0x0, r2, 0x0, 0x4ffdc, 0x0) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000280)={{{@in=@loopback, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in6=@private1}}, &(0x7f00000000c0)=0xe8) ioctl$sock_ipv6_tunnel_SIOCADD6RD(0xffffffffffffffff, 0x89f9, &(0x7f0000000380)={'ip6_vti0\x00', &(0x7f0000000140)={'ip6tnl0\x00', 0x0, 0x29, 0x0, 0x0, 0x7, 0x22, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @remote, 0x40, 0x7, 0x24cb}}) getpeername$packet(0xffffffffffffffff, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000440)=0x14) socket$inet6_icmp(0xa, 0x2, 0x3a) sendmsg$nl_route(r2, &(0x7f00000004c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000480)={&(0x7f0000001740)=@dellink={0x50, 0x11, 0x7, 0x70bd27, 0x25dfdbfe, {0x0, 0x0, 0x0, r3, 0x440, 0x26000}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @ip6vti={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_VTI_REMOTE={0x14, 0x5, @ipv4={'\x00', '\xff\xff', @local}}]}}}, @IFLA_PROTO_DOWN={0x5}]}, 0x50}}, 0x0) sendmsg$inet(r0, &(0x7f00000015c0)={0x0, 0x14, &(0x7f0000001600)=[{&(0x7f0000000240)=' ', 0xffffff1f}], 0x1}, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r4, 0x0) preadv(r4, &(0x7f0000000280), 0x45, 0xda1, 0x0) recvmsg(r0, &(0x7f0000000580)={0x0, 0x2, &(0x7f0000000500)=[{&(0x7f0000000740)=""/4096, 0xa15b0}], 0x1}, 0x700) 01:59:26 executing program 4: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r3, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) 01:59:26 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x1f00000000000000, 0x0, 0x0) 01:59:26 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) recvmmsg(r0, &(0x7f00000003c0)=[{{&(0x7f0000000080)=@sco={0x1f, @none}, 0x0, &(0x7f0000000300)=[{&(0x7f0000000000)=""/58}, {&(0x7f0000000400)=""/63}, {&(0x7f0000000140)=""/162}, {&(0x7f0000000200)=""/209}], 0x0, &(0x7f0000000340)=""/121}}], 0x1, 0x20e2, 0x0) [ 630.305268][T18155] binder: 18149:18155 unknown command 0 [ 630.327306][T18155] binder: 18149:18155 ioctl c0306201 20000200 returned -22 01:59:26 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x2, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:26 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) [ 630.502764][T18162] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. 01:59:26 executing program 3: bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000140)=@bpf_lsm={0x1d, 0x3, &(0x7f0000000000)=@framed, &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff}, 0x78) 01:59:26 executing program 4: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r3, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) 01:59:26 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x3, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:26 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x8000000000000000, 0x0, 0x0) [ 630.703997][T18173] binder: 18168:18173 unknown command 0 [ 630.719993][T18173] binder: 18168:18173 ioctl c0306201 20000200 returned -22 01:59:26 executing program 3: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r0, 0x89f8, &(0x7f0000000180)={'sit0\x00', &(0x7f0000000000)={'syztnl0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @private0, @local}}) 01:59:26 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x6, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:27 executing program 1: r0 = socket$xdp(0x2c, 0x3, 0x0) ioctl$sock_SIOCGPGRP(r0, 0x5452, &(0x7f0000000000)) 01:59:27 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0xff00000000000000, 0x0, 0x0) 01:59:27 executing program 3: r0 = socket$xdp(0x2c, 0x3, 0x0) ioctl$sock_SIOCGPGRP(r0, 0xc0189436, &(0x7f0000000000)) 01:59:27 executing program 4: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r3, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) 01:59:27 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x7, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:27 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:27 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0xffff1f0000000000, 0x0, 0x0) 01:59:27 executing program 3: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0xb, 0x0, 0x0) 01:59:27 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x8, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:27 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x8936, 0x0) 01:59:27 executing program 4: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r3, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) 01:59:27 executing program 3: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x1b, 0x0, 0x0) 01:59:27 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0xb, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 631.764814][T18215] binder: 18209:18215 unknown command 0 [ 631.788815][T18215] binder: 18209:18215 ioctl c0306201 20000200 returned -22 01:59:27 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0xffffffff00000000, 0x0, 0x0) 01:59:27 executing program 1: r0 = socket(0x10, 0x3, 0x0) syz_genetlink_get_family_id$gtp(&(0x7f00000003c0), r0) 01:59:27 executing program 3: pkey_mprotect(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0xffffffffffffffff) r0 = socket$xdp(0x2c, 0x3, 0x0) mmap$xdp(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x11, r0, 0x0) 01:59:27 executing program 4: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r3, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) 01:59:28 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:28 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x48, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:28 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x2) 01:59:28 executing program 1: syz_io_uring_setup(0x7f89, &(0x7f0000000100), &(0x7f0000d40000/0x3000)=nil, &(0x7f0000c2e000/0x2000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) 01:59:28 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFVLAN_SET_VLAN_FLAG_CMD(r0, 0x8982, &(0x7f0000000340)={0x9, 'vlan0\x00'}) 01:59:28 executing program 4: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) 01:59:28 executing program 1: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x2, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) 01:59:28 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x5c, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 632.762006][T18261] binder: 18254:18261 unknown command 0 [ 632.780230][T18261] binder: 18254:18261 ioctl c0306201 20000200 returned -22 01:59:28 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000080)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x0, 0x0, @fd=r0, 0x7, 0x0, 0xc673}, 0x0) open$dir(&(0x7f0000000180)='./file0\x00', 0x22240, 0x102) lsetxattr$trusted_overlay_origin(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), &(0x7f0000000240), 0x2, 0x1) getsockname(r0, &(0x7f00000000c0)=@sco={0x1f, @fixed}, &(0x7f0000000140)=0x80) [ 632.825108][T18261] binder: 18254:18261 ioctl c0306201 0 returned -14 01:59:28 executing program 4: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) 01:59:28 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x3) 01:59:28 executing program 1: syz_genetlink_get_family_id$ieee802154(0x0, 0xffffffffffffffff) r0 = socket$xdp(0x2c, 0x3, 0x0) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f0000001000)={&(0x7f0000000000)=""/4096, 0x104b000, 0x1000}, 0x20) mmap$xdp(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x11, r0, 0x0) 01:59:29 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:29 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local={0xac, 0x5c}}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:29 executing program 3: syz_io_uring_setup(0x78bc, &(0x7f0000000080)={0x0, 0xf064}, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, 0x0, 0x0) fork() 01:59:29 executing program 4: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) 01:59:29 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x4) 01:59:29 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000580)=@ipv6_deladdr={0x34, 0x15, 0x329, 0x0, 0x0, {}, [@IFA_ADDRESS={0x14, 0x1, @private0}, @IFA_FLAGS={0x8}]}, 0x34}}, 0x0) 01:59:29 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x541b, 0x0) 01:59:29 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local={0xac, 0x14, 0x5c}}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 633.834453][T18304] binder: 18295:18304 unknown command 0 [ 633.855515][T18304] binder: 18295:18304 ioctl c0306201 20000200 returned -22 01:59:29 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000000)={'batadv0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000580)=@ipv6_deladdr={0x34, 0x15, 0x329, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_ADDRESS={0x14, 0x1, @private0}, @IFA_FLAGS={0x8}]}, 0x34}}, 0x0) [ 633.893186][T18304] binder: 18295:18304 ioctl c0306201 0 returned -14 01:59:29 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x5) 01:59:29 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local={0xac, 0x14, 0x14, 0x6a}}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:29 executing program 1: r0 = socket(0x11, 0xa, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r0) 01:59:30 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:30 executing program 4: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) 01:59:30 executing program 3: r0 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_MAKE_EQUIV(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[], 0x28}}, 0x0) 01:59:30 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0xfe77}}, 0x0) 01:59:30 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local={0xac, 0x14, 0x14, 0xc0}}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:30 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x6) 01:59:30 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:30 executing program 3: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x5452, &(0x7f00000002c0)={'ip6gre0\x00', 0x0}) 01:59:30 executing program 1: pkey_mprotect(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0xffffffffffffffff) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000040)='ns/pid_for_children\x00') pkey_mprotect(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0xffffffffffffffff) [ 634.836863][T18340] binder: 18335:18340 unknown command 0 [ 634.898174][T18340] binder: 18335:18340 ioctl c0306201 20000200 returned -22 [ 634.916659][T18344] binder: 18335:18344 ioctl c0306201 0 returned -14 01:59:30 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x4, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:30 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x7) 01:59:31 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:31 executing program 4: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) 01:59:31 executing program 1: syz_io_uring_setup(0x68dd, &(0x7f0000000000), &(0x7f0000000000/0x4000)=nil, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) 01:59:31 executing program 3: r0 = socket$xdp(0x2c, 0x3, 0x0) mmap$xdp(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x11, r0, 0x0) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000000)) 01:59:31 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x6, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 635.291147][T18363] binder: 18357:18363 unknown command 0 [ 635.310597][T18363] binder: 18357:18363 ioctl c0306201 20000200 returned -22 01:59:31 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x8) 01:59:31 executing program 3: r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_udp_int(r0, 0x11, 0x65, 0x0, &(0x7f0000000040)) 01:59:31 executing program 1: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x9, 0x3, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x3}}, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) 01:59:31 executing program 4: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) 01:59:31 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x8, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:31 executing program 3: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r0, 0x11b, 0x2, &(0x7f0000001040)=0x1000, 0x4) mmap$xdp(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0, 0x13, r0, 0x0) 01:59:31 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x300) 01:59:32 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:32 executing program 1: bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000000200)={0xffffffffffffffff, 0x0, 0x0}, 0x20) 01:59:32 executing program 4: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000fe6000/0x18000)=nil, 0x0, 0x0, 0x14, 0x0, 0x0) 01:59:32 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0xb, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:32 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x2}, 0xc, &(0x7f00000000c0)={0x0}}, 0x0) 01:59:32 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x500) 01:59:32 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0xc, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:32 executing program 3: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'ip6tnl0\x00', &(0x7f0000000000)={'sit0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @remote, @mcast1}}) [ 636.302772][T18410] binder: 18404:18410 unknown command 0 01:59:32 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@ipv6_deladdr={0x18, 0x15, 0x1}, 0x18}}, 0x0) 01:59:32 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x600) [ 636.357656][T18410] binder: 18404:18410 ioctl c0306201 20000200 returned -22 01:59:32 executing program 4: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000fe6000/0x18000)=nil, 0x0, 0x0, 0x14, 0x0, 0x0) 01:59:32 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x12, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:33 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:33 executing program 3: pkey_mprotect(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x2, 0xffffffffffffffff) pkey_mprotect(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x0, 0xffffffffffffffff) pkey_mprotect(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x0, 0xffffffffffffffff) 01:59:33 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x8936, &(0x7f00000002c0)={'ip6gre0\x00', 0x0}) 01:59:33 executing program 4: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000fe6000/0x18000)=nil, 0x0, 0x0, 0x14, 0x0, 0x0) 01:59:33 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x700) 01:59:33 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x2a, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:33 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x2b, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:33 executing program 1: pkey_mprotect(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0xffffffffffffffff) pkey_mprotect(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0xc, 0xffffffffffffffff) 01:59:33 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x7, 0x0, 0x0, 0xffffffff, 0x0, 0x1}, 0x40) 01:59:33 executing program 4: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, r4, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) [ 637.312692][T18455] binder: 18447:18455 unknown command 0 [ 637.334205][T18455] binder: 18447:18455 ioctl c0306201 20000200 returned -22 01:59:33 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:33 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x1f00) 01:59:34 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000004c0), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:34 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x8946, &(0x7f0000000080)={'ip6tnl0\x00', &(0x7f0000000000)={'syztnl2\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr=' \x01\x00', @private0}}) 01:59:34 executing program 3: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x9, 0x3, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x13}}, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) 01:59:34 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x2, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:34 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x2000) 01:59:34 executing program 4: r0 = socket(0x10, 0x3, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'seqiv(essiv(ccm-aes-ce,sha512-ssse3))\x00'}, 0x58) 01:59:34 executing program 3: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x40049409, &(0x7f00000002c0)={'ip6gre0\x00', 0x0}) 01:59:34 executing program 4: socketpair(0x1, 0x2, 0x0, &(0x7f0000000280)) 01:59:34 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'ip6tnl0\x00', &(0x7f0000000000)={'syztnl2\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr=' \x01\x00', @private0={0xfc, 0x0, '\x00', 0x1}}}) 01:59:34 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x3, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 638.348248][T18494] binder: 18488:18494 unknown command 0 [ 638.373238][T18494] binder: 18488:18494 ioctl c0306201 20000200 returned -22 01:59:34 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0xff00) 01:59:34 executing program 4: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x18, &(0x7f00000004c0)={0x0, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) 01:59:35 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000004c0), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:35 executing program 3: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x21, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) 01:59:35 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x6, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:35 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000140)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r1, 0x1}, 0x14}}, 0x0) 01:59:35 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x12, 0x80, 0x0, 0x8, 0x0, 0x1}, 0x40) 01:59:35 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x1fffff) 01:59:35 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x7, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:35 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f0, &(0x7f0000000080)={'ip6tnl0\x00', &(0x7f0000000000)={'syztnl2\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr=' \x01\x00', @private0}}) 01:59:35 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'ipvlan0\x00', &(0x7f0000000000)=@ethtool_link_settings={0x7}}) 01:59:35 executing program 1: mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x10, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFSMAP(0xffffffffffffffff, 0xc0c0583b, &(0x7f00000002c0)=ANY=[@ANYBLOB="00011f6b"]) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) getsockopt$ARPT_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x0, 0x63, &(0x7f0000000040)={'HL\x00'}, &(0x7f0000000080)=0x1e) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000357000/0x18000)=nil, &(0x7f00000001c0)=[@text32={0x20, &(0x7f0000000380)="440f20c0350a000000440f22c0c4c1fd2eba00000000652e2e260f32f0838f6419926151acb9bd090000b8865e1608ba6e8eee380f30c4e37d04030d660f7ede26360f01cf670f00980700", 0x4b}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x100000}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000004c0)) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 639.383695][T18533] binder: 18527:18533 unknown command 0 [ 639.417732][T18533] binder: 18527:18533 ioctl c0306201 20000200 returned -22 01:59:35 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x200000) 01:59:35 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x8, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:36 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0xb, 0x0, 0x0, 0x401, 0x0, 0x1}, 0x40) 01:59:36 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_mreqn(r0, 0x0, 0x20, 0x0, &(0x7f0000000000)) 01:59:36 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89b0, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) 01:59:36 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x1000000) 01:59:36 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000004c0), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:36 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0xb, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:36 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x220007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x80000f, 0x12, r1, 0x0) preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0) sendto$inet(r0, &(0x7f00000012c0)="0c268a927f1f6588b967483641ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf90b1a7511bf746bec66ba", 0xfe6a, 0xfffff, 0x0, 0x170) 01:59:36 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFVLAN_SET_VLAN_FLAG_CMD(r0, 0x8904, &(0x7f0000000340)={0x7, 'vlan0\x00'}) 01:59:36 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x48, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:36 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFVLAN_SET_VLAN_FLAG_CMD(r0, 0xc0045878, 0x0) [ 640.621922][T18572] binder: 18566:18572 unknown command 0 01:59:36 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x2000000) [ 640.699960][T18572] binder: 18566:18572 ioctl c0306201 20000200 returned -22 01:59:36 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)={0x11, 0x0, 0x0, 0xa6f}, 0x40) 01:59:36 executing program 3: sendmsg$NL80211_CMD_SET_WIPHY_NETNS(0xffffffffffffffff, 0x0, 0x0) r0 = io_uring_setup(0xf33, &(0x7f0000000100)={0x0, 0xe3fa}) io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f00000015c0)=[{&(0x7f00000003c0)=""/223, 0xdf}, {&(0x7f00000005c0)=""/4096, 0x1000}], 0x2) 01:59:36 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x5c, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:36 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000580)=@ipv6_deladdr={0x2c, 0x15, 0x329, 0x0, 0x0, {}, [@IFA_ADDRESS={0x14, 0x1, @private0}]}, 0x2c}}, 0x0) 01:59:36 executing program 4: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r0, 0x11b, 0x2, &(0x7f0000001040)=0x1000, 0x4) mmap$xdp(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x4, 0x11, r0, 0x0) 01:59:37 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:37 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x3000000) 01:59:37 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0xc0189436, &(0x7f0000000080)={'ip6tnl0\x00', &(0x7f0000000000)={'syztnl2\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr=' \x01\x00', @private0}}) 01:59:37 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x2, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:37 executing program 3: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) write$binfmt_elf64(r0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e9b0807003b003772"], 0x78) 01:59:37 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x2}, 0x0) 01:59:37 executing program 4: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xd, &(0x7f0000000800)=ANY=[@ANYBLOB="8520"], &(0x7f0000000300)='GPL\x00', 0x6, 0x93, &(0x7f0000000340)=""/147, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) 01:59:37 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x6, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:37 executing program 3: openat$thread_pidfd(0xffffffffffffff9c, &(0x7f00000001c0), 0x296400, 0x0) 01:59:37 executing program 1: r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000001000)={&(0x7f0000000000)=""/4096, 0x104b000, 0x1000}, 0x20) mmap$xdp(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x11, r0, 0x0) [ 641.694637][T18612] binder: 18611:18612 unknown command 0 [ 641.716283][T18612] binder: 18611:18612 ioctl c0306201 20000200 returned -22 01:59:37 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x4000000) [ 641.763253][T18614] binder: 18611:18614 unknown command 0 [ 641.806818][T18614] binder: 18611:18614 ioctl c0306201 20000200 returned -22 01:59:37 executing program 4: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x11, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) 01:59:37 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:37 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x8, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:37 executing program 3: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x8929, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) 01:59:38 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x5000000) 01:59:38 executing program 4: r0 = socket$xdp(0x2c, 0x3, 0x0) pkey_mprotect(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0xffffffffffffffff) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000001000)={&(0x7f0000000000)=""/4096, 0x104b000, 0x1000}, 0x20) mmap$xdp(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x11, 0xffffffffffffffff, 0x0) [ 642.146754][T18635] binder: 18631:18635 unknown command 0 [ 642.166096][T18635] binder: 18631:18635 ioctl c0306201 20000200 returned -22 01:59:38 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:38 executing program 3: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x8, 0x0, 0x0) 01:59:38 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0xffffff1f}, 0x0) [ 642.209189][T18635] binder: 18631:18635 unknown command 0 [ 642.249116][T18635] binder: 18631:18635 ioctl c0306201 20000200 returned -22 01:59:38 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:38 executing program 3: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0xa) 01:59:38 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000580)=@ipv6_deladdr={0x34, 0x15, 0x329, 0x0, 0x0, {0xa, 0x20}, [@IFA_ADDRESS={0x14, 0x1, @private0}, @IFA_FLAGS={0x8}]}, 0x34}}, 0x0) 01:59:38 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x2, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:38 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x6000000) [ 642.529451][T18650] binder: 18648:18650 unknown command 0 [ 642.556087][T18650] binder: 18648:18650 ioctl c0306201 20000200 returned -22 [ 642.600253][T18650] binder: 18648:18650 unknown command 0 [ 642.627246][T18650] binder: 18648:18650 ioctl c0306201 20000200 returned -22 01:59:38 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x3, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:38 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x541b, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000000)={'ip6tnl0\x00', 0x0, 0x4, 0x8, 0x1f, 0x4, 0x24, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @remote, 0x10750, 0x8000, 0x80, 0x6}}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000140)={'syztnl2\x00', &(0x7f00000000c0)={'syztnl2\x00', r1, 0x29, 0x3f, 0x3f, 0x9, 0x40, @private0, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x8, 0x1, 0x2}}) 01:59:38 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @mcast1}, 0x1c) 01:59:38 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:38 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x7000000) 01:59:38 executing program 3: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x8907, 0x0) 01:59:38 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x6, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 642.966046][T18674] binder: 18669:18674 unknown command 0 [ 642.994150][T18674] binder: 18669:18674 ioctl c0306201 20000200 returned -22 01:59:38 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={&(0x7f0000000000), 0x20000004, &(0x7f00000000c0)={&(0x7f0000000040)=@delneigh={0x40, 0x1d, 0x7, 0x0, 0x0, {}, [@NDA_LLADDR={0xa, 0x2, @dev}, @NDA_PORT, @NDA_DST_IPV4={0x8, 0x1, @broadcast}, @NDA_PORT={0x6}]}, 0x40}}, 0x0) [ 643.041014][T18674] binder: 18669:18674 unknown command 0 [ 643.077563][T18674] binder: 18669:18674 ioctl c0306201 20000200 returned -22 01:59:39 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000080)={0x1b, 0x3c}, 0x40) [ 643.091677][T18678] binder: 18669:18678 ioctl c0306201 0 returned -14 01:59:39 executing program 3: r0 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$FUSE_DIRENT(r0, &(0x7f0000000080)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES64], 0x30) 01:59:39 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:39 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x7, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:39 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x8000000) 01:59:39 executing program 4: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) getdents64(r0, &(0x7f0000000300)=""/50, 0x32) 01:59:39 executing program 1: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x19, &(0x7f00000004c0)={0x0, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) 01:59:39 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x5, 0x400, 0x15, 0x8}, 0x40) [ 643.349575][T18697] binder: 18692:18697 unknown command 0 [ 643.364917][T18697] binder: 18692:18697 ioctl c0306201 20000200 returned -22 01:59:39 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x8, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 643.426146][T18697] binder: 18692:18697 unknown command 0 [ 643.439858][T18697] binder: 18692:18697 ioctl c0306201 20000200 returned -22 01:59:39 executing program 4: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x21, &(0x7f00000004c0)={0x0, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) 01:59:39 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x1f000000) [ 643.476687][T18700] binder: 18692:18700 ioctl c0306201 0 returned -14 01:59:39 executing program 1: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x0, 0xf4240, 0x0, &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) 01:59:39 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0xb, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:39 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:39 executing program 3: r0 = inotify_init1(0x0) fcntl$setown(r0, 0x8, 0xffffffffffffffff) fcntl$getownex(r0, 0x10, &(0x7f0000000080)={0x0, 0x0}) ptrace$setopts(0x4206, r1, 0x0, 0x0) ptrace(0x4207, r1) ioctl$sock_inet_SIOCSARP(0xffffffffffffffff, 0x8955, 0x0) ptrace$cont(0x4200, r1, 0x0, 0x0) 01:59:39 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000002180)={0xffffffffffffffff, 0xffffffffffffffff}) accept4$packet(r0, 0x0, 0x0, 0x0) 01:59:39 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0xff000000) [ 643.766527][T18719] ptrace attach of "/root/syz-executor.3"[8503] was attempted by "/root/syz-executor.3"[18719] [ 643.786594][T18721] binder: 18716:18721 unknown command 0 [ 643.797431][T18721] binder: 18716:18721 ioctl c0306201 20000200 returned -22 01:59:39 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x48, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 643.820409][T18719] ptrace attach of "/root/syz-executor.3"[8503] was attempted by "/root/syz-executor.3"[18719] 01:59:39 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000500)=ANY=[@ANYBLOB="68000000180001"], 0x68}}, 0x0) [ 643.875251][T18725] binder: BINDER_SET_CONTEXT_MGR already set [ 643.881442][T18725] binder: 18716:18725 ioctl 40046207 0 returned -16 [ 643.926767][T18721] binder: 18716:18721 unknown command 0 [ 643.932369][T18721] binder: 18716:18721 ioctl c0306201 20000200 returned -22 01:59:39 executing program 3: r0 = socket(0x11, 0xa, 0x0) sendto$packet(r0, 0x0, 0x0, 0x0, &(0x7f00000006c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random="9654f702e9a4"}, 0x200006d4) [ 643.978257][T18725] binder: 18716:18725 ioctl c0306201 0 returned -14 01:59:39 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x5c, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:40 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_udp_int(r0, 0x11, 0xa, 0x0, &(0x7f0000000080)) 01:59:40 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:40 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000002180)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = io_uring_setup(0xf33, &(0x7f0000000100)) io_uring_register$IORING_REGISTER_FILES(r1, 0x2, &(0x7f0000000040)=[r0], 0x1) 01:59:40 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0xffff1f00) 01:59:40 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000100)={0x6, 0x0, 0x0, 0x2, 0x0, 0x1}, 0x40) 01:59:40 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x2, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 644.256537][T18741] binder: 18739:18741 unknown command 0 [ 644.285890][T18741] binder: 18739:18741 ioctl c0306201 20000200 returned -22 01:59:40 executing program 3: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x9, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) 01:59:40 executing program 1: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x6}, 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0) setsockopt$packet_fanout_data(r0, 0x107, 0x16, &(0x7f0000000100)={0x2, &(0x7f00000000c0)=[{0x20, 0x0, 0x0, 0x890}, {0x6}]}, 0x10) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r2, 0x0, 0x0, 0x22004001, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendto$inet6(r2, &(0x7f0000000080)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090000006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5753444fe05f33e5f91045540836c3cd6af10f0cd018f0c6f57f926ac959a5628c45088fbe0c87fbe6cbcda4662d2a12f6d00"/215, 0xd0d0c2ac, 0x1, 0x0, 0x0) [ 644.329009][T18750] binder: 18739:18750 unknown command 0 [ 644.353266][T18750] binder: 18739:18750 ioctl c0306201 20000200 returned -22 01:59:40 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0xc0045878, 0x0) 01:59:40 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:40 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x6, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:40 executing program 3: r0 = socket$xdp(0x2c, 0x3, 0x0) ioctl$sock_SIOCGPGRP(r0, 0x80108906, 0x0) 01:59:40 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x20000000000000) 01:59:40 executing program 4: syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x49) [ 644.648166][T18764] binder: 18761:18764 unknown command 0 [ 644.660763][T18764] binder: 18761:18764 ioctl c0306201 20000200 returned -22 [ 644.712380][T18764] binder: 18761:18764 unknown command 0 [ 644.739740][T18764] binder: 18761:18764 ioctl c0306201 20000200 returned -22 01:59:40 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) write$FUSE_LSEEK(r0, &(0x7f0000000000)={0x18}, 0x18) 01:59:40 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={&(0x7f0000000000), 0x20000004, &(0x7f00000000c0)={&(0x7f0000000040)=@delneigh={0x40, 0x1d, 0x0, 0x0, 0x0, {}, [@NDA_LLADDR={0xa, 0x2, @dev}, @NDA_PORT, @NDA_DST_IPV4={0x8, 0x1, @broadcast}, @NDA_PORT={0x6}]}, 0xc0}}, 0x0) 01:59:40 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x8, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:40 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x9fc}, 0x40) 01:59:40 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:40 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="400000001d325f"], 0x40}}, 0x0) 01:59:40 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x100000000000000) 01:59:40 executing program 1: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x9, 0x3, &(0x7f0000000080)=@framed={{}, [], {0x95, 0x0, 0x0, 0x2}}, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) 01:59:40 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:40 executing program 4: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000580), 0x0, 0x0) ioctl$RTC_AIE_ON(r0, 0x7001) [ 645.020123][T18784] binder: 18782:18784 unknown command 0 [ 645.056072][T18784] binder: 18782:18784 ioctl c0306201 20000200 returned -22 01:59:41 executing program 3: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x1e, 0xd, 0x0, &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) [ 645.102833][T18787] binder: 18782:18787 unknown command 0 [ 645.124777][T18787] binder: 18782:18787 ioctl c0306201 20000200 returned -22 01:59:41 executing program 1: pkey_mprotect(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0xffffffffffffffff) pkey_mprotect(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x7, 0xffffffffffffffff) 01:59:41 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x2, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:41 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:41 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=@delneigh={0x28, 0x1d, 0x7, 0x0, 0x0, {}, [@NDA_LLADDR={0xa, 0x2, @dev}]}, 0x28}}, 0x0) 01:59:41 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x200000000000000) 01:59:41 executing program 3: syz_open_dev$rtc(0x0, 0x0, 0x0) syz_io_uring_setup(0x78bc, &(0x7f0000000080), &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, 0x0, 0x0) fork() 01:59:41 executing program 1: ioctl$SCSI_IOCTL_SEND_COMMAND(0xffffffffffffffff, 0x1, 0x0) mmap$IORING_OFF_SQES(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4000010, 0xffffffffffffffff, 0x10000000) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) sched_getparam(0x0, 0x0) fcntl$setlease(0xffffffffffffffff, 0x400, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'veth1_virt_wifi\x00', &(0x7f0000000000)=@ethtool_channels={0x3c}}) ioctl$FS_IOC_GETVERSION(0xffffffffffffffff, 0x80087601, 0x0) 01:59:41 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x3, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 645.427622][T18806] binder: 18803:18806 unknown command 0 [ 645.453608][T18806] binder: 18803:18806 ioctl c0306201 20000200 returned -22 01:59:41 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)={0x17, 0x0, 0x400000, 0x20, 0x14}, 0x40) [ 645.500592][T18806] binder: 18803:18806 unknown command 0 [ 645.522806][T18806] binder: 18803:18806 ioctl c0306201 20000200 returned -22 01:59:41 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:41 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x16, 0x0, 0x4, 0xbffe, 0x3401, 0x1}, 0x40) 01:59:41 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x7}, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) 01:59:41 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x6, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:41 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x300000000000000) [ 645.794027][T18828] binder: 18825:18828 unknown command 0 [ 645.832858][T18828] binder: 18825:18828 ioctl c0306201 20000200 returned -22 01:59:41 executing program 1: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x9, 0x3, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x63}}, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) 01:59:41 executing program 3: r0 = socket(0x1, 0x1, 0x0) sendmsg$AUDIT_TTY_SET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x44051) 01:59:41 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x7, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 645.870690][T18835] binder: 18825:18835 unknown command 0 [ 645.907715][T18835] binder: 18825:18835 ioctl c0306201 20000200 returned -22 01:59:41 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:41 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x400000000000000) 01:59:42 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB='#'], 0x4c}}, 0x0) [ 646.203233][T18846] binder: 18844:18846 unknown command 0 [ 646.228136][T18846] binder: 18844:18846 ioctl c0306201 20000200 returned -22 [ 646.251824][T18846] binder: 18844:18846 unknown command 0 [ 646.273521][T18846] binder: 18844:18846 ioctl c0306201 20000200 returned -22 01:59:43 executing program 4: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x3, &(0x7f0000000240)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x16) 01:59:43 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff) r2 = socket$inet6(0xa, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f0000001400)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_VLAN(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, r1, 0x1, 0x0, 0x0, {0x5}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}]}, 0x1c}}, 0x0) 01:59:43 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x8, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:43 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x500000000000000) 01:59:43 executing program 3: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0xd, &(0x7f00000004c0)={0x0, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) 01:59:43 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) [ 647.796209][T18867] binder: 18864:18867 unknown command 0 [ 647.833136][T18867] binder: 18864:18867 ioctl c0306201 20000200 returned -22 01:59:43 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'ipvlan0\x00', &(0x7f0000000000)=@ethtool_link_settings={0x8}}) 01:59:43 executing program 3: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x541b, &(0x7f00000002c0)={'ip6gre0\x00', 0x0}) 01:59:43 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0xb, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 647.889702][T18867] binder: 18864:18867 unknown command 0 [ 647.904737][T18867] binder: 18864:18867 ioctl c0306201 20000200 returned -22 01:59:43 executing program 4: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x4, &(0x7f00000004c0)={0x0, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) 01:59:43 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x600000000000000) 01:59:44 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:44 executing program 3: r0 = socket(0x10, 0x3, 0x0) sendmsg$ETHTOOL_MSG_TSINFO_GET(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="e0000000", @ANYRES16, @ANYBLOB="01"], 0xe0}}, 0x0) 01:59:44 executing program 1: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x8, &(0x7f00000004c0)={0x0, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) 01:59:44 executing program 4: r0 = openat$autofs(0xffffffffffffff9c, &(0x7f00000002c0), 0x101001, 0x0) write$tcp_mem(r0, 0x0, 0x0) [ 648.252218][T18888] binder: BINDER_SET_CONTEXT_MGR already set 01:59:44 executing program 3: r0 = io_uring_setup(0xf33, &(0x7f0000000100)) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1000002, 0x12, r0, 0x8000000) syz_io_uring_setup(0x6227, &(0x7f0000000000)={0x0, 0x0, 0x10, 0x1}, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000838000/0x3000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) 01:59:44 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 648.293941][T18888] binder: 18884:18888 ioctl 40046207 0 returned -16 [ 648.320771][T18892] binder: 18884:18892 unknown command 0 01:59:44 executing program 1: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x18, 0x0, 0x0) [ 648.356899][T18892] binder: 18884:18892 ioctl c0306201 20000200 returned -22 [ 648.369370][T18888] binder: BINDER_SET_CONTEXT_MGR already set [ 648.382978][T18888] binder: 18884:18888 ioctl 40046207 0 returned -16 01:59:44 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x8943, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) [ 648.427712][T18888] binder: 18884:18888 unknown command 0 [ 648.459077][T18888] binder: 18884:18888 ioctl c0306201 20000200 returned -22 [ 648.478332][T18892] binder_alloc: 18864: binder_alloc_buf, no vma 01:59:44 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:44 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:44 executing program 3: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x16, &(0x7f00000004c0)={0x0, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) [ 648.698275][T18907] binder: BINDER_SET_CONTEXT_MGR already set [ 648.731197][T18907] binder: 18906:18907 ioctl 40046207 0 returned -16 [ 648.766244][T18907] binder: 18906:18907 unknown command 0 [ 648.791486][T18907] binder: 18906:18907 ioctl c0306201 20000200 returned -22 [ 648.815078][T18907] binder: BINDER_SET_CONTEXT_MGR already set [ 648.827938][T18907] binder: 18906:18907 ioctl 40046207 0 returned -16 [ 648.847332][T18907] binder: 18906:18907 unknown command 0 [ 648.858637][T18907] binder: 18906:18907 ioctl c0306201 20000200 returned -22 [ 648.889238][T18907] binder_alloc: 18864: binder_alloc_buf, no vma 01:59:45 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x700000000000000) 01:59:45 executing program 1: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x9, &(0x7f00000004c0)={0x0, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) 01:59:45 executing program 3: mknodat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) stat(&(0x7f0000002880)='./file0\x00', &(0x7f00000028c0)) 01:59:45 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:45 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:45 executing program 4: r0 = socket$xdp(0x2c, 0x3, 0x0) sendmsg$xdp(0xffffffffffffffff, &(0x7f0000000740)={0x0, 0x0, 0x0}, 0x0) ioctl$sock_SIOCGPGRP(r0, 0x8901, &(0x7f0000000000)) [ 649.844611][T18925] binder: 18923:18925 unknown command 0 [ 649.870431][T18925] binder: 18923:18925 ioctl c0306201 20000200 returned -22 01:59:45 executing program 1: perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f00000001c0)) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x8, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {&(0x7f0000000080)="03", 0x1, 0x640}, {&(0x7f0000000040)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000010500)="7f000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff", 0x1002, 0x2000}, {&(0x7f0000012600)="ed41000010000000daf4655fdbf4655fdbf4655f00000000000004008000000000000800050000000af301000400000000000000000000000900000010", 0x3d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) r1 = creat(&(0x7f0000000400)='./file0/file1\x00', 0x188) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, 0x0) write$P9_RREADLINK(r1, &(0x7f00000003c0)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10) r2 = perf_event_open$cgroup(0x0, r1, 0x10, r1, 0x3) r3 = openat$vsock(0xffffffffffffff9c, &(0x7f0000004bc0), 0x0, 0x0) io_submit(0x0, 0x4, &(0x7f0000004c40)=[&(0x7f0000004840)={0x0, 0x0, 0x0, 0x1, 0x6e, 0xffffffffffffffff, &(0x7f0000004740)="0a0952b83895e5326fe5cd3fbc6022d8e28ec0092804f42e57d3805146fde64788dd004b75953bf77d56f2a1d0c7b7fdba0d647b80270385957a49dc171db7dc62bf4801054053a8734cd638825773eb601c7624d5c885fa5ef95e16d431add1b2bc578e205c97fa72b4771caf054c9096e7c9fe6c9ca7443f40aa247e19b6ab0198e417a019c7e0a65ef9371e122df7bedea0776b865db3a171a0b30d3b89fd44abfc5aa93c340a6426361eecd21b983b357ff4a3569dfd1e4c82e85e096499e72d11574a", 0xc5, 0x4, 0x0, 0x3}, &(0x7f00000048c0)={0x0, 0x0, 0x0, 0x2, 0x6, 0xffffffffffffffff, &(0x7f0000004880)="691948c63c4e7c929f3cddf1d3b2440506cdd5fba20a337a", 0x18, 0x1, 0x0, 0x3}, &(0x7f0000004a80)={0x0, 0x0, 0x0, 0x3, 0x24, 0xffffffffffffffff, &(0x7f0000004940)="850a434de14800e959ecf867ebd9ab9da769108881bca3daa3c65d1a95aedb2638917115537b538568dfb67c1e55a29f26766719de85cbf8fea12fbf59ef1a9bd060773e88047d99e5634f70cf33bcb1329007cb375b7201f4777142cd39716c3dfdd0220a4149116884948bf3f45d7675a42859c9f226f261b621cfd3203ea578b14e4161e3b3db7e058199c8d6471cf6c52e49b2e986fb6f28059cf57af935a19ef0bbdb4038d28dea3cd18b723423aab7631c3ea2bdf9f24a9e99a97709c8a5594d7898e89f66af19cc403732d2930a190a50b1dff9c7defc0357282ad956427e9a963a178e3f6b559f36156e9c545fe33805fd303c", 0xf7, 0x7, 0x0, 0x2}, &(0x7f0000004c00)={0x0, 0x0, 0x0, 0x7, 0x6, r2, &(0x7f0000004ac0)="3fa311b14486c6979f7cd872b8bbbdedc021a2e99016220f75b9bf235e21fcf3715e4190ee19e00c81846d50cc45723b992d3f8da4129d39c1044bf804acbc201da3ed6a542e17087456446b742eb2ef2619fb7274f57ca46cb471b062b508d6c767cf91fe94171aa84f21ffebd30f400513c044495a05122641a6affb8ffb014393bc52cf1d3961f7c3928318f03881e79b0481b811c78671b461f6a41fcffbb7cda8f39905fd001eef6a9fa52d11ad81b0a5dce6758b513b481e1ccf29e8afadb29d0f671cafd444be9f", 0xcb, 0x16c, 0x0, 0x2, r3}]) write$cgroup_type(r1, &(0x7f00000009c0), 0xd4ba0ff) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(r2, 0x40082404, &(0x7f00000004c0)=0x1000) getsockname$packet(0xffffffffffffffff, 0x0, &(0x7f00000002c0)) openat$ptp0(0xffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDEL6RD(0xffffffffffffffff, 0x89fa, &(0x7f00000005c0)={'syztnl0\x00', &(0x7f0000000540)={'syztnl2\x00', 0x0, 0x4, 0x2, 0x69, 0x0, 0x4, @mcast1, @loopback, 0x40, 0x8000, 0x4, 0x2}}) sendmsg$nl_route(r1, &(0x7f0000000680)={&(0x7f0000000500), 0xc, &(0x7f0000000640)={&(0x7f0000000600)=@dellinkprop={0x20, 0x6d, 0x100, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x18010, 0x400}}, 0x20}}, 0x0) 01:59:45 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:45 executing program 3: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000000180)={&(0x7f0000000080), 0xc, &(0x7f0000000140)={0x0}}, 0x0) [ 649.917253][T18925] binder: 18923:18925 unknown command 0 [ 649.930863][T18925] binder: 18923:18925 ioctl c0306201 20000200 returned -22 01:59:45 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:45 executing program 4: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xd, &(0x7f0000000800)=ANY=[@ANYBLOB="180000000100000000000000a09b00006572e0ff"], &(0x7f0000000300)='GPL\x00', 0x6, 0x93, &(0x7f0000000340)=""/147, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) 01:59:46 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x800000000000000) 01:59:46 executing program 3: r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_udp_int(r0, 0x11, 0x1, 0x0, &(0x7f0000000100)) 01:59:46 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 650.171220][T18940] loop1: detected capacity change from 0 to 4096 [ 650.292332][T18949] binder: 18945:18949 unknown command 0 01:59:46 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x2, 0x0, 0x1}, 0x49) [ 650.344575][T18949] binder: 18945:18949 ioctl c0306201 20000200 returned -22 [ 650.373128][T18952] binder: 18945:18952 unknown command 0 [ 650.432510][T18952] binder: 18945:18952 ioctl c0306201 20000200 returned -22 01:59:46 executing program 3: r0 = socket$xdp(0x2c, 0x3, 0x0) ioctl$sock_SIOCGPGRP(r0, 0x8982, &(0x7f0000000000)) 01:59:46 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:46 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x2, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 650.727763][T18940] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 650.802104][T18969] binder: 18963:18969 unknown command 0 [ 650.855652][T18969] binder: 18963:18969 ioctl c0306201 20000200 returned -22 [ 650.886130][T18969] binder: 18963:18969 unknown command 0 [ 650.891723][T18969] binder: 18963:18969 ioctl c0306201 20000200 returned -22 01:59:47 executing program 1: r0 = socket$xdp(0x2c, 0x3, 0x0) mmap$xdp(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x11, r0, 0x0) mmap$xdp(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x11, r0, 0x0) 01:59:47 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x1f00000000000000) 01:59:47 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x3, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:47 executing program 4: r0 = socket$xdp(0x2c, 0x3, 0x0) r1 = socket$xdp(0x2c, 0x3, 0x0) mmap$xdp(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x0, 0x12, r1, 0x0) mmap$xdp(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x11, r0, 0x0) 01:59:47 executing program 3: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000300)={{0x2, 0x0, @empty}, {0x0, @remote}, 0x0, {0x2, 0x0, @empty}, 'vlan1\x00'}) 01:59:47 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) [ 651.473380][T18986] binder: 18982:18986 unknown command 0 01:59:47 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 651.514228][T18986] binder: 18982:18986 ioctl c0306201 20000200 returned -22 01:59:47 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f2, &(0x7f0000000080)={'ip6tnl0\x00', &(0x7f0000000000)={'syztnl2\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr=' \x01\x00', @private0={0xfc, 0x0, '\x00', 0x1}}}) r3 = openat$full(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) syz_genetlink_get_family_id$wireguard(&(0x7f0000000a80), r3) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f00000000c0)={'syztnl0\x00', &(0x7f0000000040)={'sit0\x00', 0x0, 0x4, 0x5, 0x6, 0xe06, 0x10, @empty, @ipv4={'\x00', '\xff\xff', @empty}, 0x7, 0x50, 0x52}}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x5452, &(0x7f0000000000)={'ip6gre0\x00', 0x0}) r4 = openat$full(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) syz_io_uring_setup(0x3ebd, 0x0, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000009c0)=0x0, 0x0) syz_io_uring_submit(r5, 0x0, &(0x7f0000000ac0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000a80)='./file0\x00', 0x0, 0x0, 0x12345}, 0x7) r6 = openat$full(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) syz_genetlink_get_family_id$wireguard(&(0x7f0000000a80), r6) syz_io_uring_submit(r5, 0x0, &(0x7f00000001c0)=@IORING_OP_FALLOCATE={0x11, 0x4, 0x0, @fd=r6, 0x1, 0x0, 0x7f, 0x0, 0x1}, 0x1) syz_genetlink_get_family_id$wireguard(&(0x7f0000000a80), r4) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r4, 0x89f8, &(0x7f0000000180)={'ip6_vti0\x00', &(0x7f0000000100)={'ip6_vti0\x00', r2, 0x4, 0x0, 0x1e, 0x3, 0x20, @dev={0xfe, 0x80, '\x00', 0x15}, @dev={0xfe, 0x80, '\x00', 0xc}, 0x7800, 0x8000, 0x7, 0xffffffff}}) 01:59:47 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={&(0x7f0000000000), 0x4, &(0x7f00000000c0)={&(0x7f0000000040)=@delneigh={0x40, 0x1d, 0x0, 0x0, 0x0, {}, [@NDA_LLADDR={0xa, 0x2, @dev}, @NDA_PORT, @NDA_DST_IPV4={0x8, 0x1, @broadcast}, @NDA_PORT={0x6}]}, 0x40}}, 0x0) [ 651.565990][T18991] binder: 18982:18991 unknown command 0 [ 651.600492][T18991] binder: 18982:18991 ioctl c0306201 20000200 returned -22 [ 651.611317][T18986] binder: 18982:18986 ioctl c0306201 0 returned -14 01:59:47 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x8000000000000000) 01:59:47 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:47 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x2, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 651.904921][T19008] binder: 19004:19008 unknown command 0 [ 651.941562][T19008] binder: 19004:19008 ioctl c0306201 20000200 returned -22 01:59:47 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x8901, &(0x7f00000002c0)={'ip6gre0\x00', 0x0}) 01:59:47 executing program 3: r0 = io_uring_setup(0x5685, &(0x7f0000000300)={0x0, 0x0, 0x10}) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000004, 0x11, r0, 0x8000000) 01:59:47 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x5, 0x400, 0x1e00, 0x8}, 0x40) [ 651.966185][T19010] binder: 19004:19010 unknown command 0 [ 651.971964][T19010] binder: 19004:19010 ioctl c0306201 20000200 returned -22 [ 652.010664][T19008] binder: 19004:19008 ioctl c0306201 0 returned -14 01:59:48 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0xff00000000000000) 01:59:48 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x3, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:48 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:48 executing program 4: bpf$MAP_CREATE(0x15, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x40) 01:59:48 executing program 3: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000002180)={0xffffffffffffffff, 0xffffffffffffffff}) recvmmsg(r0, &(0x7f00000006c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x20e2, 0x0) 01:59:48 executing program 1: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x13, &(0x7f00000004c0)={0x0, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) 01:59:48 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x6, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 652.288836][T19027] binder: 19022:19027 unknown command 0 [ 652.325427][T19027] binder: 19022:19027 ioctl c0306201 20000200 returned -22 01:59:48 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x5, 0x400, 0x65d, 0x8}, 0x40) [ 652.358697][T19032] binder: 19022:19032 unknown command 0 [ 652.388748][T19032] binder: 19022:19032 ioctl c0306201 20000200 returned -22 01:59:48 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0xffff1f0000000000) 01:59:48 executing program 3: r0 = syz_io_uring_setup(0x360c, &(0x7f0000000240), &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f00000002c0), &(0x7f0000000300)) r1 = io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) io_uring_register$IORING_UNREGISTER_PERSONALITY(r0, 0xa, 0x0, r1) [ 652.408913][T19027] binder: 19022:19027 ioctl c0306201 0 returned -14 01:59:48 executing program 1: r0 = syz_io_uring_setup(0x360c, &(0x7f0000000240), &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f00000002c0), &(0x7f0000000300)) io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) io_uring_register$IORING_UNREGISTER_PERSONALITY(r0, 0xa, 0x0, 0x0) 01:59:48 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:48 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x7, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:48 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000080)={0x17, 0x0, 0x3ff, 0x20, 0x4}, 0x40) 01:59:48 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000000080)={'ip6tnl0\x00', &(0x7f0000000000)={'syztnl2\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr=' \x01\x00', @private0={0xfc, 0x0, '\x00', 0x1}}}) r3 = openat$full(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) syz_genetlink_get_family_id$wireguard(&(0x7f0000000a80), r3) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f00000000c0)={'syztnl0\x00', &(0x7f0000000040)={'sit0\x00', 0x0, 0x4, 0x5, 0x6, 0xe06, 0x10, @empty, @ipv4={'\x00', '\xff\xff', @empty}, 0x7, 0x50, 0x52}}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x5452, &(0x7f0000000000)={'ip6gre0\x00', 0x0}) r4 = openat$full(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) syz_io_uring_setup(0x3ebd, 0x0, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000009c0)=0x0, 0x0) syz_io_uring_submit(r5, 0x0, &(0x7f0000000ac0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000a80)='./file0\x00', 0x0, 0x0, 0x12345}, 0x7) r6 = openat$full(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) syz_genetlink_get_family_id$wireguard(&(0x7f0000000a80), r6) syz_io_uring_submit(r5, 0x0, &(0x7f00000001c0)=@IORING_OP_FALLOCATE={0x11, 0x4, 0x0, @fd=r6, 0x1, 0x0, 0x7f, 0x0, 0x1}, 0x1) syz_genetlink_get_family_id$wireguard(&(0x7f0000000a80), r4) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r4, 0x89f8, &(0x7f0000000180)={'ip6_vti0\x00', &(0x7f0000000100)={'ip6_vti0\x00', r2, 0x4, 0x0, 0x1e, 0x3, 0x20, @dev={0xfe, 0x80, '\x00', 0x15}, @dev={0xfe, 0x80, '\x00', 0xc}, 0x7800, 0x8000, 0x7, 0xffffffff}}) [ 652.687771][T19048] binder: 19044:19048 unknown command 0 01:59:48 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0xffffffff00000000) [ 652.728095][T19048] binder: 19044:19048 ioctl c0306201 20000200 returned -22 [ 652.764377][T19052] binder: 19044:19052 unknown command 0 01:59:48 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x5, 0x400, 0x1e, 0x8}, 0x40) 01:59:48 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x8, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 652.798419][T19052] binder: 19044:19052 ioctl c0306201 20000200 returned -22 01:59:48 executing program 4: pkey_mprotect(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x4, 0xffffffffffffffff) r0 = socket$xdp(0x2c, 0x3, 0x0) mmap$xdp(&(0x7f0000ffb000/0x4000)=nil, 0x4002, 0x0, 0x11, r0, 0x0) 01:59:48 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:48 executing program 3: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x9, 0x3, &(0x7f0000000080)=@framed={{0x18, 0xe}}, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) 01:59:48 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x5, 0x400, 0x18, 0x8}, 0x40) 01:59:49 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0xb, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:49 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x1, 0x401, "ed105400000000003ec1010001003bab137ccff52bf9aafadb7adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x2}, 0x6) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r5, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) read(r2, &(0x7f0000000240)=""/199, 0xc7) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x46, 0x0, 0x0) 01:59:49 executing program 4: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000580), 0x0, 0x0) ioctl$RTC_AIE_OFF(r0, 0x7002) [ 653.101827][T19073] binder: 19072:19073 unknown command 0 [ 653.131311][T19073] binder: 19072:19073 ioctl c0306201 20000200 returned -22 [ 653.172328][T19077] binder: 19072:19077 unknown command 0 [ 653.199891][T19077] binder: 19072:19077 ioctl c0306201 20000200 returned -22 01:59:49 executing program 3: syz_genetlink_get_family_id$ieee802154(0x0, 0xffffffffffffffff) r0 = socket$xdp(0x2c, 0x3, 0x0) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f0000001000)={&(0x7f0000000000)=""/4096, 0x104b000, 0x1000}, 0x20) setsockopt$XDP_RX_RING(r0, 0x11b, 0x2, &(0x7f0000001040)=0x1000, 0x4) mmap$xdp(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x11, r0, 0x0) 01:59:49 executing program 1: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0xe, &(0x7f00000004c0)={0x0, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) 01:59:49 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:49 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:49 executing program 4: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x19, 0xd, 0x0, &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) [ 653.441280][T19093] binder: 19090:19093 unknown command 0 [ 653.459068][T19093] binder: 19090:19093 ioctl c0306201 20000200 returned -22 01:59:49 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0xc01047d0, 0x0) [ 653.515224][T19093] binder: 19090:19093 unknown command 0 [ 653.541629][T19093] binder: 19090:19093 ioctl c0306201 20000200 returned -22 01:59:49 executing program 3: r0 = socket$xdp(0x2c, 0x3, 0x0) pkey_mprotect(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0xffffffffffffffff) setsockopt$XDP_RX_RING(r0, 0x11b, 0x2, &(0x7f0000001040)=0x1000, 0x4) mmap$xdp(&(0x7f0000ffb000/0x4000)=nil, 0x20000, 0x0, 0x11, r0, 0x0) 01:59:49 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x2, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:49 executing program 4: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x9, 0x3, &(0x7f0000000080)=@framed={{0x18, 0x9}}, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) 01:59:49 executing program 3: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x8990, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) 01:59:50 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x111480) ioctl$EVIOCSKEYCODE_V2(r0, 0x40284504, &(0x7f0000000040)={0xff, 0x1f, 0x2, 0xbe, "6447bc14ce568e4290bf184da2db25bc3a79930294a915f442427126efbbbf81"}) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) ioctl$EVIOCSCLOCKID(r0, 0x400445a0, &(0x7f0000000080)=0xff) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) 01:59:50 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:50 executing program 1: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x0, 0x20000396, 0x0, &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) 01:59:50 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000080)={0xf, 0x0, 0x0, 0x20}, 0x40) 01:59:50 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:50 executing program 4: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x2, &(0x7f00000004c0)={0x0, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) 01:59:50 executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}) write$FUSE_NOTIFY_INVAL_ENTRY(r0, &(0x7f0000000300)={0x37, 0x3, 0x0, {0x1, 0x16, 0x0, 'trusted.overlay.upper\x00'}}, 0x37) 01:59:50 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x6, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:50 executing program 4: fork() waitid(0x0, 0x0, 0x0, 0x2, 0x0) 01:59:50 executing program 1: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x1e, 0x0, 0x0) [ 654.552708][T19137] binder: 19131:19137 unknown command 0 [ 654.578013][T19137] binder: 19131:19137 ioctl c0306201 20000200 returned -22 01:59:50 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000040)={0xffffffffffffffff, 0x8, "db89b7", 0xff, 0x4}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$EVIOCGPHYS(r0, 0x80404507, &(0x7f0000000140)=""/249) 01:59:50 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x7, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 654.620764][T19146] binder: 19131:19146 unknown command 0 [ 654.644632][T19146] binder: 19131:19146 ioctl c0306201 20000200 returned -22 01:59:50 executing program 3: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000880)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000900)={0x0}}, 0x20040001) 01:59:50 executing program 1: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x9, 0x9, &(0x7f0000000140)=@framed={{}, [@func, @ldst, @call, @map, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffffa}]}, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) 01:59:50 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:50 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x8, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:50 executing program 0: syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r0, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) [ 654.905336][T19162] binder: 19159:19162 unknown command 0 [ 654.922736][T19162] binder: 19159:19162 ioctl c0306201 20000200 returned -22 01:59:50 executing program 1: fanotify_init(0x40, 0x0) 01:59:50 executing program 3: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x2, 0x4, &(0x7f0000000000)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x19}]}, &(0x7f0000000040)='GPL\x00', 0x7, 0xb4, &(0x7f0000000140)=""/180, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) [ 654.986815][T19162] binder: 19159:19162 unknown command 0 [ 655.018812][T19162] binder: 19159:19162 ioctl c0306201 20000200 returned -22 01:59:50 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0xb, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:51 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCSIFBR(r0, 0x8941, &(0x7f0000000040)=@add_del={0x2, &(0x7f0000000000)='caif0\x00'}) 01:59:51 executing program 4: getitimer(0x2, &(0x7f0000002980)) 01:59:51 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x3, 0xffffffffffffffff, 0x3d) 01:59:51 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x48, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:51 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 01:59:51 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:51 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000), 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:51 executing program 1: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0xe, 0x0, 0x0) 01:59:51 executing program 3: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0xc, 0x0, 0x0) 01:59:51 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) write$evdev(r0, &(0x7f0000000140)=[{{}, 0x0, 0x7fff, 0x8}, {{r1, r2/1000+60000}, 0x16, 0x33, 0x2000c}, {{0x0, 0xea60}, 0x16, 0x2, 0x5}, {{0x0, 0xea60}, 0x4, 0xb3bc, 0x9}, {{}, 0x3, 0x1ff, 0x5}, {{}, 0x16, 0x800}, {{r3, r4/1000+60000}, 0x17, 0x8, 0x2}], 0xa8) recvmmsg(0xffffffffffffffff, &(0x7f00000003c0)=[{{&(0x7f0000000200)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev}}}, 0x80, &(0x7f0000000280)=[{&(0x7f0000000480)=""/4096, 0x1000}], 0x1, &(0x7f00000002c0)=""/224, 0xe0}}], 0x1, 0x100, &(0x7f0000000400)={0x77359400}) clock_gettime(0x6, &(0x7f00000000c0)) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r5, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) 01:59:51 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x19, &(0x7f0000000040)=0x1, 0x4) 01:59:51 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0xf0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:51 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000100)={0xb}, 0x40) 01:59:51 executing program 3: bpf$MAP_UPDATE_ELEM(0x1a, 0x0, 0x0) [ 655.977065][T19207] binder: 19204:19207 unknown command 0 [ 655.982752][T19207] binder: 19204:19207 ioctl c0306201 20000200 returned -22 01:59:51 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_buf(r0, 0x1, 0x23, 0x0, &(0x7f0000000240)) 01:59:51 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x300, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 656.050441][T19214] binder: 19204:19214 unknown command 0 01:59:52 executing program 0: ioctl$DRM_IOCTL_MODE_CREATE_LEASE(0xffffffffffffffff, 0xc01864c6, &(0x7f0000000080)={&(0x7f0000000040)=[0x5, 0x9b95, 0x80, 0xcfd7, 0x8, 0x8], 0x6, 0x80000, 0x0, 0xffffffffffffffff}) pipe(&(0x7f0000000240)={0xffffffffffffffff}) r2 = socket$inet(0x10, 0x2, 0x0) setsockopt$PNPIPE_ENCAP(r1, 0x113, 0x1, &(0x7f0000000280), 0x4) r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f00000001c0), 0x101400, 0x0) setsockopt$inet_mtu(r3, 0x0, 0xa, &(0x7f0000000200), 0x4) splice(r1, 0x0, r2, 0x0, 0x84ffe5, 0x0) ioctl$DRM_IOCTL_IRQ_BUSID(r1, 0xc0106403, &(0x7f0000000140)={0x25e0100f, 0x5, 0x6f79939b, 0x101}) ioctl$PTP_PEROUT_REQUEST(r0, 0x40383d03, &(0x7f00000000c0)={{0x7, 0x3}, {0x800, 0x1}, 0x81, 0x1}) syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) r4 = openat(r0, &(0x7f0000000180)='./file0\x00', 0x72b142, 0x8e) ioctl$EVIOCSKEYCODE_V2(r4, 0x80104592, &(0x7f0000000000)={0x3, 0x16, 0x2000, 0x401, "ed105400000007003ec1010000003bab137ccff52ba2bdfe407abb7ec6399700"}) getsockopt$bt_BT_FLUSHABLE(r1, 0x112, 0x8, &(0x7f00000002c0)=0x2, &(0x7f0000000300)=0x4) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r5, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) [ 656.103199][T19214] binder: 19204:19214 ioctl c0306201 20000200 returned -22 01:59:52 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_buf(r0, 0x1, 0x26, 0x0, &(0x7f0000000240)) 01:59:52 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:52 executing program 1: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000340)={'ip6gre0\x00', 0x0}) 01:59:52 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x600, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:52 executing program 4: r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) getsockopt$sock_buf(r0, 0x1, 0x1f, 0x0, &(0x7f00000001c0)) 01:59:52 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000100), 0x4) 01:59:52 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_buf(r0, 0x1, 0x22, 0x0, &(0x7f0000000240)) [ 656.381021][T19232] binder: 19228:19232 unknown command 0 01:59:52 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt(r0, 0x0, 0x0, 0x0, 0x0) 01:59:52 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x700, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 656.451279][T19237] binder: 19228:19237 unknown command 0 [ 656.454130][T19232] binder: 19228:19232 ioctl c0306201 20000200 returned -22 [ 656.476210][T19237] binder: 19228:19237 ioctl c0306201 20000200 returned -22 01:59:52 executing program 3: r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000000000)) 01:59:52 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) [ 656.706083][T19250] binder: 19248:19250 unknown command 0 [ 656.712062][T19250] binder: 19248:19250 ioctl c0306201 20000200 returned -22 [ 656.741219][T19250] binder: 19248:19250 unknown command 0 [ 656.754662][T19250] binder: 19248:19250 ioctl c0306201 20000200 returned -22 01:59:53 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) process_vm_writev(0x0, &(0x7f00000003c0)=[{&(0x7f0000000040)=""/147, 0x93}, {&(0x7f0000000140)=""/45, 0x2d}, {&(0x7f0000000180)=""/206, 0xce}, {&(0x7f0000000280)=""/23, 0x17}, {&(0x7f00000002c0)=""/247, 0xf7}, {&(0x7f0000000480)=""/221, 0xdd}, {&(0x7f0000000580)=""/248, 0xf8}], 0x7, &(0x7f0000001b00)=[{&(0x7f0000000680)=""/104, 0x68}, {&(0x7f0000000700)=""/16, 0x10}, {&(0x7f0000000740)=""/61, 0x3d}, {&(0x7f0000000780)=""/187, 0xbb}, {&(0x7f0000000840)=""/64, 0x40}, {&(0x7f0000000880)=""/99, 0x63}, {&(0x7f0000000900)=""/222, 0xde}, {&(0x7f0000000a00)=""/4096, 0x1000}, {&(0x7f0000001a00)=""/199, 0xc7}], 0x9, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) 01:59:53 executing program 1: socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_genetlink_get_family_id$team(0x0, 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, 0x0) sendmsg$TEAM_CMD_PORT_LIST_GET(0xffffffffffffffff, &(0x7f0000000f80)={0x0, 0x0, &(0x7f0000000f40)={&(0x7f0000000700)={0x6c, r0, 0x1, 0x0, 0x0, {}, [{{0x8}, {0x44, 0x2, 0x0, 0x1, [{0x40, 0x1, @name={{0x24}, {0x5}, {0x10, 0x4, 'loadbalance\x00'}}}]}}, {{0x8}, {0x4}}]}, 0x6c}}, 0x0) sendmsg$TEAM_CMD_PORT_LIST_GET(0xffffffffffffffff, &(0x7f0000000f80)={0x0, 0x0, &(0x7f0000000f40)={&(0x7f0000000700)={0x6c, 0x0, 0x1, 0x0, 0x0, {}, [{{0x8}, {0x44, 0x2, 0x0, 0x1, [{0x40, 0x1, @name={{0x24}, {0x5}, {0x10, 0x4, 'loadbalance\x00'}}}]}}, {{0x8}, {0x4}}]}, 0x6c}}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f00000006c0)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_PORT_LIST_GET(r1, &(0x7f0000000f80)={0x0, 0x0, &(0x7f0000000f40)={&(0x7f0000000700)={0x6c, 0x0, 0x1, 0x0, 0x0, {}, [{{0x8}, {0x44, 0x2, 0x0, 0x1, [{0x40, 0x1, @name={{0x24}, {0x5}, {0x10, 0x4, 'loadbalance\x00'}}}]}}, {{0x8, 0x1, r2}, {0x4}}]}, 0x6c}}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$team(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f0000000f80)={0x0, 0x0, &(0x7f0000000f40)={&(0x7f0000000700)={0x6c, r4, 0x1, 0x0, 0x25dfdbfd, {}, [{{0x8}, {0x44, 0x2, 0x0, 0x1, [{0x40, 0x1, @notify_peers_interval={{}, {}, {0x0, 0x4, 0x80000001}}}]}}, {{0x8}, {0x4}}]}, 0x6c}}, 0x0) 01:59:53 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_buf(r0, 0x1, 0x2e, 0x0, &(0x7f0000000240)) 01:59:53 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0xb00, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:53 executing program 3: openat$procfs(0xffffffffffffff9c, &(0x7f0000000300)='/proc/stat\x00', 0x0, 0x0) 01:59:53 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:53 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_percpu_sys\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000080)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x28011, r0, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0x8b, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x60000b, 0x9) 01:59:53 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x1f00, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 657.357211][T19266] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. [ 657.359837][T19267] binder: 19258:19267 unknown command 0 01:59:53 executing program 3: syz_io_uring_setup(0x431b, &(0x7f0000000000)={0x0, 0x0, 0x60}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x4000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) [ 657.405940][T19267] binder: 19258:19267 ioctl c0306201 20000200 returned -22 [ 657.421386][T19271] binder: 19258:19271 unknown command 0 [ 657.428891][T19272] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. [ 657.442921][T19271] binder: 19258:19271 ioctl c0306201 20000200 returned -22 01:59:53 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x0, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:53 executing program 1: msgctl$IPC_RMID(0x0, 0x0) msgrcv(0x0, 0x0, 0x0, 0x0, 0x5800) 01:59:53 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x2, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) 01:59:53 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x3f00, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:53 executing program 3: syz_io_uring_setup(0x1be0, &(0x7f00000002c0), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000180), &(0x7f0000000340)) 01:59:53 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt(r0, 0x3, 0x0, 0x0, 0x0) 01:59:53 executing program 1: syz_open_dev$vcsn(&(0x7f0000000080), 0x0, 0x80200) [ 657.854986][T19287] binder: 19283:19287 unknown command 0 [ 657.880981][T19287] binder: 19283:19287 ioctl c0306201 20000200 returned -22 01:59:53 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 657.935029][T19292] binder: 19283:19292 unknown command 0 [ 657.970211][T19292] binder: 19283:19292 ioctl c0306201 20000200 returned -22 01:59:53 executing program 0: syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x18000, 0x0) recvmsg$can_j1939(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000040)=""/76, 0x4c}, {&(0x7f00000000c0)=""/48, 0x30}, {&(0x7f0000000140)=""/206, 0xce}, {&(0x7f0000000240)=""/52, 0x34}, {&(0x7f0000000280)=""/208, 0xd0}], 0x5, &(0x7f0000000400)=""/20, 0x14}, 0x40000000) syz_kvm_setup_cpu$x86(r0, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) 01:59:53 executing program 3: r0 = openat$zero(0xffffffffffffff9c, &(0x7f000000e340), 0x0, 0x0) fsetxattr$trusted_overlay_redirect(r0, &(0x7f0000000000), 0x0, 0x0, 0x3) 01:59:54 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x0, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:54 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xa, &(0x7f0000000000), 0x4) 01:59:54 executing program 1: r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x0) fsetxattr$trusted_overlay_redirect(r0, &(0x7f0000000180), 0x0, 0x0, 0x2) 01:59:54 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x4800, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 658.285270][T19306] binder: 19302:19306 unknown command 0 [ 658.316947][T19306] binder: 19302:19306 ioctl c0306201 20000200 returned -22 01:59:54 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x2c, &(0x7f0000000040), 0x4) [ 658.357983][T19311] binder: 19302:19311 unknown command 0 01:59:54 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=@newtclass={0x24, 0x28, 0x1}, 0x24}}, 0x0) [ 658.399102][T19311] binder: 19302:19311 ioctl c0306201 20000200 returned -22 01:59:54 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x4f, 0x0, 0x100, 0x402, "ed105c00000000003ec10100407adb7ec6389700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r5, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r6, r9, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) ioctl$BTRFS_IOC_LOGICAL_INO(r6, 0xc0389424, &(0x7f0000000180)={0x7, 0x40, '\x00', 0x0, &(0x7f0000000140)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r1, &(0x7f00000001c0)=ANY=[@ANYBLOB="211dee91230880d1f2040dc8007ba6dfa871f73dec27b533aa254342401035dd310026e37e07cba3d7a62a3503e0ab1353ab"], 0x6) 01:59:54 executing program 1: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x4, &(0x7f0000000080)=@framed={{0x18, 0xa}, [@ldst={0x3, 0x0, 0x3}]}, &(0x7f0000000040)='GPL\x00', 0x7, 0xb4, &(0x7f0000000140)=""/180, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) 01:59:54 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x0, 0x0, &(0x7f0000000040)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:54 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x5c00, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:54 executing program 3: pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_mount_image$fuse(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000']) 01:59:54 executing program 4: syz_mount_image$fuse(0x0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) move_mount(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0xffffffffffffffff, 0x0, 0x0) [ 658.811815][T19330] binder: 19321:19330 unknown command 0 [ 658.850394][T19330] binder: 19321:19330 ioctl c0306201 20000200 returned -22 01:59:54 executing program 1: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000140)="66530700ae897094e7b126b097eaa769be6d05c41bd34e677d114b654b499374a8db38f8c44f7b7d9ce423c26f45958dc387cf4c2e1fea4b7a3dfc8ea6a7efefe48dd9e05485b4ff15f715134d82ce9c0952d644157684e3dae491de7642a7c52cc2d523be91b5877341e0e1dcc2025aa18c9228103b66e1d49d31d322dbecfa63da44", 0x83}], 0x4, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x34) ptrace$cont(0x18, r0, 0x0, 0x0) write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000080)={0x78}, 0x78) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) 01:59:54 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0xf000, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:54 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_GET_SUPPORTED_CPUID(r0, 0xc008ae05, &(0x7f0000000080)=""/4096) [ 658.885501][T19336] binder: 19321:19336 unknown command 0 [ 658.913767][T19336] binder: 19321:19336 ioctl c0306201 20000200 returned -22 01:59:54 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:54 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8949, &(0x7f0000000040)={'ipvlan0\x00', 0x0}) 01:59:55 executing program 3: r0 = socket$inet(0x2, 0x3, 0x7) setsockopt(r0, 0x0, 0x0, 0x0, 0x0) [ 659.152661][T19353] ptrace attach of "/root/syz-executor.1"[19350] was attempted by "/root/syz-executor.1"[19353] [ 659.194288][T19355] binder: 19346:19355 unknown command 0 [ 659.209725][T19355] binder: 19346:19355 ioctl c0306201 20000200 returned -22 01:59:55 executing program 0: ioctl$F2FS_IOC_RESIZE_FS(0xffffffffffffffff, 0x4008f510, &(0x7f0000000040)=0x5771) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f0000000080)={0x0, 0x81, 0x20}, 0xc) write$eventfd(0xffffffffffffffff, &(0x7f00000000c0)=0xfffffffffffffffb, 0x8) ioctl$SG_GET_ACCESS_COUNT(0xffffffffffffffff, 0x2289, &(0x7f0000000140)) ioctl$EVIOCSKEYCODE_V2(0xffffffffffffffff, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r0, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) 01:59:55 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x9, &(0x7f0000000040), 0x4) 01:59:55 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 659.246357][T19355] binder: 19346:19355 unknown command 0 [ 659.276470][T19355] binder: 19346:19355 ioctl c0306201 20000200 returned -22 01:59:55 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000000), 0x0, 0x0) ioctl$BLKDISCARD(r0, 0x1277, 0x0) 01:59:55 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000100), 0x0, 0x0) ioctl$sock_TIOCINQ(r0, 0x541b, &(0x7f0000001380)) 01:59:55 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:55 executing program 1: bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x7800) 01:59:55 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 659.564414][T19372] binder: 19371:19372 unknown command 0 [ 659.586810][T19372] binder: 19371:19372 ioctl c0306201 20000200 returned -22 01:59:55 executing program 3: perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0x8a, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) eventfd(0x0) 01:59:55 executing program 4: set_mempolicy(0x3, &(0x7f00000000c0)=0xf8, 0x7fff) [ 659.624334][T19372] binder: 19371:19372 unknown command 0 [ 659.661804][T19372] binder: 19371:19372 ioctl c0306201 20000200 returned -22 01:59:55 executing program 0: syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000004300)='/proc/tty/ldiscs\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) sendmmsg(r0, &(0x7f0000004340)=[{{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000000)="c8e64cded20e04e1bc44ac1c93d26094e4a78e8d8219e89f4a73621def1c217c90eb161b39c6a172653e82fb88282a8a5e880a75410ac3f5895fa1626a8f94e58bba8c4d554f5e298381cebbdb71757ed79b4676a95c5841e85e8cb918bf216ee4d3217f3faa8c042f43ce343fd13a771929c716cce416763cba7b5203781da1efe499f5f99819b598fc40b5e5e7480aacffbf797938e1841309b5d02a59a999e9b646ebd8dc7f86e7f4ac3088796a8a6232c37a16c46744b4262a189991e6d8e944f7ceb48c50640541867c1c179fec870f82", 0xd3}, {&(0x7f0000000140)="81bfa765167436ba26a9aec8b43102461b81367448e833dee75f74ae3f332dd18c74d1982a721498a2d868e02733fd3362a12eff5d2574e168786c562aa18e5c9fe9b319a29407141d8b0d7a61d8cabc4412bc0af0575bb86937f1cedfec6b5395a507622b005d8e3bd168cb", 0x6c}, {&(0x7f00000001c0)="ce0326894807e6a8ac34cc278a63e0b03b74536376a49da0c0d7f8c07840420b167887e07b163f990445b734a6b8b8b6f597876f790799f87db80bee4ea5afa2326226989ec27aaa693f225b9e1455b7a434a896667417f17315a925e6f3c52c02d3469cbc6a74cd5e7cc14a714f4acd77ad5d34530434bba80076e22e13ba178dc61d4bc0aa40e69d7c05904ad4cdbbc13ffc735e32a1f698f2b56cdb50ba41a94e5e4ccb31152d254d208e6cc66efe18bcfe2821a0b180d0985b2980f550af2009532936e211a4b3310928ebf37a30c795f2a23efc8a44ad1a916c2368761cd6230544bef47ca4df7e8fb3b5e6189f7332", 0xf2}, {&(0x7f00000002c0)="40c5be557b857c1f275627a4b4414a9d28b456874260b006773c527ba399ef642401a68380fcb2736936efb51c30970f9338700054bc9f4f05c35cf4b6c2fa4298065bbb80d6a24bc2f27f5868fcc5f1748fc223071693f8c4e6b96627", 0x5d}, {&(0x7f0000000340)="002c0a3f4ecbdce8eb69a416ceb7296422508967f2ec456c5d9d228544bba529758234efcd61956cf08ef4597bdca102884405f5201a9fa944e0", 0x3a}, {&(0x7f0000000380)="02d7c712", 0x4}, {&(0x7f00000003c0)="3f6bea", 0x3}, {&(0x7f0000000480)="65d577d7f8b41417893ea39fb52b54caf2232e6267029b5c6fd6be37d7d4589f4a7d9fa4f3d452282bea5afa8eedfa0c151665be79534e7ca38b8b1a4e20baa807802b9a3428bb18a2e49aa2a1ee4de8e39e95cb6a5a332a36cb882c5767e7e95fbaf468bae64573a4a6b5f033bc525428b31986da740f3d4cf95fab40d83a756fb41dd1994c8a98e20efbec52dc14f7928e9ecf4a3aa49a4c8d8c62360128d07fa10672cdeb99f4bec5f272a481372e4514fe6f5ff1f1d11efef470e28a99b7b4bd8cb0348e20a8d93e0b755540", 0xce}], 0x8, &(0x7f0000000600)=[{0x70, 0x6, 0x8, "b36585ae68b39b0c2437bc680f8779a602084e25a7848ce1ea55a99c80c1bd010e694458e71201559da19941bd17f8269a0afe7ef8729a7d0d3e6dcc068a9ee8c886a8f181ccc66aca1ed27769baeb9809a8271f2516f7dbd4f8f7080dd12c"}], 0x70}}, {{&(0x7f0000000680)=@qipcrtr={0x2a, 0x1, 0x7fff}, 0x80, &(0x7f0000000a80)=[{&(0x7f0000000400)="901b6522ee7669467d9ff966cab1b1949a067df1a88e9131fce2969c706050", 0x1f}, {&(0x7f0000000700)="991ed6e5021bb81d8a5a98c5433c02de71290c02753107", 0x17}, {&(0x7f0000000740)="86b3f07d02889734536a3d04a7c01095d7ce46fda06710bb5331cdb694e28d3eb64879ca1d3f181d1ac743b2e6a5cf0eb05849394a6e92ccd85ed3fa56480c87a54858615ea5765ac6eb3357577c15598fc72c5a3bbde9be76b851c04a0141c10572c2651dff036b490a5d695e0766cfc2c4ca084f484dca40a400ec89a6dcc9395fa3c8d494072d2b124d39eddcd7a1c64bfd65c30383f568230e4051a67260bd556d7d8b2d34e346140611820ff39355ab58884c2d7599b5147f91d4", 0xbd}, {&(0x7f0000000800)="3b0d03f14600e66d8246419ede0c7892d24d38588b7b45a5f0544ce01d75530d7d53ef54345032d2bc9bb1c09364e431f8df370ebbc3ebf1bd2062a1bfacf2dc83c4b09e3690cb6c352218daf081950a39293e7b9850a952dc5aeb699edbe8cbae79b3e0a042565da336d06381fe3dc069ed1302f774a7ff067981381aa18c15", 0x80}, {&(0x7f0000000880)="fe2a7d2be5200012ec8030bc1cc5f242b80c9f7eb1d0359f5029f0c89ff271d627478d9afeb60847f090943ce55b52004fc754002b3bc9ab64dc2bf200c48089bc7bf4ca84f986b9fe5be998cd9b575d9838b61ea0e5dfcfdaea226af84aa08a08db19434b920d3d787180747422cdb6cd30f1b3e24cf9af1235b9cb5ba3dd24fe8b547b9a413aa0607b29257300fdcb04ffaf453f559547963c7fa5b94fe9465ef39579c49d63eec9ee5be31f1408f2d71dbaf8235388611c8ab1365b9bb3cbcf1863ea0b17d3183d76b8a3fae954f011da5f33737ed0fe4d8b6fa4293f5349cf97fd7398c846a068089841b27c600e4ee71d34feec3568cc45189bae21", 0xfe}, {&(0x7f0000000980)}, {&(0x7f00000009c0)="7de409943a55a5fb25dbc59100dd9ba738e79632192f3cee43d0b5704541a3d3d11b0d39471039869f6e386f778f5748ed3084bedbd21dd2f32ed51c1d8edf721af27e7b9209ac3aa3580ebad32b0ec0a2e3cd800f4668703e16f4b8bc3eaf11e58b18372756007bf9bf76fac5c6c4d8ba04e3ce877ab3427ae6e533d4cc335cfceda9630d199c898e206de57447d81fbc3f", 0x92}], 0x7, &(0x7f0000000b00)=[{0x18, 0x0, 0x9, "dd7052a3ce34"}, {0x1010, 0x104, 0x5, "8be2e7aca3407060bba07482857d05519d3e385999e32c7e458c06f33c18fc8dfda01f9664ecba4d38df08ec453712c1cdb6b9bf6fdd590301777778acd44adca364ec1427bdde5ba6bf066bb4429e19eff09a9ef5fc302a4a938d58c82cc30582509e47ab54e647817fe98b64c891a907dc5a0070229ac547276d0f310895eaf5af2b0776d822f904351922190fb9e5b5ec2400e740da10de3be042d8149235de799373b6953396c1bcf8570de45156f3e1a3f5b901400385363058acc55bbc60e11a2b6861171fa06d6b969e425360c28ec24bd35e1cb6999ecce634fb28cc5e97c5980d40390c9c4d0ea9296068115c1942f94082139f268eb6303dff56b7a6c250217eb857dd0c6c0c8f552a23a5c21def252515c0e4d4de6e2b4fb66eb834e938e76ccf9df8dae8692bf1c76d78283edac0f6e016e0c139ddd3f144e65700234b0056ab5cffbd5160bdd79f6ac4a040c8dade1519c17abac7f843d1fc963d4279fcba80ae6785e5475927e090ae109923b784210c8a426bd3d99d3e27c41c86ad584dfc923fef867bb6dec9060982bef6cc707e7064ac81952770002ceee4a1218dcc2d5975be00f45142f2a424b3c38228ae0c3a2fbb9d818957ea80f88edb77d60ee93d2e4655eca19eed682e8d7cee5472799b9ebf0fa6da0d2d9a9c4ef2138126a67ceea9c774e903c2da9ae65115402a17ec73aff55bc97c546f28b43fe6c30887eb84dd3c826fec7bae679d32db8748d5b9d3d7cce207551beefc5fc601bdad9fc9035ebac3a1ff1be9cab521929cf5866b2686fa554e9f389f8c34688001eafd38093e94dda373894bc4c752c61935c9bf7e6bc39eafc73916f5a688ed6b1b4f75d562ef3c4d75482399d5759c13e0e6fef4f38cd88371246e8d4e302f88a43f6e456a4a581911af00f57bd5451c35a7ff93b666fe278b29a5a96e6fd21d8a4fd91623b2ec496a0e1a1cde7f3f1689fd57a4094c58bd7e06f82775520a2d7d9453bcaea429e651e99488d5e8dce8f8a9ae8556b3641da934d85ddeb983652c95729fd3d931c0e9c6134f8873f2fac201b75b2a8a0a4cfd96f8b9137ac4ccd65eadae2fa74c68aeceaa62095835a0c4488a70ba0e952f3447370f48b75e43e860f4594042628149a87cb18b2212d51bc95662a12ba1f79c28e848627abaa0dc2f92087394a37faf074afca67761c083fe9c5e97f5c41aa2c941f287177444d28ca6cbea7752f4d9ebded91295ad1281dc334ab3d01a8b03e40057830e5d08e27dded9dd5db7ca4ade9c96cc29f02568ba1f2f7e471e495df7060018c6d69cc792a6bde51624d5c6f5ed46ea364ab133a31154d1eaaa2f1b67a5575f577bf9963864dd8a51a67f9d0eb409c098098f4e891e9528827ec62579adb00e824129e48be99d0cd16a43e6b03d5b1bd485f4e39df91e216801a2c016b4f8f0a900bf281c77765b1fdc4d3fa2bbac7c96a273d8118d684bb131a4532ec6383e802e44890277d1c5a6af331d9c76c58c370cd1bd84feb468e71d6fafe344caa39ea4397b98b8002a1514a5ba77c3cf9977bbe5b7c9a241fece5e20d31e2ffe3c8c3b6a486f827a9b1a64b0955130de24629fbd198b5f7d97cd7ea80fc7e83e9f13535bb24adf920577721aa7edafb57916ab538e4da364d332ac5602ea6bd1ff4d2bda23a1c35ec35bea92d3a9bcce53dfe00b658611118083c5ec0fddeb94cfd7a26500a97973430d3820773e017bcdfb6a5be0952c586963d417a40b9c0339ef20adcebdcf89e0809b8f76256f2986549e77d1e41f9f040af8f66c8c59accaeef20f43bdb41cd10db26bb0db33937730c08abc80c080c2b3dc5a5337c930fe87c31f072cce3c0d7497838de7b69c211a6827ed3887ce852ac45967f5fa547e0f9c39663024d18d99a70736c233cc3d9699673a33f3e38a3562113bb330d7495e4492436577d2e94b370cef7d813856712cffb3d2df3d88314998f8cc60789682a6881d0ee5a0c0fa4ec8508c797361b2e86f2408ad81bda76f0f439035113033b68782205617f977b25b5d4ce71149600eafd8c0005b5388768d5b159b44e6c824b3980c52fb89d3779fd8eeb6fe2a7dea234134f32d445e993b057896848a2a044dd9be6e09b5212d1ff540a2682d29158967eeed4dd0ffcaf9877c2688ef5cf0660977a104b628e0bfec5ad344e214a025b3541285077c3dced2563292ebf22956c2215e4ad168337968084089c8071612a926c2f6be8b3bbcfd3b97c41e62444db2d7d5939ff06dab09a5501629040480d6604f453a8e3b681debba23763e56c283b1a94e026682a1b4f660ad6decd11da4d1cdc3841aef8a3ab5b6bfb984b6b6012aa4a5e4386566356e91ecafa254630c1cc24d88dd69fdab94571d1205eb6407dd08d796d24c2a86075fce89ec196e51256254e55798857a8d4b239d84cb561e5b3a9c75b8380cde8cf4c0a685853e3ff78aeac9077b8767c02c56127dd89c6e21c7f9a4b6794028b42e0f9a357e929b7c23423c61772f0a6112a1b55804382a2a4cb1a8bb929da2444b7967d06756ec1b8922887c14f09cd7eea21b8479a1ce2cc85592409db50cd3d2ff8e564e0aecef79c7aea680d785040b7a79e8b4e5cf78afa377591bb1e16c641d19bdda1531d176da9e98e6d93863511a051c13473d8a7d2052ecf9ec43517e315436c9134244326c02dfc1d5d97d265e35310cd949720dda381b9d7d71f152d8da22aca4ee89f829cfa891cd5c2fc310fc4cdbba9330ee50e62fe5a0c0df6195b3ab6d2697fac0930df9e388deb7dfa92dce7f5cd3c9f84b9f1d638703fcc5a295ca837e28fe98c3cdbf5131d83f058a434d0ea34c24984ae417d0cc14e0338e08fbedfca51ba285a014c5bcd05dc65f4351bd00b3f1941dbaeebdd57cf1725b02c307ddf92a86a0391f49edb23d8832428c83ff623f1612f6001becde53d6181f06a8bbd5c2590cb42c7ba22ea3585c2a92a327c95af82fe9dbc67618276d39a38e711cd4bcc580a34152a32e08f554790923e48dd3d62d027f57d3330ba7342fa541c79c4f0f859c90bacc4376e36a247e8d8c34a08f04d4355929dd1907ee654c43b5ff0c69cb6674d89ab909b5713a1e6f5e7bc41c98193d549b72ad46ed1401ccb21be27529de2298038b7a02d7d30a6df0d84049c3fa8f9b977e3e654d95feeb232da18d7c668fa79e3db9bc7f274b8085a8cca47cfb3326869f6a2cb52d97b11ac00f7121284e157c616bfd4594f45ff4daadf33957ec3e4cc4302c4f4c5cbf0e2616467a7553733862c81410dfcd1a263833c7fc59722b277aa6fe2fb7c7cac2f7ec29df1a718882ac0aa9e896f7a216dc9dbbfec32d6ca4575cb3f392a8253fa4ec9d3590600bd0d72ac92391a8c79c47216e6e3b35def4e77a825c24e15f10ff16f65fa9176ff4ab22adc3b9a94610f364a5a2c53945c7a0157571c07288797bae683dab550dde2ee99380d71a31132eaeafe0248225ba071e26ce2e1433a130f19eba3000168cfec4c84b0928490a3d9803c816d80fdb540aac570e9c1db0340aac4ba2bb657415a59c9a7ea1d735963a7bc598030c198f909196a2d3ef6f0ea1f674258d0083b6637b29010951444aae6058500deed55bc200b1f1011af7ef9a4100323b741c03a3d9591ecbb993d81e62e597d9db7734286aaadb634b4224d1f794bcaaa304677f31417cc56b17e790360ef7ea3d9c62e099b2e383f447317e225b1288e93d011dbbf6444fa9d830380a58234e3587c14a86cce79985c0c7cdc2a78d842391326facc4e9a8e1c24f1628ec5fc5044d48813bccc961641cd24d7159ce40dc736bf872a004649a51d474de511871cb26069b22370f493706cff42f5221762554c2fc72a0d852f8c075061fa13988d34a97a6f9f7f14bf0e55a4d1da058d0a453513774d0d59b295250c40f8181fbe5428e1c9302e6c257d741ff06e239709ec5224501ccb411316a332b390fb179287330fc50902acdbc6d27c0d83e7be8107a505e9ad4bb5ef1f238385d3c8fcdd3f35b69f06f5809efe634659bc8753e771830f1a791f55be9f40fc84df3c8e230436f94345ed82de02c2658b15f5c0c669f0760262da64278cef525b77a4751d5ae6e2e6d0753045ed0ef77b27fab97869850d65a669a01bfbef48ec91b1ab9ac9d38309e648cb36bd8ae79f5435de748b058f169d1c46c7840b98d4b34863be433d01eeb044929a33f3e72a96eb22341a351d0bfb4e0d7e57e273e636a88ff6b0cce445997823862f8d76b65c9b8a97d7e6c456ab2a0375ce44afff0e3da9e984568c7a935435d15a400b901bad78fda142c229d6b1d18d58686f0df2a645f2ba5e3491430e1e8b3625cd1e56a0fc7062638f8485ab873d7f9052b88ee178ac46484fcb5a971d80e26fde58400f7f441e898f7036f11303e8621b02a33cc815707a9c2874964e5caf896053c7380c865e7a6eabd36682a722bda87b0026d4be2c2610711172ec13a67693725eab5bc6ed85148888bd30c9736ee515d4958860ebbc0ba8035c9e644e48fec2385c5bdbd141d69711a29f8ca5269e587ed2d9b83ab91f1a44c55b8b4aabfdce95ebd7079e6518b143053f302d47748cacdbde8ab03edd79ca64d6598ac4ce9e5f1efab919e7c7a08423f63fab20eff57c58ebcf6c500a812331404542f31bb59be24b611043dda68ae99ddaeea19de0a1a2ba2b5e1b04f59adb4541fa57bb54301a18ab3eda256e9ec82daa928697c731ff2e2129ecd31ef39a6a859314623cbe0bfbbdd159cf9cd8a449a2b5fea0d6605fcdd37d0052cfaea3169078085279264a46a477a4caa8f3c5b964ffe23cf15eeeda83c96e3f77ae804249799ebb3c52ceb7dc53220fcdbcd761fb472a0c673b5b789afc94142b7e095c2f2cc9b8919d288d09f3fac674c7691b3da54acdddfeb68f6012ca852c84a480a24f1aa1a44e4fa943a8b0bb81e4b8fcd86a9cf765630af921ee815bf936734b2c3f14b2ac775654380fbda473d37a70d248d3a1604ffaa9c49c9cf1ade95f5ab3ca92b0443b5acd76d4fb6697ad6a08d450dbd7df0e0fa09eae12228deb1d73d1cec5cc34dbc3d6d4506b16f043a859ad346e3de1fcb000c968232fbed6b25e5d28094ce452bc96f617fe337e49071028ca3313607a57f570146dc462f10e75a3e2b18ecc83e94d7f164f2a397170306ef8d706552f7c3cf102bc360db70240ff8acd0093a24b6f3cf748e2b51335bdb1d9dc573a1dcb7afe24a2ed5a54ca68546b25724c76ba9f97247c045b1c911d348147cc6bde554e0d7480234b1b05b5cab7159e9515fb3cedda71765883074ba35ff785b1db230dc569c931dcf4c0cca35efe1f5600ced1d6b70309d4a6773cce8b142a8741ffb73ff40b65b7d071debf1b4795d9ccabd67b066324035088dc0fda58eb3f170513082ff405bb6cf8e543704eaa6dcad5074ef3b6d375932a4da12943426900aa5e97132dd4e1551a01d461f30c8cf0f7692ab13fc3b3e2dcf1f98e080eb94d4e8bf346127f56bf995c531be5f8af52b5b905c3e2145f4c9ee9644570a2306f3e049b8a1b34c504c6c22ab6a42b466f38277bcb282ac4d5e4bcd37612843282c07c8919ca57e65f7dcb40d64c19054609894c47f44fb5feae7d1e531bfbe29c348e1c97774bb30e2321853ce3c0f2b614f9b5a23f391710d47ab5ace416ed73e08ef64c19e924d8c540b5420b23e880830f60e76986fea466cc13cd5b654aa18959de7adb2e77edf296699843b5b7bfdef9bb2aca802d10e"}, {0x18, 0x0, 0x3, "c0be9458"}, {0x100, 0x104, 0xffffffff, "058bbc8db75fa6459d15fe077b40d78b406f5c05fa019e8ee468cb5dbffc9cf54e25e54b7a1b85bc5fc4aa813534c879abc05b7a2ddbd034d80bc8c4e4c3a041ab550eebcaa1cb0b86dad3ee3c506bf03445727e6700f6cc060b83a01b58e0446126506910b786d5e63f698f49627f670019f9efae6f1872441d4dcb306d6ff19c684774d48a0ed6fa69583f9bc836d3b899dba1c5730c474425fdfd1d87fcbd9b3a45bb1b0bd233e922a6c4348e07ef3060c71e84ce02951c3f572ad77b938e31d764f3edf0c5a96872a81994531b3fb712403d4c3ebc90ccb37394f97ebf541107e4a7f363b190b3727b"}], 0x1140}}, {{&(0x7f0000001c40)=@un=@abs={0x1, 0x0, 0x4e20}, 0x80, &(0x7f0000002f40)=[{&(0x7f0000001cc0)="d39d66abbe412bff3748b02a04dd85c8c85b284faa87acb30fd204dffcdc4cc4a9acdf8ca34568125bcd1a0e06331b97694d669ba6f822a2a8507924dfd1fe86e15b268dbb63e35df4d6b05777d633f1722d554f4781715960bedfbd9518febb642481e0b5c0339ba618a0b8c7ab63852dd2592eb7250926f32d5e99581872f6f9ab2cf62aec9de792dcfeceb7c44257b1d1c96f6a3f83a39b2c28b8ca91f3926414d8fce6ba3cfade897d0721247bdd0753dbf9076c583e55958de9789b818966ed1349cad12d4d6354a1806e00a79a56c274097152e7a25e76d76aa9e9b3b3d47b928538ac28a361b1e4335322420835db7f59632346e3a80741b7", 0xfc}, {&(0x7f0000001dc0)="916b38ead7465167fad8c534aa085f21c1ec385e053d0bcd800a8b6862688ce5b5bed6d2c1be95cd18744ca7bb33a7f4e1619059917422259279f452556981310b331cfa0e9e7807dd9ae8ee0b7d28d6bf4575b4df8846e0f60fa67e702b0fc2387d2ebb0caeedc60e6f5ec55afd6ca43e2bc0297be2544e180372765fb463a1b2ab131ed4493de268eb9eaf93ce21921db654255ad1fa2076f25aa0e2915806edadc0bc9411354b097e6f1b6409358127d8d7923ffddd864205612a98600168dd0457bdecb18e413f7dbe24d64bf80282a260dcc1b9e343716ab120d2eeddf244039e3749938028e20cb7b57332dfbd6c4daf1d58f844f46dc95eaf02bb50e0dd427b979a6435562f054fcc75462c668af132566ea648e7833a30f00c259cee5299502b4bf503b536f2b3a4fdb583cb9cc8ff131eff7b259acce8e1a139f3fb06e946384cf525b2d805f5099e4eaa500fd217d1da6951a57243048276ee3625a95cab217220b345183ebfd0824db0d78a94a67e66935ba0d6e1733ec2364a304eea0a4ccdc14a66a9e51d807c93d0fb0a0011aec5cc6cdf8bb964c38f65cda77379dde2e0bdb558154ca3b217b9c549781b02100315828fabc75e2cb07c07f1e54b59b7480030782d5ba619f144c38696b05d867512bbb4356ddc587cefbdeffc2dce5606ae56cbd54d697fd7973034a415cd0da1881724c40f34707f042572228025ac0412343fd2f64666d027372ee8301e759f07bd74acc492384510c7b5cd77047b2140d3954ad8dbb05e0dcd3644150e5a9d9ddda613acca1e4ee669379f185b844cca271e874bb11b34c37bfb31e1689f9b6f3b085be046ac2f15a83bbc47bdee172cd04b7e3778ae8ad610f811e1bbb05e7eee3350a3a721390e3366966166673dfb61741523892f72692b2b92de449cc0efe6dde09e3873eafec4db2e27fa204c3dd34a7a74a86f40b73b8cede92dbc6b269eac67bbca14dd277bfec7a6d60fbff1dc91ff0a8db92a1c21461ca575d59a9c4f487c9fd105cd55e67531a9ce31cfb2f5249fd31c70269d81dba65153282801cfcdbe30ed4b102f9d1de265d1621ed7d320a2332a9879b4864d4af91365a9e19977453321dfc6d18f143240ed0a272d49fcf26be969833d134a582d53c63505834400fbf8ae9e3b00113ae34d57ee1dc6bfb2cb613d502ea4d5844e36b37c91be95e7e5fab4d785a4583dad780304d1c66a0eaaacbcf25b7b332dee9e2b9460135485ae2885d427c46292620d07a6623324260448a5d7bdd9cf2f95758466b820fc40fd042a6865653114d8179091e5a2bfe2d5a8d6c2944fd3ae45f8d4899ee3458d7ff61e5d77dce4e9980a9fdd1e6cb6eb268c4d618eff05926d243ca21a92b37272484ff0744d6f3127f24296e503f82e9a204e999d50f075435893fe3c9280dd0396abd5f345f554833433e6dd59e41961e20504d6791538e475d577a1677ee8015fda1581a56b99a3b15b65d95ac6d2eb4d13248a5826c58fc6631de2e27e6acec36658412d0f7727835a758cd05991697bd045cf70a52607f0efdf05418acee63be04276a0c655aafb3ac5b1d0918c2e4ccbdb0eb38c895b22180ac145732fa1e2f1ccba1148aa326ac06c67f55e2c615f8692a25e0978a0bcaaa5830847d0f022978b41f479e88a19c24f8ed6a747f11939eee46096137d78b300cdeefd9f2982d7ec6bd00b1b6b33100159e9617d062e81f56d70eec6a449691ecb52bc5a9248c55b95f59567f9d56137048ea8d6fca2bab91ba0df4e75c4b3327dc2e397660d0a4d5d797f186f63a5d1d1860df58573d763107f32de82409f5a8489c1a0e475c02d80d441bb0ff335c75432668875ba8af736c7c2110f794bf7b421d666a4f01b680aff8acf93c1961512068152863eea03d91dd361ca50ac5b45598f8a7fb58c00e2ec520af8690fc7b325e4bdf97fb595c8c3eabf690fa41c5e2815c5ad0e139c6a23e5cd7766494553be37de180a662fe0056a75fef89fc6efabf65a2510fec293b498ecc6f7aac86b42ba12322e72c5301679c81e3e95530e24be8d42a5f0be923c9e448c817c85c737fda84ce57532679efefaba97c87015ae6f10a58b02a8b9d00250d3abf0cb52ef78c0a33720823564252adc7e3b195800cea5da260a1f1e4cb4b765065599d43ca5b93f3dd09f9d3128c41044ec43b516148ceba4d14f3ff568cbe8221dbdc63b74e82c31d74e2c8567afe04b964f5a07a5d9d1c4aafe44a5f9e903511030faad4f7186f38ab9b9fb75cd2827bfd2a793e485e93213dd49ce725795fe3689b52973f06c85ba627af7253780cee1b12f320de61dd495363b345d8e71c4757e7625fb0112c0329df591e87593da832c27d22806a27e62a85df07c91f9596e2b96493d60d5f555cd3238db9fddb5d7b00af511a14e1370e966f66c24c3580346249fb0edda0d80ff721fc6fa66a48b3dcb3a679e8b3eb23044af4930647b032f6673dbd16f2c1da506c249a20c7e5073d399c069e33ac36177af4cb0439ecdcaf0ff48c0bf1414ee80b55f322f19072287d2dbcf3b16293b6fa84d94f82146462d17941aba6c993fbf2ebc0d155140e91083950731f28d6c44c1ed608441829bde02dea17b8b7dc59f24f36eadb7848df3de44b67f9041e8323813e531cef99059b4886af8c096245d7bacf4983458bb1376c958662db23a37bbb3342bb59635e496bb82a0a7cbcbfefe466c07bdbb29a04d8ba0f22d283d9d7f617c372af09632a924af448c823cc6305147e2a5b4b38525d3bc1662f537b98543d409ec7c8bd5efb30b2003a839ac50b6d5346874626f39645dfbedaaeb2358ec3d60b0e9dffc031980a8f26e9235ae2548290441f3db5dcd00e16eefb1599eaf0f9ab746bcb68eacf29755fff378f1776aeed9f2dceeaf8d8b66b0d2a72b1ef9ebb3ac9ece5a847a27b4b04891da6da3082bc1915bf59c2739a6bd145310c27e8fb9051d93d88844383f5175c3d169eccadebf5bdb9cada7b9c886ab9c1254db5975035058c9999783f44f2fde195bfd242a1d11aea76e41730ec910d61ac6469517b6f21ff6885ef68a3e7bdec09e6a937fc205f03d896f8c474ba61071f7e84abe18edb5d7f0be11947ce6e138134d89a4f6fc9829172e0de2586acb0a3888e745182f6addf8164041d1c46f2fdfbcc4a2ea9eabbde3d5d0dfb639e46d0adf2799a9e7eb876b3b771e2e8aa07d0cce8018e4dc11b12409bbfe0b9acb83b13f1fa1972fd83c18bda3f6373b22e9343e8cc5726750b1c72ffa05083f66e9e5153bc3f120167c9e9c6799e7af45c7f1195f8f3fea6a09c123056667e18c41239e07832ff0f8ced06e9766c4621b1659648b0d0978f12c99f1277303b3ec721e192f68ac8a4cdae56d67cddc752b5172860b737c26d72aa568d2991d8a9f8767eff64570643fc53b89fbe0a809d004d6d35ce7589f02a28c908fe817abbfa0aeffeed5025de3f21b2beb18c51045346565960142a5e1931ca63da2d564191a4cf87e589d87564cb28127ce787dc747b72d201c9ed442e0a7507d6df40bfc2be313e87a3920824179667578ab8137e2b376e7e455d38739120b2da4466c281fde8805aa087a0fbad6d44d48814760fcd4f821c5554bb5fe10d4d405ec6ff4a72d08487941fd3d3f65d350fdae41ecb6a0bb49a338539050e1fc985444d3d29db32f7a10791fe66d2242ccf7d4fa163a666bc70bc423cb559cd04f055575bbbac569ff4253c62e7fd98b897d73f62bdeea8907095b8979fb6870d417a084a04a4a5e3ab8124b815ca5cd1d83e2ae650d2a6f1bb7d7cb59dced752fb8f5fb199282658c6104eb788be7c4cfe15ddb7d298c78deae31ddfa919ad4f372c361239910bedb99519a6e7a2b9f9a8dd2b37d741770239b694c2fc58d2590f1de4e978d8e4d44d60ebdcacb3f9ddbbbe9d2cc9b967793aa7f295e0bb105adc01fbcf32ecafd34ffd20baa77f7249fa98b28a53b6c672dfca7a0a427e9e3b6a6b24d529984bc3e3af4bf28ae145016a5ca5c9ed464f1ab3317edbb201436b2063792aff696c754f38a23dbfb8b581ac7dfe450df6b34475eed8ad10b76de40d8929f7dc87a860c5e3b9d60e31340c78640775ff0f8512e72aaa478f6afd39092bcd9e010f3254cf82a71051798cf09bbc7e54b9263aaee7aa27c554380ab3384656fef88ab31f24ba7d09a2a4a84dbf31a101173f70d7396daf517117d0e38d3944a4e9b42bce18b397db8dffe01a2cfe7efb296201c3257c028c513e2fd39b818713ae5640db69300a9116b4e890639faaf526d60ea349c761160565bcf85f267a9727a9a844c9608631c7a369d1e73d165f0589460fe77a4b49ec61e35c7740da543f134eac0ca84feed56a910b22e2379940ac6a5d8dc0f37a0cffe92be0ab1c68782e74c6be454992f34878aae5d886e75626d7dacaac6125ced06b8fd613307042e6771de50d9fd45a7dfc427c220f39b52c19c4b62aaf09b70b8e846b3f5351e8cf841ca7070e7e3ddc900d13fd3a88f81cb3dc9854cbac1e61430244d8e9a82ffc2debb689988e978854ca3077f7baa56f4723db76e732637fb9a8a3169d6cad7dcf650c75c0875f19c078babc9c028392449c53c14b279214fd3194254883afdf45ad444a342856be000811c677d7f65547fc48e5f5a85fee17e41fb351341d4d3ed4c3887ee9d471b2bb1e3cee4d2fef279337e7402f4b64f2a0fe1d4f5ff01176ffa4f11122ec966b8c299288b1a5a6257862916b3c37b7c3902917cba0723570a7ce799d902e06dd94da7dd7e611df97bf6eb0eb2a5e13a354bce1a7c9d3f60a17c7fb571895412a661888ad8437096956d86f07e242e8b956ad910728c200effd74022d29eb0c1cf8d100f9409837ea474e15d2b08f8137c0608d1839f2648203054a827b54d3f2ff80431df79ee330a3da8f26a935f56c62435a6fc4425dc00d17855ce573a77c221cba8c8c6c3280b69fa6bd4ff24c52d994884aad11b5e7142f0ad1aca11f1598ee0279f1a9ea7e2d476c0f88605161385e68c56052b9747cb6c5efa84d083bc715c0b478738e24683262e9fff1a5553fe452d1d7f15bbd4046cfc2de1f3b8f1f9f7d1878b1f1e49c6bb78d72611c7a071da0b63707e6818eb87d3281f12048273fd40cf28680d8ca7f2f9fa305eaff3ccb4514ff8fca24611fe4e2a2cdc7e58a81c330bd431a05f1821335437a78ad91b6f2ecdca775b5660f184ded4cd3f3dc38d53a47d52c6e6dbe677c2a29d427fda3fd79716f1cfe989c87b8d608f83c2da8f7746e50ca3f5cbf6660515bc053c902c0b360de15f125a16a5381173237e894429424f05c128627c69f03f1022bd751700c755bf04f27bd9e14fb1c924966c6cf0142b9d5928f78faa6f00de4215a61d7aaa9fdd7c634a6effa9700b52b91b046236adf99dd4ff39df8431806a0deeda33d61e632f320ee02fa3909c21e1fec8065556a45e8010181f754e31c6d1334e7f0b857f7af38e6afdfe42061249bcd8588bc8c5fe2da64ae258270090467da81181a4fb5559c42ee096414c8960d69b99244eeb75d6c4850143e17b068e3a7d12320ceca09aaf2a34621e9e604c7344fb48282ccee28077a54859510742ce40485ac8d55d42ce75c07aa20f779027b7bd38b4106dc6d4977a206e9ac4ce90f40b148646ae20758067ef59286367c51b054fa6a476cc994b95c9669c088d5799b7b5635d049869854e07a000dfb0ce84ac0a4ad36478d4d904e948c5452b9f3eef8f3a74be89", 0x1000}, {&(0x7f0000002dc0)="5fbd400d3b1ad8fcf398d3e7b90b3dd89308c7d277efc100a65c8afa6f4d540837bea9428bd896a3f999466e982c79b42ec856c9ba298372d771b516a170be33e9873f8a55b25bed9aaa2d624f6a4e628304591a9730492f5db65f0cc99a05446728aabd02a289ef98ba8642d980f3cedfb097a087a604b9183909bf7943c1b2e237996d00860c059d522b36675627025a74e63ed1277fa76bc69144b969539fc55a5ed37a3f0e0f70c2d5610435c76ff0d852034445", 0xb6}, {&(0x7f0000002e80)="3557567ec523c2a7fdedf36debc4ffe04526a5c741a9d59f97e4027ed7f3e9cfc602fad6be1d296a97a6dacc1bab3e35082944df7fe147f1a5e37fb9efa51bc2fc1abced414f666579cb871fbb1684d59bdd6a8980e2a5cc1cc27c9e67260e0ad4f7e542d0b176ea062c455bbc190450ac1db35debb6444747e166b8a3d95ef8b99e39ea710ec966f7edec36271a979e75cbdd0d301b2e33c7ca5530722c058c772690adbd69f7d28f5713359b937fdc5753340b02", 0xb5}], 0x4, &(0x7f0000002f80)=ANY=[@ANYBLOB="d0000000000000001801000002000000af975f7bbd9df702d104283f742f7ec89f4fac590fbd978ad09262370013fd6aa14e05188a1dcc1ec4d154264461872ffba9800a7031c5beeb044bacc6c5eba451225090b46b182f2633155db13d61b3d9e0a323047c2eeafdf70ccde6c154f1760cf33df73175c2d23b11fc94e47b4d646583bb9ee8a80c630506656c12553f5bea011d73a671acded0d269e19185bc70d4003e9a1813c72b0b1c4afedf0ae8d2fff47f2a41ba6c75b5ae4bc37f8d657bdd860fba9cf474000000000000003800000000000000010000000101000091343d4fe4a8cb1d170dc376f8112b3d188b7417aad113335459ade77beb74d5056f096f209d6000080100000000000084000000ff0700009c3adc6652c381600bb1491f291f904280cff9546a82e6ca6edd5fb5458ca322c284cbc4d338fb8ec54bbe409e5237c03c9fc2b7801c881334d82a9d7c1e6044d9dec0d0da12e84a3aaef1b01902f50e48dde959dd99f7d55f612471dcb7a99e3c9104023bef9b4937034e177cf3d080d97cc958f46a3d02a2414d4eceec29c0e18e1828b71cd3c8dc6b69a1dac42f343d0461b81f7862132829e8a7b448646ec2f3ab85dc13e77031c2113f88df8869e3f6fe0134a33c3bb8a921829cb7cf128360dbd54733a9d690f19035fd2a2c64c8c7e080d95912e0c3880b585d29db71ddb35cd4a2f9ed46af7dbdd50000"], 0x210}}, {{0x0, 0x0, &(0x7f00000042c0)=[{&(0x7f00000031c0)="746c951879f59545a1b04d6280042ddebd8b1bfcece6f919afaf38a452f82a86e1c26aa07989978d54f4f493d4d54ca27cb4bdb960f996a2e16916bcf9138995cec54902c917e8482ed9f20b066781b0b2b9f4c4b53514044991d27bbf9968292ecb1d3a1fe434f4ffaa5fb06171e0c27c380637a8b46dea31b6d313b8bd9ba7325207537ab81655c8206ba2383207097773d9feda6ec7612c529a7bb3efac86df3b7848d03fe00c919db737756c96f0dd4197bbce03bd5644ec6e1beb87723e229683d31f7457f31702b594d2c661146cc0d370b438cf9c246ee7023a8ab06c09e8384d39b43bfc04e57459152d813c", 0xf0}, {&(0x7f00000032c0)="b729e54aa4199115cefedcb077cb709bcd040990ad5dc7be0e52a817d8322ed90acd284059c42f16c83f0713e77bb2ffea639a96b03692eaf78a9a1fbbba1e124e4944a7af9a176beca50012652ef0cb688b742debfc8e5092a76de98e04d83469a02976c9e31a70ef0c9fca50b3aa562ea01c87d786a99c84c4dfc387b9714ced33744fb6dac9183d1017b76d659efa8a036d88a6e5bf7c1fd1f85beec42f8fa715323932dedb5443cdd6ae266abc4cb7beaaac55ba1e9b4c5024739acdb94d61920beed1bcab9fad46be4a7f4abbdb8e912e64e1c820a318b9281876415d851e1c5778a50a93f68615ac432a6d612a117257791debf25b10c31b19c994c1050c15151fa59ddeaaa48e5231e2f48dca8ecb520e324cced9793cc1d05bfda783423e36cca1ede6a64778359f15d967d1154585d162db61e6e6dac368eebdc3e5a9c1f48b27e633bc165b5262003c9477242f0cccb307f841475e82b36f39d0eab9ae3af1eac139e10429555d5dfb9af0ae5f356f187a307cf0f4397e87dbcfa643149a363787be4eef7def65a54a2311c677cb01a4abce5ced125cb9332223585b849910690ffc7c75325a8e2ab30d3258bffe7a670cd1e65aab4e8761e05e8001ecd3aff6e78d995ae6b84da266ebf46d46c700ed7c1b5b011e2780c6b850f38442fe1896989b335cd555d04bc949b000d733ac40c676362fb91db6ba9e465f058039b9a66f856e0f006fa1f8040d09d54cf521b14255161f1124430f248b49999288a8521fbaeac500ae00f2f1817aa3b79629e3a4a37b790dda4a0bd6acd7864e1522f5d0c26420718b2f71d7f5101f5dfdf0900d5b8dd144dc8ed052694ca10979b1e6441cc640230efa7ee0d59eefc23fe84fb1804733ad412e908cd4a4bed69f8e334790f9bbf70720f93adaba09ddab4a6cc972b5d8899caa20c45c725a0a1e7b9cbc16bb02ed25c2e824ed8ce3cfb1850cf8608e24e31be99202e877d38135c75e817cc0f2fa759e3b0b368c211e74ab359f84115e3aaa400713b3d928e1957edab694586b18d694e665b3dbf7f1cba4fe5614bb05543144947b58f0c63210668b1c1ab9030568442077eafd1eaf2c8f73c40ad2be3373096fb2516f9ce13ac6de5ce2025cde5ba48dcb0019dbc8f76a7072c3d2a4ed19254150779f97fa303c34779a2a91255005b76d00be4adec7320ee82cd3273c8b54c433dc0226347da28e6eb7ff1b2476bf835e1df717f317acfdb41e950201f36af8266318dd268ee0d53558c7c0694c5607f75deae944a7026a952e77d37e5ff6debc20837bfd68d231a08689112beb9de7b53b80a167d7d18294fd5d1a85a194fcb90fa63a1ec19b4646da64b87a4179e42df396d709f04e418ffe6db52c78fd790bb179a0bb54ac32f4ee738e4d9f4f8a2b247950f4e23929a913826bc8d20ab60abe0e60900235b4fbd28aee5fe25cf7a2adb1afc4ac78725c037465528dc9247ef8eceaf25e2277005d65b9768115705ba6bfb563e22742f9b8e321835f225cdebf845cd9e08d030ca51fa8f9bd65ee8a017777caa77102aaadcae3aedc0ba3fdcd063e83976ea293563bd496de8359d13cb24e1b562ee5e484d611406785e40fa8b78aa09c69cbb89ee396b101e65b79a007cf734f728479b1d2d59ab3582cb4cee438ff669dd32df94ee95eaed1cdd4cd40e178eef9df8c2d57cdedbabcf05001dd8a1a18be159f5a3d81297f1f74d157ff697906114dc68e0e11f9a8d105b9d1b16d77982496d288b964bc4d723854c5bb574b06c076a5aac7fc2bf8bf13e69d7f846e6f7ef54064156f908aba2ea496a2de11160f2e1489f76d0a49755fe01a8132e58c0afaef1df66fdaf1c8d45b0b190a5f9d94c2fb11bc9f63b688292334cfa04be1bcddd75224fcf71845880fbab676287edfe317c8aa73d93d52e0477bc7aa8830328d1c63b1d04bf3fc838efbecb56a130a32ad66146f48a04e36aa40d99489e2348bc7e6e1b56de4f451e429837f810b0ddc8e8a42d1b0d64236d2193801ffaf84e91fa342f8269f6ac52d7218c200317485ff00218b74b37204a9d6f3755e1b7d67968c497c43ac3e1a0d4819d1a1c6167234355c3f74937846d8e93425f85adc47a68e4e775e50b0c863a3bbf5147902bac44a5b38c3b22b2f59d841b9c01e3760fc2ebbf2e8c8df754f673ee65c40f213f39d7f9a102586733e4bd1c0a0ad5d5508784272af832da25277f18a2334ce99f85cd222e8d86bd386d5abd45e0bd088b06ea0093fb341b34e9c84c382850b66f159bdecce01cf50471e1a47785d32dab6a2b60a563635f48ef82a8c5600a38f9091c8045d15177b7b7ae6de148d8b0b90131f8bf05e10a9dd69f63c76b0252e44ab0765148f40d31068865c600f0e1a81ae333c8f16c5cd374a9003a971b22e97e987f1d43243689233b09c596ed408db3bd4b769f80c44415b250fcb8c0161ec6d9d89e3c9914dc3c5d2ba6d0b92ce1117cc0d405beef2e6dfb9a8756adf56f87863e92bb77d659747dcba5cb14c2fb31333bae69580fffc99b9b9a8b9fdc48e54fca8ada4b92f762df159ff1a56926d311fa81a309a58cb3db54bc7b1fb23e3178a3b1a8088e67404e4682248caa021b2c18f6f5a10bf99412cf7db1f827532776bcb01ffc72750cd21f332017b4bcb06c94e77893073e6e9fc2c5d878c4664ad10c053cc95150f102b101861fa93ad8701a3f526ea72869485457ba84f861d4cb28341788733deac0a411e338efd8068a7ff7d5a184f8dc7deaedb3ff326e22c220d7ae1f70c48fff41834dcfece9248bad3e4d0b5d1647ee91bb064a0816ef0aa1d58b72eb7841af0aef10018c947ce220a6dd81b7576464454c57be7215954e87de48391c10b1fe1b957f954fefa3a708a88967cabd8af09dcecd1374b30d59ea76d58992ad6f00e17d525219450d7d04055ebbfc77790fe921f158d8ac7ca70933b937672410062ada5a4f9a2b2328fe98ccb48ec8a2ffaf9e124028fea7dea85429b8a6997dafbec1613807ea4ee6a5394e074178f8eb37d3324146ee94aa1da74fefd6ebfb7a99ddabadd95bfa71fbf43816ee78c009a4f44e7faf2f07fa9e97b60fa70483269e4514b3000f5bd55f237832bd5d0636f8cc6299980563e5576004caa5f6da80e560c0d1aa9c998367843b0d68605738c4b19d76b8f605b4d17e8fc4b304c4a5dfda93b6f31948d7b9a7b69610c217b57665f172e5c744f33379aadab2cddfda3a463d49669cf8c917793a951c90c9c228a2a0a27ebe8812c45bccbff0fdf894c634bc0d91386058d08a0799cdb86fbffd9a4d7870d01ee61b30ae739828c4a4a6c9eb2e39ea194d8b1ef2a855d52faa8d71884faf11a161bbaa00930e03366ea56ab2d54b6a21d38d01ac29a87025194a3a513d70ed2a09617f84d10eb4480e8b29789b682a008f2bc0b0e56c8ac7402714fd6dec0ac4ae33a3fcc67e3ec7169bc970f871ca5b10e19448b1f93b2742a4404d3c06378608956f1ffaa7ca2f156a28e41746487208dcdff31c091486ad46bde98547f57d9598a44d8c5e5963184a5ac136b181661fe423ed26fd2c5d28fd8a6f9c28d7d4711bd13029c3fb92bbd7699ee14afc41c4eb091b3fd38f3bcab7ee456fa7895f1990b598bb69ac900b5566628d8ba34a2541115719d638ec8a4fcc7ec4248033122e5bfcf3121f676aaf1dabca1cfdc24f9ce8b255cb0c9d09f10e785d33cf38a12bc3580ec907c34b300d16d83f42c8ba0a4501db4088f3c43d627e279848b40c5a529b4ec7077106969c9c7a828e6a2e0ec03b815877b431307c825137e4c119c2e4f828198c90e22a815487890f23b336f0688b8f113e66a4ae1999e729a8f3650b4cef5b76dad61405884516451e2b41d376516390b566e8ac6a3b05eae28fb01cbfda07f49f208af26bb2d132677989c0bb3c052e53080c98ca7065b98c04b7aa23842b7042eb6e123d6f9b74ad33a48403ed76da228b884a0326f6bee1a924ffd3c136be00113b88cfe00c311cc6adcbb2f11bb0d554bce2ed2b8391581ba3d0d61a2e9adebc64e38371dd7d57fcb9d4e20db529d4edc0a080919151e0f5c947c37513aad6c7402e47eefa2c98402a566874af82d9fbfdd0af9586b7659d05c6f502d9491dca08e9701f5008a1848661fc68f736c77ea0d4150d5aa174756ead33c3aa1d2c6afb1b9abc3b51325c38b58d4dfd49271e63b2d103a93a70ef6d4793768eb58fd3c157835504090d26051134f55f709015007532f932405e8faad6b47515bbaf30906137d255066a1e5061022c64cf44b635785047cda5d0ab2d8697396acc44eec17d813c3ab0da7d98f05c2cbf42c2f73bbb4e43a7118d4292b47ebbb7a5ef8cb46c61596f68b7be79280bdcd5bd6b56cf150e07e579d6a57aeb58114a7ec92faf8e299ebcf9b13c4f80f7c3467bb3dc46c47fac49b1fe73cdfa0eb5f947d5ac476f91cb9dd326dbfed47797044f659eb5859dff6849462905b301c2113f9e2f52606e3b38d0ecb6ae6ce0cb3bb5c36d8677bda49f932acfe083550e885e91668c5cae220b1ce1016e11030ed037171d797378de8b73f25e2f80c44655c094672b7a8b004661e47b247f12e40f8289cd464f8f2badb815577890500bfcd08726b19cefb5879c7e5d5fe6580cfcd9ecefbd12b27fc726102cf348891ba8f5a16f479a0fd956f159179b8612265a9922e99cdb177855d3b43f78e5dfb7a39a28d6fcb3f06498b54ccf161915e25c6d1cd8392e97673451f867db38f213d164ede6492ad7ef4a5ce3507626275d4fad76d5b869fe9f4838fe68e673052343996721ee84340b10f6e59307d1d785802bd35de65a86887a7f8c4bcbd2a5ae550450911775759a20751fe3f4b8a42d72f6945b123f9be1cc80fc808774870f661a72384119f99b11f78fd4a4d2910a285d3c62171cee3f83fc02aa59319616a9a70e674bb152630b23b42cb4880563c93fbc8237cb0001c7bbfefa422971ec2d2d4c92a6b65eef344f4cabb974f94732b44f380ad6aa3a56fc11dd0a93ba022a1944d80b57defdd0f97248d270968664c0141512189da903c7d0c65f3efca0ebda7cf44120301b7162f9b950addb2f2833af295c3fbd22b4e744e7a5da8e2badfb9dad4970f0ec7d9e6048d8dd5556d3162b236ea972a5951af810e70d6f9229948c485339a6295022a68759329fb4760680a2dd3cc7db2cae398857868d9f2b7fb897ca47a3f5e1323df563d7af8b6bb06b2fb6258d6b13f72a8adf4cd9fe9c4c1643d93bce48db7dcd3c017f47cd8b19f6b90cb0b6334d106b5ddea3888a520e0983c1a8d87c12aac8018ec0c89a661f35c3fcd9a0cabc414cb9dfc64a16a3675f1ee2a60648e2a462ad5732f4bda1f08ad31a645afe725f1f2d2f1e8381a5c42adb84b8f8a547480d8ffe1d928a494126be5b74266a61d35791d996c6fc56f9373f8f9d18e41af842f5357212fc337597b333d04bddd396ca7249a0a9c7ffbf6a60c63bf544cf234494cdfde77b058aeb4ac00bf0c8128dcb539151f8fe4c848572bd7e72c996ee3293970923ba3b4c7e29236aa20c0d04522f7d38ea434e9eed7d66cda16090697d5f916d68d9fc3857e1b651bed847d9aa192e65eb80e059a6b45a9e14c7b8075790b106aa299c0321ceadc7db1681d9e6a3af16928b56e23be53d30cbd73a32a3732fa62918a6355befde483152fb9ef693d4347f2daeb6a05d397273d13fcc25417273e3cd1d37b2614e7e97c2c9df24ea11de425ac81428dbe", 0x1000}], 0x2, &(0x7f0000004300)}}], 0x4, 0x4048040) r4 = openat$null(0xffffffffffffff9c, &(0x7f0000000980), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) syz_kvm_setup_cpu$x86(r6, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) 01:59:55 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8970, &(0x7f0000000040)={'ipvlan0\x00', 0x0}) 01:59:55 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000001a80)={0xc, 0x0, &(0x7f0000001980)=[@free_buffer={0x40406301}], 0x0, 0x0, 0x0}) 01:59:55 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x2, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:55 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_buf(r0, 0x1, 0x2c, 0x0, &(0x7f0000000240)) 01:59:55 executing program 3: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x18, 0x4, &(0x7f0000000080)=@framed={{}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}]}, &(0x7f0000000100)='GPL\x00', 0x1, 0x1000, &(0x7f0000000480)=""/4096, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) [ 660.001650][T19395] binder: 19389:19395 unknown command 0 [ 660.034278][T19395] binder: 19389:19395 ioctl c0306201 20000200 returned -22 01:59:56 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x3, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:56 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_buf(r0, 0x1, 0x11, 0x0, &(0x7f0000000240)) [ 660.081357][T19401] binder: 19389:19401 unknown command 0 [ 660.106397][T19401] binder: 19389:19401 ioctl c0306201 20000200 returned -22 01:59:56 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) 01:59:56 executing program 4: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./mnt\x00', 0x0, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="1000000040000000030000002b00000005000000010000000000000000000000002000000020000010000000000000009f09c75f0000ffff53ef0100010000009f09c75f000000000000000001000000000000000b0000008000000038000000c20201006b04000076b65be2f6da47278c750525a5b65a09", 0x78, 0x400}, {&(0x7f0000010080)="000000000000000000000000ede2de4df49d4f87b54a3176cfd4eb4f010040000c000000000000009f09c75f", 0x2c, 0x4e0}, {&(0x7f00000100c0)="01000000000000000000000000000000000000000401000012", 0x19, 0x560}, {&(0x7f00000100e0)="00000000000000000000000000000000000000000104", 0x16, 0x640}, {&(0x7f0000010100)="000000000000000000000000000000000000000000000000000000005178aedb0300000013000000230000002b0005000200040000000000907306c205002a9c00000000000000000000000000000000000000000000000091ecd11b", 0x5c, 0x7e0}, {0x0}, {&(0x7f0000010ce0)="00000000000000000000000000000000000000000000000000000000c99b0000ed410000000400009f09c75f9f09c75f9f09c75f00000000000003000200000000000800000000000af3010004000000000000000000000001000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005c1f", 0x9e, 0x8c60}], 0x0, &(0x7f0000010f60)) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='mnt', 0x0, 0x0) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0xc0506617, &(0x7f0000000140)={@desc={0x1, 0x0, @desc3}}) 01:59:56 executing program 3: openat$zero(0xffffffffffffff9c, 0x0, 0x1e0c1, 0x0) 01:59:56 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x6, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 660.415882][T19419] loop4: detected capacity change from 0 to 140 [ 660.429377][T19416] binder: 19410:19416 unknown command 0 01:59:56 executing program 0: mmap(&(0x7f0000fe7000/0x1000)=nil, 0x1000, 0x8, 0x8010, 0xffffffffffffffff, 0x8ab10000) r0 = syz_open_dev$evdev(&(0x7f0000000240), 0x0, 0x101101) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) clock_gettime(0x0, &(0x7f00000000c0)={0x0, 0x0}) write$evdev(0xffffffffffffffff, &(0x7f0000000140)=[{{0x0, 0x2710}, 0x16, 0x8cc, 0x91}, {{r2, r3/1000+60000}, 0x1f, 0x200}, {{r4, r5/1000+60000}, 0x14, 0x72b7, 0x4}, {{0x0, 0x2710}, 0x4, 0x1, 0x100}, {{0x0, 0xea60}, 0x11, 0x4, 0x6}, {{r6, r7/1000+10000}, 0x17, 0x1f, 0x7}, {{}, 0x16, 0x5, 0x80000000}, {{}, 0x3, 0x6, 0x4}], 0xc0) 01:59:56 executing program 3: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000140)=@req3={0x0, 0x10001}, 0x1c) 01:59:56 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000100)={0xb, 0x0, 0x0, 0x1}, 0x40) [ 660.465184][T19416] binder: 19410:19416 ioctl c0306201 20000200 returned -22 [ 660.496339][T19421] binder: 19410:19421 unknown command 0 [ 660.528327][T19421] binder: 19410:19421 ioctl c0306201 20000200 returned -22 [ 660.532202][T19419] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 660.552292][T19416] binder: 19410:19416 ioctl c0306201 0 returned -14 [ 660.574229][T19419] ext4 filesystem being mounted at /root/syzkaller-testdir602053728/syzkaller.hgbYLe/345/mnt supports timestamps until 2038 (0x7fffffff) 01:59:56 executing program 1: r0 = socket$unix(0x1, 0x5, 0x0) getsockopt$sock_buf(r0, 0x1, 0x37, 0x0, &(0x7f0000000140)) 01:59:56 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000100), 0x0, 0x0) ioctl$sock_TIOCINQ(r0, 0x5452, &(0x7f0000001380)) 01:59:56 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) 01:59:56 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$sock_buf(r0, 0x1, 0x2b, 0x0, &(0x7f00000002c0)) 01:59:56 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fdf000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000040)="0f20d835080000000f22d866ba4000b800000000ef66b83c008ec8c48225ac2f0f01d16526e5bef4b9160b00000f3266baf80cb8c2c5498aef66bafc0cb00eee0f1cbbc68a8bbb", 0x47}], 0x1, 0xe, 0x0, 0x0) 01:59:56 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x7, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:56 executing program 1: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000e40)={'sit0\x00', 0x0}) [ 660.936770][T19444] binder: 19438:19444 unknown command 0 [ 660.960015][T19444] binder: 19438:19444 ioctl c0306201 20000200 returned -22 01:59:56 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0xc, &(0x7f0000000040), 0x4) 01:59:56 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x911, 0x1}, 0x40) [ 661.007331][T19444] binder: 19438:19444 unknown command 0 [ 661.042215][T19444] binder: 19438:19444 ioctl c0306201 20000200 returned -22 01:59:56 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x8, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 661.058762][T19449] binder: 19438:19449 ioctl c0306201 0 returned -14 01:59:57 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMP(r0, 0x1, 0x21, &(0x7f0000000080), 0x4) 01:59:57 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) 01:59:57 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x2}, 0x6) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0, 0x62}], 0x1, 0x3c, 0x0, 0x0) 01:59:57 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt(r0, 0x1, 0x6, &(0x7f0000000080)="faa37895", 0x4) 01:59:57 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'veth0\x00', &(0x7f0000000000)=@ethtool_rxfh_indir={0x1}}) 01:59:57 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0xb, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 661.418836][T19465] binder: 19459:19465 unknown command 0 01:59:57 executing program 1: perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0x8a, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sysfs$2(0x2, 0xfffffffeffffffff, 0x0) [ 661.476365][T19465] binder: 19459:19465 ioctl c0306201 20000200 returned -22 [ 661.486982][T19468] binder: 19459:19468 unknown command 0 [ 661.492712][T19468] binder: 19459:19468 ioctl c0306201 20000200 returned -22 [ 661.540524][T19465] binder: 19459:19465 ioctl c0306201 0 returned -14 01:59:57 executing program 4: io_setup(0x3, &(0x7f0000000140)=0x0) io_destroy(r0) 01:59:57 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x8, &(0x7f0000000040), 0x4) 01:59:57 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 01:59:57 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x48, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:57 executing program 1: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4c000000}, [@call={0x85, 0x0, 0x0, 0x24}]}, &(0x7f0000000080)='syzkaller\x00', 0x6, 0xb4, &(0x7f0000000140)=""/180, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) 01:59:57 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8921, &(0x7f0000000040)={'ipvlan0\x00', 0x0}) 01:59:57 executing program 4: r0 = syz_open_dev$loop(&(0x7f0000000140), 0x0, 0x8a00) ioctl$BLKRAGET(r0, 0x1263, 0x0) [ 661.938243][T19485] binder: 19480:19485 unknown command 0 [ 661.952550][T19485] binder: 19480:19485 ioctl c0306201 20000200 returned -22 [ 661.987961][T19485] binder: 19480:19485 unknown command 0 [ 662.021044][T19485] binder: 19480:19485 ioctl c0306201 20000200 returned -22 01:59:58 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x5c, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 662.057276][T19490] syz-executor.1[19490] is installing a program with bpf_probe_write_user helper that may corrupt user memory! 01:59:58 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 01:59:58 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_buf(r0, 0x1, 0xa, 0x0, &(0x7f0000000240)) 01:59:58 executing program 4: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x4, &(0x7f0000000080)=@framed={{0x18, 0x2}, [@ldst={0x3, 0x0, 0x3}]}, &(0x7f0000000040)='GPL\x00', 0x7, 0xb4, &(0x7f0000000140)=""/180, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) 01:59:58 executing program 3: bpf$MAP_UPDATE_ELEM(0x22, &(0x7f0000000240)={0xffffffffffffffff, 0x0, 0x0}, 0x20) 01:59:58 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0xf0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 662.066987][T19490] syz-executor.1[19490] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 662.393442][T19501] binder: 19496:19501 unknown command 0 01:59:58 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_buf(r0, 0x1, 0x9, 0x0, &(0x7f0000000240)) 01:59:58 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x2, 0x0, 0x15, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r2, &(0x7f00000001c0)=@abs={0x1}, 0x6e) ioctl$sock_SIOCADDRT(r2, 0x89e0, 0x0) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(0xffffffffffffffff, 0xc0c89425, &(0x7f0000000140)={"8b2a26958d2a6f5930ecbbc7740baa9b", 0x0, 0x0, {0x3e51, 0x30321861}, {0x2, 0x5}, 0x7fffffff, [0x2, 0x3, 0x3, 0x7, 0x200, 0x40, 0x2, 0x1, 0xb1b6, 0x9, 0x7, 0x4, 0x92c4, 0x62164516, 0x100000000, 0x7f]}) ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f0000001cc0)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8914, &(0x7f0000000040)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r') ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x8923, &(0x7f0000000680)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\x00\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1\x81\x96\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xfa4\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ') ioctl$BTRFS_IOC_SCRUB(r5, 0xc400941b, &(0x7f00000018c0)={r4, 0x8, 0x80000001, 0x1}) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r2, 0x50009418, &(0x7f0000000480)={{}, r3, 0x2, @unused=[0x6, 0x100000001, 0x6, 0x6], @devid=r4}) ioctl$BTRFS_IOC_SCRUB_PROGRESS(0xffffffffffffffff, 0xc400941d, &(0x7f0000000080)={r4, 0xfffffffffffffffa, 0x9}) ioctl$BTRFS_IOC_DEV_INFO(0xffffffffffffffff, 0xd000941e, &(0x7f0000000180)={r4, "936c110874ece2efe2eda364fd7fa6f3"}) ioctl$BTRFS_IOC_SNAP_DESTROY_V2(0xffffffffffffffff, 0x5000943f, &(0x7f0000000080)={{}, 0x0, 0x0, @inherit={0x60, &(0x7f0000001480)=ANY=[@ANYBLOB="01020000000000000300000000000000070000517f000000000000000000000003000000000000000100000000d80000000000000000008000000000810000000000000040000000000000000800000000000000eca000000000000050793c5a27cef2c5a454f263a4e4e9483c615fb3c4ae52a2dda2ebe20525e0206c83a913680c4dff969a541ab4e9a7354791a2102ce7560fcac0c2daba43b254c15ee41c5b098dd83c68fc51b1cb041347b4573dbdc9cdbadb9f684257f8e0a2ea79c8ac7eb353d8b5fba4b670af8fdfa95b2be396dae5d401b2c1031ca87bfc5715562947753c23337188266eb91fb4584a6646ea10c03190a6585536a498405e652d923c1eb616bb7af00e270493cf2dc823dc12a2cd8d00000000000000000000003788c27f4b3e420df3461b07f8e9f58241e25a9189d2a07e671b0feb6ecb3875d083f30780ea72"]}, @devid=r4}) ioctl$BTRFS_IOC_SCRUB_PROGRESS(0xffffffffffffffff, 0xc400941d, &(0x7f0000000140)={r4, 0x3ff, 0x7, 0x1}) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f0000000480)={0x4, 0x6, {0x5, @struct={0x100, 0x9}, 0x0, 0x0, 0x1, 0x1f, 0x5, 0x3, 0xc9, @struct={0x451, 0xc}, 0xa35d, 0x8, [0x1, 0x5, 0x1f, 0x355, 0x70e9e7c3, 0x6]}, {0x5, @usage=0x2, 0x0, 0x80000001, 0x8, 0x4, 0x6, 0xb01a, 0xa, @struct={0x1000, 0x4}, 0x3f, 0x8, [0x1c0000000000, 0x9, 0xffffffffffffffc0, 0x2, 0x2]}, {0x7fff, @struct={0x4, 0xfffffeff}, r4, 0x7b89, 0x8, 0xaa3c, 0xca, 0x2, 0x2, @struct={0xff, 0x3}, 0x6, 0xacd, [0x100000000, 0x9, 0x7, 0x9, 0x10000, 0x400]}, {0x4, 0xfff, 0x3}}) ioctl$EVIOCSKEYCODE(r0, 0x40084504, &(0x7f0000000040)=[0x2, 0x1ff]) [ 662.472826][T19503] binder: 19496:19503 unknown command 0 [ 662.474384][T19501] binder: 19496:19501 ioctl c0306201 20000200 returned -22 01:59:58 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_buf(r0, 0x1, 0x6, 0x0, &(0x7f0000000240)) 01:59:58 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f00000001c0)={0x2, 0x0, 0x0, 0x101}, 0x40) [ 662.527322][T19503] binder: 19496:19503 ioctl c0306201 20000200 returned -22 01:59:58 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 01:59:58 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x300, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:58 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_tcp_buf(r0, 0x6, 0x19, 0x0, &(0x7f0000000000)) 01:59:58 executing program 3: syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000002680)='ns/time_for_children\x00') 01:59:58 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8942, &(0x7f0000000040)={'ipvlan0\x00', 0x0}) [ 662.904199][T19521] binder: 19518:19521 unknown command 0 [ 662.941383][T19521] binder: 19518:19521 ioctl c0306201 20000200 returned -22 [ 662.975187][T19524] binder: 19518:19524 unknown command 0 [ 663.009912][T19524] binder: 19518:19524 ioctl c0306201 20000200 returned -22 01:59:59 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x600, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:59 executing program 4: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x4, &(0x7f0000000000)=@framed={{}, [@alu={0x4, 0x0, 0xd, 0x0, 0x0, 0xfffffffffffffff0}]}, &(0x7f00000000c0)='syzkaller\x00', 0x7, 0xb4, &(0x7f0000000140)=""/180, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) 01:59:59 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0x0, 0x0, &(0x7f0000001980), 0x0, 0x0, 0x0}) 01:59:59 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_buf(r0, 0x1, 0x2f, 0x0, &(0x7f0000000240)) [ 663.253480][T19509] Y­4`Ò˜: renamed from lo [ 663.435380][T19540] binder: 19534:19540 unknown command 0 01:59:59 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r0, r3, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(r3, 0x40086607, &(0x7f0000000200)=0x800) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) ppoll(&(0x7f0000000040)=[{0xffffffffffffffff, 0x4000}, {r3, 0x1300}], 0x2, &(0x7f00000000c0)={r4, r5+60000000}, &(0x7f0000000240)={[0xe8]}, 0x8) r6 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r6, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) ioctl$EVIOCSKEYCODE_V2(r6, 0x40284504, &(0x7f00000001c0)={0x90, 0x18, 0x0, 0x52ee, "9e697f4113808c0ca5dc983b49d77b292c67e922a9901347f0fbe500"}) r7 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000180), 0x110001, 0x0) ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r8 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r8, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) 01:59:59 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8934, &(0x7f0000000040)={'ipvlan0\x00', 0x0}) 01:59:59 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x700, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:59 executing program 4: r0 = syz_open_dev$vcsa(&(0x7f0000000100), 0x0, 0x0) inotify_add_watch(r0, 0x0, 0x300000c2) 01:59:59 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0x12, &(0x7f0000000140), 0x4) [ 663.480185][T19540] binder: 19534:19540 ioctl c0306201 20000200 returned -22 [ 663.513181][T19543] binder: 19534:19543 unknown command 0 [ 663.555620][T19543] binder: 19534:19543 ioctl c0306201 20000200 returned -22 01:59:59 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0x0, 0x0, &(0x7f0000001980), 0x0, 0x0, 0x0}) 01:59:59 executing program 1: r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$SOCK_DIAG_BY_FAMILY(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x14, 0x14, 0x1}, 0x14}}, 0x0) 01:59:59 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0xb00, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 01:59:59 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) setsockopt$sock_int(r0, 0x1, 0x5, &(0x7f0000000000)=0xa9, 0x4) 01:59:59 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt(r0, 0x0, 0x8, 0x0, 0x0) [ 663.923720][T19561] binder: 19557:19561 unknown command 0 [ 663.952229][T19561] binder: 19557:19561 ioctl c0306201 20000200 returned -22 [ 663.997511][T19566] binder: 19557:19566 unknown command 0 [ 664.024942][T19566] binder: 19557:19566 ioctl c0306201 20000200 returned -22 02:00:00 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x1f00, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 02:00:00 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8943, &(0x7f0000000040)={'ipvlan0\x00', 0x0}) 02:00:00 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000040), 0xa0802, 0x0) ioctl$EVIOCSKEYCODE_V2(r1, 0x40284504, &(0x7f0000000080)={0x5, 0x20, 0x5, 0x7fffffff, "53ca0f1babae7a6079b639635dff36cd2512fc6fbc304cddc77d8388ecb8c733"}) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) 02:00:00 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000100)=0x9500, 0x4) 02:00:00 executing program 5: r0 = syz_open_dev$binderN(&(0x7f0000000140), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binderN(&(0x7f0000000100), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000800)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) dup2(r1, r0) r2 = syz_open_dev$binderN(&(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x40046304, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x44, 0x0, &(0x7f00000002c0)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000000c0)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x1, 0x0, &(0x7f0000000040)="aa"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001a80)={0x0, 0x0, &(0x7f0000001980), 0x0, 0x0, 0x0}) 02:00:00 executing program 3: socketpair(0x1, 0x0, 0x4, &(0x7f00000016c0)) 02:00:00 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x3f00, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 02:00:00 executing program 1: bpf$MAP_UPDATE_ELEM(0xc, &(0x7f0000000240)={0xffffffffffffffff, 0x0, 0x0}, 0x20) [ 664.459718][T19583] binder: 19578:19583 unknown command 0 [ 664.494544][T19583] binder: 19578:19583 ioctl c0306201 20000200 returned -22 02:00:00 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_buf(r0, 0x1, 0x28, 0x0, &(0x7f0000000240)) [ 664.532025][T19586] binder: 19578:19586 unknown command 0 02:00:00 executing program 3: bpf$PROG_LOAD(0x5, &(0x7f0000001b80)={0x5, 0x2, &(0x7f0000000a80)=@raw=[@map_val], &(0x7f0000000ac0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff}, 0x78) [ 664.588843][T19586] binder: 19578:19586 ioctl c0306201 20000200 returned -22 02:00:00 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 02:00:00 executing program 5: socketpair(0x26, 0x5, 0x20, &(0x7f0000000040)) 02:00:00 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) ioctl$EVIOCGKEYCODE(r1, 0x80084504, &(0x7f0000000140)=""/249) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r3, r6, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) mmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2000000, 0x30, r3, 0x42cad000) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) 02:00:00 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_buf(r0, 0x1, 0x29, 0x0, &(0x7f0000000240)) 02:00:00 executing program 4: timer_create(0x0, 0x0, &(0x7f00000000c0)) timer_gettime(0x0, &(0x7f0000000100)) 02:00:00 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x3, &(0x7f0000000040)=0x1, 0x4) 02:00:01 executing program 1: bpf$MAP_UPDATE_ELEM(0xd, &(0x7f0000000240)={0xffffffffffffffff, 0x0, 0x0}, 0x20) 02:00:01 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getpeername(r0, &(0x7f0000000140)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, &(0x7f00000001c0)=0x80) 02:00:01 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x4800, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 02:00:01 executing program 3: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sysvipc/shm\x00', 0x0, 0x0) read$eventfd(r0, &(0x7f0000000140), 0x8) 02:00:01 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_buf(r0, 0x1, 0xb, 0x0, &(0x7f0000000240)) 02:00:01 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x5c00, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 02:00:01 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0xc, &(0x7f0000000100), 0x4) 02:00:01 executing program 5: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/tty/ldiscs\x00', 0x0, 0x0) read$eventfd(r0, &(0x7f0000000140), 0x8) 02:00:01 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x9, 0x608001) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) ioctl$EVIOCSKEYCODE(r0, 0x40084504, &(0x7f0000000140)=[0x9]) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) poll(&(0x7f0000000080)=[{r1, 0x280}], 0x1, 0x8742) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) 02:00:01 executing program 4: r0 = getpgrp(0x0) ioprio_set$pid(0x3, r0, 0x0) 02:00:01 executing program 3: perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0x8a, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x3, &(0x7f0000000140)=0x0) io_pgetevents(r0, 0x0, 0x0, 0x0, 0x0, 0x0) 02:00:01 executing program 1: pselect6(0x40, &(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000080), &(0x7f00000000c0)={0x77359400}, &(0x7f00000002c0)={&(0x7f0000000100), 0x2b}) 02:00:01 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0xf000, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 02:00:01 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_buf(r0, 0x1, 0x19, 0x0, &(0x7f0000000240)) 02:00:02 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0xffff, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 02:00:02 executing program 4: syz_mount_image$ext4(&(0x7f00000013c0)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x40000, 0x4, &(0x7f0000000200)=[{&(0x7f0000001340)="200000004000000003000000300000000f000000000000000200000002000000008000000080000020000000dcf4655fdcf4655f0100ffff53ef010001000000dbf4655f000000000000000001000000000000000b0000000002", 0x5a, 0x400}, {&(0x7f0000010400)="02000000030000000400000030", 0xd, 0x1000}, {&(0x7f0000010500)="ffff000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff", 0x1000, 0x2000}, {&(0x7f0000001400)="ed410000001000f4655fdcf4655fdcf4655f00001e00000004e43b1fef", 0x1d, 0x4200}], 0x0, &(0x7f0000013a00)) setxattr$trusted_overlay_upper(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0), &(0x7f0000001280)=ANY=[], 0x638, 0x0) 02:00:02 executing program 5: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x19}]}, &(0x7f0000000040)='GPL\x00', 0x7, 0xb4, &(0x7f0000000140)=""/180, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) 02:00:02 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt(r0, 0x0, 0x6, &(0x7f0000000080)="fa", 0x1) 02:00:02 executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)) [ 666.418682][T19654] loop4: detected capacity change from 0 to 512 [ 666.481602][T19654] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. 02:00:02 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 02:00:03 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSFF(r0, 0x40304580, &(0x7f0000000040)={0x51, 0xfff, 0x5, {0xfffb, 0x4}, {0x3, 0x5}, @rumble={0x20, 0x7dcd}}) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) 02:00:03 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt(r0, 0x0, 0x6, &(0x7f0000000080)="fa", 0x1) 02:00:03 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8932, &(0x7f0000000040)={'ipvlan0\x00', 0x0}) 02:00:03 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_buf(r0, 0x1, 0x3c, 0x0, &(0x7f0000000240)) 02:00:03 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8953, &(0x7f0000000040)={'ipvlan0\x00', 0x0}) 02:00:03 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x2, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 02:00:03 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x8929, &(0x7f00000000c0)={'syztnl1\x00', 0x0}) 02:00:03 executing program 3: sendmsg$SOCK_DIAG_BY_FAMILY(0xffffffffffffffff, 0x0, 0xc7128000efd002e5) 02:00:03 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8901, &(0x7f0000000040)={'ipvlan0\x00', 0x0}) 02:00:03 executing program 1: r0 = socket$inet(0x2, 0xa, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'veth1_macvtap\x00'}) 02:00:03 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x3, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 02:00:03 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0xff, 0xb, 0x0, 0xfffffffd, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) ioctl$EVIOCGKEY(r0, 0x80404518, &(0x7f0000000040)=""/13) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) 02:00:03 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_tcp_buf(r0, 0x6, 0xc, 0x0, &(0x7f0000000000)) 02:00:03 executing program 4: syz_io_uring_setup(0x2, &(0x7f0000000200), &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000000/0x2000)=nil, &(0x7f0000000280), &(0x7f00000002c0)) [ 667.603907][T19703] syz-executor.1 uses obsolete (PF_INET,SOCK_PACKET) 02:00:03 executing program 5: socketpair(0x10, 0x2, 0x813, &(0x7f0000000080)) 02:00:03 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x6, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 02:00:03 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @multicast2}, 0x10) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r1, 0x0) preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0) setsockopt$sock_int(r0, 0x1, 0x12, &(0x7f0000000040)=0x80000001, 0x4) sendto$inet(r0, 0x0, 0x0, 0x20020080, &(0x7f0000000080)={0x2, 0x4e20}, 0x10) sendto$inet(r0, &(0x7f0000000580)="8f", 0x20000581, 0x400c040, 0x0, 0x0) 02:00:03 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x25, &(0x7f0000000040), 0x4) 02:00:03 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt(r0, 0x0, 0x6, 0x0, 0x0) 02:00:03 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) mmap(&(0x7f0000fee000/0x3000)=nil, 0x3000, 0x1000000, 0x80010, r3, 0x596f9000) 02:00:03 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x7, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 02:00:03 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=@ipv6_getanyicast={0x14, 0x3e, 0x1}, 0x14}}, 0x0) 02:00:04 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x3, &(0x7f0000000040), 0x4) 02:00:04 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000940), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xc0189436, 0x400000) 02:00:04 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=@ipv6_getanyicast={0x10, 0x3e, 0x1}, 0x14}}, 0x0) 02:00:04 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x8, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 02:00:04 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_tcp_buf(r0, 0x6, 0x12, 0x0, &(0x7f0000000000)) 02:00:04 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000040)="ccf2260f009d000000000fa066baf80cb81b9fda8bef66bafc0cec26360f78bc88e8640000c4c27922f30f1c42960f320fc772a10f01f6", 0x37}], 0x1, 0x0, 0x0, 0x0) 02:00:04 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x2, &(0x7f0000000040), 0x4) 02:00:04 executing program 4: syz_mount_image$tmpfs(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={[{@size={'size', 0x3d, [0x6d, 0x0]}}]}) 02:00:04 executing program 3: r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x0) ioctl$EVIOCGSW(r0, 0x8040451b, &(0x7f0000000040)=""/44) 02:00:04 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0xb, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 02:00:04 executing program 5: perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0x8a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = add_key(0x0, 0x0, 0x0, 0x0, 0x0) add_key$keyring(&(0x7f0000000000), &(0x7f00000000c0)={'syz', 0x2}, 0x0, 0x0, r0) request_key(&(0x7f0000000100)='big_key\x00', &(0x7f0000000140)={'syz', 0x1}, &(0x7f0000000180)='\xff\xff\xff\xff\xff\xff', r0) r1 = add_key$keyring(&(0x7f0000000080), &(0x7f00000000c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) add_key(&(0x7f0000000040)='asymmetric\x00', 0x0, &(0x7f0000000140)="f2", 0xfffff, r1) keyctl$assume_authority(0x10, r1) keyctl$restrict_keyring(0x1d, r1, &(0x7f0000000400)='syzkaller\x00', &(0x7f0000000440)='vlan1\x00') r2 = add_key$keyring(&(0x7f0000000080), &(0x7f00000000c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) add_key(&(0x7f0000000040)='asymmetric\x00', 0x0, &(0x7f0000000140)="f2", 0xfffff, r2) keyctl$assume_authority(0x10, r2) keyctl$restrict_keyring(0x1d, r2, &(0x7f0000000400)='syzkaller\x00', &(0x7f0000000440)='vlan1\x00') add_key$keyring(&(0x7f0000000080), &(0x7f00000000c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) 02:00:04 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_buf(r0, 0x6, 0x1f, &(0x7f0000000080)="f2e54fabe731e098", 0x8) 02:00:04 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_buf(r0, 0x1, 0x8, 0x0, &(0x7f0000000240)) 02:00:04 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = syz_mount_image$jfs(&(0x7f00000000c0), &(0x7f0000000140)='./file0\x00', 0xffffffffffffffff, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000180)}], 0x40000, &(0x7f0000000200)={[{@noquota}, {@errors_continue}], [{@subj_type}, {@obj_role={'obj_role', 0x3d, '/dev/vmci\x00'}}, {@uid_eq={'uid', 0x3d, 0xee00}}, {@fscontext={'fscontext', 0x3d, 'sysadm_u'}}]}) open_tree(r2, &(0x7f0000000280)='./file0\x00', 0x1100) r3 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$F2FS_IOC_START_ATOMIC_WRITE(r3, 0xf501, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(0xffffffffffffffff, 0x1, &(0x7f0000000040)={0x200, r1}, 0x0) 02:00:04 executing program 3: syz_io_uring_setup(0x4319, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0xfffffffe}, &(0x7f0000001000/0x3000)=nil, &(0x7f0000003000/0x4000)=nil, &(0x7f0000000080), &(0x7f0000000100)) 02:00:04 executing program 5: r0 = getpgid(0x0) sched_rr_get_interval(r0, &(0x7f0000000040)) 02:00:04 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x48, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 02:00:04 executing program 1: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/cgroups\x00', 0x0, 0x0) read$eventfd(r0, &(0x7f0000000140), 0x8) 02:00:05 executing program 3: r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x100000, 0x5, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000800100000f000000000000000100000005000000000004000040000020000000d9f4655fd9f4655f0100ffff53ef010001000000d9f4655f000000000000000001000000000000000b0000000004000008000000d2c201001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000085f42d27379e44ba9a8dcb77402e9f71010040", 0x1f, 0x4e0}, {&(0x7f0000010400)="02000000030000000400000018000f000300040000000000000000000f00c2b4", 0x20, 0x800}, {&(0x7f0000011600)="ed41000000080000d9f4655fd9f4655fd9f4655f00000000000004004000000000000800050000000af301000400000000000000000000000100000020", 0x3d, 0x2400}, {&(0x7f0000012500)="020000000c0001022e000000020000000c0002022e2e00000b00000014", 0x1d, 0x10000}], 0x0, &(0x7f0000013e00)=ANY=[]) getdents(r0, &(0x7f0000000040)=""/50, 0x32) 02:00:05 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x5c, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 02:00:05 executing program 5: r0 = socket$packet(0x11, 0x2, 0x300) recvmmsg(r0, &(0x7f0000004800)=[{{0x0, 0x0, &(0x7f00000017c0)=[{&(0x7f00000003c0)=""/173, 0xad}], 0x1}}, {{0x0, 0x0, 0x0, 0x3c}}], 0x2, 0x0, 0x0) 02:00:05 executing program 4: r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x0) ioctl$EVIOCGLED(r0, 0x80404519, &(0x7f0000000040)=""/191) 02:00:05 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f0000000000)=ANY=[], 0xfffffecc) ioctl$EVIOCSKEYCODE(r2, 0x40084504, &(0x7f0000000040)=[0xfffffffe, 0x6]) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) open_tree(r1, &(0x7f0000000080)='./file0\x00', 0x0) syz_kvm_setup_cpu$x86(r3, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) [ 669.267754][T19789] loop3: detected capacity change from 0 to 2048 02:00:05 executing program 1: syz_io_uring_setup(0x431b, &(0x7f0000000000)={0x0, 0x0, 0x42}, &(0x7f0000000000/0x3000)=nil, &(0x7f0000000000/0x4000)=nil, &(0x7f0000000080), &(0x7f00000000c0)) 02:00:05 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0xf0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 669.390133][T19789] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. 02:00:05 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r0 = inotify_init1(0x0) inotify_add_watch(r0, &(0x7f0000000000)='./file0\x00', 0x21000800) 02:00:05 executing program 5: r0 = openat$zero(0xffffffffffffff9c, &(0x7f000000e340), 0x0, 0x0) fsetxattr$trusted_overlay_redirect(r0, &(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x8, 0x0) 02:00:05 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_buf(r0, 0x1, 0x2d, 0x0, &(0x7f0000000240)) 02:00:05 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x300, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 02:00:05 executing program 1: r0 = syz_open_dev$vcsa(&(0x7f0000000100), 0xc00, 0x0) ioctl$sock_TIOCINQ(r0, 0x541b, 0x0) 02:00:05 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x600, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 02:00:05 executing program 5: r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x0) ioctl$EVIOCGBITSW(r0, 0x80404525, &(0x7f0000000080)=""/4096) 02:00:05 executing program 4: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./mnt\x00', 0x0, 0x6, &(0x7f0000000200)=[{&(0x7f0000010000)="1000000040000000030000002b00000005000000010000000000000000000000002000000020000010000000000000009f09c75f0000ffff53ef0100010000009f09c75f000000000000000001000000000000000b0000008000000038000000c20201006b04000076b65be2f6da47278c750525a5b65a09", 0x78, 0x400}, {&(0x7f0000010080)="000000000000000000000000ede2de4df49d4f87b54a3176cfd4eb4f010040000c000000000000009f09c75f", 0x2c, 0x4e0}, {&(0x7f00000100c0)="01000000000000000000000000000000000000000401000012", 0x19, 0x560}, {&(0x7f00000100e0)="00000000000000000000000000000000000000000104", 0x16, 0x640}, {&(0x7f0000010100)="000000000000000000000000000000000000000000000000000000005178aedb0300000013000000230000002b0005000200040000000000907306c205002a9c00000000000000000000000000000000000000000000000091ecd11b", 0x5c, 0x7e0}, {&(0x7f0000010ce0)="00000000000000000000000000000000000000000000000000000000c99b0000ed410000000400009f09c75f9f09c75f9f09c75f00000000000003000200000000000800000000000af3010004000000000000000000000001000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005c1f", 0x9e, 0x8c60}], 0x0, &(0x7f0000010f60)) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='mnt', 0x0, 0x0) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0xc0406619, &(0x7f0000000140)={@desc={0x1, 0x0, @desc3}}) 02:00:05 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_tcp_buf(r0, 0x6, 0x1e, 0x0, &(0x7f0000000000)) [ 670.036067][T19829] loop4: detected capacity change from 0 to 140 [ 670.077527][T19829] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 670.089383][T19829] ext4 filesystem being mounted at /root/syzkaller-testdir602053728/syzkaller.hgbYLe/372/mnt supports timestamps until 2038 (0x7fffffff) 02:00:06 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x0, 0x22081) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) 02:00:06 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x700, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 02:00:06 executing program 1: bpf$MAP_UPDATE_ELEM(0x1e, &(0x7f0000000240)={0xffffffffffffffff, 0x0, 0x0}, 0x20) 02:00:06 executing program 5: io_setup(0x3, &(0x7f0000000140)=0x0) io_pgetevents(r0, 0x0, 0x0, 0x0, 0x0, 0x0) 02:00:06 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x7, &(0x7f0000000040)=0x1, 0x4) 02:00:06 executing program 4: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./mnt\x00', 0x0, 0x6, &(0x7f0000000200)=[{&(0x7f0000010000)="1000000040000000030000002b00000005000000010000000000000000000000002000000020000010000000000000009f09c75f0000ffff53ef0100010000009f09c75f000000000000000001000000000000000b0000008000000038000000c20201006b04000076b65be2f6da47278c750525a5b65a09", 0x78, 0x400}, {&(0x7f0000010080)="000000000000000000000000ede2de4df49d4f87b54a3176cfd4eb4f010040000c000000000000009f09c75f", 0x2c, 0x4e0}, {&(0x7f00000100c0)="01000000000000000000000000000000000000000401000012", 0x19, 0x560}, {&(0x7f00000100e0)="00000000000000000000000000000000000000000104", 0x16, 0x640}, {&(0x7f0000010100)="000000000000000000000000000000000000000000000000000000005178aedb0300000013000000230000002b0005000200040000000000907306c205002a9c00000000000000000000000000000000000000000000000091ecd11b", 0x5c, 0x7e0}, {&(0x7f0000010ce0)="00000000000000000000000000000000000000000000000000000000c99b0000ed410000000400009f09c75f9f09c75f9f09c75f00000000000003000200000000000800000000000af3010004000000000000000000000001000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005c1f", 0x9e, 0x8c60}], 0x0, &(0x7f0000010f60)) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='mnt', 0x0, 0x0) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r0, 0xc0406619, &(0x7f0000000140)={@desc={0x1, 0x0, @desc3}}) [ 670.389132][T19845] loop4: detected capacity change from 0 to 140 02:00:06 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0xb00, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 02:00:06 executing program 1: r0 = socket$inet(0x2, 0x3, 0x7) setsockopt(r0, 0x0, 0x40, 0x0, 0x0) [ 670.499988][T19845] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. 02:00:06 executing program 5: r0 = getpgid(0x0) r1 = getpid() kcmp$KCMP_EPOLL_TFD(r0, r1, 0x7, 0xffffffffffffffff, &(0x7f0000000480)) 02:00:06 executing program 3: syz_genetlink_get_family_id$fou(0x0, 0xffffffffffffffff) [ 670.540378][T19845] ext4 filesystem being mounted at /root/syzkaller-testdir602053728/syzkaller.hgbYLe/373/mnt supports timestamps until 2038 (0x7fffffff) 02:00:06 executing program 3: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001b40)={0x0, 0x0, 0x0, &(0x7f0000001980)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x74) 02:00:06 executing program 4: openat$autofs(0xffffff9c, &(0x7f0000000780), 0x4000, 0x0) 02:00:06 executing program 0: sendmsg$NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x40, 0x0, 0x8, 0x70bd2b, 0x25dfdbfd, {{}, {@val={0x8}, @val={0xc, 0x99, {0xfffffa2b, 0x65}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa}]}, 0x40}, 0x1, 0x0, 0x0, 0x404c080}, 0x8004) r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) 02:00:06 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x1f00, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 02:00:06 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_tcp_buf(r0, 0x6, 0x23, 0x0, &(0x7f00000001c0)) 02:00:06 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_buf(r0, 0x1, 0xc, 0x0, &(0x7f0000000240)) 02:00:06 executing program 3: socket$xdp(0x2c, 0x3, 0x0) openat$kvm(0xffffff9c, &(0x7f00000001c0), 0x0, 0x0) 02:00:06 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x3f00, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 02:00:06 executing program 5: openat$kvm(0xffffff9c, &(0x7f00000001c0), 0x0, 0x0) 02:00:06 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_RINGS_SET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x20000010) openat$autofs(0xffffff9c, 0x0, 0x0, 0x0) 02:00:06 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r5, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) setsockopt$bt_hci_HCI_DATA_DIR(r2, 0x0, 0x1, &(0x7f0000000040), 0x4) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) 02:00:07 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_RINGS_SET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) openat$autofs(0xffffff9c, &(0x7f0000000780), 0x4000, 0x0) 02:00:07 executing program 3: shmctl$IPC_SET(0x0, 0x1, &(0x7f00000003c0)={{0x0, 0x0, 0xee00, 0xee01}}) 02:00:07 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 02:00:07 executing program 5: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f00000005c0)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x400, 0x0, 0x32}, 0x9c) bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000847fff)='X', 0x7780, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) 02:00:07 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_RINGS_SET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x14}, 0x14}}, 0x0) 02:00:07 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_RINGS_SET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) 02:00:07 executing program 1: sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, 0x0, 0x0) syz_genetlink_get_family_id$fou(&(0x7f0000000180), 0xffffffffffffffff) 02:00:07 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x4800, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 02:00:07 executing program 3: timer_create(0x0, &(0x7f0000000080)={0x0, 0x12}, &(0x7f0000000200)) clock_gettime(0x0, &(0x7f00000001c0)={0x0}) timer_settime(0x0, 0x1, &(0x7f0000000340)={{0x0, 0x989680}, {r0}}, 0x0) timer_create(0x0, &(0x7f0000000000)={0x0, 0x14}, &(0x7f0000000040)=0x0) clock_nanosleep(0x2, 0x0, &(0x7f00000000c0)={0x0, 0x3938700}, &(0x7f0000000100)) timer_settime(r1, 0x0, &(0x7f0000000400)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, 0x0) 02:00:07 executing program 0: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000040), 0x80, 0x0) r1 = openat(0xffffffffffffffff, &(0x7f00000001c0)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r1, 0x0) preadv(r1, &(0x7f0000000280), 0x18, 0xd9f, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x13, 0xa, &(0x7f00000002c0)=ANY=[@ANYBLOB="180000000800000000000000fe0200001800000000020000000000000900000018250000", @ANYRES32=r0, @ANYBLOB="00000000080000000904ff00040000001ff40800020000003f2a0000080000009500000000000000f47bcd198af104cd139bf1456dcdaff2effa759820b515ddf47a35c4b32cb9ce81352779410a1b8860d3693507e5cead2142d357522cc3020b45614065cecd8f879e497911317b81234087715faa5f4b09433f0721b40bc5c7e9"], &(0x7f0000000140)='GPL\x00', 0x0, 0x1c, &(0x7f0000000180)=""/28, 0x41100, 0x17, '\x00', 0x0, 0xa, r1, 0x8, &(0x7f00000001c0)={0x7, 0x4}, 0x8, 0x10, &(0x7f0000000200)={0x4, 0x8, 0x6, 0x401}, 0x10, 0xffffffffffffffff}, 0x78) r2 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r2, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r3, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) 02:00:07 executing program 4: sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000b80)) 02:00:07 executing program 5: openat$kvm(0xffffff9c, 0x0, 0x0, 0x0) 02:00:07 executing program 1: openat$autofs(0xffffff9c, &(0x7f0000000780), 0x0, 0x0) 02:00:07 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x5c00, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 02:00:07 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_RINGS_SET(r0, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) 02:00:07 executing program 5: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001b40)={0x0, 0x3, &(0x7f0000001940)=@framed, &(0x7f0000001980)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x74) 02:00:07 executing program 1: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000b80)) 02:00:07 executing program 0: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x0, @private0}]}, &(0x7f0000000180)=0x10) r1 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f0000000240)={r2}, &(0x7f0000000280)=0x8) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f00000000c0)={r2, 0x48, &(0x7f0000000040)=[@in6={0xa, 0x4e22, 0x3, @dev={0xfe, 0x80, '\x00', 0x31}, 0x866}, @in6={0xa, 0x4e22, 0xbd2, @private1, 0xc6a}, @in={0x2, 0x4e20, @multicast2}]}, &(0x7f0000000140)=0x10) r3 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r3, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) 02:00:07 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0xf000, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 02:00:07 executing program 5: openat$autofs(0xffffff9c, &(0x7f0000000080), 0x0, 0x0) 02:00:08 executing program 3: r0 = syz_open_dev$hidraw(&(0x7f0000000040), 0x0, 0x2) write$hidraw(r0, &(0x7f0000001300)="5bbc50d97799782e3021e53e92d3be1e53e42788bd0f16eb33e5c69802e7e13253d3c0e08c07ba5a7724f732aa6743311df42222d02158e746c73f06814c037231d87aa8d7c6df5387603fd089f11716d8e8c06924691d63d74560aff4627a3ba93ac4f93a7b92fe0fc1a98f1a106e4660b094abb987c524ad00876baaa085d0087a24afdb623eacbd94aa6bc5dbf533184f95aa50a090c4e2b92f3f6e9ee9f3721e08cdf9ef6c1a90123f77104f38746fff34651740eb71e253e0ec6079999683409cb6d529875c55512ca7bd5be8d66a2e80f9871a34d4789d33a471cd7d0bcf44d423b81e5ad15bdb5d24ced4aa439cca458d4e636892b85e4cac9ea2ba4f0ec3d09710547ae4533f034390d3861424735c0267c32a7ff83d1808eb552c9f2b9702b30e9ed3bf36d1942fa1f552ef92c417e7adbd62853f4bd2bb6202be9d487d572f34411edd4bf8a47e115488038a5e047fc417e2498e2d11065c1dbce5cfe7cb570246e1416f2778b81e3c0c52ad8557b1f1bd08142dc6597bbebb9a5652be327490e13d3401651be1d7d4e7687b1414358290a16ff5de7ba970193c93558d7d95c87963a284c5bcda4773775a7ffb07af945c55cbd692eb70f712f48204e80c984702304cb88fb54c475d6e9bfd1b7339238d50257117d3bcb54e365952b5bb8b22156805ecc05c96c36b747b94fe5e19619424f88e655eff3a15aa469b3e28530122e4da0d3119591711e04db424a5ad65f6d6b1122e1ea89e879cfb6e5856364057832a0bb065cb7c383660a4c5019bd1193555631fd781a48ff6d102b40532216e9af1d71cc97d2dd2b27a809fd3eda8f76be3110e68e93f9880e4bfdb387c183c45136a746ba4d91a3b10c9f77088671831152736c07aa0ff6f5f256d66e4b9ac187f3924f903e201ecb84a74e00395e9c884fc406c9c2edb471940f6bdecfb61e428d035af049a882f157c16f6a2fee6dc3be8e475b03dc1ae219543f4412a265b648d7f220680665855329893c6200d26dd4c40fb5feccc2e771522cb4e9b623a0eb91b839998aa814ea8e7600b2bb2d94bbe1c00ca34ad5ee6999dcc5808ceaeb40bcedc6e4e738a1a45cfa34094ed94c72dee1d79d3b1a8638d51db7bd7ed522c033fd5dc04865d0729ef51dd51742cfcc83e54d698fa4305a479e8bab92cea9130c043a5554fd3939c484253968901525024c9671fe821c13e5037e44123dcbe231452f8bcc6ada5571cde9f3f43bc3d50827d56f906b966a8ccab7f273ad867e6bb666270f2ef02243d5513a11b3157cb0ce05b06a19f3435a2a31444b4c7147ca0bf7df1b6ded27745758103deab7355e23b0b22576dfffd476ef9e8e0274c62609d93ed4a145ca7ecf5e6fe323b882be6fae1c11bbcaa13650c24a75d4127426721d334d435a98c2a574edf3cd22fed35c4f4b3d43ed7dc267c28858f555e107af7473dab08dee2a14c60b45d9a8547f73ed48043f58e025268eb42c4394c56e23a64d7424ca57f008aff092812c343d7fc8b2a3be0b0bce47a74f3ba7a19bd24d418420c75d80403924a4ede2479f68fc07eba00956ed2c49c43767a640e836a7de179ff36d5e5e3fd9cda18d4efed41bdf08059c11bfeae521ef7c36ec7eeb54ef98f2f665e2ba9677d985d903b86bd3c0af266c4f2b62a6f76823b0d097495890e2db81b1fd4098f4c0baf98d923e48afe16719a9eadafc18ebd48f115e7c18615255e6737f76dd0d5121af54f8323db3e935caa3ac90dd0af9216b274ad24eadde2aed3061ef369a20e70e23d68ae0350ae7ced759f491652afc465a3659c3a5f7ce3eabaedd3c87b0f62ca3d43862b3509ebcd9d21d6e276860fc227046afdbe3bd9982826961888f969a2858c5242273105b962c84b4f26624336ccdec7709435ac8a88971cf0a626cd053935bdee08c5a1f30f76d05b9b19fd923047d3fd0ef1441ada3e760430300a4291fca1e450922163c426c15ed58a2c45d82ec21ec277de60eb0a508ca39324bf3605428ce6f3d3350bd7146421a983eec0fbca62925ac5fa613bf87e0500848e5e2d3efca8f74e79596f0bedd16fe86ebbee75dd47c5c416f2ba8c4f01d27a8641986417801cdfc50f03a3edf70fea82db0ae9854b30835ece771e2171cbc46e7d808d7ff07f81e208a8c208ad57d5855fde272cf4068d4e65ba15ca1a315b37bb85a0a75cb6eae3e8015bccb15b37ae2d9ee019187f1d47748917bde1a9c197ed0dff4bbfd9f784ac8e33bbc0e63a91e5ecae2577fb66af458d1f992f6334732301a3bb2469738367ae144575357c2b16b42c042bb4cd7fd5b0c2300ff8b383d92786a87e52e7d21d2da66147f4695799743706bb93dfc7e3c5b1c067fd9cef88af2b4e48fe578e1cd085c47f5e0d3d7c5ada5bcef369ac3a0e6a5fb3ffcefde44fbc491d92f034cc25d73bf480649211c8ab1f76a72d235f3d6da8c7ea44d75bfdac665da086e014a00dab47c4404175f7e65ea6b0833df0b96b2085549f25089947f478b2f57615f9e795a3add9cee3120a9caca89ba1b712380e145df0afa84469264366a12cfc157ba3886322701f7c0cb6cdbb1e21da56d130decb50863150791fad75295811825ac650f85b364511f7dd2d6dadfea39ff7d6c930c878f994f0fed4f3e9dc4f8ea47249f3c9d7d8bf3c033708542e703a778f54d700b96f9cdf620e17826ba1ac9239b61fbbda87432444e358ea10f9b3452f5ab096efe3ebb65e38c14c428f2e15d722ab3368ce5020c083f588e02539c02beb4c6347723a49e32070e778220a6a0678b192fe45b84dcb3a61adca72432a076cffc3f58fb3adfcb2980bf249209b4232f42f1c061e1b6ede3b0072eb642db13e6b847647b783cd527ae58e15051d8dca08426021d3fcd94e3dac56b10d77ed95273b37fc210fb293fb22f410c2ff0a7efcccab9d1e21b0eb077c93e688657d7503e9640984948cd2ad802e257d43c940c84d2c901bd6c44f30d3f8cf30a3cc921466d8b7d291e75caf50b5a765a8a52e9fb5275721c0e50561414f976459bea3a42a845d786799b922eb3c2fcc0628eb8c862e5750b6f8e12b5ef7f5b86974e378b6a8e8878ee41edbdc969e2d6f061595417cdc92102d599f7192d0afc8443b571e576a710b442af778ef8f3a7e366167787afb9f3e7498eeefbd29e43b7aff2c346c25cb61cc1d2234caf819a472fcd6565c69c6ba688f925feeb7fae10340cfe3b8cb316c646c36c91d427029ac0f4ca901d1221352c0bc26209d8065d08d980627b0dd1c196c3f72797c88496c6ef9ba4d00a741855ac11e82317e6bc7f5c2d328a849857f5072e79134f433ac41b5445e5befe23b3c55eb70e7919ec81ee0ee56c6d70f4e7645a6e9f1b7c5467a6be34aebc16f3d90f75007c8e074bc031e4e5e6cc148044ba78e3d641308e221c6154901692f3454d844c69201fce5f43c12b77ed16f646d0b8470794f7fb96c3faefcbadf64bc51cbd9803696043836de0e3b10cc91e520437cc02074221137042ff617a774434c7f25e92906c9d30e6120e717da014c8b1a599069bc1ef299ba07bbb04a10442408322e7e3d48ff2292c53a482024f22adcd4ef1cccd203ae7438b208ebf2f059f516ef56039b14f873931c3b1a0533c2a835482a0786de821f964be0fea8577b1a0ae5bca790b66b31ef4a01ada4f31d65b468a3cdc19dbb24dfd947c3b864ba51e4d2f561a67218c62c8b16dfbd34b522e40176051f68d161410f29c3b15e8c239c58f669a45b6eb5a3df6cfa730238b3ec61cac7eaf2b8d0c9ec7d8d71340bc83b74c6c9907de50b2a1ecd96f601e2d4066a44d5cb3dae4269a2d35595be94410353a01c1c12ced31865ce4bc7c16ca28180e5de3c32d8ec06665dd0b29747629213257a32c6b661898c6f7e402e6538bc55b6302fb55f948f7837cdd2e378ea124e49d330016a5062ef423f2e2f1f019fd15ced435e95640ea1cc594d7e929b6ea59fe4110d5bcdcba32314301de8d2e4a629d439fc7b71ed8fbc7a8f9d21b2655e2d6682850ab68bbb1641cac67ab0e402fe61198c8cc18d5911bb1634867d546b6284d0016d9fddaa0bb428249b846e27431e0eb5bfc2c8fdad29317df0db428181dbd6ac00d788f1ec46dd1e9dff9d18e040d512542903a487ad7fcec457351ee0368fdfb58bf87236030cc2a6f3596f69fa76d2332a6a850eb0d23257cd45eefbe29ee91d9c982f7ae2a40c043b2af50b6663967eb11e03273e8858b8bdaa49605a9b3f51264b7227a5d5fd3ed5a0f7262d5d548dcbab8bf69eb39507aafe4f57b31524f1714c0e49a63140eefc5a8b9dc98d9d40194c1ccfa7fb80faf981d56860267a3ca4a01f6e5e3e6ec20e5c8f19c2f648128ac3e24a98587d9c0ebb0eacf3a8485e9c580469bec71bb87b43cf1a4b581b4011713c062786eeceacde633f47613b1f51fcd57936ae40105a6d713835887f75a551e696fda48119b174c52ade33072952de0418b35df42626246d8908b958cb972269f0959e5838a7e459bf70f64143437305522ba19d3478bfd8eba1d44a0494653f36ee68c7148bc64fd10f6c8f9860b68065cbe588553bcebcf31a4b704a5eabc2f22c41302fa093215eafc1d24c21918afd9b40c10ba51f75114b4d530f1a13c90099d9e1c5794a66c1b6ab435fb7e97922eca095690e14432522f0c4665a141f64df65c681f250fba8b9db5c71587e1b68966868227c7a67b4a493fe67430bfdf020f585d05421810a4c89acaa9c1633618ac7beb55863713edca907dcee158fd23ca14006cac98ca34b4dc26ca200b47b3456a5f06d7e3b5083a5f7a02ef3c82fc7b441dc7e000c564943e34c414875fbc71b8d53fe579e9964dbaf7816e29a7ea7517fa78b8451d40b8ec40e575339ab", 0xfffffdef) 02:00:08 executing program 4: perf_event_open(&(0x7f00000012c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_STP_STATE={0x8, 0x5, 0x1}]}}}]}, 0x3c}}, 0x0) 02:00:08 executing program 1: syz_open_dev$evdev(&(0x7f0000000300), 0x3db, 0x841) 02:00:08 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 02:00:08 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x400, 0x80581) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) 02:00:08 executing program 5: syz_open_dev$hiddev(&(0x7f0000000000), 0x0, 0x6c0041) 02:00:08 executing program 3: r0 = syz_open_dev$evdev(&(0x7f0000000300), 0x0, 0x0) ioctl$EVIOCGVERSION(r0, 0x80044501, 0x0) 02:00:08 executing program 5: syz_open_dev$hiddev(&(0x7f0000001200), 0x0, 0x0) syz_open_dev$evdev(&(0x7f0000001300), 0xc4, 0x0) 02:00:08 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 02:00:08 executing program 4: syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) syz_usb_connect(0x0, 0x71, &(0x7f0000000f40)={{0x12, 0x1, 0x0, 0x3d, 0xb, 0xc, 0x10, 0x41e, 0x4052, 0xd017, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5f, 0x2, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x19, 0xff, 0x3, 0xad, 0x32, 0x14, 0x0, [@cdc_ecm={{0x5}, {0x5}, {0xd}}], [{{0x9, 0x5, 0x0, 0x2, 0x40, 0x0, 0x4}}, {}, {}]}}, {{0x9, 0x4, 0x21, 0x0, 0x2, 0x45, 0x3c, 0x56, 0x1f, [], [{}, {{0x9, 0x5, 0x0, 0x0, 0x40}}]}}]}}]}}, 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f0000003ec0)={0x1c, 0x0, 0x0, 0x0}) ioctl$EVIOCRMFF(0xffffffffffffffff, 0x40044581, 0x0) 02:00:08 executing program 1: syz_open_dev$hiddev(&(0x7f0000000240), 0x0, 0x121100) 02:00:08 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, &(0x7f0000000040)=0x4, 0x4) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) 02:00:08 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x6, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 02:00:08 executing program 3: r0 = syz_open_dev$hidraw(&(0x7f0000000040), 0x0, 0x2) write$hidraw(r0, &(0x7f0000001300)="5bbc50d97799782e3021e53e92d3be1e53e42788bd0f16eb33e5c69802e7e13253d3c0e08c07ba5a7724f732aa6743311df42222d02158e746c73f06814c037231d87aa8d7c6df5387603fd089f11716d8e8c06924691d63d74560aff4627a3ba93ac4f93a7b92fe0fc1a98f1a106e4660b094abb987c524ad00876baaa085d0087a24afdb623eacbd94aa6bc5dbf533184f95aa50a090c4e2b92f3f6e9ee9f3721e08cdf9ef6c1a90123f77104f38746fff34651740eb71e253e0ec6079999683409cb6d529875c55512ca7bd5be8d66a2e80f9871a34d4789d33a471cd7d0bcf44d423b81e5ad15bdb5d24ced4aa439cca458d4e636892b85e4cac9ea2ba4f0ec3d09710547ae4533f034390d3861424735c0267c32a7ff83d1808eb552c9f2b9702b30e9ed3bf36d1942fa1f552ef92c417e7adbd62853f4bd2bb6202be9d487d572f34411edd4bf8a47e115488038a5e047fc417e2498e2d11065c1dbce5cfe7cb570246e1416f2778b81e3c0c52ad8557b1f1bd08142dc6597bbebb9a5652be327490e13d3401651be1d7d4e7687b1414358290a16ff5de7ba970193c93558d7d95c87963a284c5bcda4773775a7ffb07af945c55cbd692eb70f712f48204e80c984702304cb88fb54c475d6e9bfd1b7339238d50257117d3bcb54e365952b5bb8b22156805ecc05c96c36b747b94fe5e19619424f88e655eff3a15aa469b3e28530122e4da0d3119591711e04db424a5ad65f6d6b1122e1ea89e879cfb6e5856364057832a0bb065cb7c383660a4c5019bd1193555631fd781a48ff6d102b40532216e9af1d71cc97d2dd2b27a809fd3eda8f76be3110e68e93f9880e4bfdb387c183c45136a", 0x269) write$hidraw(r0, &(0x7f0000001300)="5bbc50d97799782e3021e53e92d3be1e53e42788bd0f16eb33e5c69802e7e13253d3c0e08c07ba5a7724f732aa6743311df42222d02158e746c73f06814c037231d87aa8d7c6df5387603fd089f11716d8e8c06924691d63d74560aff4627a3ba93ac4f93a7b92fe0fc1a98f1a106e4660b094abb987c524ad00876baaa085d0087a24afdb623eacbd94aa6bc5dbf533184f95aa50a090c4e2b92f3f6e9ee9f3721e08cdf9ef6c1a90123f77104f38746fff34651740eb71e253e0ec6079999683409cb6d529875c55512ca7bd5be8d66a2e80f9871a34d4789d33a471cd7d0bcf44d423b81e5ad15bdb5d24ced4aa439cca458d4e636892b85e4cac9ea2ba4f0ec3d09710547ae4533f034390d3861424735c0267c32a7ff83d1808eb552c9f2b9702b30e9ed3bf36d1942fa1f552ef92c417e7adbd62853f4bd2bb6202be9d487d572f34411edd4bf8a47e115488038a5e047fc417e2498e2d11065c1dbce5cfe7cb570246e1416f2778b81e3c0c52ad8557b1f1bd08142dc6597bbebb9a5652be327490e13d3401651be1d7d4e7687b1414358290a16ff5de7ba970193c93558d7d95c87963a284c5bcda4773775a7ffb07af945c55cbd692eb70f712f48204e80c984702304cb88fb54c475d6e9bfd1b7339238d50257117d3bcb54e365952b5bb8b22156805ecc05c96c36b747b94fe5e19619424f88e655eff3a15aa469b3e28530122e4da0d3119591711e04db424a5ad65f6d6b1122e1ea89e879cfb6e5856364057832a0bb065cb7c383660a4c5019bd1193555631fd781a48ff6d102b40532216e9af1d71cc97d2dd2b27a809fd3eda8f76be3110e68e93f9880e4bfdb387c183c45136a746ba4d91a3b10c9f77088671831152736c07aa0ff6f5f256d66e4b9ac187f3924f903e201ecb84a74e00395e9c884fc406c9c2edb471940f6bdecfb61e428d035af049a882f157c16f6a2fee6dc3be8e475b03dc1ae219543f4412a265b648d7f220680665855329893c6200d26dd4c40fb5feccc2e771522cb4e9b623a0eb91b839998aa814ea8e7600b2bb2d94bbe1c00ca34ad5ee6999dcc5808ceaeb40bcedc6e4e738a1a45cfa34094ed94c72dee1d79d3b1a8638d51db7bd7ed522c033fd5dc04865d0729ef51dd51742cfcc83e54d698fa4305a479e8bab92cea9130c043a5554fd3939c484253968901525024c9671fe821c13e5037e44123dcbe231452f8bcc6ada5571cde9f3f43bc3d50827d56f906b966a8ccab7f273ad867e6bb666270f2ef02243d5513a11b3157cb0ce05b06a19f3435a2a31444b4c7147ca0bf7df1b6ded27745758103deab7355e23b0b22576dfffd476ef9e8e0274c62609d93ed4a145ca7ecf5e6fe323b882be6fae1c11bbcaa13650c24a75d4127426721d334d435a98c2a574edf3cd22fed35c4f4b3d43ed7dc267c28858f555e107af7473dab08dee2a14c60b45d9a8547f73ed48043f58e025268eb42c4394c56e23a64d7424ca57f008aff092812c343d7fc8b2a3be0b0bce47a74f3ba7a19bd24d418420c75d80403924a4ede2479f68fc07eba00956ed2c49c43767a640e836a7de179ff36d5e5e3fd9cda18d4efed41bdf08059c11bfeae521ef7c36ec7eeb54ef98f2f665e2ba9677d985d903b86bd3c0af266c4f2b62a6f76823b0d097495890e2db81b1fd4098f4c0baf98d923e48afe16719a9eadafc18ebd48f115e7c18615255e6737f76dd0d5121af54f8323db3e935caa3ac90dd0af9216b274ad24eadde2aed3061ef369a20e70e23d68ae0350ae7ced759f491652afc465a3659c3a5f7ce3eabaedd3c87b0f62ca3d43862b3509ebcd9d21d6e276860fc227046afdbe3bd9982826961888f969a2858c5242273105b962c84b4f26624336ccdec7709435ac8a88971cf0a626cd053935bdee08c5a1f30f76d05b9b19fd923047d3fd0ef1441ada3e760430300a4291fca1e450922163c426c15ed58a2c45d82ec21ec277de60eb0a508ca39324bf3605428ce6f3d3350bd7146421a983eec0fbca62925ac5fa613bf87e0500848e5e2d3efca8f74e79596f0bedd16fe86ebbee75dd47c5c416f2ba8c4f01d27a8641986417801cdfc50f03a3edf70fea82db0ae9854b30835ece771e2171cbc46e7d808d7ff07f81e208a8c208ad57d5855fde272cf4068d4e65ba15ca1a315b37bb85a0a75cb6eae3e8015bccb15b37ae2d9ee019187f1d47748917bde1a9c197ed0dff4bbfd9f784ac8e33bbc0e63a91e5ecae2577fb66af458d1f992f6334732301a3bb2469738367ae144575357c2b16b42c042bb4cd7fd5b0c2300ff8b383d92786a87e52e7d21d2da66147f4695799743706bb93dfc7e3c5b1c067fd9cef88af2b4e48fe578e1cd085c47f5e0d3d7c5ada5bcef369ac3a0e6a5fb3ffcefde44fbc491d92f034cc25d73bf480649211c8ab1f76a72d235f3d6da8c7ea44d75bfdac665da086e014a00dab47c4404175f7e65ea6b0833df0b96b2085549f25089947f478b2f57615f9e795a3add9cee3120a9caca89ba1b712380e145df0afa84469264366a12cfc157ba3886322701f7c0cb6cdbb1e21da56d130decb50863150791fad75295811825ac650f85b364511f7dd2d6dadfea39ff7d6c930c878f994f0fed4f3e9dc4f8ea47249f3c9d7d8bf3c033708542e703a778f54d700b96f9cdf620e17826ba1ac9239b61fbbda87432444e358ea10f9b3452f5ab096efe3ebb65e38c14c428f2e15d722ab3368ce5020c083f588e02539c02beb4c6347723a49e32070e778220a6a0678b192fe45b84dcb3a61adca72432a076cffc3f58fb3adfcb2980bf249209b4232f42f1c061e1b6ede3b0072eb642db13e6b847647b783cd527ae58e15051d8dca08426021d3fcd94e3dac56b10d77ed95273b37fc210fb293fb22f410c2ff0a7efcccab9d1e21b0eb077c93e688657d7503e9640984948cd2ad802e257d43c940c84d2c901bd6c44f30d3f8cf30a3cc921466d8b7d291e75caf50b5a765a8a52e9fb5275721c0e50561414f976459bea3a42a845d786799b922eb3c2fcc0628eb8c862e5750b6f8e12b5ef7f5b86974e378b6a8e8878ee41edbdc969e2d6f061595417cdc92102d599f7192d0afc8443b571e576a710b442af778ef8f3a7e366167787afb9f3e7498eeefbd29e43b7aff2c346c25cb61cc1d2234caf819a472fcd6565c69c6ba688f925feeb7fae10340cfe3b8cb316c646c36c91d427029ac0f4ca901d1221352c0bc26209d8065d08d980627b0dd1c196c3f72797c88496c6ef9ba4d00a741855ac11e82317e6bc7f5c2d328a849857f5072e79134f433ac41b5445e5befe23b3c55eb70e7919ec81ee0ee56c6d70f4e7645a6e9f1b7c5467a6be34aebc16f3d90f75007c8e074bc031e4e5e6cc148044ba78e3d641308e221c6154901692f3454d844c69201fce5f43c12b77ed16f646d0b8470794f7fb96c3faefcbadf64bc51cbd9803696043836de0e3b10cc91e520437cc02074221137042ff617a774434c7f25e92906c9d30e6120e717da014c8b1a599069bc1ef299ba07bbb04a10442408322e7e3d48ff2292c53a482024f22adcd4ef1cccd203ae7438b208ebf2f059f516ef56039b14f873931c3b1a0533c2a835482a0786de821f964be0fea8577b1a0ae5bca790b66b31ef4a01ada4f31d65b468a3cdc19dbb24dfd947c3b864ba51e4d2f561a67218c62c8b16dfbd34b522e40176051f68d161410f29c3b15e8c239c58f669a45b6eb5a3df6cfa730238b3ec61cac7eaf2b8d0c9ec7d8d71340bc83b74c6c9907de50b2a1ecd96f601e2d4066a44d5cb3dae4269a2d35595be94410353a01c1c12ced31865ce4bc7c16ca28180e5de3c32d8ec06665dd0b29747629213257a32c6b661898c6f7e402e6538bc55b6302fb55f948f7837cdd2e378ea124e49d330016a5062ef423f2e2f1f019fd15ced435e95640ea1cc594d7e929b6ea59fe4110d5bcdcba32314301de8d2e4a629d439fc7b71ed8fbc7a8f9d21b2655e2d6682850ab68bbb1641cac67ab0e402fe61198c8cc18d5911bb1634867d546b6284d0016d9fddaa0bb428249b846e27431e0eb5bfc2c8fdad29317df0db428181dbd6ac00d788f1ec46dd1e9dff9d18e040d512542903a487ad7fcec457351ee0368fdfb58bf87236030cc2a6f3596f69fa76d2332a6a850eb0d23257cd45eefbe29ee91d9c982f7ae2a40c043b2af50b6663967eb11e03273e8858b8bdaa49605a9b3f51264b7227a5d5fd3ed5a0f7262d5d548dcbab8bf69eb39507aafe4f57b31524f1714c0e49a63140eefc5a8b9dc98d9d40194c1ccfa7fb80faf981d56860267a3ca4a01f6e5e3e6ec20e5c8f19c2f648128ac3e24a98587d9c0ebb0eacf3a8485e9c580469bec71bb87b43cf1a4b581b4011713c062786eeceacde633f47613b1f51fcd57936ae40105a6d713835887f75a551e696fda48119b174c52ade33072952de0418b35df42626246d8908b958cb972269f0959e5838a7e459bf70f64143437305522ba19d3478bfd8eba1d44a0494653f36ee68c7148bc64fd10f6c8f9860b68065cbe588553bcebcf31a4b704a5eabc2f22c41302fa093215eafc1d24c21918afd9b40c10ba51f75114b4d530f1a13c90099d9e1c5794a66c1b6ab435fb7e97922eca095690e14432522f0c4665a141f64df65c681f250fba8b9db5c71587e1b68966868227c7a67b4a493fe67430bfdf020f585d05421810a4c89acaa9c1633618ac7beb55863713edca907dcee158fd23ca14006cac98ca34b4dc26ca200b47b3456a5f06d7e3b5083a5f7a02ef3c82fc7b441dc7e000c564943e34c414875fbc71b8d53fe579e9964dbaf7816e29a7ea7517fa78b8451d40b8ec40e575339ab", 0xd98) 02:00:08 executing program 5: syz_open_dev$evdev(&(0x7f0000001700), 0x0, 0x101000) 02:00:08 executing program 1: syz_open_dev$evdev(&(0x7f0000000300), 0x3db, 0x0) 02:00:09 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x21, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 02:00:09 executing program 5: r0 = syz_open_dev$hidraw(&(0x7f0000000000), 0x0, 0x402) write$hidraw(r0, &(0x7f0000001300)="5bbc50d97799782e3021e53e92d3be1e53e42788bd0f16eb33e5c69802e7e13253d3c0e08c07ba5a7724f732aa6743311df42222d02158e746c73f06814c037231d87aa8d7c6df5387603fd089f11716d8e8c06924691d63d74560aff4627a3ba93ac4f93a7b92fe0fc1a98f1a106e4660b094abb987c524ad00876baaa085d0087a24afdb623eacbd94aa6bc5dbf533184f95aa50a090c4e2b92f3f6e9ee9f3721e08cdf9ef6c1a90123f77104f38746fff34651740eb71e253e0ec6079999683409cb6d529875c55512ca7bd5be8d66a2e80f9871a34d4789d33a471cd7d0bcf44d423b81e5ad15bdb5d24ced4aa439cca458d4e636892b85e4cac9ea2ba4f0ec3d09710547ae4533f034390d3861424735c0267c32a7ff83d1808eb552c9f2b9702b30e9ed3bf36d1942fa1f552ef92c417e7adbd62853f4bd2bb6202be9d487d572f34411edd4bf8a47e115488038a5e047fc417e2498e2d11065c1dbce5cfe7cb570246e1416f2778b81e3c0c52ad8557b1f1bd08142dc6597bbebb9a5652be327490e13d3401651be1d7d4e7687b1414358290a16ff5de7ba970193c93558d7d95c87963a284c5bcda4773775a7ffb07af945c55cbd692eb70f712f48204e80c984702304cb88fb54c475d6e9bfd1b7339238d50257117d3bcb54e365952b5bb8b22156805ecc05c96c36b747b94fe5e19619424f88e655eff3a15aa469b3e28530122e4da0d3119591711e04db424a5ad65f6d6b1122e1ea89e879cfb6e5856364057832a0bb065cb7c383660a4c5019bd1193555631fd781a48ff6d102b40532216e9af1d71cc97d2dd2b27a809fd3eda8f76be3110e68e93f9880e4bfdb387c183c45136a746ba4d91a3b10c9f77088671831152736c07aa0ff6f5f256d66e4b9ac187f3924f903e201ecb84a74e00395e9c884fc406c9c2edb471940f6bdecfb61e428d035af049a882f157c16f6a2fee6dc3be8e475b03dc1ae219543f4412a265b648d7f220680665855329893c6200d26dd4c40fb5feccc2e771522cb4e9b623a0eb91b839998aa814ea8e7600b2bb2d94bbe1c00ca34ad5ee6999dcc5808ceaeb40bcedc6e4e738a1a45cfa34094ed94c72dee1d79d3b1a8638d51db7bd7ed522c033fd5dc04865d0729ef51dd51742cfcc83e54d698fa4305a479e8bab92cea9130c043a5554fd3939c484253968901525024c9671fe821c13e5037e44123dcbe231452f8", 0x36c) 02:00:09 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) read(r1, &(0x7f0000000140)=""/197, 0xc5) 02:00:09 executing program 3: r0 = syz_open_dev$hidraw(&(0x7f0000000040), 0x0, 0x0) read$hidraw(r0, 0x0, 0xeffd) [ 673.232916][ T4886] usb 5-1: new high-speed USB device number 20 using dummy_hcd 02:00:09 executing program 1: socket$xdp(0xa, 0x3, 0xa) [ 673.512754][ T4886] usb 5-1: Using ep0 maxpacket: 16 [ 673.642814][ T4886] usb 5-1: config 0 has an invalid interface number: 25 but max is 1 [ 673.650932][ T4886] usb 5-1: config 0 has an invalid interface number: 33 but max is 1 [ 673.659644][ T4886] usb 5-1: config 0 has no interface number 0 [ 673.666427][ T4886] usb 5-1: config 0 has no interface number 1 [ 673.674097][ T4886] usb 5-1: config 0 interface 25 altsetting 255 has an invalid endpoint with address 0x0, skipping [ 673.685318][ T4886] usb 5-1: config 0 interface 25 altsetting 255 has an invalid endpoint with address 0x0, skipping [ 673.696585][ T4886] usb 5-1: config 0 interface 25 altsetting 255 has an invalid endpoint with address 0x0, skipping [ 673.707810][ T4886] usb 5-1: config 0 interface 33 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 673.718978][ T4886] usb 5-1: config 0 interface 33 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 673.730084][ T4886] usb 5-1: config 0 interface 25 has no altsetting 0 [ 673.942874][ T4886] usb 5-1: New USB device found, idVendor=041e, idProduct=4052, bcdDevice=d0.17 [ 673.951961][ T4886] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 673.962115][ T4886] usb 5-1: Product: syz [ 673.967521][ T4886] usb 5-1: Manufacturer: syz [ 673.972235][ T4886] usb 5-1: SerialNumber: syz [ 673.983459][ T4886] usb 5-1: config 0 descriptor?? [ 674.014423][T19977] raw-gadget gadget: fail, usb_ep_enable returned -22 02:00:10 executing program 4: r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) accept4$vsock_stream(r0, 0x0, 0x0, 0x0) 02:00:10 executing program 5: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x2, [@struct={0x0, 0x1, 0x0, 0x4, 0x0, 0x0, [{0x1000000}]}]}}, &(0x7f0000000100)=""/232, 0x32, 0xe8, 0x1}, 0x20) 02:00:10 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x2f, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 02:00:10 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) sendto$inet(r0, 0x0, 0x0, 0x20000821, &(0x7f0000000080)={0x2, 0x0, @private}, 0x10) 02:00:10 executing program 1: syz_read_part_table(0x0, 0x1, &(0x7f0000005340)=[{0x0, 0x0, 0x100000001}]) syz_read_part_table(0x0, 0x0, 0x0) syz_mount_image$msdos(0x0, &(0x7f0000001400)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, 0x0, 0x0, 0x0) 02:00:10 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) r1 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080), 0xa56e9a3b58a4ca8f, 0x0) ioctl$F2FS_IOC_WRITE_CHECKPOINT(r1, 0xf507, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000010003ec1010000003bab137ccf00"}) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) r3 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000040), 0x200041, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) [ 674.376848][ T4886] usb 5-1: USB disconnect, device number 20 [ 674.435767][T20036] loop1: detected capacity change from 0 to 264192 02:00:10 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x32, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 02:00:10 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x0, 0x200000005c831, 0xffffffffffffffff, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x6) mincore(&(0x7f0000c58000/0x3000)=nil, 0x3000, &(0x7f0000000040)=""/93) 02:00:10 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_PROBE_MESH_LINK(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={0x0}}, 0x0) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000000540)={0x0, 0x6000000, &(0x7f0000000500)={&(0x7f0000000280)={0x80, r1, 0xd, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_FRAME={0x5f, 0x33, @probe_response={@with_ht={{{}, {}, @device_b, @device_a, @random="82ebcc838ea9"}}, 0x0, @random, 0x0, @val={0x0, 0x6, @default_ibss_ssid}, @void, @val={0x3, 0x1}, @val={0x4, 0x6}, @val={0x6, 0x2}, @val={0x2d, 0x1a}, @void, @void}}, @NL80211_ATTR_DONT_WAIT_FOR_ACK={0x4}]}, 0x80}}, 0x0) 02:00:10 executing program 4: r0 = socket(0xa, 0x3, 0x81) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000100)=0x2f1a, 0x4) setsockopt$SO_TIMESTAMP(r0, 0x1, 0x1d, &(0x7f0000000540)=0x4, 0x4) [ 674.597480][T20036] loop1: detected capacity change from 0 to 264192 02:00:10 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x2, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x2, 0x3}, 0x6) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r5, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) fsetxattr$trusted_overlay_redirect(r2, &(0x7f0000000080), &(0x7f0000000240)='./file0\x00', 0x8, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) open_by_handle_at(r7, &(0x7f0000000140)=@OVL_FILEID_V0={0xeb, 0xfb, {0x0, 0xfb, 0xeb, 0x7, 0x5, "5e3d22142ed301072f27c52f9505b486", "35829aef13243118c3c58468e5c6f572100bfa5067a3e66632c820fa5a1721f4e80c06127b0fdb6c391a517807114183315439011069be17866d58bdfd8c4b6c2f879edd6bbc53c931ba8ae18d3a691924b2c8831ee6a464d10a9184c3b51355d20c7516e3b3bfcb61b5e94f2ee79a3d41ad799f22bd53885d4b16d308bd9412b74c37af212abd0d4e52e36d2d4a871c63e1e7788952cb7c544d7890b62427ec0f4aa41e9308deee30e457ae00caabee1f67883124965740f3877ec84410f4a92a169005248f8f13edf1a4c14c448de205f247de8a1e"}}, 0x0) 02:00:10 executing program 1: r0 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000000)={0x5, 0x0, 0x0, 0x0, 0x0, "1cbbe8b0acc62e8e"}) 02:00:10 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x33, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 02:00:10 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r0, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) recvmmsg(0xffffffffffffffff, &(0x7f0000000cc0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x1612c2, 0x0) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/timer_list\x00', 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) sendfile(r2, r3, 0x0, 0x4000000000010046) 02:00:10 executing program 4: r0 = socket$inet_sctp(0x2, 0x5, 0x84) connect$inet(r0, &(0x7f0000000180)={0x10, 0x2}, 0x10) sendto(r0, 0x0, 0x0, 0x0, &(0x7f0000000080)=@in6={0x1c, 0x1c, 0x3}, 0x1c) 02:00:10 executing program 3: r0 = openat$ptmx(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) sendfile(r0, 0xffffffffffffffff, 0x0, 0x0) 02:00:10 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x3a, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 02:00:10 executing program 1: r0 = socket(0x1e, 0x1, 0x0) sched_setattr(0x0, 0x0, 0x0) sched_setattr(0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) prlimit64(0x0, 0x0, &(0x7f0000000040)={0x6}, &(0x7f0000000080)) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x2000, 0xa4) prlimit64(0x0, 0x0, &(0x7f0000000100)={0x7, 0x80000000}, &(0x7f0000000180)) perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x9, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) connect$tipc(r0, &(0x7f0000000000)=@name={0x1e, 0x2, 0x0, {{0x1, 0x1}}}, 0x10) write$binfmt_misc(r0, &(0x7f0000000040)=ANY=[], 0x2000011a) 02:00:11 executing program 4: fork() waitid(0x0, 0x0, 0x0, 0x9, 0x0) 02:00:11 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x6c, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) 02:00:11 executing program 3: r0 = socket(0x1e, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r1 = getpid() sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x2, 0x0, 0x0, 0x9}, 0x0) sched_setattr(r1, &(0x7f0000000240)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000040)={0x6}, &(0x7f0000000080)) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x2000, 0xa4) prlimit64(r1, 0xd, &(0x7f0000000100)={0x7, 0x80000000}, &(0x7f0000000180)) perf_event_open(&(0x7f0000000340)={0x6, 0x80, 0x9, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) connect$tipc(r0, &(0x7f0000000000)=@name={0x1e, 0x2, 0x0, {{0x1, 0x1}}}, 0x10) write$binfmt_misc(r0, &(0x7f0000000040)=ANY=[], 0x2000011a) 02:00:11 executing program 4: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1000002, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x6, 0x80, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 02:00:11 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000440), 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80104592, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x401, "ed105400000000003ec1010000003bab137ccff52ba200fe407adb7ec6399700"}) mmap(&(0x7f0000ffa000/0x1000)=nil, 0x1000, 0x8, 0x40010, r0, 0xea42c000) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) 02:00:11 executing program 2: syz_emit_ethernet(0x6a, &(0x7f0000000080)={@multicast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x3, 0x0, 0x3, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x11, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x7, 0x13, 0x0, [@empty=0x1000000, @remote, @multicast2, @remote]}, @ssrr={0x89, 0x17, 0x0, [@loopback, @dev, @dev, @loopback, @rand_addr]}]}}}}}}}, 0x0) [ 675.392165][ T301] ================================================================== [ 675.400624][ T301] BUG: KASAN: use-after-free in tipc_recvmsg+0xf77/0xf90 [ 675.408396][ T301] Read of size 4 at addr ffff888085abcf40 by task kworker/u4:7/301 [ 675.416309][ T301] [ 675.418641][ T301] CPU: 1 PID: 301 Comm: kworker/u4:7 Not tainted 5.14.0-rc2-next-20210723-syzkaller #0 [ 675.428384][ T301] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 675.438453][ T301] Workqueue: tipc_rcv tipc_conn_recv_work [ 675.444212][ T301] Call Trace: [ 675.447503][ T301] dump_stack_lvl+0xcd/0x134 [ 675.452125][ T301] print_address_description.constprop.0.cold+0x6c/0x309 [ 675.459295][ T301] ? tipc_recvmsg+0xf77/0xf90 [ 675.463988][ T301] ? tipc_recvmsg+0xf77/0xf90 [ 675.468860][ T301] kasan_report.cold+0x83/0xdf [ 675.473737][ T301] ? tipc_recvmsg+0xf77/0xf90 [ 675.478440][ T301] tipc_recvmsg+0xf77/0xf90 [ 675.482986][ T301] ? tsk_advance_rx_queue+0x460/0x460 [ 675.488381][ T301] ? aa_af_perm+0x230/0x230 [ 675.492967][ T301] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 675.499226][ T301] ? security_socket_recvmsg+0x8f/0xc0 [ 675.504962][ T301] ? tsk_advance_rx_queue+0x460/0x460 [ 675.510353][ T301] sock_recvmsg+0xca/0x110 [ 675.514792][ T301] tipc_conn_rcv_from_sock+0x162/0x2f0 [ 675.520276][ T301] ? tipc_conn_rcv_sub+0x650/0x650 [ 675.525449][ T301] tipc_conn_recv_work+0xeb/0x190 [ 675.530503][ T301] process_one_work+0x98d/0x1630 [ 675.535547][ T301] ? pwq_dec_nr_in_flight+0x320/0x320 [ 675.540949][ T301] ? rwlock_bug.part.0+0x90/0x90 [ 675.545902][ T301] ? _raw_spin_lock_irq+0x41/0x50 [ 675.550958][ T301] worker_thread+0x658/0x11f0 [ 675.555931][ T301] ? process_one_work+0x1630/0x1630 [ 675.561153][ T301] kthread+0x3e5/0x4d0 [ 675.565242][ T301] ? set_kthread_struct+0x130/0x130 [ 675.570560][ T301] ret_from_fork+0x1f/0x30 [ 675.575042][ T301] [ 675.577454][ T301] Allocated by task 20105: [ 675.581867][ T301] kasan_save_stack+0x1b/0x40 [ 675.588047][ T301] __kasan_slab_alloc+0x84/0xa0 [ 675.592924][ T301] kmem_cache_alloc_node+0x266/0x3e0 [ 675.598754][ T301] __alloc_skb+0x20b/0x340 [ 675.603196][ T301] tipc_buf_acquire+0x25/0xe0 [ 675.608046][ T301] tipc_msg_build+0xf7/0x10a0 [ 675.612744][ T301] __tipc_sendstream+0x6d0/0x1150 [ 675.617839][ T301] tipc_sendstream+0x4c/0x70 [ 675.622628][ T301] sock_sendmsg+0xcf/0x120 [ 675.627147][ T301] sock_write_iter+0x289/0x3c0 [ 675.631920][ T301] new_sync_write+0x426/0x650 [ 675.636695][ T301] vfs_write+0x75a/0xa40 [ 675.640999][ T301] ksys_write+0x1ee/0x250 [ 675.645438][ T301] do_syscall_64+0x35/0xb0 [ 675.649874][ T301] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 675.655789][ T301] [ 675.658116][ T301] Freed by task 301: [ 675.662105][ T301] kasan_save_stack+0x1b/0x40 [ 675.667063][ T301] kasan_set_track+0x1c/0x30 [ 675.671688][ T301] kasan_set_free_info+0x20/0x30 [ 675.676788][ T301] __kasan_slab_free+0xfb/0x130 [ 675.681662][ T301] slab_free_freelist_hook+0xdf/0x240 [ 675.687059][ T301] kmem_cache_free+0x8e/0x5a0 [ 675.691861][ T301] kfree_skbmem+0x166/0x1b0 [ 675.696390][ T301] kfree_skb+0x140/0x3f0 [ 675.700653][ T301] tipc_recvmsg+0x70d/0xf90 [ 675.705176][ T301] sock_recvmsg+0xca/0x110 [ 675.709695][ T301] tipc_conn_rcv_from_sock+0x162/0x2f0 [ 675.715188][ T301] tipc_conn_recv_work+0xeb/0x190 [ 675.720427][ T301] process_one_work+0x98d/0x1630 [ 675.725459][ T301] worker_thread+0x658/0x11f0 [ 675.730176][ T301] kthread+0x3e5/0x4d0 [ 675.734359][ T301] ret_from_fork+0x1f/0x30 [ 675.738796][ T301] [ 675.741133][ T301] The buggy address belongs to the object at ffff888085abcf00 [ 675.741133][ T301] which belongs to the cache skbuff_fclone_cache of size 472 [ 675.755899][ T301] The buggy address is located 64 bytes inside of [ 675.755899][ T301] 472-byte region [ffff888085abcf00, ffff888085abd0d8) [ 675.769110][ T301] The buggy address belongs to the page: [ 675.774863][ T301] page:ffffea000216af00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x85abc [ 675.785033][ T301] head:ffffea000216af00 order:1 compound_mapcount:0 [ 675.791632][ T301] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 675.799644][ T301] raw: 00fff00000010200 0000000000000000 dead000000000122 ffff888144188280 [ 675.808250][ T301] raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000 [ 675.816930][ T301] page dumped because: kasan: bad access detected [ 675.823437][ T301] page_owner tracks the page as allocated [ 675.829164][ T301] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 8474, ts 675218467256, free_ts 673276198485 [ 675.849939][ T301] get_page_from_freelist+0xa72/0x2f80 [ 675.855514][ T301] __alloc_pages+0x1b2/0x500 [ 675.860387][ T301] alloc_pages+0x1a3/0x2d0 [ 675.865003][ T301] allocate_slab+0x32e/0x4b0 [ 675.869615][ T301] ___slab_alloc+0x4ba/0x820 [ 675.874222][ T301] __slab_alloc.constprop.0+0xa7/0xf0 [ 675.879700][ T301] kmem_cache_alloc_node+0x12c/0x3e0 [ 675.885007][ T301] __alloc_skb+0x20b/0x340 [ 675.889449][ T301] sk_stream_alloc_skb+0x109/0xc30 [ 675.894635][ T301] tcp_sendmsg_locked+0xc78/0x2f10 [ 675.899768][ T301] tcp_sendmsg+0x2b/0x40 [ 675.904030][ T301] inet_sendmsg+0x99/0xe0 [ 675.908414][ T301] sock_sendmsg+0xcf/0x120 [ 675.912847][ T301] sock_write_iter+0x289/0x3c0 [ 675.917630][ T301] new_sync_write+0x426/0x650 [ 675.922440][ T301] vfs_write+0x75a/0xa40 [ 675.926789][ T301] page last free stack trace: [ 675.931464][ T301] free_pcp_prepare+0x373/0x860 [ 675.936348][ T301] free_unref_page+0x19/0x690 [ 675.941138][ T301] unfreeze_partials+0x17c/0x1d0 [ 675.946099][ T301] put_cpu_partial+0x13d/0x230 [ 675.950988][ T301] qlist_free_all+0x5a/0xc0 [ 675.955505][ T301] kasan_quarantine_reduce+0x180/0x200 [ 675.960977][ T301] __kasan_slab_alloc+0x8e/0xa0 [ 675.965861][ T301] kmem_cache_alloc+0x285/0x4a0 [ 675.970731][ T301] getname_flags.part.0+0x50/0x4f0 [ 675.976021][ T301] getname_flags+0x9a/0xe0 [ 675.980806][ T301] do_symlinkat+0x86/0x300 [ 675.985338][ T301] do_syscall_64+0x35/0xb0 [ 675.989810][ T301] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 675.995899][ T301] [ 675.998223][ T301] Memory state around the buggy address: [ 676.003856][ T301] ffff888085abce00: fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc fc [ 676.012147][ T301] ffff888085abce80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 676.020480][ T301] >ffff888085abcf00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 676.028547][ T301] ^ [ 676.034707][ T301] ffff888085abcf80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 676.042874][ T301] ffff888085abd000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 676.051030][ T301] ================================================================== [ 676.059127][ T301] Disabling lock debugging due to kernel taint 02:00:12 executing program 5: r0 = socket$packet(0x11, 0x3, 0x300) io_setup(0xffff, &(0x7f0000000000)=0x0) io_submit(r1, 0x1, &(0x7f0000000200)=[&(0x7f00000001c0)={0x0, 0x0, 0x0, 0x7, 0x0, r0, &(0x7f0000000240)='Hl', 0x2}]) [ 676.613283][ T301] Kernel panic - not syncing: panic_on_warn set ... [ 676.619904][ T301] CPU: 1 PID: 301 Comm: kworker/u4:7 Tainted: G B 5.14.0-rc2-next-20210723-syzkaller #0 [ 676.631015][ T301] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 676.641063][ T301] Workqueue: tipc_rcv tipc_conn_recv_work [ 676.647055][ T301] Call Trace: [ 676.650327][ T301] dump_stack_lvl+0xcd/0x134 [ 676.654994][ T301] panic+0x306/0x73d [ 676.658931][ T301] ? __warn_printk+0xf3/0xf3 [ 676.663644][ T301] ? preempt_schedule_common+0x59/0xc0 [ 676.669093][ T301] ? tipc_recvmsg+0xf77/0xf90 [ 676.673775][ T301] ? preempt_schedule_thunk+0x16/0x18 [ 676.679141][ T301] ? trace_hardirqs_on+0x38/0x1c0 [ 676.684289][ T301] ? trace_hardirqs_on+0x51/0x1c0 [ 676.689303][ T301] ? tipc_recvmsg+0xf77/0xf90 [ 676.693970][ T301] ? tipc_recvmsg+0xf77/0xf90 [ 676.698635][ T301] end_report.cold+0x63/0x6f [ 676.703218][ T301] kasan_report.cold+0x71/0xdf [ 676.708408][ T301] ? tipc_recvmsg+0xf77/0xf90 [ 676.713085][ T301] tipc_recvmsg+0xf77/0xf90 [ 676.717580][ T301] ? tsk_advance_rx_queue+0x460/0x460 [ 676.722956][ T301] ? aa_af_perm+0x230/0x230 [ 676.727454][ T301] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 676.733685][ T301] ? security_socket_recvmsg+0x8f/0xc0 [ 676.739158][ T301] ? tsk_advance_rx_queue+0x460/0x460 [ 676.744519][ T301] sock_recvmsg+0xca/0x110 [ 676.748931][ T301] tipc_conn_rcv_from_sock+0x162/0x2f0 [ 676.754386][ T301] ? tipc_conn_rcv_sub+0x650/0x650 [ 676.759579][ T301] tipc_conn_recv_work+0xeb/0x190 [ 676.764596][ T301] process_one_work+0x98d/0x1630 [ 676.769531][ T301] ? pwq_dec_nr_in_flight+0x320/0x320 [ 676.775158][ T301] ? rwlock_bug.part.0+0x90/0x90 [ 676.780169][ T301] ? _raw_spin_lock_irq+0x41/0x50 [ 676.785186][ T301] worker_thread+0x658/0x11f0 [ 676.789858][ T301] ? process_one_work+0x1630/0x1630 [ 676.795054][ T301] kthread+0x3e5/0x4d0 [ 676.799132][ T301] ? set_kthread_struct+0x130/0x130 [ 676.804338][ T301] ret_from_fork+0x1f/0x30 [ 676.810246][ T301] Kernel Offset: disabled [ 676.814820][ T301] Rebooting in 86400 seconds..