05:43:32 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:43:32 executing program 3: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110, 0x0, {0x0, 0x4000000000000000}}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2847.430735][T32235] binder: 32228:32235 unknown command 0 [ 2847.473688][T32235] binder: 32228:32235 ioctl c0306201 20000200 returned -22 05:43:32 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0x7a000000}], 0x0, 0x0, 0x0}) [ 2847.520463][T32242] binder: 32228:32242 ioctl c018620c 200000c0 returned -14 05:43:33 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000440)={{}, 0x1, 0x6, 0x0, {}, 0x6, 0x1}) ioctl$KVM_RUN(r4, 0xae80, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r5, 0x0) ioctl$TIOCSBRK(r5, 0x5427) ioctl$KVM_NMI(r4, 0xae9a) 05:43:33 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:43:33 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x11], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:43:33 executing program 3: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110, 0x0, {0x0, 0x4000000000000000}}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:43:33 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x6000000, 0x0, 0x0, 0x0, 0x0}) 05:43:33 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0xfdfdffff}], 0x0, 0x0, 0x0}) [ 2848.876251][T32281] binder: 32277:32281 unknown command 0 [ 2848.888946][T32281] binder: 32277:32281 ioctl c0306201 20000200 returned -22 05:43:33 executing program 3: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110, 0x0, {0x0, 0x4000000000000}}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2848.941774][T32281] binder: 32277:32281 ioctl c018620c 200000c0 returned -14 05:43:33 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:43:33 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x1d], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:43:33 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0xfffffdfd}], 0x0, 0x0, 0x0}) 05:43:33 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x7000000, 0x0, 0x0, 0x0, 0x0}) 05:43:34 executing program 3: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110, 0x0, {0x0, 0xb70c0000}}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2849.175200][T32314] binder: 32303:32314 unknown command 0 [ 2849.208418][T32314] binder: 32303:32314 ioctl c0306201 20000200 returned -22 [ 2849.222609][T32317] binder: 32303:32317 ioctl c018620c 200000c0 returned -14 05:43:34 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0x0, 0x2}], 0x0, 0x0, 0x0}) 05:43:34 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:43:34 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x8000000, 0x0, 0x0, 0x0, 0x0}) 05:43:34 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x400c630f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000140)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_GET_REGS(r4, 0x8090ae81, &(0x7f0000000140)) ioctl$VIDIOC_SUBDEV_G_EDID(r1, 0xc0285628, &(0x7f0000000040)={0x0, 0x10000, 0x1, [], &(0x7f0000000000)=0x2}) 05:43:34 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x48], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2849.468355][T32334] binder_alloc: 12546: binder_alloc_buf, no vma [ 2849.473441][T32335] binder: 32330:32335 unknown command 0 [ 2849.476936][T32332] binder: 32328:32332 unknown command 0 [ 2849.495496][T32335] binder: 32330:32335 ioctl c0306201 20000200 returned -22 05:43:34 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:43:34 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0x0, 0x3}], 0x0, 0x0, 0x0}) 05:43:34 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000440)={{}, 0x1, 0x6, 0x0, {}, 0x6, 0x1}) ioctl$KVM_RUN(r4, 0xae80, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(r1, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x80, 0x3, 0x8, 0x101, 0x0, 0x0, {0x7, 0x0, 0x8}, [@CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x15}, @CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}, @CTA_TIMEOUT_DATA={0x44, 0x4, 0x0, 0x1, @udp=[@CTA_TIMEOUT_UDP_REPLIED={0x8, 0x2, 0x1, 0x0, 0x101}, @CTA_TIMEOUT_UDP_REPLIED={0x8, 0x2, 0x1, 0x0, 0xb771}, @CTA_TIMEOUT_UDP_REPLIED={0x8, 0x2, 0x1, 0x0, 0x1ff}, @CTA_TIMEOUT_UDP_UNREPLIED={0x8, 0x1, 0x1, 0x0, 0x7}, @CTA_TIMEOUT_UDP_REPLIED={0x8, 0x2, 0x1, 0x0, 0x7}, @CTA_TIMEOUT_UDP_UNREPLIED={0x8, 0x1, 0x1, 0x0, 0x6}, @CTA_TIMEOUT_UDP_UNREPLIED={0x8, 0x1, 0x1, 0x0, 0xfff}, @CTA_TIMEOUT_UDP_UNREPLIED={0x8, 0x1, 0x1, 0x0, 0x7}]}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x6}, @CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x80}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000051) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r5, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000080)={&(0x7f0000000100)={0x13c, r6, 0x800, 0x70bd26, 0x25dfdbff, {}, [@TIPC_NLA_MON={0x14, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xff}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x800000}]}, @TIPC_NLA_MEDIA={0x38, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x701a}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}]}, @TIPC_NLA_PUBL={0x2c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xffffffff}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x80000000}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x6}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x9}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x4}]}, @TIPC_NLA_NET={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0xfffffffffffffffd}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x4}, @TIPC_NLA_NET_ID={0x8, 0x1, 0xfffffff8}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x1ff}]}, @TIPC_NLA_BEARER={0x84, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e21, 0x200, @local, 0x6}}, {0x20, 0x2, @in6={0xa, 0x4e20, 0x8, @local, 0xb3be}}}}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x800}]}]}]}, 0x13c}, 0x1, 0x0, 0x0, 0x20040000}, 0x11) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)={0x1c, 0x0, 0x907, 0x0, 0x0, {}, [@L2TP_ATTR_CONN_ID={0x8}]}, 0x1c}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000004c0)={&(0x7f0000000680)=ANY=[@ANYBLOB="a10ecd76922470c903000000515b62e45f62d3c34622df82b1e72e10253824bc18621bfd5e953b40a6f360d2cfdd4648df9519313498deb197e87414869fd53e423602cf6fd3cc805caf172736d743b3b7855cc5bc204b63eace5f0f3d456010823aa4f65f528bc9309771818761f0c3fd258ad8fb4aa50854a98004f00786f6a4d2f56533e7d05a1db593648b38c922a3159efb780bbda4481eb0ee07fd93cf900f689feb0ea4ecd2d91114e72fd4561bdde863e1a9057aae3726dca9422c7ce300e1aa46e7264dd189293391b07741f0008a3395b6097ee55d9f2fbbbac3b826837b6f6e35e31a4bf196d1442e9397a6c4115ea51e8a02f0a9af5148189f35c6f34b854f048bf5b1b524046c59b8e8bce66f392ddf731ba8477c01c735ff928c612d9fc1f4d4d91af445350842f8c0f14915f45bfef324822d3d8dfe0637ce05753b18fd868f39c81d4c8ec835c3c9617d4a65ff719354f2b208f7350c640fe7a6893f6fa8c99b2af197d371551840a88503c10168b9f6e033fb86424b4cc6a19c2839f10d9fd8a85177fd000000a485135075a8918c26d237dae7a30d8bc944055e541184fad5aa625bbc303037587a5d015fd2f4303cc15daaacb0b23f4e52494c8224f059f359525f73ee53d1fd4b92b1ca3111b7617d087b1c1c1a11db247ba5859ffbc09b22b141aa7b2b5f82f67e30f7b950ecf60a9652aa6d9f4da82ebec76436b921d0f0ea390c4e0a2493318b211b93367a876566277bc3a471d55e6fbb3ebea3b0da342eacdd9092f751d2c700", @ANYRES16=0x0, @ANYBLOB="ba362cbd7000fcdbdf250300000008001800ac1414aa"], 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x48001) ioctl$KVM_NMI(r4, 0xae9a) [ 2849.517593][T32332] binder: 32328:32332 ioctl c0306201 20000200 returned -22 [ 2849.542555][T32339] binder: 32328:32339 ioctl c018620c 200000c0 returned -14 05:43:34 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x4c], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:43:34 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x20000000, 0x0, 0x0, 0x0, 0x0}) 05:43:34 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x400c630f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) io_setup(0x0, &(0x7f0000000000)=0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x94000, 0x0) io_submit(r1, 0x1, &(0x7f00000000c0)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, r2, &(0x7f0000000240)="18220d25e024af32e6c99854f5962ef0060c759016d877dfe5e9acb1f2db35cca866a94b236f87868ec40a0f02fcf761db3741d52f316beda63edf8800a55f3a562406eacf69a46fe737dc17244e1f231d3f4e6eb47b8c40f45ed09520a7327d55af7bfcae5eb312d38079fb30b79bf374e5ebad2342163352954657423770f7b66409ec814db497ab332707b029e5aa85038a4a3493a5333da9cc48120d803fdb058c27afde69d0a94dba0842a42d4f9698f09c1b6efc762583dae316bb82a219cdefbd5677d787976434", 0xcb, 0x100000001, 0x0, 0x5, r3}]) 05:43:34 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x74], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2849.695073][T32355] binder_alloc: 12546: binder_alloc_buf, no vma [ 2849.799749][T32356] connmark_tg_check: 27 callbacks suppressed [ 2849.799773][T32356] cannot load conntrack support for proto=3 [ 2849.837744][T32371] binder: 32360:32371 unknown command 0 05:43:34 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0x0, 0x4}], 0x0, 0x0, 0x0}) 05:43:34 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x60], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2849.844912][T32369] binder: 32361:32369 unknown command 0 [ 2849.846659][T32371] binder: 32360:32371 ioctl c0306201 20000200 returned -22 [ 2849.850477][T32369] binder: 32361:32369 ioctl c0306201 20000200 returned -22 [ 2849.881236][T32369] binder: 32361:32369 ioctl c018620c 200000c0 returned -14 [ 2849.910410][T32373] cannot load conntrack support for proto=3 05:43:34 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x3f000000, 0x0, 0x0, 0x0, 0x0}) [ 2849.954148][T32380] cannot load conntrack support for proto=3 05:43:34 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x41, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x0, 0x0, 0x0}) 05:43:34 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2850.058590][T32385] binder_alloc: 12546: binder_alloc_buf, no vma [ 2850.111030][T32389] binder: 32383:32389 unknown command 0 [ 2850.120122][T32389] binder: 32383:32389 ioctl c0306201 20000200 returned -22 [ 2850.140783][T32387] cannot load conntrack support for proto=3 [ 2850.157154][T32389] binder: 32383:32389 ioctl c018620c 200000c0 returned -14 05:43:35 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x40000000, 0x0, 0x0, 0x0, 0x0}) 05:43:35 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0x0, 0x5}], 0x0, 0x0, 0x0}) [ 2850.251799][T32401] cannot load conntrack support for proto=3 [ 2850.265694][T32401] cannot load conntrack support for proto=3 [ 2850.299884][T32404] binder_alloc: 12546: binder_alloc_buf, no vma [ 2850.321448][T32405] binder: 32403:32405 unknown command 0 [ 2850.345995][T32405] binder: 32403:32405 ioctl c0306201 20000200 returned -22 [ 2850.359744][T32405] binder: 32403:32405 ioctl c018620c 200000c0 returned -14 05:43:35 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0xc, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x0, 0x0, 0x0}) 05:43:35 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x68], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:43:35 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x88], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:43:35 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0x0, 0x6}], 0x0, 0x0, 0x0}) 05:43:35 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x48000000, 0x0, 0x0, 0x0, 0x0}) 05:43:35 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280)='/dev/kvm\x00', 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r5, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_PIT(r5, 0x8048ae66, &(0x7f0000000200)={[{0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, 0x0, 0x3}, {0x3, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xab, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) r6 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x400000000000002) ioctl$VIDIOC_QUERY_DV_TIMINGS(r0, 0x80845663, &(0x7f0000000000)={0x0, @reserved}) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(r6, 0x4090ae82, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000440)={{}, 0x1, 0x6, 0x0, {}, 0x6, 0x1}) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$KVM_NMI(r6, 0xae9a) [ 2850.529123][T32411] binder: 32410:32411 unknown command 0 [ 2850.548780][T32411] binder: 32410:32411 ioctl c0306201 20000200 returned -22 [ 2850.561143][T32416] binder_alloc: 12546: binder_alloc_buf, no vma [ 2850.569884][T32418] cannot load conntrack support for proto=3 [ 2850.585627][T32423] cannot load conntrack support for proto=3 [ 2850.614502][T32411] binder: 32410:32411 ioctl c018620c 200000c0 returned -14 05:43:35 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0xfffffffd, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 05:43:35 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0x0, 0x7}], 0x0, 0x0, 0x0}) 05:43:35 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:43:35 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x4c000000, 0x0, 0x0, 0x0, 0x0}) [ 2850.683124][T32426] cannot load conntrack support for proto=3 [ 2850.792244][T32444] cannot load conntrack support for proto=3 [ 2850.817074][T32442] binder: 32437:32442 unknown command 0 [ 2850.824312][T32445] binder_alloc: 12546: binder_alloc_buf, no vma [ 2850.850405][T32447] binder: 32441:32447 unknown command 0 [ 2850.859022][T32442] binder: 32437:32442 ioctl c0306201 20000200 returned -22 05:43:35 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:43:35 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0x0, 0x12}], 0x0, 0x0, 0x0}) [ 2850.914681][T32451] binder: 32441:32451 ioctl c018620c 200000c0 returned -14 [ 2850.941847][T32447] binder: 32441:32447 ioctl c0306201 20000200 returned -14 05:43:35 executing program 3 (fault-call:2 fault-nth:0): r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) 05:43:35 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x6c], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:43:35 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x60000000, 0x0, 0x0, 0x0, 0x0}) [ 2851.069483][T32455] binder_alloc: 12546: binder_alloc_buf, no vma [ 2851.116213][T32460] binder: 32456:32460 unknown command 0 [ 2851.124143][T32462] binder: 32457:32462 unknown command 0 [ 2851.137927][T32460] binder: 32456:32460 ioctl c0306201 20000200 returned -22 [ 2851.151178][T32462] binder: 32457:32462 ioctl c0306201 20000200 returned -22 05:43:36 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0x0, 0x48}], 0x0, 0x0, 0x0}) 05:43:36 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2851.168669][T32464] FAULT_INJECTION: forcing a failure. [ 2851.168669][T32464] name failslab, interval 1, probability 0, space 0, times 0 [ 2851.201624][T32462] binder: 32457:32462 ioctl c018620c 200000c0 returned -14 [ 2851.214635][T32464] CPU: 1 PID: 32464 Comm: syz-executor.3 Not tainted 5.8.0-rc5-syzkaller #0 [ 2851.223340][T32464] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2851.233505][T32464] Call Trace: [ 2851.236804][T32464] dump_stack+0x18f/0x20d [ 2851.241156][T32464] should_fail.cold+0x5/0x14 [ 2851.245760][T32464] ? tomoyo_realpath_from_path+0xc3/0x620 [ 2851.251486][T32464] should_failslab+0x5/0xf [ 2851.255914][T32464] __kmalloc+0x27d/0x340 [ 2851.260164][T32464] ? rcu_read_lock_sched_held+0x3a/0xb0 [ 2851.265724][T32464] tomoyo_realpath_from_path+0xc3/0x620 [ 2851.271272][T32464] ? tomoyo_profile+0x42/0x50 [ 2851.276051][T32464] tomoyo_path_number_perm+0x1cb/0x4d0 [ 2851.281519][T32464] ? tomoyo_path_number_perm+0x183/0x4d0 [ 2851.287156][T32464] ? tomoyo_execute_permission+0x470/0x470 [ 2851.293010][T32464] ? lock_acquire+0x1f1/0xad0 [ 2851.297686][T32464] ? delayed_put_pid+0x30/0x30 [ 2851.302458][T32464] ? find_held_lock+0x2d/0x110 [ 2851.307268][T32464] ? __mutex_unlock_slowpath+0xe2/0x610 [ 2851.312811][T32464] ? lock_is_held_type+0xb0/0xe0 [ 2851.317756][T32464] ? __fget_files+0x294/0x400 [ 2851.322464][T32464] security_file_ioctl+0x50/0xb0 [ 2851.327407][T32464] ksys_ioctl+0x50/0x180 [ 2851.331656][T32464] __x64_sys_ioctl+0x6f/0xb0 [ 2851.336246][T32464] ? lockdep_hardirqs_on+0x6a/0xe0 [ 2851.341360][T32464] do_syscall_64+0x60/0xe0 [ 2851.345779][T32464] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2851.351666][T32464] RIP: 0033:0x45c1d9 [ 2851.355548][T32464] Code: Bad RIP value. [ 2851.359603][T32464] RSP: 002b:00007f5820a3ac78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2851.368025][T32464] RAX: ffffffffffffffda RBX: 0000000000008800 RCX: 000000000045c1d9 [ 2851.375985][T32464] RDX: 00000000200000c0 RSI: 00000000c0306201 RDI: 0000000000000003 [ 2851.383943][T32464] RBP: 00007f5820a3aca0 R08: 0000000000000000 R09: 0000000000000000 [ 2851.391902][T32464] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2851.399859][T32464] R13: 0000000000c9fb6f R14: 00007f5820a3b9c0 R15: 000000000078bfac [ 2851.453193][T32481] binder_alloc: 12546: binder_alloc_buf, no vma 05:43:36 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000340)={r2, @in6={{0xa, 0x4e24, 0x0, @local, 0x6}}, 0x3e7, 0x3, 0x1, 0x1ff, 0x6}, &(0x7f00000000c0)=0x98) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f0000000000)={r2, 0x8001}, &(0x7f0000000040)=0x8) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(r5, 0x4090ae82, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000440)={{}, 0x1, 0x6, 0x0, {}, 0x6, 0x1}) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_NMI(r5, 0xae9a) 05:43:36 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:43:36 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x74], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:43:36 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0x0, 0x4c}], 0x0, 0x0, 0x0}) 05:43:36 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x68000000, 0x0, 0x0, 0x0, 0x0}) 05:43:36 executing program 3 (fault-call:2 fault-nth:1): r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) [ 2851.551094][T32464] ERROR: Out of memory at tomoyo_realpath_from_path. [ 2851.631246][T32495] binder_alloc: 12546: binder_alloc_buf, no vma [ 2851.640577][T32496] binder: 32491:32496 unknown command 0 [ 2851.658786][T32496] binder: 32491:32496 ioctl c0306201 20000200 returned -22 05:43:36 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x7a], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2851.679792][T32503] binder: 32498:32503 unknown command 0 05:43:36 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:43:36 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0x0, 0x60}], 0x0, 0x0, 0x0}) [ 2851.708094][T32496] binder: 32491:32496 ioctl c018620c 200000c0 returned -14 [ 2851.716500][T32503] binder: 32498:32503 ioctl c0306201 20000200 returned -22 [ 2851.744743][T32510] FAULT_INJECTION: forcing a failure. [ 2851.744743][T32510] name failslab, interval 1, probability 0, space 0, times 0 [ 2851.820834][T32510] CPU: 0 PID: 32510 Comm: syz-executor.3 Not tainted 5.8.0-rc5-syzkaller #0 [ 2851.829565][T32510] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2851.839616][T32510] Call Trace: [ 2851.842919][T32510] dump_stack+0x18f/0x20d [ 2851.846276][T32529] binder_alloc: 12546: binder_alloc_buf, no vma [ 2851.847253][T32510] should_fail.cold+0x5/0x14 [ 2851.847279][T32510] ? tomoyo_encode2.part.0+0xe9/0x3a0 [ 2851.847294][T32510] should_failslab+0x5/0xf 05:43:36 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = syz_genetlink_get_family_id$fou(&(0x7f0000000040)='fou\x00') sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x24, r3, 0x800, 0x70bd2a, 0x25dfdbff, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @initdev={0xac, 0x1e, 0x1, 0x0}}, @FOU_ATTR_IPPROTO={0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x40000}, 0x8014) r4 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(r5, 0x4090ae82, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000440)={{}, 0x1, 0x6, 0x0, {}, 0x6, 0x1}) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_NMI(r5, 0xae9a) 05:43:36 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x6c000000, 0x0, 0x0, 0x0, 0x0}) [ 2851.847320][T32510] __kmalloc+0x27d/0x340 [ 2851.872192][T32510] ? tomoyo_realpath_from_path+0xc3/0x620 [ 2851.877917][T32510] tomoyo_encode2.part.0+0xe9/0x3a0 [ 2851.883125][T32510] ? tomoyo_realpath_from_path+0xc3/0x620 [ 2851.888849][T32510] tomoyo_encode+0x28/0x50 [ 2851.893266][T32510] tomoyo_realpath_from_path+0x186/0x620 [ 2851.898930][T32510] tomoyo_path_number_perm+0x1cb/0x4d0 [ 2851.904383][T32510] ? tomoyo_path_number_perm+0x183/0x4d0 [ 2851.910012][T32510] ? tomoyo_execute_permission+0x470/0x470 [ 2851.915818][T32510] ? lock_acquire+0x1f1/0xad0 [ 2851.920494][T32510] ? delayed_put_pid+0x30/0x30 [ 2851.925261][T32510] ? find_held_lock+0x2d/0x110 [ 2851.930051][T32510] ? __mutex_unlock_slowpath+0xe2/0x610 [ 2851.935592][T32510] ? lock_is_held_type+0xb0/0xe0 [ 2851.940543][T32510] ? __fget_files+0x294/0x400 [ 2851.945229][T32510] security_file_ioctl+0x50/0xb0 [ 2851.950170][T32510] ksys_ioctl+0x50/0x180 [ 2851.954416][T32510] __x64_sys_ioctl+0x6f/0xb0 [ 2851.959007][T32510] ? lockdep_hardirqs_on+0x6a/0xe0 [ 2851.964121][T32510] do_syscall_64+0x60/0xe0 05:43:36 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0x0, 0x68}], 0x0, 0x0, 0x0}) [ 2851.968541][T32510] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2851.974431][T32510] RIP: 0033:0x45c1d9 [ 2851.978316][T32510] Code: Bad RIP value. [ 2851.980193][T32534] binder: 32531:32534 unknown command 0 [ 2851.982375][T32510] RSP: 002b:00007f5820a3ac78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2851.982390][T32510] RAX: ffffffffffffffda RBX: 0000000000008800 RCX: 000000000045c1d9 [ 2851.982399][T32510] RDX: 00000000200000c0 RSI: 00000000c0306201 RDI: 0000000000000003 [ 2851.982408][T32510] RBP: 00007f5820a3aca0 R08: 0000000000000000 R09: 0000000000000000 05:43:36 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x88], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2851.982417][T32510] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2851.982426][T32510] R13: 0000000000c9fb6f R14: 00007f5820a3b9c0 R15: 000000000078bfac 05:43:36 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2852.102310][T32538] binder: 32531:32538 ioctl c018620c 200000c0 returned -14 05:43:37 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0x0, 0x6c}], 0x0, 0x0, 0x0}) 05:43:37 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0xe8], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:43:37 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2852.256877][T32534] binder: 32531:32534 ioctl c0306201 20000200 returned -14 [ 2852.359463][T32510] ERROR: Out of memory at tomoyo_realpath_from_path. 05:43:37 executing program 3 (fault-call:2 fault-nth:2): r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) 05:43:37 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x74000000, 0x0, 0x0, 0x0, 0x0}) 05:43:37 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0x0, 0x74}], 0x0, 0x0, 0x0}) 05:43:37 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0xff], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2852.513998][T32578] binder: 32575:32578 unknown command 0 [ 2852.519589][T32578] binder: 32575:32578 ioctl c0306201 20000200 returned -22 [ 2852.580196][T32588] binder: 32582:32588 unknown command 0 [ 2852.581060][T32578] binder: 32575:32578 ioctl c018620c 200000c0 returned -14 [ 2852.598573][T32588] binder: 32582:32588 ioctl c0306201 20000200 returned -22 05:43:38 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, 0x0) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, 0xffffffffffffffff, 0x0) ioctl$TIOCPKT(0xffffffffffffffff, 0x5420, &(0x7f0000000000)=0x81) ioctl$KVM_SET_REGS(r4, 0x4090ae82, 0x0) ioctl$EVIOCGREP(0xffffffffffffffff, 0x80084503, &(0x7f0000000100)=""/238) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000440)={{}, 0x1, 0x6, 0x0, {}, 0x6, 0x1}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_NMI(r4, 0xae9a) open$dir(&(0x7f0000000040)='./file0\x00', 0x2cf81, 0x8) 05:43:38 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:43:38 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:43:38 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0x0, 0x7a}], 0x0, 0x0, 0x0}) 05:43:38 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x7a000000, 0x0, 0x0, 0x0, 0x0}) 05:43:38 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) 05:43:38 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0x0, 0x300}], 0x0, 0x0, 0x0}) [ 2853.367588][T32603] binder: 32599:32603 unknown command 0 [ 2853.379079][T32603] binder: 32599:32603 ioctl c0306201 20000200 returned -22 [ 2853.388183][T32606] binder: 32602:32606 unknown command 0 05:43:38 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2853.420356][T32606] binder: 32602:32606 ioctl c0306201 20000200 returned -22 [ 2853.439284][T32603] binder: 32599:32603 ioctl c018620c 200000c0 returned -14 05:43:38 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x2], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:43:38 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x2, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) 05:43:38 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0xff000000, 0x0, 0x0, 0x0, 0x0}) 05:43:38 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0x0, 0x500}], 0x0, 0x0, 0x0}) [ 2853.696014][T32640] binder: 32633:32640 unknown command 0 [ 2853.708917][T32641] binder: 32635:32641 unknown command 0 [ 2853.719021][T32640] binder: 32633:32640 ioctl c0306201 20000200 returned -22 [ 2853.734178][T32641] binder: 32635:32641 ioctl c0306201 20000200 returned -22 [ 2853.775252][T32641] binder: 32635:32641 ioctl c018620c 200000c0 returned -14 [ 2854.622259][T32619] warn_alloc: 5 callbacks suppressed [ 2854.622280][T32619] syz-executor.1: page allocation failure: order:0, mode:0x400cc4(GFP_KERNEL_ACCOUNT|GFP_DMA32), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 2854.644893][T32619] CPU: 0 PID: 32619 Comm: syz-executor.1 Not tainted 5.8.0-rc5-syzkaller #0 [ 2854.653568][T32619] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2854.663625][T32619] Call Trace: [ 2854.666917][T32619] dump_stack+0x18f/0x20d [ 2854.671250][T32619] warn_alloc.cold+0x87/0x17a [ 2854.675925][T32619] ? zone_watermark_ok_safe+0x260/0x260 [ 2854.681511][T32619] ? wait_for_completion+0x260/0x260 [ 2854.686801][T32619] __alloc_pages_slowpath.constprop.0+0x2197/0x2780 [ 2854.693406][T32619] ? warn_alloc+0x120/0x120 [ 2854.697909][T32619] ? __alloc_pages_nodemask+0x3e5/0x930 [ 2854.703456][T32619] ? lock_is_held_type+0xb0/0xe0 [ 2854.708395][T32619] ? find_held_lock+0x2d/0x110 [ 2854.713161][T32619] __alloc_pages_nodemask+0x68f/0x930 [ 2854.718528][T32619] ? __zone_watermark_ok+0x370/0x370 [ 2854.723816][T32619] ? __alloc_pages_slowpath.constprop.0+0x2780/0x2780 [ 2854.730571][T32619] ? lock_is_held_type+0xb0/0xe0 [ 2854.735511][T32619] ? rcu_read_lock_sched_held+0x3a/0xb0 [ 2854.741052][T32619] ? __alloc_pages_nodemask+0x6b1/0x930 [ 2854.746612][T32619] alloc_pages_current+0x187/0x280 [ 2854.751729][T32619] alloc_mmu_pages+0x7f/0x170 [ 2854.756421][T32619] kvm_mmu_create+0x3cb/0x560 [ 2854.761093][T32619] kvm_arch_vcpu_create+0x16d/0xb70 [ 2854.766291][T32619] kvm_vm_ioctl+0x1547/0x23c0 [ 2854.770966][T32619] ? lock_downgrade+0x820/0x820 [ 2854.775813][T32619] ? kvm_unregister_device_ops+0x60/0x60 [ 2854.781442][T32619] ? trace_hardirqs_on+0x5f/0x220 [ 2854.786467][T32619] ? lockdep_hardirqs_on+0x6a/0xe0 [ 2854.791580][T32619] ? tomoyo_path_number_perm+0x244/0x4d0 [ 2854.797211][T32619] ? tomoyo_execute_permission+0x470/0x470 [ 2854.803020][T32619] ? __might_fault+0x11f/0x1d0 [ 2854.807790][T32619] ? __sanitizer_cov_trace_switch+0x45/0x70 [ 2854.813677][T32619] ? do_vfs_ioctl+0x27d/0x1090 [ 2854.818442][T32619] ? generic_block_fiemap+0x60/0x60 [ 2854.823637][T32619] ? __might_fault+0x190/0x1d0 [ 2854.828399][T32619] ? _copy_to_user+0x126/0x160 [ 2854.833166][T32619] ? __fget_files+0x294/0x400 [ 2854.837847][T32619] ? kvm_unregister_device_ops+0x60/0x60 [ 2854.843477][T32619] ksys_ioctl+0x11a/0x180 [ 2854.847804][T32619] __x64_sys_ioctl+0x6f/0xb0 [ 2854.852389][T32619] ? lockdep_hardirqs_on+0x6a/0xe0 [ 2854.857519][T32619] do_syscall_64+0x60/0xe0 [ 2854.861932][T32619] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2854.867832][T32619] RIP: 0033:0x45c1d9 [ 2854.871715][T32619] Code: Bad RIP value. [ 2854.875771][T32619] RSP: 002b:00007f58ffb7fc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2854.884190][T32619] RAX: ffffffffffffffda RBX: 000000000000edc0 RCX: 000000000045c1d9 [ 2854.892171][T32619] RDX: 0000000000000000 RSI: 000000000000ae41 RDI: 0000000000000006 [ 2854.900137][T32619] RBP: 000000000078bfe0 R08: 0000000000000000 R09: 0000000000000000 [ 2854.908101][T32619] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000078bfac [ 2854.916068][T32619] R13: 0000000000c9fb6f R14: 00007f58ffb809c0 R15: 000000000078bfac [ 2854.941645][T32619] Mem-Info: [ 2854.944824][T32619] active_anon:318303 inactive_anon:20515 isolated_anon:0 [ 2854.944824][T32619] active_file:2307 inactive_file:46348 isolated_file:9 [ 2854.944824][T32619] unevictable:0 dirty:69 writeback:0 [ 2854.944824][T32619] slab_reclaimable:22833 slab_unreclaimable:210181 [ 2854.944824][T32619] mapped:62917 shmem:20757 pagetables:124747 bounce:0 [ 2854.944824][T32619] free:681763 free_pcp:655 free_cma:0 [ 2854.992189][T32619] Node 0 active_anon:966308kB inactive_anon:47800kB active_file:8kB inactive_file:3064kB unevictable:0kB isolated(anon):0kB isolated(file):36kB mapped:224068kB dirty:20kB writeback:0kB shmem:48760kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 323584kB writeback_tmp:0kB all_unreclaimable? yes [ 2855.022284][T32619] Node 1 active_anon:306904kB inactive_anon:34260kB active_file:9220kB inactive_file:182328kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:27600kB dirty:256kB writeback:0kB shmem:34268kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB all_unreclaimable? no [ 2855.051084][T32619] Node 0 DMA free:10264kB min:220kB low:272kB high:324kB reserved_highatomic:0KB active_anon:3964kB inactive_anon:272kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15908kB mlocked:0kB kernel_stack:124kB pagetables:272kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2855.104813][T32619] lowmem_reserve[]: 0 2515 2515 2515 2515 [ 2855.110565][T32619] Node 0 DMA32 free:35300kB min:35916kB low:44892kB high:53868kB reserved_highatomic:0KB active_anon:962344kB inactive_anon:47528kB active_file:8kB inactive_file:3064kB unevictable:0kB writepending:20kB present:3129332kB managed:2578200kB mlocked:0kB kernel_stack:85656kB pagetables:245232kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2855.144032][T32619] lowmem_reserve[]: 0 0 0 0 0 [ 2855.148727][T32619] Node 0 Normal free:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:786432kB managed:0kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2855.178455][T32619] lowmem_reserve[]: 0 0 0 0 0 [ 2855.183891][T32619] Node 1 Normal free:2682648kB min:53972kB low:67464kB high:80956kB reserved_highatomic:0KB active_anon:306904kB inactive_anon:34260kB active_file:9220kB inactive_file:182328kB unevictable:0kB writepending:256kB present:3932160kB managed:3870200kB mlocked:0kB kernel_stack:80812kB pagetables:253484kB bounce:0kB free_pcp:492kB local_pcp:492kB free_cma:0kB [ 2855.217801][T32619] lowmem_reserve[]: 0 0 0 0 0 [ 2855.230156][T32619] Node 0 DMA: 4*4kB (ME) 5*8kB (UM) 6*16kB (UM) 8*32kB (U) 8*64kB (UME) 7*128kB (ME) 7*256kB (UME) 5*512kB (UME) 2*1024kB (UE) 1*2048kB (M) 0*4096kB = 10264kB [ 2855.261706][T32619] Node 0 DMA32: 210*4kB (UME) 1113*8kB (UME) 470*16kB (UME) 230*32kB (UME) 118*64kB (UME) 21*128kB (UME) 6*256kB (UME) 0*512kB 0*1024kB 0*2048kB 0*4096kB = 36400kB [ 2855.297129][T32619] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 2855.323854][T32619] Node 1 Normal: 298*4kB (UME) 45*8kB (UME) 50*16kB (UME) 13*32kB (ME) 19*64kB (UME) 2*128kB (E) 2*256kB (E) 2*512kB (ME) 2*1024kB (ME) 2*2048kB (ME) 652*4096kB (UM) = 2682512kB [ 2855.355670][T32619] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 2855.365838][T32619] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 2855.375624][T32619] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 2855.385801][T32619] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 2855.395818][T32619] 30755 total pagecache pages [ 2855.400603][T32619] 0 pages in swap cache [ 2855.408428][T32619] Swap cache stats: add 0, delete 0, find 0/0 [ 2855.415198][T32619] Free swap = 0kB [ 2855.419006][T32619] Total swap = 0kB [ 2855.423772][T32619] 1965979 pages RAM [ 2855.427666][T32619] 0 pages HighMem/MovableOnly [ 2855.433408][T32619] 349902 pages reserved [ 2855.437643][T32619] 0 pages cma reserved 05:43:40 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) recvmsg(r0, &(0x7f0000000380)={&(0x7f0000000140)=@nl=@unspec, 0x80, &(0x7f00000002c0)=[{&(0x7f00000001c0)=""/150, 0x96}, {&(0x7f0000000280)=""/7, 0x7}], 0x2, &(0x7f0000000300)=""/81, 0x51}, 0x10143) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400204) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) getsockopt$bt_BT_POWER(r1, 0x112, 0x9, &(0x7f0000000000)=0x1, &(0x7f0000000580)=0x1) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/sequencer2\x00', 0xe2a00, 0x0) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r4, 0x84, 0x1b, &(0x7f00000004c0)=ANY=[@ANYRES32=0x0, @ANYBLOB="9f0000003e76b651889f08cd174268510e339b700645cd241b66a86b34358149cdaaca03e917c32741fcc64e2ee630f71bb66bcfefadeff7d7a77d9be97396b06f9596b2f217db617b13fa0961b39faaa35108cc0c42b8d8a75fa3336332fd7b38c20fa1302b10ac5aae95361adfbabd8d0a8fa097e3e555668c0e86b923c8a44cc2b3407b50181274a2911bc958079d25d35600"/163], &(0x7f0000000400)=0xa7) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000440)={{}, 0x1, 0x6, 0x0, {}, 0x6, 0x1}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r5, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0x4000, &(0x7f0000000080), 0x0, r5}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f00000005c0)={0x40, @tick=0x8001, 0x1, {0x3, 0x5}, 0x83, 0x2, 0x80}) 05:43:40 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0x0, 0x600}], 0x0, 0x0, 0x0}) 05:43:40 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:43:40 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x10, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) 05:43:40 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x100000000000000, 0x0, 0x0, 0x0, 0x0}) 05:43:40 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x3], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2855.571802][T32668] binder: 32663:32668 unknown command 0 [ 2855.572634][T32670] binder: 32664:32670 unknown command 0 [ 2855.584981][T32672] connmark_tg_check: 27 callbacks suppressed [ 2855.584991][T32672] cannot load conntrack support for proto=3 [ 2855.609807][T32668] binder: 32663:32668 ioctl c0306201 20000200 returned -22 [ 2855.619630][T32675] binder_alloc_new_buf_locked: 6 callbacks suppressed [ 2855.619638][T32675] binder_alloc: 12546: binder_alloc_buf, no vma [ 2855.631568][T32670] binder: 32664:32670 ioctl c0306201 20000200 returned -22 [ 2855.649931][T32681] binder: 32663:32681 ioctl 10 200000c0 returned -22 [ 2855.657336][T32682] binder: 32664:32682 ioctl c018620c 200000c0 returned -14 05:43:40 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x4], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2855.668490][T32683] cannot load conntrack support for proto=3 [ 2855.674116][T32674] cannot load conntrack support for proto=3 [ 2855.698798][T32668] binder: 32663:32668 unknown command 0 [ 2855.706947][T32681] binder: 32663:32681 ioctl 10 200000c0 returned -22 05:43:40 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, 0x0) r5 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280)='/dev/kvm\x00', 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r7, 0xae60) ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_GET_NR_MMU_PAGES(r1, 0xae45, 0x20) setsockopt$CAN_RAW_JOIN_FILTERS(r5, 0x65, 0x6, &(0x7f0000000040), 0x4) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000440)={{}, 0x1, 0x6, 0x0, {}, 0x6, 0x1}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_NMI(r4, 0xae9a) 05:43:40 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x200000000000000, 0x0, 0x0, 0x0, 0x0}) 05:43:40 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2855.736797][T32668] binder: 32663:32668 ioctl c0306201 20000200 returned -22 05:43:40 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0x0, 0x700}], 0x0, 0x0, 0x0}) 05:43:40 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x4c01, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) [ 2855.910252][T32711] binder: 32703:32711 unknown command 0 [ 2855.921470][T32713] cannot load conntrack support for proto=3 [ 2855.935449][T32716] binder_alloc: 12546: binder_alloc_buf, no vma [ 2855.947282][T32704] cannot load conntrack support for proto=3 05:43:40 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x5], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2855.958606][T32711] binder: 32703:32711 ioctl c0306201 20000200 returned -22 [ 2855.983489][T32728] cannot load conntrack support for proto=3 [ 2855.987203][T32722] binder: 32703:32722 ioctl c018620c 200000c0 returned -14 05:43:40 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0x0, 0x1200}], 0x0, 0x0, 0x0}) [ 2856.019665][T32730] binder: 32723:32730 unknown command 0 [ 2856.051730][T32730] binder: 32723:32730 ioctl c0306201 20000200 returned -22 05:43:40 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) setsockopt$IP_VS_SO_SET_ZERO(r0, 0x0, 0x48f, &(0x7f0000000380)={0x21, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e20, 0x0, 'none\x00', 0x11, 0x8, 0x76}, 0x2c) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000440)={{}, 0x1, 0x6, 0x0, {}, 0x6, 0x1}) ioctl$KVM_RUN(r4, 0xae80, 0x0) r5 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uhid\x00', 0x802, 0x0) vmsplice(r5, &(0x7f0000000280)=[{&(0x7f0000000040)="760bd767f6d51bd689b6f66be754d2dd3a7deba8d044bd4cf99d28d0a08b654eb8364056cf0e145ffc6845d298c03a69828487", 0x33}, {&(0x7f0000000080)="4d1ad06b0caf353b00ed6a29d216b2a7cb8929dac9fd", 0x16}, {&(0x7f0000000100)="3fe4bd9bc218343c8ec252c6839a113c15144c8a1335cdcddc411d8ef05c05e24fdb2a8af4628d76f409d63c9358903dd26692a3c0", 0x35}, {&(0x7f0000000140)="83de47b827608866144e5e0cf5b9c097609f9b35378a5df9bb9357f65ef3da2299b040aeff29da81abd3d59f16233e74c7828b9a86e15851700d102de79e3b32afbe915ea734640da42869e3dadf32543c4a8ab26439c52398af16dc27739091bf21b0ff4b07151c53bad5cd5ee8c91861606b91dba0654659436640829e6cf387a402697c0f58aafd702517", 0x8c}, {&(0x7f0000000200)="0403a3665c6ad2feaa7ee0eb9ed106149ddc3f623657418bbfa9543a6a71c790e90cdecee6336ef1d660667aafa0b14623fd45ba2730a3151730f592344e081dea111dd55f42972e7328cb78", 0x4c}], 0x5, 0x0) ioctl$KVM_NMI(r4, 0xae9a) fsetxattr$trusted_overlay_origin(0xffffffffffffffff, &(0x7f0000000300)='trusted.overlay.origin\x00', &(0x7f0000000340)='y\x00', 0x2, 0x1) 05:43:40 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x300000000000000, 0x0, 0x0, 0x0, 0x0}) 05:43:41 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x12], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2856.074700][T32730] binder: 32723:32730 ioctl 4c01 200000c0 returned -22 [ 2856.087302][T32730] binder: 32723:32730 unknown command 0 [ 2856.096900][T32731] binder: 32723:32731 ioctl 4c01 200000c0 returned -22 [ 2856.107896][T32730] binder: 32723:32730 ioctl c0306201 20000200 returned -22 05:43:41 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x541b, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) [ 2856.171666][T32739] binder_alloc: 12546: binder_alloc_buf, no vma [ 2856.192670][T32738] binder: 32735:32738 unknown command 0 [ 2856.198238][T32738] binder: 32735:32738 ioctl c0306201 20000200 returned -22 [ 2856.211703][T32737] cannot load conntrack support for proto=3 [ 2856.257359][T32737] cannot load conntrack support for proto=3 [ 2856.266329][T32751] binder: 32735:32751 ioctl c018620c 200000c0 returned -14 [ 2856.271296][T32748] cannot load conntrack support for proto=3 05:43:41 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0x0, 0x2000}], 0x0, 0x0, 0x0}) 05:43:41 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x6], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2856.309605][T32764] cannot load conntrack support for proto=3 05:43:41 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x400000000000000, 0x0, 0x0, 0x0, 0x0}) 05:43:41 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1d], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:43:41 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000340)={r6, @in6={{0xa, 0x4e24, 0x0, @local, 0x6}}, 0x3e7, 0x3, 0x1, 0x1ff, 0x6}, &(0x7f00000000c0)=0x98) sendmsg$inet_sctp(r5, &(0x7f0000000540)={&(0x7f0000000000)=@in={0x2, 0x4e20, @broadcast}, 0x10, &(0x7f00000004c0)=[{&(0x7f0000000040)="54165cd712115a5bc0c422b8d6f725496e6936972156c03944ea6f518abd60b336ab4e06f943926f7e391d0e165a84e6842d5930b89c2b99b134", 0x3a}, {&(0x7f0000000080)="7d769fefcafcdc5b8cc9a7054fb3f29f0d0add602ae379d3dd8a7ef456a629c5278267", 0x23}, {&(0x7f0000000100)="1f457196d83a838d7a6a62e82bb060974765b3598ea5da88d99140ce85731a392b732b630a821a1e916ea925c357f1ab2323f0aed55a6f0a4d79002598", 0x3d}, {&(0x7f0000000140)="63636132480d673c2404b197f483dbe146b49a98ed1d4ecfc555236a96e2a6f461d16544342b87b1f4170208e166d27e7a850f4ccd2e3a9cfa43418b4b63d00613df07a04725d04ff4b333f04e3953c1c98fd1c368cbbf4b9d49c73103bf393ef763ce4f60ab674acebb891b8d95b15885659b2082163b17c1b0e147e5493dd33d3769c827ed8d74c0d6a912eb5d099894073ab7daa6552edb5947d5a3a6a0641b20995f6cfbc6ddded15f02e1fcca3037cde6ce3794781bbfc923fdee3a1bfc0ff8af81cf68a8bddf4cf9c599d37fb8ba67f8b12e7bfe9636d8789d1ab21c6d74fe95b904006f6cbb4a906e08", 0xed}, {&(0x7f0000000240)="4b17895f050c796ee365f3bfa7516293c5b47ab58225088049cd2061af6cfa8f3b94a53ed97c3b54c80e52942c3393b169e0637929cddb29712081512a446f4120a61cd77745e50e122d0afa23e3eb597db144c509a188e952e6345520fed7a4cd92e980374f751aa25330b49403590432d7b5ae240e7648644a4f158d716377c341510cef6b216bfe3c9281095e24bcd11cbb70ed7d4469aae56924091c36b30f387bf26c43b2f8049a3510f222a5e655d88bbc9aa18ae4aff9bc93712d64ed18cefbd6afe586678d0c2c9a56f759a2434828418efcb730f2b7ef6d6c5870b3", 0xe0}, {&(0x7f0000000340)="e9c6bad7fa489dadadfb452286b2fdf9682f67980dad905c5e21480c4c2510292e6b39db828f39c12f5ed2fa6c3bd7e0316555c06b0df06fd020d234db67a23ef9a9d9cc3145714f874025a919d5ac2a7e785d09b5be2bf77d448ccbda161c3af11f0355b4bbb2ef06c5457d9bb44b0a275a9264777cbb52cd51158f0e7c6d5f191f79abd563530bcdb49fec3a072fc5318e9e8b991e53ea24376fe5a0b8cc6fa3cc73dd3b9e87b5e5f73465c44828868637761c1583004573", 0xb9}], 0x6, &(0x7f0000000400)=[@sndinfo={0x20, 0x84, 0x2, {0xfa2e, 0x201, 0x9, 0x6, r6}}], 0x20, 0x45}, 0x8000) r7 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000580)='/dev/dlm-monitor\x00', 0x189001, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r7, 0x6, 0x1d, &(0x7f00000005c0)={0xfffffc01, 0x4, 0x1000, 0x1000, 0x7fff}, 0x14) ioctl$KVM_SET_REGS(r4, 0x4090ae82, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000440)={{}, 0x1, 0x1d700000, 0x0, {}, 0x6, 0x1}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_NMI(r4, 0xae9a) [ 2856.392912][ T308] binder: 303:308 unknown command 0 [ 2856.398151][ T308] binder: 303:308 ioctl c0306201 20000200 returned -22 [ 2856.417676][ T310] binder_alloc: 12546: binder_alloc_buf, no vma [ 2856.428152][ T308] binder: 303:308 ioctl 541b 200000c0 returned -22 05:43:41 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0x0, 0x4800}], 0x0, 0x0, 0x0}) [ 2856.462051][ T308] binder: 303:308 unknown command 0 [ 2856.476163][ T314] binder: 303:314 ioctl 541b 200000c0 returned -22 [ 2856.481025][ T316] binder: 311:316 unknown command 0 [ 2856.491414][ T316] binder: 311:316 ioctl c0306201 20000200 returned -22 [ 2856.495560][ T308] binder: 303:308 ioctl c0306201 20000200 returned -22 05:43:41 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2856.562945][ T316] binder: 311:316 ioctl c018620c 200000c0 returned -14 05:43:41 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x7], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:43:41 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) [ 2856.610252][ T330] binder_alloc: 12546: binder_alloc_buf, no vma 05:43:41 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x500000000000000, 0x0, 0x0, 0x0, 0x0}) 05:43:41 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0x0, 0x4c00}], 0x0, 0x0, 0x0}) [ 2856.735166][ T346] binder: 341:346 unknown command 0 [ 2856.740410][ T346] binder: 341:346 ioctl c0306201 20000200 returned -22 05:43:41 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000440)={{0x40}, 0x0, 0x6, 0x0, {}, 0x6, 0x1}) ioctl$KVM_RUN(r4, 0xae80, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10, r5, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) inotify_add_watch(r5, &(0x7f0000000000)='./file0\x00', 0x6000081a) openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ttyprintk\x00', 0x408001, 0x0) ioctl$TIOCGETD(0xffffffffffffffff, 0x5424, &(0x7f00000000c0)) ioctl$KVM_NMI(r4, 0xae9a) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) [ 2856.776993][ T352] binder: 350:352 unknown command 0 [ 2856.784402][ T355] binder_alloc: 12546: binder_alloc_buf, no vma [ 2856.808574][ T352] binder: 350:352 ioctl c0306201 20000200 returned -22 05:43:41 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x11], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:43:41 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:43:41 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x5450, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) 05:43:41 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0x0, 0x6000}], 0x0, 0x0, 0x0}) [ 2856.845884][ T360] binder: 350:360 ioctl c018620c 200000c0 returned -14 05:43:41 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x600000000000000, 0x0, 0x0, 0x0, 0x0}) 05:43:41 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2856.968471][ T376] binder: 368:376 unknown command 0 [ 2856.985534][ T379] binder_alloc: 12546: binder_alloc_buf, no vma [ 2857.019665][ T376] binder: 368:376 ioctl c0306201 20000200 returned -22 05:43:41 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x1d], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2857.072591][ T376] binder: 368:376 unknown command 0 [ 2857.083383][ T387] binder: 380:387 unknown command 0 [ 2857.102295][ T376] binder: 368:376 ioctl c0306201 20000200 returned -22 05:43:42 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0x0, 0x6800}], 0x0, 0x0, 0x0}) [ 2857.116888][ T387] binder: 380:387 ioctl c0306201 20000200 returned -22 05:43:42 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x5451, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) 05:43:42 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2857.155850][ T391] binder: 380:391 ioctl c018620c 200000c0 returned -14 05:43:42 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x700000000000000, 0x0, 0x0, 0x0, 0x0}) [ 2857.240229][ T397] binder_alloc: 12546: binder_alloc_buf, no vma [ 2857.334747][ T402] binder: 398:402 unknown command 0 [ 2857.351874][ T406] binder: 405:406 unknown command 0 [ 2857.353884][ T402] binder: 398:402 ioctl c0306201 20000200 returned -22 [ 2857.366784][ T406] binder: 405:406 ioctl c0306201 20000200 returned -22 [ 2857.389689][ T402] binder: 398:402 unknown command 0 [ 2857.392431][ T406] binder: 405:406 ioctl c018620c 200000c0 returned -14 [ 2857.399473][ T402] binder: 398:402 ioctl c0306201 20000200 returned -22 05:43:42 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0x0, 0x6c00}], 0x0, 0x0, 0x0}) 05:43:42 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x48], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:43:42 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:43:42 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x5452, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) 05:43:42 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x800000000000000, 0x0, 0x0, 0x0, 0x0}) 05:43:42 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r5 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nvme-fabrics\x00', 0x8000, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000440)={{}, 0x1, 0x6, 0x0, {}, 0x6, 0x1}) ioctl$KVM_RUN(r4, 0xae80, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) setsockopt$inet_dccp_int(r6, 0x21, 0x19, &(0x7f0000000040)=0x8001, 0x4) ioctl$KVM_NMI(r4, 0xae9a) 05:43:42 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x4c], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2857.561316][ T420] binder_alloc: 12546: binder_alloc_buf, no vma [ 2857.569194][ T422] binder: 417:422 unknown command 0 [ 2857.586630][ T422] binder: 417:422 ioctl c0306201 20000200 returned -22 [ 2857.588309][ T426] binder: 418:426 unknown command 0 05:43:42 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x74], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:43:42 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0x0, 0x7400}], 0x0, 0x0, 0x0}) [ 2857.622546][ T426] binder: 418:426 ioctl c0306201 20000200 returned -22 [ 2857.626929][ T422] binder: 417:422 unknown command 0 [ 2857.664844][ T433] binder: 418:433 ioctl c018620c 200000c0 returned -14 [ 2857.676425][ T422] binder: 417:422 ioctl c0306201 20000200 returned -22 05:43:42 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x60], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2857.763381][ T447] binder_alloc: 12546: binder_alloc_buf, no vma 05:43:42 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x2000000000000000, 0x0, 0x0, 0x0, 0x0}) 05:43:42 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0x0, 0x7a00}], 0x0, 0x0, 0x0}) 05:43:42 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x5460, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) 05:43:42 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:43:42 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x68], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2857.918907][ T458] binder: 453:458 unknown command 0 05:43:42 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0x0, 0x1000000}], 0x0, 0x0, 0x0}) [ 2857.939738][ T462] binder: 457:462 unknown command 0 [ 2857.950880][ T458] binder: 453:458 ioctl c0306201 20000200 returned -22 [ 2857.961879][ T462] binder: 457:462 ioctl c0306201 20000200 returned -22 05:43:42 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x88], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2858.005485][ T462] binder: 457:462 ioctl c018620c 200000c0 returned -14 05:43:43 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000440)={{}, 0x1, 0x6, 0x0, {}, 0x6, 0x1}) ioctl$KVM_RUN(r4, 0xae80, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) r6 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040)='devlink\x00') sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_SET(r5, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000080)={&(0x7f0000000100)={0x60, r6, 0x0, 0x70bd25, 0x25dfdbfd, {}, [{{@pci={{0x8, 0x1, 'pci\x00'}, {0x11, 0x2, '0000:00:10.0\x00'}}, {0x8}}, {0x8, 0xb, 0xa7aa}, {0x6, 0x16, 0x40}, {0x5, 0x12, 0x1}, {0x6, 0x11, 0x81}, {0x8, 0xb, 0xf1b}}]}, 0x60}, 0x1, 0x0, 0x0, 0x28048084}, 0x8040) ioctl$KVM_NMI(r4, 0xae9a) 05:43:43 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x3f00000000000000, 0x0, 0x0, 0x0, 0x0}) 05:43:43 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x6364, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) 05:43:43 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x6c], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:43:43 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:43:43 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0x0, 0x2000000}], 0x0, 0x0, 0x0}) [ 2858.293715][ T501] binder: 491:501 unknown command 0 [ 2858.304904][ T501] binder: 491:501 ioctl c0306201 20000200 returned -22 [ 2858.320191][ T503] binder: 497:503 unknown command 0 [ 2858.326628][ T503] binder: 497:503 ioctl c0306201 20000200 returned -22 05:43:43 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0x0, 0x3000000}], 0x0, 0x0, 0x0}) 05:43:43 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2858.366068][ T511] binder: 491:511 ioctl 6364 200000c0 returned -22 [ 2858.378690][ T503] binder: 497:503 ioctl c018620c 200000c0 returned -14 [ 2858.402829][ T501] binder: 491:501 unknown command 0 [ 2858.403101][ T511] binder: 491:511 ioctl 6364 200000c0 returned -22 05:43:43 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x74], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2858.408300][ T501] binder: 491:501 ioctl c0306201 20000200 returned -22 05:43:43 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x4000000000000000, 0x0, 0x0, 0x0, 0x0}) 05:43:43 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x8933, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) 05:43:43 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2858.654917][ T537] binder: 535:537 unknown command 0 [ 2858.660170][ T537] binder: 535:537 ioctl c0306201 20000200 returned -22 [ 2858.668407][ T536] binder: 534:536 unknown command 0 [ 2858.687272][ T536] binder: 534:536 ioctl c0306201 20000200 returned -22 [ 2858.698582][ T537] binder: 535:537 ioctl 8933 200000c0 returned -22 [ 2858.718626][ T536] binder: 534:536 ioctl c018620c 200000c0 returned -14 [ 2858.727690][ T537] binder: 535:537 unknown command 0 [ 2858.741490][ T544] binder: 535:544 ioctl 8933 200000c0 returned -22 [ 2858.748966][ T537] binder: 535:537 ioctl c0306201 20000200 returned -22 05:43:44 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r3, 0x400c6615, &(0x7f0000000000)={0x0, @aes128}) r4 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(r5, 0x4090ae82, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000440)={{}, 0x1, 0x6, 0x0, {}, 0x6, 0x1}) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_NMI(r5, 0xae9a) 05:43:44 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x7a], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:43:44 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0x0, 0x4000000}], 0x0, 0x0, 0x0}) 05:43:44 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:43:44 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x4800000000000000, 0x0, 0x0, 0x0, 0x0}) 05:43:44 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x400454ca, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) [ 2859.916474][ T566] binder: 563:566 unknown command 0 [ 2859.920375][ T569] binder: 562:569 unknown command 0 [ 2859.934503][ T569] binder: 562:569 ioctl c0306201 20000200 returned -22 [ 2859.946494][ T566] binder: 563:566 ioctl c0306201 20000200 returned -22 05:43:44 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x88], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:43:44 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:43:44 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0x0, 0x5000000}], 0x0, 0x0, 0x0}) [ 2859.970991][ T576] binder: 563:576 ioctl 400454ca 200000c0 returned -22 [ 2859.985308][ T578] binder: 562:578 ioctl c018620c 200000c0 returned -14 [ 2860.045222][ T566] binder: 563:566 unknown command 0 [ 2860.050466][ T566] binder: 563:566 ioctl c0306201 20000200 returned -22 [ 2860.058483][ T576] binder: 563:576 ioctl 400454ca 200000c0 returned -22 05:43:45 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x4c00000000000000, 0x0, 0x0, 0x0, 0x0}) 05:43:45 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:43:45 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0xe8], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2860.245354][ T600] binder: 597:600 unknown command 0 [ 2860.260919][ T600] binder: 597:600 ioctl c0306201 20000200 returned -22 [ 2860.312658][ T600] binder: 597:600 ioctl c018620c 200000c0 returned -14 05:43:46 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0xc241, 0x0) ioctl$SIOCGETLINKNAME(r5, 0x89e0, &(0x7f0000000040)={0x1, 0x1}) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000440)={{}, 0x1, 0x6, 0x0, {0x0, 0xfd}, 0x6, 0x8}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_NMI(r4, 0xae9a) 05:43:46 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x40046205, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) 05:43:46 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0x0, 0x6000000}], 0x0, 0x0, 0x0}) 05:43:46 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:43:46 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x6000000000000000, 0x0, 0x0, 0x0, 0x0}) 05:43:46 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0xff], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2861.148911][ T633] connmark_tg_check: 48 callbacks suppressed [ 2861.148919][ T633] cannot load conntrack support for proto=3 [ 2861.179249][ T639] binder_alloc_new_buf_locked: 6 callbacks suppressed [ 2861.179257][ T639] binder_alloc: 12546: binder_alloc_buf, no vma [ 2861.190346][ T642] cannot load conntrack support for proto=3 [ 2861.205061][ T643] binder: 635:643 unknown command 0 [ 2861.219578][ T645] binder: 638:645 unknown command 0 [ 2861.229069][ T640] cannot load conntrack support for proto=3 [ 2861.234386][ T643] binder: 635:643 ioctl c0306201 20000200 returned -22 05:43:46 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:43:46 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:43:46 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0x0, 0x7000000}], 0x0, 0x0, 0x0}) [ 2861.256250][ T645] binder: 638:645 ioctl c0306201 20000200 returned -22 [ 2861.290219][ T645] binder: 638:645 ioctl c018620c 200000c0 returned -14 05:43:46 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x6800000000000000, 0x0, 0x0, 0x0, 0x0}) 05:43:46 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x40046207, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) [ 2861.366173][ T667] cannot load conntrack support for proto=3 [ 2861.402765][ T675] cannot load conntrack support for proto=3 05:43:46 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x2], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2861.460481][ T677] cannot load conntrack support for proto=3 [ 2861.477590][ T678] binder_alloc: 12546: binder_alloc_buf, no vma [ 2861.569756][ T685] binder: 681:685 unknown command 0 [ 2861.582697][ T686] binder: 684:686 unknown command 0 [ 2861.590240][ T685] binder: 681:685 ioctl c0306201 20000200 returned -22 [ 2861.610791][ T686] binder: 684:686 ioctl c0306201 20000200 returned -22 [ 2861.620195][ T685] binder: 681:685 unknown command 0 [ 2861.628237][ T685] binder: 681:685 ioctl c0306201 20000200 returned -22 [ 2861.637096][ T686] binder: 684:686 ioctl c018620c 200000c0 returned -14 [ 2861.688587][ T688] cannot load conntrack support for proto=3 05:43:47 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0x0, 0x12000000}], 0x0, 0x0, 0x0}) 05:43:47 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000440)={{}, 0x0, 0x7, 0x0, {0x0, 0xfd}, 0x6, 0x1}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_NMI(r4, 0xae9a) 05:43:47 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x40046208, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) 05:43:47 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x6c00000000000000, 0x0, 0x0, 0x0, 0x0}) 05:43:47 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:43:47 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x3], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2862.460427][ T704] binder: 700:704 unknown command 0 [ 2862.469455][ T705] binder: 701:705 unknown command 0 [ 2862.469462][ T706] cannot load conntrack support for proto=3 [ 2862.490204][ T704] binder: 700:704 ioctl c0306201 20000200 returned -22 [ 2862.495485][ T710] binder_alloc: 12546: binder_alloc_buf, no vma [ 2862.499760][ T705] binder: 701:705 ioctl c0306201 20000200 returned -22 05:43:47 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x4], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2862.515227][ T709] cannot load conntrack support for proto=3 [ 2862.524160][ T712] cannot load conntrack support for proto=3 [ 2862.526963][ T715] binder: 701:715 ioctl c018620c 200000c0 returned -14 05:43:47 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x40049409, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) 05:43:47 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:43:47 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0x0, 0x20000000}], 0x0, 0x0, 0x0}) 05:43:47 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x7400000000000000, 0x0, 0x0, 0x0, 0x0}) 05:43:47 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000440)={{}, 0x1, 0x6, 0x0, {}, 0x6, 0x1}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_NMI(r4, 0xae9a) [ 2862.719410][ T738] binder_alloc: 12546: binder_alloc_buf, no vma [ 2862.736590][ T739] binder: 733:739 unknown command 0 [ 2862.746447][ T740] binder: 736:740 unknown command 0 05:43:47 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x5], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:43:47 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:43:47 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0x0, 0x48000000}], 0x0, 0x0, 0x0}) [ 2862.766538][ T739] binder: 733:739 ioctl c0306201 20000200 returned -22 [ 2862.779867][ T740] binder: 736:740 ioctl c0306201 20000200 returned -22 [ 2862.807222][ T747] binder: 736:747 ioctl c018620c 200000c0 returned -14 05:43:47 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x4018620d, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) 05:43:47 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x7a00000000000000, 0x0, 0x0, 0x0, 0x0}) 05:43:47 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x6], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2862.956009][ T763] binder_alloc: 12546: binder_alloc_buf, no vma [ 2862.969558][ T764] binder: 762:764 unknown command 0 [ 2862.990403][ T764] binder: 762:764 ioctl c0306201 20000200 returned -22 05:43:47 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x12], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:43:47 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0x0, 0x4c000000}], 0x0, 0x0, 0x0}) 05:43:48 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x40186366, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) [ 2863.096431][ T771] binder: 769:771 unknown command 0 [ 2863.107294][ T771] binder: 769:771 ioctl c0306201 20000200 returned -22 05:43:48 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x7], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2863.166377][ T778] binder: 769:778 ioctl c018620c 200000c0 returned -14 [ 2863.179508][ T781] binder_alloc: 12546: binder_alloc_buf, no vma 05:43:48 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1d], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2863.228577][ T787] binder: 783:787 unknown command 0 [ 2863.260647][ T787] binder: 783:787 ioctl c0306201 20000200 returned -22 [ 2863.279991][ T790] binder: 783:790 ioctl 40186366 200000c0 returned -22 [ 2863.296248][ T787] binder: 783:787 unknown command 0 [ 2863.302859][ T790] binder: 783:790 ioctl 40186366 200000c0 returned -22 [ 2863.311101][ T787] binder: 783:787 ioctl c0306201 20000200 returned -22 05:43:49 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x8000000000000000, 0x0, 0x0, 0x0, 0x0}) 05:43:49 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0x0, 0x60000000}], 0x0, 0x0, 0x0}) 05:43:49 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x11], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:43:49 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:43:49 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x4020940d, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) 05:43:49 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) dup(r4) openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x20000, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280)='/dev/kvm\x00', 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000440)={{}, 0x1, 0x6, 0x0, {}, 0x6, 0x1}) fcntl$setstatus(r2, 0x4, 0x6000) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_NMI(r3, 0xae9a) [ 2864.457769][ T825] binder: 818:825 unknown command 0 [ 2864.467007][ T821] binder: 815:821 unknown command 0 [ 2864.475465][ T826] binder_alloc: 12546: binder_alloc_buf, no vma [ 2864.483195][ T825] binder: 818:825 ioctl c0306201 20000200 returned -22 [ 2864.491574][ T821] binder: 815:821 ioctl c0306201 20000200 returned -22 05:43:49 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:43:49 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0x0, 0x68000000}], 0x0, 0x0, 0x0}) [ 2864.556773][ T821] binder: 815:821 ioctl c018620c 200000c0 returned -14 05:43:49 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x1d], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:43:49 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x80086301, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) 05:43:49 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:43:49 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0xff00000000000000, 0x0, 0x0, 0x0, 0x0}) [ 2864.717234][ T855] binder: 853:855 unknown command 0 05:43:49 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000200)='/dev/hwrng\x00', 0x2000, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000280)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) write$binfmt_script(r6, &(0x7f0000000100)=ANY=[@ANYRESDEC=r4, @ANYBLOB="6adc350db8ae87af54cbe436d4769e873a91b91602dae841dbae2d0ea954020d49a6f2717237a52eb54e2e1c1b2f1e279191c206b1ebcab454883dbfdee462b43bff8511a34056399b8972df937a9a342563036213c014c2b9b0c96a76c81dd874a9a2cd5bc0b596e8874176f88a1f79afea3e699d7da5976227756d6bd59c6f25c69392aa40c00ab96702223ca7338a384da410ca12bb0d6e53abce1c86a56be65d3b0083ceb238fc0a66f4e8f944515fe5b774d4e97107d4ba5e63ea82ff"], 0xfffffffffffffdbb) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r5, 0x0) write$ppp(r5, &(0x7f0000000000)="80a4a14c5af1bc0a7609037358fee117b1a5d9887dfee0ddde5af472b3badb5dc3f49374a4dca824da6f226dc9270e2da9f35ec917db89320248895d99b597b57cfdf236", 0x44) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000440)={{}, 0x1, 0x6, 0x0, {}, 0x6, 0x1}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_NMI(r4, 0xae9a) [ 2864.740041][ T858] binder_alloc: 12546: binder_alloc_buf, no vma [ 2864.749574][ T855] binder: 853:855 ioctl c0306201 20000200 returned -22 [ 2864.768357][ T860] binder: 853:860 ioctl 80086301 200000c0 returned -22 05:43:49 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:43:49 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0x0, 0x6c000000}], 0x0, 0x0, 0x0}) [ 2864.827577][ T855] binder: 853:855 unknown command 0 [ 2864.833524][ T868] binder: 865:868 unknown command 0 [ 2864.833999][ T860] binder: 853:860 ioctl 80086301 200000c0 returned -22 [ 2864.849980][ T868] binder: 865:868 ioctl c0306201 20000200 returned -22 [ 2864.851956][ T855] binder: 853:855 ioctl c0306201 20000200 returned -22 05:43:49 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x48], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2864.912901][ T873] binder: 865:873 ioctl c018620c 200000c0 returned -14 05:43:49 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0045878, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) 05:43:49 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0x0, 0x74000000}], 0x0, 0x0, 0x0}) [ 2864.973011][ T883] binder_alloc: 12546: binder_alloc_buf, no vma 05:43:49 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x2, 0x0, 0x0}) 05:43:49 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:43:50 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000440)={{}, 0x1, 0x6, 0x0, {}, 0x6, 0x1}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_NMI(r4, 0xae9a) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000340)={r5, @in6={{0xa, 0x4e24, 0x0, @local, 0x6}}, 0x3e7, 0x3, 0x1, 0x1ff, 0x6}, &(0x7f00000000c0)=0x98) setsockopt$inet_sctp_SCTP_AUTH_DEACTIVATE_KEY(r1, 0x84, 0x23, &(0x7f0000000000)={r5, 0x8}, 0x8) [ 2865.098456][ T894] binder_alloc: 12546: binder_alloc_buf, no vma [ 2865.117055][ T895] binder: 892:895 unknown command 0 [ 2865.134173][ T895] binder: 892:895 ioctl c0306201 20000200 returned -22 [ 2865.156386][ T898] binder: 896:898 unknown command 0 [ 2865.172680][ T895] binder: 892:895 unknown command 0 05:43:50 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x4c], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:43:50 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0x0, 0x7a000000}], 0x0, 0x0, 0x0}) [ 2865.209749][ T898] binder: 896:898 ioctl c0306201 20000200 returned -22 [ 2865.230843][ T909] binder: 896:909 ioctl c018620c 200000c0 returned -14 [ 2865.244575][ T895] binder: 892:895 ioctl c0306201 20000200 returned -22 05:43:50 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x74], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:43:50 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x3, 0x0, 0x0}) 05:43:50 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0045878, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) 05:43:50 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x60], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:43:50 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0x0, 0xfdfdffff}], 0x0, 0x0, 0x0}) 05:43:50 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2865.450924][ T927] binder: 924:927 unknown command 0 [ 2865.471021][ T927] binder: 924:927 ioctl c0306201 20000200 returned -22 [ 2865.491994][ T928] binder: 926:928 unknown command 0 [ 2865.498677][ T927] binder: 924:927 ioctl c018620c 200000c0 returned -14 [ 2865.517170][ T928] binder: 926:928 ioctl c0306201 20000200 returned -22 05:43:50 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x4, 0x0, 0x0}) [ 2865.557005][ T928] binder: 926:928 unknown command 0 05:43:50 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x68], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:43:50 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x88], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2865.595647][ T928] binder: 926:928 ioctl c0306201 20000200 returned -22 [ 2865.666490][ T945] binder: 942:945 unknown command 0 [ 2865.686707][ T945] binder: 942:945 ioctl c0306201 20000200 returned -22 [ 2865.719193][ T945] binder: 942:945 ioctl c018620c 200000c0 returned -14 05:43:50 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0046209, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) 05:43:50 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0x0, 0xfffffdfd}], 0x0, 0x0, 0x0}) 05:43:50 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x6c], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:43:50 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x0, 0x0}) 05:43:50 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:43:50 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r2, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, &(0x7f0000000200)={[{0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x2, 0x40}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0xfc, 0x2000}], 0x2000}) poll(&(0x7f0000000000)=[{0xffffffffffffffff, 0x2}, {0xffffffffffffffff, 0x3300}, {0xffffffffffffffff, 0x64}, {r2, 0x90}], 0x4, 0x106) msgget(0x2, 0xe) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(r5, 0x4090ae82, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000440)={{}, 0x1, 0x6, 0x0, {0x0, 0x4}, 0x6, 0x1}) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_NMI(r5, 0xae9a) 05:43:50 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x74], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2865.921344][ T969] binder: 967:969 unknown command 0 [ 2865.927617][ T969] binder: 967:969 ioctl c0306201 20000200 returned -22 [ 2865.934872][ T972] binder: 963:972 unknown command 0 [ 2865.940097][ T972] binder: 963:972 ioctl c0306201 20000200 returned -22 05:43:50 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0x0, 0x100000000000000}], 0x0, 0x0, 0x0}) 05:43:50 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2865.985803][ T979] binder: 967:979 ioctl c018620c 200000c0 returned -14 05:43:50 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc018620b, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) 05:43:50 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x6, 0x0, 0x0}) [ 2866.138284][ T1000] binder: 997:1000 unknown command 0 05:43:51 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0x0, 0x200000000000000}], 0x0, 0x0, 0x0}) 05:43:51 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2866.169566][ T1000] binder: 997:1000 ioctl c0306201 20000200 returned -22 [ 2866.174337][ T988] connmark_tg_check: 43 callbacks suppressed [ 2866.174360][ T988] cannot load conntrack support for proto=3 [ 2866.245857][ T1013] binder: 1011:1013 unknown command 0 [ 2866.258601][ T1013] binder: 1011:1013 ioctl c0306201 20000200 returned -22 [ 2866.283722][ T1013] binder: 1011:1013 ioctl c018620c 200000c0 returned -14 05:43:51 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) 05:43:51 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x7a], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2866.308307][ T1016] binder_alloc_new_buf_locked: 4 callbacks suppressed [ 2866.308316][ T1016] binder_alloc: 12546: binder_alloc_buf, no vma [ 2866.325382][ T1017] cannot load conntrack support for proto=3 05:43:51 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x7, 0x0, 0x0}) 05:43:51 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0x0, 0x300000000000000}], 0x0, 0x0, 0x0}) [ 2866.361969][ T1022] cannot load conntrack support for proto=3 [ 2866.419267][ T1024] cannot load conntrack support for proto=3 [ 2866.427605][ T1025] binder: 1021:1025 unknown command 0 [ 2866.452617][ T1025] binder: 1021:1025 ioctl c0306201 20000200 returned -22 [ 2866.484764][ T1025] binder: 1021:1025 ioctl c018620c 200000c0 returned -22 [ 2866.492527][ T1032] binder: 1031:1032 unknown command 0 [ 2866.497914][ T1032] binder: 1031:1032 ioctl c0306201 20000200 returned -22 [ 2866.508373][ T1034] binder_alloc: 12546: binder_alloc_buf, no vma [ 2866.517791][ T1025] binder: 1021:1025 unknown command 0 [ 2866.525641][ T1025] binder: 1021:1025 ioctl c0306201 20000200 returned -22 [ 2866.542760][ T1036] binder: 1021:1036 ioctl c018620c 200000c0 returned -22 [ 2866.553173][ T1032] binder: 1031:1032 ioctl c018620c 200000c0 returned -14 05:43:51 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x88], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:43:51 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:43:51 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0x0, 0x400000000000000}], 0x0, 0x0, 0x0}) 05:43:51 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0189436, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) 05:43:51 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x8, 0x0, 0x0}) [ 2866.960882][ T1058] binder_alloc: 12546: binder_alloc_buf, no vma [ 2866.968569][ T1059] cannot load conntrack support for proto=3 [ 2866.976490][ T1063] binder: 1057:1063 unknown command 0 [ 2866.985367][ T1064] binder: 1054:1064 unknown command 0 [ 2866.989012][ T1063] binder: 1057:1063 ioctl c0306201 20000200 returned -22 [ 2867.001916][ T1065] cannot load conntrack support for proto=3 05:43:51 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r4 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) sendmsg$NL80211_CMD_NEW_MPATH(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="44000200", @ANYRES16=0x0, @ANYBLOB="000325bd7000fcdbdf25170000000a001a00aaaaaaaaaabb00000a000600aaaaaaaaaabb00000c009900d22c0000020000000a0006000000000000000000"], 0x44}, 0x1, 0x0, 0x0, 0x4008080}, 0x40000) ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r4, 0x4040ae77, &(0x7f0000000000)={0x40}) ioctl$KVM_SET_PIT(r4, 0x8048ae66, &(0x7f0000000200)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, {0x7fffffff}]}) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(r3, 0x4090ae82, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000440)={{}, 0x1, 0x6, 0x0, {}, 0x6, 0x1}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_NMI(r3, 0xae9a) 05:43:51 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0xe8], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:43:51 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0x0, 0x500000000000000}], 0x0, 0x0, 0x0}) [ 2867.011425][ T1061] cannot load conntrack support for proto=3 [ 2867.029096][ T1064] binder: 1054:1064 ioctl c0306201 20000200 returned -22 05:43:51 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2867.059156][ T1072] binder: 1054:1072 ioctl c018620c 200000c0 returned -14 05:43:52 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc020660b, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) 05:43:52 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x48, 0x0, 0x0}) [ 2867.126453][ T1079] binder_alloc: 12546: binder_alloc_buf, no vma [ 2867.158707][ T1083] cannot load conntrack support for proto=3 05:43:52 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0x0, 0x600000000000000}], 0x0, 0x0, 0x0}) [ 2867.203269][ T1090] cannot load conntrack support for proto=3 [ 2867.212329][ T1085] cannot load conntrack support for proto=3 05:43:52 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0xff], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:43:52 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r5 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/qat_adf_ctl\x00', 0x10ba40, 0x0) ioctl$TIOCMIWAIT(r5, 0x545c, 0x0) connect(r5, &(0x7f0000000240)=@qipcrtr={0x2a, 0xffffffffffffffff, 0xfffffffe}, 0x80) ioctl$KVM_SET_REGS(r4, 0x4090ae82, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000440)={{}, 0x1, 0x6, 0x0, {}, 0x6, 0x1}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000000)={0xffffffffffffffff}, 0x2, 0x8}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r1, &(0x7f0000000100)={0x15, 0x110, 0xfa00, {r6, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x4e23, 0x4, @local, 0x7}, @in6={0xa, 0x4e20, 0x1000, @private2, 0x80000000}}}, 0x118) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_NMI(r4, 0xae9a) [ 2867.248918][ T1094] binder: 1088:1094 unknown command 0 [ 2867.283754][ T1094] binder: 1088:1094 ioctl c0306201 20000200 returned -22 05:43:52 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2867.307355][ T1098] binder: 1096:1098 unknown command 0 05:43:52 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306202, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) [ 2867.333923][ T1100] binder_alloc: 12546: binder_alloc_buf, no vma [ 2867.343796][ T1098] binder: 1096:1098 ioctl c0306201 20000200 returned -22 [ 2867.372479][ T1106] binder: 1096:1106 ioctl c018620c 200000c0 returned -14 05:43:52 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:43:52 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0x0, 0x700000000000000}], 0x0, 0x0, 0x0}) [ 2867.447941][ T1118] QAT: Invalid ioctl 05:43:52 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x4c, 0x0, 0x0}) 05:43:52 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2867.504568][ T1120] binder: 1119:1120 unknown command 0 [ 2867.524782][ T1120] binder: 1119:1120 ioctl c0306201 20000200 returned -22 [ 2867.572715][ T1129] binder_alloc: 12546: binder_alloc_buf, no vma [ 2867.577213][ T1124] binder: 1119:1124 ioctl c0306202 200000c0 returned -22 05:43:52 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x2], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:43:52 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0x0, 0x1200000000000000}], 0x0, 0x0, 0x0}) [ 2867.658683][ T1120] binder: 1119:1120 unknown command 0 [ 2867.659050][ T1124] binder: 1119:1124 ioctl c0306202 200000c0 returned -22 [ 2867.665523][ T1120] binder: 1119:1120 ioctl c0306201 20000200 returned -22 [ 2867.710927][ T1139] binder: 1135:1139 unknown command 0 05:43:52 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:43:52 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x3], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2867.731274][ T1139] binder: 1135:1139 ioctl c0306201 20000200 returned -22 05:43:52 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306203, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) [ 2867.800209][ T1139] binder: 1135:1139 ioctl c018620c 200000c0 returned -14 [ 2867.809976][ T1150] binder_alloc: 12546: binder_alloc_buf, no vma [ 2867.894322][ T1168] binder: 1158:1168 unknown command 0 [ 2867.930670][ T1168] binder: 1158:1168 ioctl c0306201 20000200 returned -22 [ 2867.943211][ T1171] binder: 1158:1171 ioctl c0306203 200000c0 returned -22 [ 2867.978333][ T1168] binder: 1158:1168 unknown command 0 [ 2867.982400][ T1171] binder: 1158:1171 ioctl c0306203 200000c0 returned -22 [ 2867.996985][ T1103] QAT: Invalid ioctl 05:43:52 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x60, 0x0, 0x0}) 05:43:52 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0x0, 0x2000000000000000}], 0x0, 0x0, 0x0}) 05:43:52 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:43:52 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x4], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2868.017800][ T1168] binder: 1158:1168 ioctl c0306201 20000200 returned -22 05:43:52 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r5 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000140)={[0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x4cb, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x6, 0x0, 0x4, 0x6]}) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) r6 = dup(r5) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000340)={r7, @in6={{0xa, 0x4e24, 0x0, @local, 0x6}}, 0x3e7, 0x3, 0x1, 0x1ff, 0x6}, &(0x7f00000000c0)=0x98) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r6, 0x84, 0x6d, &(0x7f0000000200)=ANY=[@ANYRES32=r7, @ANYBLOB="86000000e64bc6979f2056a4412698b7ee1b0f60184bdfd40b4ee5c7bd44ad5ad4df37166adedb712c9a81823481676f8c4b3896b42a19fe49a57c0f0f53a2b7acdd9f6799ba6d670928bca11ae97d76192965ca176a6343196e63d7b0b6036fc2ee1870afae56d8d371c26a64aa341150f2a2881d5b029d4f64d9c99b7bd9db09b4db2ddb5ef1878f86e32308d3aeb542912000627fc816e412fe7239019acc67ea00"/174], &(0x7f0000000100)=0x8e) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000440)={{}, 0x1, 0x6, 0x0, {}, 0x6, 0x1}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_NMI(r4, 0xae9a) 05:43:52 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306205, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) [ 2868.107100][ T1184] binder_alloc: 12546: binder_alloc_buf, no vma [ 2868.117736][ T1185] binder: 1177:1185 unknown command 0 [ 2868.139990][ T1185] binder: 1177:1185 ioctl c0306201 20000200 returned -22 [ 2868.151000][ T1196] binder: 1186:1196 unknown command 0 05:43:53 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2868.182411][ T1196] binder: 1186:1196 ioctl c0306201 20000200 returned -22 [ 2868.192368][ T1198] binder: 1177:1198 ioctl c018620c 200000c0 returned -14 [ 2868.208327][ T1204] binder: 1186:1204 ioctl c0306205 200000c0 returned -22 05:43:53 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0x0, 0x4800000000000000}], 0x0, 0x0, 0x0}) [ 2868.246140][ T1196] binder: 1186:1196 unknown command 0 [ 2868.254590][ T1204] binder: 1186:1204 ioctl c0306205 200000c0 returned -22 [ 2868.278082][ T1196] binder: 1186:1196 ioctl c0306201 20000200 returned -22 05:43:53 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x5], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:43:53 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x68, 0x0, 0x0}) 05:43:53 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306214, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) [ 2868.332606][ T1218] binder_alloc: 12546: binder_alloc_buf, no vma 05:43:53 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:43:53 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0x0, 0x4c00000000000000}], 0x0, 0x0, 0x0}) [ 2868.499460][ T1229] binder: 1223:1229 unknown command 0 [ 2868.507279][ T1232] binder: 1224:1232 unknown command 0 [ 2868.536766][ T1232] binder: 1224:1232 ioctl c0306201 20000200 returned -22 05:43:53 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x12], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2868.539860][ T1229] binder: 1223:1229 ioctl c0306201 20000200 returned -22 05:43:53 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x6], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:43:53 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1d], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2868.573108][ T1241] binder: 1224:1241 ioctl c0306214 200000c0 returned -22 [ 2868.590358][ T1244] binder_alloc: 12546: binder_alloc_buf, no vma [ 2868.594036][ T1240] binder: 1223:1240 ioctl c018620c 200000c0 returned -14 05:43:53 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0x0, 0x6000000000000000}], 0x0, 0x0, 0x0}) [ 2868.652917][ T1232] binder: 1224:1232 unknown command 0 [ 2868.658336][ T1232] binder: 1224:1232 ioctl c0306201 20000200 returned -22 [ 2868.670908][ T1241] binder: 1224:1241 ioctl c0306214 200000c0 returned -22 05:43:53 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x7, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) 05:43:53 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x6c, 0x0, 0x0}) 05:43:53 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:43:53 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x7], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:43:53 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280)='/dev/kvm\x00', 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000440)={{}, 0x1, 0x6, 0x0, {}, 0x6, 0x1}) ioctl$vim2m_VIDIOC_STREAMOFF(r1, 0x40045612, &(0x7f0000000000)=0x2) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_NMI(r4, 0xae9a) r7 = shmget$private(0x0, 0x4000, 0x0, &(0x7f000000c000/0x4000)=nil) shmat(r7, &(0x7f0000000000/0x13000)=nil, 0x4000) shmctl$SHM_UNLOCK(r7, 0xc) 05:43:53 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0x0, 0x6800000000000000}], 0x0, 0x0, 0x0}) [ 2868.797906][ T1267] binder: 1263:1267 unknown command 0 [ 2868.826090][ T1267] binder: 1263:1267 ioctl c0306201 20000200 returned -22 [ 2868.859797][ T1274] binder: 1270:1274 unknown command 0 [ 2868.872190][ T1274] binder: 1270:1274 ioctl c0306201 20000200 returned -22 05:43:53 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:43:53 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x14, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) [ 2868.906081][ T1274] binder: 1270:1274 ioctl c018620c 200000c0 returned -14 05:43:53 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x74, 0x0, 0x0}) 05:43:53 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0x0, 0x6c00000000000000}], 0x0, 0x0, 0x0}) 05:43:54 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2869.097620][ T1308] binder: 1304:1308 unknown command 0 [ 2869.115456][ T1314] binder: 1310:1314 unknown command 0 [ 2869.134426][ T1308] binder: 1304:1308 ioctl c0306201 20000200 returned -22 [ 2869.143793][ T1314] binder: 1310:1314 ioctl c0306201 20000200 returned -22 [ 2869.156590][ T1317] binder: 1304:1317 unknown command 0 [ 2869.176661][ T1317] binder: 1304:1317 ioctl c0306201 200000c0 returned -22 [ 2869.189923][ T1314] binder: 1310:1314 ioctl c018620c 200000c0 returned -14 05:43:54 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x11], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:43:54 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0x0, 0x7400000000000000}], 0x0, 0x0, 0x0}) [ 2869.206492][ T1308] binder: 1304:1308 unknown command 0 [ 2869.206825][ T1317] binder: 1304:1317 unknown command 0 [ 2869.221729][ T1308] binder: 1304:1308 ioctl c0306201 20000200 returned -22 [ 2869.224809][ T1317] binder: 1304:1317 ioctl c0306201 200000c0 returned -22 05:43:54 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x7a, 0x0, 0x0}) 05:43:54 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x2, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) 05:43:54 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2869.406936][ T1343] binder: 1339:1343 unknown command 0 [ 2869.418973][ T1342] binder: 1336:1342 unknown command 0 [ 2869.451700][ T1342] binder: 1336:1342 ioctl c0306201 20000200 returned -22 [ 2869.460950][ T1343] binder: 1339:1343 ioctl c0306201 20000200 returned -22 [ 2869.475205][ T1348] binder: 1339:1348 unknown command 16388 [ 2869.495621][ T1350] binder: 1336:1350 ioctl c018620c 200000c0 returned -14 [ 2869.512444][ T1348] binder: 1339:1348 ioctl c0306201 200000c0 returned -22 [ 2869.542198][ T1348] binder: 1339:1348 unknown command 16388 [ 2869.542219][ T1343] binder: 1339:1343 unknown command 0 [ 2869.547952][ T1348] binder: 1339:1348 ioctl c0306201 200000c0 returned -22 [ 2869.574723][ T1343] binder: 1339:1343 ioctl c0306201 20000200 returned -22 05:43:54 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000440)={{}, 0x1, 0x6, 0x0, {}, 0x6, 0x1}) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) read(r5, &(0x7f00000004c0)=""/4096, 0x1000) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_NMI(r4, 0xae9a) 05:43:54 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0x0, 0x7a00000000000000}], 0x0, 0x0, 0x0}) 05:43:54 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x1d], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:43:54 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:43:54 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x300, 0x0, 0x0}) 05:43:54 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x3, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) 05:43:54 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300, 0x0, 0xfdfdffff00000000}], 0x0, 0x0, 0x0}) 05:43:54 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x48], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2869.749797][ T1372] binder: 1367:1372 unknown command 0 [ 2869.762027][ T1373] binder: 1369:1373 unknown command 0 [ 2869.777728][ T1372] binder: 1367:1372 ioctl c0306201 20000200 returned -22 [ 2869.793575][ T1372] binder: 1367:1372 unknown command 64 05:43:54 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x74], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2869.804317][ T1372] binder: 1367:1372 ioctl c0306201 200000c0 returned -22 [ 2869.811355][ T1373] binder: 1369:1373 ioctl c0306201 20000200 returned -22 [ 2869.826345][ T1373] binder: 1369:1373 ioctl c018620c 200000c0 returned -14 [ 2869.873420][ T1372] binder: 1367:1372 unknown command 0 [ 2869.892371][ T1393] binder: 1367:1393 unknown command 64 [ 2869.897878][ T1393] binder: 1367:1393 ioctl c0306201 200000c0 returned -22 [ 2869.913664][ T1372] binder: 1367:1372 ioctl c0306201 20000200 returned -22 05:43:54 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x4c], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:43:54 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x2, 0x0, 0x0}) 05:43:54 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x500, 0x0, 0x0}) [ 2870.089276][ T1413] binder: 1408:1413 unknown command 0 [ 2870.114029][ T1420] binder: 1409:1420 ioctl c0306201 200000c0 returned -14 [ 2870.132153][ T1413] binder: 1408:1413 ioctl c0306201 20000200 returned -22 [ 2870.164726][ T1427] binder: 1408:1427 ioctl c018620c 200000c0 returned -14 05:43:55 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:43:55 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x4, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) 05:43:55 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x3, 0x0, 0x0}) 05:43:55 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x600, 0x0, 0x0}) 05:43:55 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x100, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ocfs2_control\x00', 0x2440, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r5, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r5, 0xc058534f, &(0x7f0000000440)={{0x1, 0x43}, 0x0, 0x6, 0xc393, {0x8, 0x8}, 0x6, 0x7}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_NMI(r4, 0xae9a) 05:43:55 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x60], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2870.428549][ T1442] binder: 1437:1442 unknown command 0 [ 2870.438185][ T1447] binder: 1439:1447 unknown command 0 [ 2870.440397][ T1446] binder: 1445:1446 ioctl c0306201 200000c0 returned -14 [ 2870.446762][ T1442] binder: 1437:1442 ioctl c0306201 20000200 returned -22 [ 2870.471942][ T1447] binder: 1439:1447 ioctl c0306201 20000200 returned -22 05:43:55 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x88], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2870.508655][ T1454] binder: 1437:1454 unknown command 0 [ 2870.529140][ T1447] binder: 1439:1447 ioctl c018620c 200000c0 returned -14 05:43:55 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x4, 0x0, 0x0}) [ 2870.585847][ T1454] binder: 1437:1454 ioctl c0306201 200000c0 returned -22 [ 2870.609218][ T1442] binder: 1437:1442 unknown command 0 [ 2870.616691][ T1454] binder: 1437:1454 unknown command 0 [ 2870.624618][ T1442] binder: 1437:1442 ioctl c0306201 20000200 returned -22 05:43:55 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x700, 0x0, 0x0}) [ 2870.648407][ T1454] binder: 1437:1454 ioctl c0306201 200000c0 returned -22 05:43:55 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x5, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) 05:43:55 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x68], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:43:55 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r5 = socket(0x10, 0x803, 0x0) ioctl$SG_SET_COMMAND_Q(r1, 0x2271, &(0x7f0000000080)) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) ioctl$sock_inet_SIOCDELRT(r5, 0x890c, &(0x7f0000000000)={0x0, {0x2, 0x4e20, @broadcast}, {0x2, 0x4e22, @loopback}, {0x2, 0x4e22, @multicast1}, 0x5, 0x0, 0x0, 0x0, 0x3f, 0x0, 0x3, 0x7fffffff, 0x290}) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000440)={{}, 0x1, 0x6, 0x0, {}, 0x6, 0x1}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_NMI(r4, 0xae9a) [ 2870.695806][ T1469] binder: 1467:1469 ioctl c0306201 200000c0 returned -14 05:43:55 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x5, 0x0, 0x0}) [ 2870.761532][ T1475] binder: 1472:1475 unknown command 0 [ 2870.772486][ T1474] binder: 1471:1474 unknown command 0 [ 2870.787807][ T1475] binder: 1472:1475 ioctl c0306201 20000200 returned -22 [ 2870.796467][ T1474] binder: 1471:1474 ioctl c0306201 20000200 returned -22 05:43:55 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2870.812036][ T1480] binder: 1472:1480 unknown command 0 [ 2870.841595][ T1480] binder: 1472:1480 ioctl c0306201 200000c0 returned -22 [ 2870.864187][ T1474] binder: 1471:1474 ioctl c018620c 200000c0 returned -14 05:43:55 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x6c], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2870.892953][ T1475] binder: 1472:1475 unknown command 0 [ 2870.899013][ T1475] binder: 1472:1475 ioctl c0306201 20000200 returned -22 [ 2870.909018][ T1480] binder: 1472:1480 unknown command 0 05:43:55 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2870.935415][ T1495] binder: 1484:1495 ioctl c0306201 200000c0 returned -14 [ 2870.958891][ T1480] binder: 1472:1480 ioctl c0306201 200000c0 returned -22 05:43:55 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x2000, 0x0, 0x0}) 05:43:55 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x6, 0x0, 0x0}) 05:43:56 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x6, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) 05:43:56 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x74], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2871.141561][ T1513] binder: 1512:1513 unknown command 0 [ 2871.155279][ T1513] binder: 1512:1513 ioctl c0306201 20000200 returned -22 05:43:56 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:43:56 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r1, 0xc01064b5, &(0x7f0000000180)={&(0x7f0000000100)}) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) sendmsg$NFNL_MSG_CTHELPER_DEL(r1, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000040)={&(0x7f00000008c0)=ANY=[@ANYBLOB="d40000000209010100000000000000000100000508000340000000080800054000000002080005400000000408000340000000008c0002001400018008000100ac1414aa080002b1e70000012c00040000000000000000000000000000000000000000aa14000400fe800000000000000005000000000000000000000006000340000000002c00018014000300ff01000000000000000000000000000114000400fc020000000000008639e69cb539a819000000000000000108000340000000020c0004800800014080000000838c8807fef7a3985c46d48a835ee59f8455d89079b85e2378948b82f68f51374ca18242064ac82e4b999c30d6d2af5708afc2800f2af239652151d1f1c2faed9573ce40f1f3783e0846bd184da74a7684484f5359b6ffaec4e937584709aae7063c6908cbdc722ab9d151127c50ca1835424ec1efeb259e4dbcbaaa68fb27a278f372b57c654dbfa8d572d307b0823dcd3d08f74000f0e179a2a6caee2b275ed676d5f1d95a15318c31fa2d8476837ff92972c40d82f8b7aacda3dcf0dd1eb0a6f74050029b9f9280c0d67aac0896d2c1a27e0700000007c10a94807d3e5d41aea9d9ebe2cf3d9a03c9973c5295d7eead333163f29748201fe670b0760db41dfceffd01e4d7edca39a857f1b261ed13d10983298142a960dbd24767ee09304c528238118778a5a88efb014a5da87ab6272340d698ac9b410cfc62b0b3def9e25cf8dd04119427d15ea1d88351855bf5541e861a32d20c193b0f6489b70dbb8d2aac3949b5c46c7b23ecf15749f04af4873a1da9cee4ffec6d1453e6f5ddcc831acf3685f97cd016bad485024d661f9d5a98ee4199c04c163b831052576e839c83deaa14e99b380dfbe9c9a3f33a6186de7c143fabe4f49d42278a6728e249eaabe41312436728ac7f6b2c981791f23a150e340bf9ffd52390ec54e7286bbd32fe14a9dc4621b48d499136eee6525f7c3a72ddc42bd2a2a8e7147449d27f52ea07f0ce055535c84bd03156e52a41a0456ff8bc33198c3d7ad369c703a251658f72261c1809f06f8546b86b242f91d15e33ae516721ff2d2527289daec5fea30df9e03213066a204658eb3c83a3fddc35fdfafd854ead81a3eb428f73dcb9226e62759f9944a4aa86e9e192053d47f517fc5a225fe5985f8df9019d2fbe1ed7a9c0aaa19b22da47c39416e311b3becbb8e95d11ff44f6708a8e2d51b7d840043ce9ba856cdd0750cda73b9e825bca8e1b819f98b413c42e69d62776ee7122d904e1b018119b1ae59f7432cdb901aed6f0b24141924b28796d59d190956ab2c1cdbc231c52d96d4e11b6c54233e859ab50e00629c31d23bd612127a2f4989d91835e22aede8a178dd8e8658e"], 0xd4}, 0x1, 0x0, 0x0, 0x1011}, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000440)={{}, 0x1, 0x6, 0x0, {}, 0x6, 0x1}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_NMI(r4, 0xae9a) [ 2871.189359][ T1513] binder: 1512:1513 ioctl c018620c 200000c0 returned -14 05:43:56 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x3f00, 0x0, 0x0}) [ 2871.308946][ T1522] binder: 1519:1522 unknown command 0 [ 2871.320197][ T1527] connmark_tg_check: 57 callbacks suppressed [ 2871.320205][ T1527] cannot load conntrack support for proto=3 [ 2871.336416][ T1522] binder: 1519:1522 ioctl c0306201 20000200 returned -22 [ 2871.346479][ T1538] binder: 1525:1538 unknown command 0 [ 2871.352847][ T1538] binder: 1525:1538 ioctl c0306201 20000200 returned -22 [ 2871.363350][ T1542] binder: 1519:1542 unknown command 0 [ 2871.369261][ T1546] cannot load conntrack support for proto=3 [ 2871.373468][ T1537] cannot load conntrack support for proto=3 [ 2871.389650][ T1544] binder_alloc_new_buf_locked: 10 callbacks suppressed [ 2871.389657][ T1544] binder_alloc: 12546: binder_alloc_buf, no vma 05:43:56 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2871.398203][ T1542] binder: 1519:1542 ioctl c0306201 200000c0 returned -22 [ 2871.422061][ T1538] binder: 1525:1538 ioctl c018620c 200000c0 returned -14 [ 2871.436909][ T1551] cannot load conntrack support for proto=3 05:43:56 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2871.468306][ T1522] binder: 1519:1522 unknown command 0 [ 2871.480233][ T1542] binder: 1519:1542 unknown command 0 [ 2871.480465][ T1544] binder: 1531:1544 ioctl c0306201 200000c0 returned -14 [ 2871.488925][ T1522] binder: 1519:1522 ioctl c0306201 20000200 returned -22 05:43:56 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x4000, 0x0, 0x0}) 05:43:56 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280)='/dev/kvm\x00', 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r6, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000440)={{}, 0x1, 0x6, 0x0, {}, 0x6, 0x1}) r7 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ttynull\x00', 0x240, 0x0) ioctl$TCSBRK(r7, 0x5409, 0x7f) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_NMI(r4, 0xae9a) [ 2871.531151][ T1542] binder: 1519:1542 ioctl c0306201 200000c0 returned -22 [ 2871.599884][ T1563] cannot load conntrack support for proto=3 05:43:56 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x7, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) 05:43:56 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x7, 0x0, 0x0}) [ 2871.647445][ T1569] cannot load conntrack support for proto=3 [ 2871.676705][ T1568] binder: 1564:1568 unknown command 0 05:43:56 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x88], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:43:56 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2871.692386][ T1566] cannot load conntrack support for proto=3 [ 2871.707256][ T1568] binder: 1564:1568 ioctl c0306201 20000200 returned -22 [ 2871.754329][ T1568] binder: 1564:1568 ioctl c018620c 200000c0 returned -14 [ 2871.766171][ T1586] binder_alloc: 12546: binder_alloc_buf, no vma [ 2871.773343][ T1583] binder: 1576:1583 unknown command 0 [ 2871.797770][ T1583] binder: 1576:1583 ioctl c0306201 20000200 returned -22 [ 2871.815520][ T1586] binder: 1580:1586 ioctl c0306201 200000c0 returned -14 [ 2871.826654][ T1602] binder: 1576:1602 unknown command 0 [ 2871.848194][ T1602] binder: 1576:1602 ioctl c0306201 200000c0 returned -22 [ 2871.860452][ T1603] cannot load conntrack support for proto=3 05:43:56 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x4800, 0x0, 0x0}) [ 2871.895579][ T1604] cannot load conntrack support for proto=3 [ 2871.913411][ T1583] binder: 1576:1583 unknown command 0 [ 2871.919177][ T1602] binder: 1576:1602 unknown command 0 [ 2871.925713][ T1583] binder: 1576:1583 ioctl c0306201 20000200 returned -22 [ 2871.937314][ T1618] cannot load conntrack support for proto=3 05:43:56 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0xe8], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:43:56 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x12, 0x0, 0x0}) 05:43:56 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000440)={{}, 0x1, 0x6, 0x0, {}, 0x6, 0x1}) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280)='/dev/kvm\x00', 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r6, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_PIT(r6, 0x8048ae66, &(0x7f0000000200)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) dup3(r6, 0xffffffffffffffff, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) ioctl$KVM_NMI(r4, 0xae9a) [ 2871.944746][ T1602] binder: 1576:1602 ioctl c0306201 200000c0 returned -22 05:43:56 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x300, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) [ 2872.024509][ T1621] binder: 1619:1621 unknown command 0 [ 2872.040971][ T1621] binder: 1619:1621 ioctl c0306201 20000200 returned -22 [ 2872.056311][ T1624] binder_alloc: 12546: binder_alloc_buf, no vma 05:43:56 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2872.073380][ T1621] binder: 1619:1621 ioctl c018620c 200000c0 returned -14 [ 2872.084286][ T1624] binder: 1622:1624 ioctl c0306201 200000c0 returned -14 05:43:57 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0xff], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:43:57 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x48, 0x0, 0x0}) 05:43:57 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x4c00, 0x0, 0x0}) [ 2872.161858][ T1634] binder: 1629:1634 unknown command 0 [ 2872.189522][ T1634] binder: 1629:1634 ioctl c0306201 20000200 returned -22 05:43:57 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2872.277494][ T1653] binder_alloc: 12546: binder_alloc_buf, no vma [ 2872.300207][ T1654] binder: 1651:1654 unknown command 0 [ 2872.312724][ T1653] binder: 1650:1653 ioctl c0306201 200000c0 returned -14 [ 2872.326586][ T1654] binder: 1651:1654 ioctl c0306201 20000200 returned -22 05:43:57 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x500, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) [ 2872.378448][ T1654] binder: 1651:1654 ioctl c018620c 200000c0 returned -14 05:43:57 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:43:57 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x4c, 0x0, 0x0}) 05:43:57 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:43:57 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x6000, 0x0, 0x0}) [ 2872.509240][ T1671] binder: 1669:1671 unknown command 0 [ 2872.543266][ T1671] binder: 1669:1671 ioctl c0306201 20000200 returned -22 [ 2872.575831][ T1677] binder_alloc: 12546: binder_alloc_buf, no vma [ 2872.590412][ T1671] binder: 1669:1671 unknown command 0 [ 2872.599531][ T1677] binder: 1672:1677 ioctl c0306201 200000c0 returned -14 [ 2872.619975][ T1671] binder: 1669:1671 ioctl c0306201 20000200 returned -22 [ 2872.682106][ T1691] binder: 1688:1691 unknown command 0 [ 2872.705075][ T1691] binder: 1688:1691 ioctl c0306201 20000200 returned -22 [ 2872.753863][ T1691] binder: 1688:1691 ioctl c018620c 200000c0 returned -14 [ 2873.518449][ T1626] warn_alloc: 6 callbacks suppressed [ 2873.518468][ T1626] syz-executor.1: page allocation failure: order:0, mode:0x400cc4(GFP_KERNEL_ACCOUNT|GFP_DMA32), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 2873.542360][ T1626] CPU: 0 PID: 1626 Comm: syz-executor.1 Not tainted 5.8.0-rc5-syzkaller #0 [ 2873.550954][ T1626] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2873.561007][ T1626] Call Trace: [ 2873.564302][ T1626] dump_stack+0x18f/0x20d [ 2873.568637][ T1626] warn_alloc.cold+0x87/0x17a [ 2873.573317][ T1626] ? zone_watermark_ok_safe+0x260/0x260 [ 2873.578879][ T1626] ? wait_for_completion+0x260/0x260 [ 2873.584174][ T1626] __alloc_pages_slowpath.constprop.0+0x2197/0x2780 [ 2873.590777][ T1626] ? warn_alloc+0x120/0x120 [ 2873.595283][ T1626] ? __alloc_pages_nodemask+0x3e5/0x930 [ 2873.600833][ T1626] ? lock_is_held_type+0xb0/0xe0 [ 2873.605772][ T1626] ? find_held_lock+0x2d/0x110 [ 2873.610544][ T1626] __alloc_pages_nodemask+0x68f/0x930 [ 2873.615922][ T1626] ? __zone_watermark_ok+0x370/0x370 [ 2873.621209][ T1626] ? __alloc_pages_slowpath.constprop.0+0x2780/0x2780 [ 2873.627964][ T1626] ? lock_is_held_type+0xb0/0xe0 [ 2873.632906][ T1626] ? rcu_read_lock_sched_held+0x3a/0xb0 [ 2873.638470][ T1626] ? __alloc_pages_nodemask+0x6b1/0x930 [ 2873.644018][ T1626] alloc_pages_current+0x187/0x280 [ 2873.649141][ T1626] alloc_mmu_pages+0x7f/0x170 [ 2873.653825][ T1626] kvm_mmu_create+0x3cb/0x560 [ 2873.658613][ T1626] kvm_arch_vcpu_create+0x16d/0xb70 [ 2873.663827][ T1626] kvm_vm_ioctl+0x1547/0x23c0 [ 2873.668509][ T1626] ? lock_downgrade+0x820/0x820 [ 2873.673361][ T1626] ? kvm_unregister_device_ops+0x60/0x60 [ 2873.678994][ T1626] ? trace_hardirqs_on+0x5f/0x220 [ 2873.684018][ T1626] ? lockdep_hardirqs_on+0x6a/0xe0 [ 2873.689152][ T1626] ? tomoyo_path_number_perm+0x244/0x4d0 [ 2873.694803][ T1626] ? tomoyo_execute_permission+0x470/0x470 [ 2873.700615][ T1626] ? __might_fault+0x11f/0x1d0 [ 2873.705391][ T1626] ? __sanitizer_cov_trace_switch+0x45/0x70 [ 2873.711280][ T1626] ? do_vfs_ioctl+0x27d/0x1090 [ 2873.716041][ T1626] ? generic_block_fiemap+0x60/0x60 [ 2873.721234][ T1626] ? __might_fault+0x190/0x1d0 [ 2873.725994][ T1626] ? _copy_to_user+0x126/0x160 [ 2873.730759][ T1626] ? __fget_files+0x294/0x400 [ 2873.735465][ T1626] ? kvm_unregister_device_ops+0x60/0x60 [ 2873.741118][ T1626] ksys_ioctl+0x11a/0x180 [ 2873.745450][ T1626] __x64_sys_ioctl+0x6f/0xb0 [ 2873.750041][ T1626] ? lockdep_hardirqs_on+0x6a/0xe0 [ 2873.755162][ T1626] do_syscall_64+0x60/0xe0 [ 2873.759600][ T1626] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2873.765494][ T1626] RIP: 0033:0x45c1d9 [ 2873.769379][ T1626] Code: Bad RIP value. [ 2873.773437][ T1626] RSP: 002b:00007f58ffba0c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2873.781847][ T1626] RAX: ffffffffffffffda RBX: 000000000000edc0 RCX: 000000000045c1d9 [ 2873.789819][ T1626] RDX: 0000000000000000 RSI: 000000000000ae41 RDI: 0000000000000006 [ 2873.798747][ T1626] RBP: 000000000078bf40 R08: 0000000000000000 R09: 0000000000000000 [ 2873.806749][ T1626] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000078bf0c [ 2873.814719][ T1626] R13: 0000000000c9fb6f R14: 00007f58ffba19c0 R15: 000000000078bf0c [ 2873.867806][ T1626] Mem-Info: [ 2873.870982][ T1626] active_anon:319248 inactive_anon:20516 isolated_anon:0 [ 2873.870982][ T1626] active_file:2309 inactive_file:46392 isolated_file:0 [ 2873.870982][ T1626] unevictable:0 dirty:71 writeback:0 [ 2873.870982][ T1626] slab_reclaimable:22976 slab_unreclaimable:211459 [ 2873.870982][ T1626] mapped:62973 shmem:20758 pagetables:125528 bounce:0 [ 2873.870982][ T1626] free:678359 free_pcp:703 free_cma:0 [ 2873.910411][ T1626] Node 0 active_anon:966308kB inactive_anon:47800kB active_file:12kB inactive_file:3096kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:224064kB dirty:20kB writeback:0kB shmem:48760kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 323584kB writeback_tmp:0kB all_unreclaimable? yes [ 2873.940361][ T1626] Node 1 active_anon:310684kB inactive_anon:34264kB active_file:9224kB inactive_file:182472kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:27828kB dirty:264kB writeback:0kB shmem:34272kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB all_unreclaimable? no [ 2873.969003][ T1626] Node 0 DMA free:10264kB min:220kB low:272kB high:324kB reserved_highatomic:0KB active_anon:3964kB inactive_anon:272kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15908kB mlocked:0kB kernel_stack:124kB pagetables:272kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2873.999653][ T1626] lowmem_reserve[]: 0 2515 2515 2515 2515 [ 2874.005969][ T1626] Node 0 DMA32 free:34156kB min:35916kB low:44892kB high:53868kB reserved_highatomic:0KB active_anon:962344kB inactive_anon:47528kB active_file:12kB inactive_file:3096kB unevictable:0kB writepending:20kB present:3129332kB managed:2578200kB mlocked:0kB kernel_stack:85656kB pagetables:245232kB bounce:0kB free_pcp:344kB local_pcp:244kB free_cma:0kB [ 2874.039330][ T1626] lowmem_reserve[]: 0 0 0 0 0 [ 2874.044671][ T1626] Node 0 Normal free:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:786432kB managed:0kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2874.074392][ T1626] lowmem_reserve[]: 0 0 0 0 0 [ 2874.079091][ T1626] Node 1 Normal free:2669160kB min:53972kB low:67464kB high:80956kB reserved_highatomic:0KB active_anon:310684kB inactive_anon:34264kB active_file:9224kB inactive_file:182472kB unevictable:0kB writepending:264kB present:3932160kB managed:3870200kB mlocked:0kB kernel_stack:81784kB pagetables:256608kB bounce:0kB free_pcp:2540kB local_pcp:1176kB free_cma:0kB [ 2874.113392][ T1626] lowmem_reserve[]: 0 0 0 0 0 [ 2874.118089][ T1626] Node 0 DMA: 4*4kB (ME) 5*8kB (UM) 6*16kB (UM) 8*32kB (U) 8*64kB (UME) 7*128kB (ME) 7*256kB (UME) 5*512kB (UME) 2*1024kB (UE) 1*2048kB (M) 0*4096kB = 10264kB [ 2874.135241][ T1626] Node 0 DMA32: 177*4kB (UM) 978*8kB (UME) 403*16kB (UME) 205*32kB (UME) 132*64kB (UME) 20*128kB (UME) 7*256kB (UME) 0*512kB 0*1024kB 0*2048kB 0*4096kB = 34340kB [ 2874.152228][ T1626] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 2874.164527][ T1626] Node 1 Normal: 254*4kB (UE) 30*8kB (UE) 182*16kB (UME) 25*32kB (UE) 10*64kB (UME) 4*128kB (UME) 2*256kB (E) 2*512kB (ME) 3*1024kB (UME) 2*2048kB (ME) 648*4096kB (UM) = 2669032kB [ 2874.184356][ T1626] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 2874.194535][ T1626] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 2874.204410][ T1626] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 2874.214625][ T1626] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 2874.224535][ T1626] 30792 total pagecache pages [ 2874.229212][ T1626] 0 pages in swap cache [ 2874.234406][ T1626] Swap cache stats: add 0, delete 0, find 0/0 [ 2874.240469][ T1626] Free swap = 0kB [ 2874.245299][ T1626] Total swap = 0kB [ 2874.249027][ T1626] 1965979 pages RAM [ 2874.253885][ T1626] 0 pages HighMem/MovableOnly [ 2874.258579][ T1626] 349902 pages reserved [ 2874.263874][ T1626] 0 pages cma reserved 05:43:59 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x60, 0x0, 0x0}) 05:43:59 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:43:59 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x600, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) 05:43:59 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:43:59 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x6800, 0x0, 0x0}) 05:43:59 executing program 1: socket$unix(0x1, 0x1, 0x0) socket$isdn_base(0x22, 0x3, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000200)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) r3 = fcntl$dupfd(r2, 0x406, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(r5, 0x4090ae82, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000440)={{}, 0x1, 0x6, 0x0, {}, 0x6, 0x1}) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_NMI(r5, 0xae9a) write$P9_RSTATFS(r3, &(0x7f0000000000)={0x43, 0x9, 0x1, {0xffff, 0x96, 0x2, 0x20, 0xaf7, 0x0, 0x6, 0x200, 0x7}}, 0x43) [ 2874.376121][ T1730] binder_alloc: 12546: binder_alloc_buf, no vma [ 2874.387905][ T1734] binder: 1726:1734 unknown command 0 [ 2874.389039][ T1733] binder: 1728:1733 unknown command 0 [ 2874.408596][ T1733] binder: 1728:1733 ioctl c0306201 20000200 returned -22 [ 2874.419314][ T1730] binder: 1724:1730 ioctl c0306201 200000c0 returned -14 05:43:59 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:43:59 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2874.435043][ T1734] binder: 1726:1734 ioctl c0306201 20000200 returned -22 [ 2874.457317][ T1733] binder: 1728:1733 ioctl c018620c 200000c0 returned -14 05:43:59 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x700, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) 05:43:59 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:43:59 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x68, 0x0, 0x0}) 05:43:59 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x6c00, 0x0, 0x0}) [ 2874.642807][ T1761] binder: 1759:1761 unknown command 0 [ 2874.657094][ T1761] binder: 1759:1761 ioctl c0306201 20000200 returned -22 [ 2874.679836][ T1761] binder: 1759:1761 unknown command 0 05:43:59 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2874.697209][ T1761] binder: 1759:1761 ioctl c0306201 20000200 returned -22 [ 2874.736066][ T1767] binder_alloc: 12546: binder_alloc_buf, no vma [ 2874.740369][ T1766] binder: 1764:1766 unknown command 0 [ 2874.760988][ T1766] binder: 1764:1766 ioctl c0306201 20000200 returned -22 [ 2874.773456][ T1767] binder: 1763:1767 ioctl c0306201 200000c0 returned -14 05:43:59 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:43:59 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x3f00, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) [ 2874.804165][ T1766] binder: 1764:1766 ioctl c018620c 200000c0 returned -14 05:43:59 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x12], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:43:59 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x6c, 0x0, 0x0}) [ 2874.951131][ T1787] binder: 1781:1787 unknown command 0 [ 2874.986094][ T1787] binder: 1781:1787 ioctl c0306201 20000200 returned -22 [ 2875.014067][ T1797] binder_alloc: 12546: binder_alloc_buf, no vma [ 2875.034450][ T1797] binder: 1790:1797 ioctl c0306201 200000c0 returned -14 [ 2875.034636][ T1787] binder: 1781:1787 unknown command 0 [ 2875.081410][ T1787] binder: 1781:1787 ioctl c0306201 20000200 returned -22 05:44:00 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:44:00 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x7400, 0x0, 0x0}) 05:44:00 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1d], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:00 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x74, 0x0, 0x0}) 05:44:00 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x1000000, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) 05:44:00 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) r5 = open(&(0x7f0000000140)='./file0\x00', 0x34532b7829bd63ae, 0x5d) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) r7 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r7, 0x84, 0xf, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e24, @private=0xa010102}}, 0x13ea, 0x1, 0x1, 0x1ff, 0x10000}, &(0x7f00000000c0)=0x98) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000080)={0x4, 0x0, 0xfff, 0x2, r6}, 0x10) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000440)={{}, 0x1, 0x6, 0x0, {}, 0x6, 0x1}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_NMI(r4, 0xae9a) ioctl$FS_IOC_GETFLAGS(0xffffffffffffffff, 0x80086601, &(0x7f0000000000)) [ 2876.091298][ T1822] binder: 1816:1822 unknown command 0 [ 2876.101139][ T1823] binder: 1817:1823 unknown command 0 [ 2876.110832][ T1827] binder_alloc: 12546: binder_alloc_buf, no vma [ 2876.119385][ T1823] binder: 1817:1823 ioctl c0306201 20000200 returned -22 [ 2876.134409][ T1827] binder: 1814:1827 ioctl c0306201 200000c0 returned -14 05:44:01 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2876.147393][ T1822] binder: 1816:1822 ioctl c0306201 20000200 returned -22 [ 2876.166132][ T1834] binder: 1816:1834 ioctl c018620c 200000c0 returned -14 05:44:01 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:01 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x7a00, 0x0, 0x0}) 05:44:01 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x2000000, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) 05:44:01 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x7a, 0x0, 0x0}) [ 2876.368041][ T1846] binder: 1843:1846 unknown command 0 [ 2876.373630][ T1847] binder: 1845:1847 unknown command 0 [ 2876.373646][ T1847] binder: 1845:1847 ioctl c0306201 20000200 returned -22 [ 2876.384770][ T1847] binder: 1845:1847 ioctl c018620c 200000c0 returned -14 [ 2876.404468][ T1849] connmark_tg_check: 26 callbacks suppressed [ 2876.404476][ T1849] cannot load conntrack support for proto=3 [ 2876.421457][ T1855] binder_alloc: 12546: binder_alloc_buf, no vma [ 2876.429779][ T1851] cannot load conntrack support for proto=3 [ 2876.449140][ T1855] binder: 1852:1855 ioctl c0306201 200000c0 returned -14 [ 2876.462642][ T1846] binder: 1843:1846 ioctl c0306201 20000200 returned -22 [ 2876.467962][ T1861] cannot load conntrack support for proto=3 [ 2876.496779][ T1851] cannot load conntrack support for proto=3 05:44:01 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x3000000, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) 05:44:01 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xff00, 0x0, 0x0}) 05:44:01 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:01 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:44:01 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x300, 0x0, 0x0}) [ 2876.658413][ T1878] cannot load conntrack support for proto=3 [ 2876.671161][ T1879] binder: 1869:1879 unknown command 0 [ 2876.673963][ T1876] binder_alloc: 12546: binder_alloc_buf, no vma [ 2876.685250][ T1873] binder: 1870:1873 unknown command 0 [ 2876.688920][ T1879] binder: 1869:1879 ioctl c0306201 20000200 returned -22 [ 2876.690648][ T1873] binder: 1870:1873 ioctl c0306201 20000200 returned -22 [ 2876.699063][ T1877] cannot load conntrack support for proto=3 [ 2876.716051][ T1881] cannot load conntrack support for proto=3 [ 2876.723809][ T1876] binder: 1867:1876 ioctl c0306201 200000c0 returned -14 [ 2876.732416][ T1873] binder: 1870:1873 ioctl c018620c 200000c0 returned -14 [ 2876.779869][ T1879] binder: 1869:1879 unknown command 0 [ 2876.789681][ T1877] cannot load conntrack support for proto=3 [ 2876.798023][ T1879] binder: 1869:1879 ioctl c0306201 20000200 returned -22 05:44:01 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x500, 0x0, 0x0}) [ 2876.957911][ T1901] binder_alloc: 12546: binder_alloc_buf, no vma [ 2876.964964][ T1901] binder: 1899:1901 ioctl c0306201 200000c0 returned -14 05:44:01 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) fcntl$addseals(r3, 0x409, 0x4) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000440)={{}, 0x1, 0x6, 0x0, {}, 0x6, 0x1}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_NMI(r4, 0xae9a) 05:44:01 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:01 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x4000000, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) 05:44:01 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1000000, 0x0, 0x0}) 05:44:01 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1d], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:44:01 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x600, 0x0, 0x0}) [ 2877.066561][ T1919] cannot load conntrack support for proto=3 [ 2877.074651][ T1917] binder: 1910:1917 unknown command 0 [ 2877.075123][ T1915] binder: 1912:1915 unknown command 0 [ 2877.086731][ T1917] binder: 1910:1917 ioctl c0306201 20000200 returned -22 [ 2877.097537][ T1924] cannot load conntrack support for proto=3 [ 2877.103717][ T1922] binder_alloc: 12546: binder_alloc_buf, no vma [ 2877.132812][ T1917] binder: 1910:1917 ioctl c018620c 200000c0 returned -14 [ 2877.150743][ T1922] binder: 1914:1922 ioctl c0306201 200000c0 returned -14 05:44:02 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:44:02 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2877.182155][ T1915] binder: 1912:1915 ioctl c0306201 20000200 returned -22 05:44:02 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0}) 05:44:02 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x700, 0x0, 0x0}) 05:44:02 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000440)={{}, 0x1, 0x6, 0x0, {}, 0x6, 0x1}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_NMI(r4, 0xae9a) [ 2877.254193][ T1915] binder: 1912:1915 unknown command 0 [ 2877.259614][ T1915] binder: 1912:1915 ioctl c0306201 20000200 returned -22 05:44:02 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x5000000, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) 05:44:02 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:44:02 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2877.373801][ T1952] binder: 1947:1952 unknown command 0 [ 2877.381062][ T1955] binder_alloc: 12546: binder_alloc_buf, no vma [ 2877.406335][ T1955] binder: 1950:1955 ioctl c0306201 200000c0 returned -14 [ 2877.406346][ T1952] binder: 1947:1952 ioctl c0306201 20000200 returned -22 [ 2877.420563][ T1952] binder: 1947:1952 ioctl c018620c 200000c0 returned -14 [ 2877.430520][ T1959] binder: 1956:1959 unknown command 0 [ 2877.451205][ T1959] binder: 1956:1959 ioctl c0306201 20000200 returned -22 05:44:02 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x1200, 0x0, 0x0}) 05:44:02 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x3000000, 0x0, 0x0}) 05:44:02 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x74], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:02 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:44:02 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x6000000, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) [ 2877.678670][ T1983] binder_alloc: 12546: binder_alloc_buf, no vma [ 2877.687024][ T1984] binder: 1980:1984 unknown command 0 [ 2877.700690][ T1983] binder: 1978:1983 ioctl c0306201 200000c0 returned -14 [ 2877.710179][ T1984] binder: 1980:1984 ioctl c0306201 20000200 returned -22 05:44:02 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:44:02 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2877.725239][ T1986] binder: 1981:1986 unknown command 0 [ 2877.753455][ T1986] binder: 1981:1986 ioctl c0306201 20000200 returned -22 [ 2877.764551][ T1984] binder: 1980:1984 ioctl c018620c 200000c0 returned -14 [ 2877.790489][ T1986] binder: 1981:1986 unknown command 0 05:44:02 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x2000, 0x0, 0x0}) [ 2877.809728][ T1986] binder: 1981:1986 ioctl c0306201 20000200 returned -22 [ 2877.950573][ T1998] binder_alloc: 12546: binder_alloc_buf, no vma [ 2877.957674][ T1998] binder: 1997:1998 ioctl c0306201 200000c0 returned -14 05:44:03 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x7000000, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) 05:44:03 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x4000000, 0x0, 0x0}) 05:44:03 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:44:03 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x88], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:03 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x4800, 0x0, 0x0}) [ 2878.859018][ T2025] binder: 2013:2025 unknown command 0 [ 2878.869019][ T2026] binder: 2018:2026 unknown command 0 [ 2878.875005][ T2025] binder: 2013:2025 ioctl c0306201 20000200 returned -22 [ 2878.880182][ T2033] binder_alloc: 12546: binder_alloc_buf, no vma [ 2878.884495][ T2026] binder: 2018:2026 ioctl c0306201 20000200 returned -22 05:44:03 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x74], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:44:03 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:03 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x3f000000, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) [ 2878.908754][ T2033] binder: 2020:2033 ioctl c0306201 200000c0 returned -14 [ 2878.944964][ T2039] binder: 2018:2039 ioctl c018620c 200000c0 returned -14 05:44:03 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x4c00, 0x0, 0x0}) 05:44:03 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5000000, 0x0, 0x0}) 05:44:03 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = shmget$private(0x0, 0x4000, 0x0, &(0x7f000000c000/0x4000)=nil) shmat(r2, &(0x7f0000000000/0x13000)=nil, 0x4000) shmctl$IPC_STAT(r2, 0x2, &(0x7f0000000000)=""/65) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x32a00, 0x0) ioctl$TIOCGLCKTRMIOS(r5, 0x5456, &(0x7f0000000180)={0x53da, 0x683, 0x245, 0x80000001, 0x8, "45c5bad6b02521c67b761d91651b7f3d11ba1e"}) r6 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(r6, 0x4090ae82, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000440)={{}, 0x1, 0x6, 0x0, {}, 0x6, 0x1}) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$KVM_NMI(r6, 0xae9a) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r1, 0x89f6, &(0x7f00000001c0)={'ip6tnl0\x00', &(0x7f0000000240)={'syztnl2\x00', 0x0, 0x29, 0xd4, 0xcb, 0x100, 0x12, @ipv4={[], [], @loopback}, @remote, 0x20, 0x80, 0x4, 0x6}}) sendmsg$ETHTOOL_MSG_DEBUG_SET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000300)={&(0x7f00000004c0)=ANY=[@ANYBLOB='P\t\x00\x00', @ANYRES16=0x0, @ANYBLOB="08002dbd7000fddbdf2508000000640302803c00038038000180040003001b000200747275737465642e6f7665726c61792e696d70757265000008000100ffffffff0400030005000200000000005c000400e9de6e0c87c54880cbf1b614c7bc04355ab79e1ce236d9742d97b4aaf9a0df4b6de6936f6b2ac7897d78c6059d0c3ba406c168f3b0060f8c55509fff6a04d7342ae29f2e38d9f56f764911d006dfe6bf133fe5b8595c0526d60004001ed160eaf55e95735e0ce65b9e3beb34ca307f04a3e63b9419d2da723d080e00ab0b65da3eaf4b5e86f85488e026add1fe404815d476e1af4b34876cc3a317f6d2beecd5571e6b62fc6c53e03fb35f68c9d47ec1febe40a151c6fecea43e5c985e4d505debe273aa144274f5fa214168bf5602c747b595f80c36b594d3b757fea6acbf1218202bfe3aba32c39886e5c42e05be9f695a19f810f977d6362d6843b3d19a8b93ed8b9e53136265f59abe5ef437c82e04ed04cc1b3e61ef2d428ff5acec5fc3fa59ab462810d62ca1ad09bf83530000400005000a2e92b3ca51849cd666c33eb7a628ea57e4fdde71502ba70ef496f02a3542c1ff975b1a1c388cb3e6c3d00a03acb941ce52ac0e45655ea516c9c1330400010030000400c7c5ed869845c2b69522847f48c98d744e3acbbd72ff78490ce6e20cd80886a3f0d41a911696ae4529b8b64a9d0005007053e6bdda3fd856e30aab30ef599d3627c1f8443f537dcc110ce76512e3aa7c0a792b9735d5b0d656e7a1dbf6e8ddf7024f8cd66e7c282f4b2c5dc157f79e14b80ba6ea3d57d2da82c944b48dc1f6c48e6119c4761bb865f42180baffc804ae8d1850a9331997f8865f7266cb6d81d13fa168f3e7438b052fc39f43c36fcfd34d5d134b52b6b8d0ca90a85b68e14848b97a82dee1e90a9917000000d70004007323c644d7ce9ef0d97f6ed07462fff7d304fdb2fa8a41ca88122ee4f491e9407b6f26e6e392b6fcea60b83e063df183b055a2693274f554be2c3221d638a233892ee1379e554e0ce6c184e94da0c29f31d9f9f54cf4e8bf55f7b212b8ef45b630bad2eb739cd4d372489eb9566e89b1408ecfe95a1ce72634f41ff6e0fa1fd8a2d90efc8d5e112eef0a1a1be7101d4985bab9c48a1e2d2939b67d9573d93730f3cb78313b21a20394f3ee43539416e4746cd77608e6a9aab31a3528ac7e623fb8c24da1ba163c198709337d18194d19619a70000400010070000180140002007866726d3000000000000000000000001400020074756e6c3000000000000000000000001400020076657468315f766c616e0000000000001400020000000000000000000000000000000000140002006261746164765f736c6176655f3100000800030003000000bc000280b10004005e071152e22ae10156ce1a2c2e699ac826d8f1027e16c9a3b9b654bedaa17d480375c8d12c0ca38c288b0dc1fe8991c33584ac31a53da28707897eb7bdac9e667140d40a21f6394ceb5812b0915b9558905b0f3cb74c8b43da722f3fc59eb216c033668c2c41ee80e1b7aefc5e6c384be43d977b5431614d53b84a1cf40dc1e5c5297253bf44f433b36e53e3a95c5f5715422db93cd32a140b458f861c16ca0b4b84e20fdf804b5bbade783efb00000004000100440001800800030003000000140002006970365f7674693000000000000000000800030003000000140002007663616e30000000000000000000000008000100", @ANYRES32=r7, @ANYBLOB="54000180080003000100000008000300030000001400020076657468305f766972745f7769666900080003000000000008000300000000000800030000000000140002006272696467655f736c6176655f3100008c000280880003801800018004000300080001003f00000008000100000000802400018004000300060002003a0000000b0002002d2e402a212d0000060002002900000048000180040003001b000200747275737465642e6f7665726c61792e696d70757265000006000200a800000008000100010000000d0002002f6465762f6b766d000000000400030008000280040001008003028008000200ff01000016000500537d1ed3ec00d8908a59cb53a510e339f725000004000100580003805400018008000100e2740000160002002f70726f632f636170692f6361706932300000000400030008000100000001001b000200747275737465642e6f7665726c61792e696d707572650000080001000900000044000380200001800a0002005d2b2d5d2e00000008000100010000000800010004000000200001800b0002007b2f3a23127d0000060002005e0000000400030004000300000203801c0001800d0002002f6465762f6b766d0000000008000100ff0700004c000180040003000500020000000000160002002f70726f632f636170692f6361706932300000000d0002002f6465762f6b766d00000000050002000000000008000100030000000400030050000180060002002a0000000d0002002f6465762f6b766d0000000009000200245b2d5b000000000d0002002f6465762f6b766d0000000004000300040003000e0002007dfe5bea077ba35c2500000024000180160002002f70726f632f636170692f6361706932300000000600020024000000740001800700020027250000080001000080000008000100000000800400030011000200265b5b287d5c282127252523000000000d0002002f6465762f6b766d00000000160002002f70726f632f636170692f6361706932300000000800010007000000080001000100000008000100000000001c000180080002002f217d0004000300040003000400030004000300040001801c000180160002002f70726f632f636170692f636170693230000000200001801b000200747275737465642e6f7665726c61792e696d7075726500005000018004000300060002002500000004000300060002005d0000001b000200747275737465642e6f7665726c61792e696d707572650000040003000d0002002f6465762f6b766d00000000040003000400010004000100b40003802800018008000100b1d700000d0002002f6465762f6b766d000000000800010008000000040003000800018004000300300001800400030008000100ffffffff110002005b23295c2d2a5b9f2528232d000000000a000200287b252ce50000000c00018004000300040003004400018004000300040003000800010006000000080001000900000008000200275c230008000100e6000000160002002f70726f632f636170692f636170693230000000"], 0x950}, 0x1, 0x0, 0x0, 0x40000}, 0x0) fgetxattr(r3, &(0x7f0000000080)=@known='trusted.overlay.impure\x00', &(0x7f0000000100)=""/23, 0x17) 05:44:03 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2879.078710][ T2052] binder: 2049:2052 unknown command 0 [ 2879.093965][ T2052] binder: 2049:2052 ioctl c0306201 20000200 returned -22 05:44:04 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2879.150126][ T2052] binder: 2049:2052 unknown command 0 [ 2879.157802][ T2061] binder: 2060:2061 unknown command 0 [ 2879.171481][ T2052] binder: 2049:2052 ioctl c0306201 20000200 returned -22 [ 2879.175425][ T2071] binder_alloc: 12546: binder_alloc_buf, no vma [ 2879.182521][ T2061] binder: 2060:2061 ioctl c0306201 20000200 returned -22 [ 2879.207537][ T2074] binder: 2060:2074 ioctl c018620c 200000c0 returned -14 [ 2879.244433][ T2071] binder: 2063:2071 ioctl c0306201 200000c0 returned -14 05:44:04 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:04 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0xfdfdffff, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) 05:44:04 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x6000000, 0x0, 0x0}) 05:44:04 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x6000, 0x0, 0x0}) 05:44:04 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x88], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2879.438684][ T2094] binder: 2088:2094 unknown command 0 [ 2879.446029][ T2095] binder_alloc: 12546: binder_alloc_buf, no vma [ 2879.452062][ T2093] binder: 2089:2093 unknown command 0 [ 2879.466137][ T2095] binder: 2090:2095 ioctl c0306201 200000c0 returned -14 [ 2879.470386][ T2094] binder: 2088:2094 ioctl c0306201 20000200 returned -22 [ 2879.481532][ T2093] binder: 2089:2093 ioctl c0306201 20000200 returned -22 05:44:04 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:04 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x6800, 0x0, 0x0}) [ 2879.518746][ T2099] binder: 2089:2099 ioctl c018620c 200000c0 returned -14 [ 2879.519829][ T2094] binder: 2088:2094 unknown command 0 [ 2879.572523][ T2094] binder: 2088:2094 ioctl c0306201 20000200 returned -22 05:44:04 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:44:04 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x7000000, 0x0, 0x0}) [ 2879.680104][ T2112] binder: 2107:2112 ioctl c0306201 200000c0 returned -14 [ 2879.766097][ T2121] binder: 2119:2121 unknown command 0 [ 2879.779708][ T2121] binder: 2119:2121 ioctl c0306201 20000200 returned -22 [ 2879.804517][ T2121] binder: 2119:2121 ioctl c018620c 200000c0 returned -14 05:44:05 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x6c00, 0x0, 0x0}) 05:44:05 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0xfffffdfd, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) 05:44:05 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:05 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:44:05 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x8000000, 0x0, 0x0}) 05:44:05 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, 0x0) setsockopt$inet_sctp_SCTP_INITMSG(r1, 0x84, 0x2, &(0x7f0000000000)={0x101, 0x7, 0x2, 0x86}, 0x8) ioctl$KVM_SET_REGS(r4, 0x4090ae82, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000240)={{}, 0x1, 0xffffffff, 0x0, {}, 0x6, 0x1}) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r4, 0xc04c5349, &(0x7f0000000100)={0xcce, 0x40, 0x400}) ioctl$KVM_RUN(r4, 0xae80, 0x0) r5 = socket$inet_sctp(0x2, 0x5, 0x84) r6 = openat$6lowpan_enable(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/debug/bluetooth/6lowpan_enable\x00', 0x2, 0x0) fsetxattr$trusted_overlay_upper(r6, &(0x7f0000000180)='trusted.overlay.upper\x00', &(0x7f00000001c0)={0x0, 0xfb, 0x4c, 0x1, 0x5, "df70eb1ab0b41af69b1ec08d284bc633", "ec4ca43558635cf64862000a68e1f27151a8e9db025b47bbedc2a63fcb31c3e5d5aad9bee33a0cddadb2ae0a6b95093d3cea2992bb6d2a"}, 0x4c, 0x1) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000340)={r7, @in6={{0xa, 0x4e20, 0x0, @local, 0x6}}, 0xfff, 0x7fffffff, 0x1, 0x101ff, 0x1}, &(0x7f00000000c0)=0x98) setsockopt$inet_sctp_SCTP_AUTH_DEACTIVATE_KEY(r5, 0x84, 0x23, &(0x7f0000000040)={r7, 0x2}, 0x8) [ 2880.539774][ T2138] binder: 2134:2138 unknown command 0 [ 2880.545555][ T2140] binder: 2132:2140 ioctl c0306201 200000c0 returned -14 [ 2880.560214][ T2138] binder: 2134:2138 ioctl c0306201 20000200 returned -22 [ 2880.563562][ T2141] binder: 2135:2141 unknown command 0 [ 2880.598063][ T2138] binder: 2134:2138 unknown command 0 05:44:05 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x7400, 0x0, 0x0}) [ 2880.626314][ T2141] binder: 2135:2141 ioctl c0306201 20000200 returned -22 [ 2880.628728][ T2138] binder: 2134:2138 ioctl c0306201 20000200 returned -22 05:44:05 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2880.668659][ T2150] binder: 2135:2150 ioctl c018620c 200000c0 returned -14 05:44:05 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:44:05 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000bf7000)={0x10000, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(0xffffffffffffffff, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, &(0x7f0000000200)={[{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}]}) ioctl$VIDIOC_S_EXT_CTRLS(r1, 0xc0205648, &(0x7f0000000100)={0x0, 0x4, 0x7ff, 0xffffffffffffffff, 0x0, &(0x7f0000000000)={0x98092a, 0x3f6, [], @value64}}) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(0xffffffffffffffff, 0xc0a85322, &(0x7f0000000140)) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000440)={{0x9}, 0x1, 0x7f, 0x0, {0x0, 0x7f}, 0x7, 0x8000001}) ioctl$KVM_RUN(r4, 0xae80, 0x0) r5 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r5, &(0x7f0000000040)={0xa, 0x0, 0x0, @empty}, 0x1c) sendmmsg(r5, &(0x7f0000000b80)=[{{0x0, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000080)="ae4a56b3b0022cc93b60059e06755476cb57c8e19ebf7e5effc0a5314330e27c0f5fb9bc407a91756332302f8981384d", 0x30}], 0x1}}], 0x1, 0x0) ioctl$KVM_NMI(r4, 0xae9a) 05:44:05 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x100000000000000, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) 05:44:05 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x20000000, 0x0, 0x0}) 05:44:05 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2880.801604][ T2174] binder: 2171:2174 ioctl c0306201 200000c0 returned -14 05:44:05 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x7a00, 0x0, 0x0}) [ 2880.870750][ T2182] binder: 2178:2182 unknown command 0 [ 2880.896455][ T2182] binder: 2178:2182 ioctl c0306201 20000200 returned -22 [ 2880.908869][ T2186] binder: 2183:2186 unknown command 0 05:44:05 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2880.931528][ T2186] binder: 2183:2186 ioctl c0306201 20000200 returned -22 [ 2880.988555][ T2196] binder: 2183:2196 ioctl c018620c 200000c0 returned -14 05:44:05 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:05 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x3f000000, 0x0, 0x0}) 05:44:05 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x200000000000000, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) 05:44:06 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2881.079127][ T2209] binder: 2207:2209 ioctl c0306201 200000c0 returned -14 05:44:06 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:06 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x1000000, 0x0, 0x0}) [ 2881.189231][ T2219] binder: 2215:2219 unknown command 0 [ 2881.210419][ T2219] binder: 2215:2219 ioctl c0306201 20000200 returned -22 [ 2881.210947][ T2220] binder: 2213:2220 unknown command 0 [ 2881.250363][ T2224] binder: 2215:2224 ioctl c018620c 200000c0 returned -14 [ 2881.263524][ T2220] binder: 2213:2220 ioctl c0306201 20000200 returned -22 [ 2881.275854][ T2227] binder: 2225:2227 ioctl c0306201 200000c0 returned -14 [ 2881.305499][ T2220] binder: 2213:2220 unknown command 0 [ 2881.338588][ T2220] binder: 2213:2220 ioctl c0306201 20000200 returned -22 05:44:06 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x8387e7e49d7573bc, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(0xffffffffffffffff, 0x40045532, &(0x7f0000000040)) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) set_robust_list(&(0x7f0000000300)={&(0x7f00000001c0), 0x40, &(0x7f00000002c0)={&(0x7f0000000280)}}, 0x18) getsockopt$inet_sctp6_SCTP_RECVRCVINFO(r5, 0x84, 0x20, &(0x7f0000000100), &(0x7f0000000140)=0x4) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000440)={{0xfc}, 0x1, 0x6, 0x0, {0x0, 0xff}, 0x6, 0x8000}) ioctl$KVM_GET_DIRTY_LOG(r1, 0x4010ae42, &(0x7f0000000000)={0x1ff, 0x0, &(0x7f0000fff000/0x1000)=nil}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_NMI(r4, 0xae9a) ioctl$BINDER_SET_MAX_THREADS(r1, 0x40046205, &(0x7f0000000080)=0x2) 05:44:06 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:44:06 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x40000000, 0x0, 0x0}) 05:44:06 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:06 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x300000000000000, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) 05:44:06 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x2000000, 0x0, 0x0}) [ 2881.511930][ T2246] connmark_tg_check: 45 callbacks suppressed [ 2881.511937][ T2244] binder: 2240:2244 unknown command 0 [ 2881.511941][ T2246] cannot load conntrack support for proto=3 [ 2881.521180][ T2250] binder: 2238:2250 unknown command 0 [ 2881.527285][ T2248] binder_alloc_new_buf_locked: 5 callbacks suppressed [ 2881.527294][ T2248] binder_alloc: 12546: binder_alloc_buf, no vma [ 2881.537403][ T2251] cannot load conntrack support for proto=3 [ 2881.565249][ T2242] cannot load conntrack support for proto=3 [ 2881.572575][ T2250] binder: 2238:2250 ioctl c0306201 20000200 returned -22 [ 2881.573591][ T2256] binder: 2240:2256 ioctl c018620c 200000c0 returned -14 [ 2881.596515][ T2244] binder: 2240:2244 ioctl c0306201 20000200 returned -14 05:44:06 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x400000000000000, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) [ 2881.612756][ T2248] binder: 2235:2248 ioctl c0306201 200000c0 returned -14 [ 2881.615720][ T2242] cannot load conntrack support for proto=3 05:44:06 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000440)={{}, 0x1, 0x6, 0x0, {}, 0x6, 0x1}) ioctl$KVM_RUN(r4, 0xae80, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r5, 0x0) ioctl$KVM_SET_DEVICE_ATTR(r5, 0x4018aee1, &(0x7f0000000040)={0x0, 0xe3e1, 0x3c63, &(0x7f0000000000)=0x1}) ioctl$KVM_NMI(r4, 0xae9a) 05:44:06 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:06 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:44:06 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x48000000, 0x0, 0x0}) 05:44:06 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x3000000, 0x0, 0x0}) [ 2881.736664][ T2267] binder: 2264:2267 unknown command 0 [ 2881.744692][ T2267] binder: 2264:2267 ioctl c0306201 20000200 returned -22 [ 2881.774415][ T2271] cannot load conntrack support for proto=3 [ 2881.783550][ T2276] cannot load conntrack support for proto=3 [ 2881.794082][ T2267] binder: 2264:2267 unknown command 0 [ 2881.801415][ T2267] binder: 2264:2267 ioctl c0306201 20000200 returned -22 05:44:06 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x12], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2881.840287][ T2285] binder: 2273:2285 unknown command 0 [ 2881.863665][ T2286] binder_alloc: 12546: binder_alloc_buf, no vma [ 2881.877266][ T2285] binder: 2273:2285 ioctl c0306201 20000200 returned -22 05:44:06 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x500000000000000, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) [ 2881.909692][ T2286] binder: 2280:2286 ioctl c0306201 200000c0 returned -14 [ 2881.919161][ T2291] binder: 2273:2291 ioctl c018620c 200000c0 returned -14 [ 2881.944679][ T2290] cannot load conntrack support for proto=3 05:44:06 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x4c000000, 0x0, 0x0}) 05:44:06 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:44:06 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x4000000, 0x0, 0x0}) [ 2882.004577][ T2297] binder: 2296:2297 unknown command 0 [ 2882.017524][ T2299] cannot load conntrack support for proto=3 [ 2882.046133][ T2297] binder: 2296:2297 ioctl c0306201 20000200 returned -22 [ 2882.062084][ T2305] cannot load conntrack support for proto=3 05:44:07 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x600000000000000, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) [ 2882.099810][ T2308] binder_alloc: 12546: binder_alloc_buf, no vma [ 2882.129077][ T2310] binder: 2307:2310 unknown command 0 [ 2882.133786][ T2308] binder: 2304:2308 ioctl c0306201 200000c0 returned -14 05:44:07 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1d], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:07 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2882.151528][ T2310] binder: 2307:2310 ioctl c0306201 20000200 returned -22 [ 2882.179980][ T2311] cannot load conntrack support for proto=3 [ 2882.214112][ T2310] binder: 2307:2310 ioctl c018620c 200000c0 returned -14 [ 2882.242093][ T2329] binder: 2322:2329 unknown command 0 05:44:07 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x5000000, 0x0, 0x0}) 05:44:07 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x60000000, 0x0, 0x0}) [ 2882.261578][ T2329] binder: 2322:2329 ioctl c0306201 20000200 returned -22 05:44:07 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:07 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x700000000000000, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) [ 2882.330502][ T2337] binder_alloc: 12546: binder_alloc_buf, no vma [ 2882.357748][ T2337] binder: 2334:2337 ioctl c0306201 200000c0 returned -14 [ 2882.375125][ T2343] binder: 2338:2343 unknown command 0 [ 2882.398460][ T2343] binder: 2338:2343 ioctl c0306201 20000200 returned -22 05:44:07 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x6000000, 0x0, 0x0}) [ 2882.446401][ T2353] binder: 2338:2353 ioctl c018620c 200000c0 returned -14 05:44:07 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:44:07 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:07 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x68000000, 0x0, 0x0}) [ 2882.504549][ T2351] binder: 2346:2351 unknown command 0 [ 2882.542650][ T2351] binder: 2346:2351 ioctl c0306201 20000200 returned -22 [ 2882.554466][ T2357] binder_alloc: 12546: binder_alloc_buf, no vma [ 2882.560803][ T2357] binder: 2356:2357 ioctl c0306201 200000c0 returned -14 [ 2882.577490][ T2351] binder: 2346:2351 unknown command 0 [ 2882.597520][ T2351] binder: 2346:2351 ioctl c0306201 20000200 returned -22 [ 2882.609089][ T2365] binder: 2358:2365 unknown command 0 05:44:07 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:07 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1d], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:44:07 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x7000000, 0x0, 0x0}) 05:44:07 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x3f00000000000000, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) [ 2882.639380][ T2365] binder: 2358:2365 ioctl c0306201 20000200 returned -22 [ 2882.676827][ T2368] binder: 2358:2368 ioctl c018620c 200000c0 returned -14 05:44:07 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x6c000000, 0x0, 0x0}) 05:44:07 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2882.770669][ T2376] binder_alloc: 12546: binder_alloc_buf, no vma [ 2882.791473][ T2380] binder: 2375:2380 unknown command 0 [ 2882.808524][ T2376] binder: 2371:2376 ioctl c0306201 200000c0 returned -14 [ 2882.820525][ T2380] binder: 2375:2380 ioctl c0306201 20000200 returned -22 [ 2882.855686][ T2380] binder: 2375:2380 unknown command 0 05:44:07 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:44:07 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x12000000, 0x0, 0x0}) [ 2882.879805][ T2388] binder: 2383:2388 unknown command 0 [ 2882.892034][ T2380] binder: 2375:2380 ioctl c0306201 20000200 returned -22 [ 2882.915393][ T2388] binder: 2383:2388 ioctl c0306201 20000200 returned -22 05:44:07 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:07 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0xfdfdffff00000000, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) [ 2882.951521][ T2388] binder: 2383:2388 ioctl c018620c 200000c0 returned -14 05:44:07 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x74000000, 0x0, 0x0}) 05:44:07 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2883.042582][ T2409] binder_alloc: 12546: binder_alloc_buf, no vma [ 2883.065660][ T2409] binder: 2402:2409 ioctl c0306201 200000c0 returned -14 05:44:08 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x74], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2883.097573][ T2420] binder: 2415:2420 unknown command 0 [ 2883.108791][ T2420] binder: 2415:2420 ioctl c0306201 20000200 returned -22 [ 2883.116807][ T2419] binder: 2414:2419 unknown command 0 [ 2883.133794][ T2420] binder: 2415:2420 ioctl c018620c 200000c0 returned -14 05:44:08 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x20000000, 0x0, 0x0}) [ 2883.144996][ T2419] binder: 2414:2419 ioctl c0306201 20000200 returned -22 05:44:08 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x7a000000, 0x0, 0x0}) 05:44:08 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release={0x630b}], 0x0, 0x0, 0x0}) 05:44:08 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:44:08 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2883.229483][ T2430] binder_alloc: 12546: binder_alloc_buf, no vma [ 2883.258254][ T2430] binder: 2427:2430 ioctl c0306201 200000c0 returned -14 05:44:08 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x48000000, 0x0, 0x0}) [ 2883.314381][ T2439] binder: 2437:2439 unknown command 0 [ 2883.331399][ T2439] binder: 2437:2439 ioctl c0306201 20000200 returned -22 [ 2883.345449][ T2440] binder: 2438:2440 unknown command 0 [ 2883.363706][ T2440] binder: 2438:2440 ioctl c0306201 20000200 returned -22 [ 2883.375112][ T2439] binder: 2437:2439 ioctl c018620c 200000c0 returned -14 [ 2883.400827][ T2449] binder: 2438:2449 unknown command 0 05:44:08 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2883.420001][ T2452] binder_alloc: 12546: binder_alloc_buf, no vma [ 2883.446023][ T2449] binder: 2438:2449 ioctl c0306201 200000c0 returned -22 05:44:08 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x88], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2883.466872][ T2452] binder: 2446:2452 ioctl c0306201 200000c0 returned -14 05:44:08 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xff000000, 0x0, 0x0}) 05:44:08 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x4c000000, 0x0, 0x0}) [ 2883.492335][ T2440] binder: 2438:2440 unknown command 0 [ 2883.498115][ T2449] binder: 2438:2449 unknown command 0 [ 2883.503821][ T2440] binder: 2438:2440 ioctl c0306201 20000200 returned -22 [ 2883.530208][ T2449] binder: 2438:2449 ioctl c0306201 200000c0 returned -22 [ 2883.564954][ T2467] binder: 2463:2467 unknown command 0 05:44:08 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2883.589257][ T2467] binder: 2463:2467 ioctl c0306201 20000200 returned -22 [ 2883.629127][ T2467] binder: 2463:2467 ioctl c018620c 200000c0 returned -14 05:44:08 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release={0x630c}], 0x0, 0x0, 0x0}) 05:44:08 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2883.644765][ T2477] binder_alloc: 12546: binder_alloc_buf, no vma [ 2883.669625][ T2477] binder: 2470:2477 ioctl c0306201 200000c0 returned -14 05:44:08 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x100000000000000, 0x0, 0x0}) [ 2883.717339][ T2484] binder: 2480:2484 unknown command 0 [ 2883.755412][ T2484] binder: 2480:2484 ioctl c0306201 20000200 returned -22 05:44:08 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x60000000, 0x0, 0x0}) [ 2883.773962][ T2488] binder: 2480:2488 unknown command 0 05:44:08 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x74], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2883.805496][ T2488] binder: 2480:2488 ioctl c0306201 200000c0 returned -22 [ 2883.821342][ T2495] binder: 2493:2495 unknown command 0 05:44:08 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2883.848282][ T2495] binder: 2493:2495 ioctl c0306201 20000200 returned -22 [ 2883.872850][ T2484] binder: 2480:2484 unknown command 0 [ 2883.878379][ T2484] binder: 2480:2484 ioctl c0306201 20000200 returned -22 [ 2883.879071][ T2495] binder: 2493:2495 ioctl c018620c 200000c0 returned -14 [ 2883.887979][ T2488] binder: 2480:2488 unknown command 0 [ 2883.896180][ T2501] binder: 2497:2501 ioctl c0306201 200000c0 returned -14 [ 2883.932085][ T2488] binder: 2480:2488 ioctl c0306201 200000c0 returned -22 05:44:08 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x68000000, 0x0, 0x0}) 05:44:08 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x200000000000000, 0x0, 0x0}) 05:44:08 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:08 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release={0x630d}], 0x0, 0x0, 0x0}) 05:44:08 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2884.051606][ T2514] binder: 2512:2514 ioctl c0306201 200000c0 returned -14 05:44:09 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x6c000000, 0x0, 0x0}) [ 2884.102291][ T2517] binder: 2515:2517 unknown command 0 [ 2884.129529][ T2517] binder: 2515:2517 ioctl c0306201 20000200 returned -22 [ 2884.161094][ T2527] binder: 2515:2527 ioctl c018620c 200000c0 returned -14 [ 2884.171625][ T2524] binder: 2521:2524 unknown command 0 [ 2884.185128][ T2524] binder: 2521:2524 ioctl c0306201 20000200 returned -22 05:44:09 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2884.211243][ T2532] binder: 2529:2532 ioctl c0306201 200000c0 returned -14 [ 2884.226512][ T2533] binder: 2521:2533 unknown command 0 05:44:09 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x88], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:44:09 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x300000000000000, 0x0, 0x0}) [ 2884.256231][ T2533] binder: 2521:2533 ioctl c0306201 200000c0 returned -22 [ 2884.291073][ T2524] binder: 2521:2524 unknown command 0 [ 2884.297625][ T2533] binder: 2521:2533 unknown command 0 05:44:09 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x74000000, 0x0, 0x0}) [ 2884.303268][ T2524] binder: 2521:2524 ioctl c0306201 20000200 returned -22 [ 2884.323839][ T2533] binder: 2521:2533 ioctl c0306201 200000c0 returned -22 05:44:09 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release={0x40046302}], 0x0, 0x0, 0x0}) [ 2884.380945][ T2542] binder: 2539:2542 unknown command 0 [ 2884.403853][ T2542] binder: 2539:2542 ioctl c0306201 20000200 returned -22 [ 2884.421123][ T2544] binder: 2543:2544 ioctl c0306201 200000c0 returned -14 05:44:09 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2884.438764][ T2542] binder: 2539:2542 ioctl c018620c 200000c0 returned -14 05:44:09 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x7a000000, 0x0, 0x0}) 05:44:09 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x400000000000000, 0x0, 0x0}) 05:44:09 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2884.557024][ T2565] binder: 2558:2565 unknown command 0 [ 2884.583507][ T2565] binder: 2558:2565 ioctl c0306201 20000200 returned -22 [ 2884.591070][ T2569] binder: 2566:2569 ioctl c0306201 200000c0 returned -14 05:44:09 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2884.603533][ T2572] binder: BC_ACQUIRE_RESULT not supported [ 2884.621532][ T2575] binder: 2567:2575 unknown command 0 [ 2884.642629][ T2572] binder: 2558:2572 ioctl c0306201 200000c0 returned -22 [ 2884.647183][ T2575] binder: 2567:2575 ioctl c0306201 20000200 returned -22 [ 2884.685965][ T2579] binder: 2567:2579 ioctl c018620c 200000c0 returned -14 [ 2884.703858][ T2565] binder: 2558:2565 unknown command 0 [ 2884.709391][ T2565] binder: 2558:2565 ioctl c0306201 20000200 returned -22 [ 2884.719826][ T2572] binder: BC_ACQUIRE_RESULT not supported 05:44:09 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0xfdfdffff, 0x0, 0x0}) 05:44:09 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2884.759658][ T2572] binder: 2558:2572 ioctl c0306201 200000c0 returned -22 05:44:09 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:44:09 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release={0x40046304}], 0x0, 0x0, 0x0}) 05:44:09 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x500000000000000, 0x0, 0x0}) [ 2884.849216][ T2589] binder: 2588:2589 ioctl c0306201 200000c0 returned -14 05:44:09 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0xfffffdfd, 0x0, 0x0}) 05:44:09 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2884.931519][ T2600] binder: 2596:2600 unknown command 0 [ 2884.977220][ T2602] binder: 2599:2602 unknown command 0 [ 2884.977737][ T2600] binder: 2596:2600 ioctl c0306201 20000200 returned -22 [ 2885.009856][ T2604] binder: 2596:2604 ioctl c018620c 200000c0 returned -14 05:44:09 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2885.022901][ T2602] binder: 2599:2602 ioctl c0306201 20000200 returned -22 [ 2885.039970][ T2614] binder: 2606:2614 ioctl c0306201 200000c0 returned -14 05:44:10 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x600000000000000, 0x0, 0x0}) 05:44:10 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:10 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x100000000000000, 0x0, 0x0}) 05:44:10 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release={0x40046307}], 0x0, 0x0, 0x0}) [ 2885.195999][ T2621] binder: 2620:2621 unknown command 0 [ 2885.216214][ T2621] binder: 2620:2621 ioctl c0306201 20000200 returned -22 [ 2885.226444][ T2628] binder: 2624:2628 ioctl c0306201 200000c0 returned -14 [ 2885.238535][ T2633] binder: 2627:2633 unknown command 0 05:44:10 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2885.260491][ T2634] binder: 2620:2634 ioctl c018620c 200000c0 returned -14 [ 2885.271776][ T2633] binder: 2627:2633 ioctl c0306201 20000200 returned -22 05:44:10 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x200000000000000, 0x0, 0x0}) 05:44:10 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:10 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x700000000000000, 0x0, 0x0}) 05:44:10 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release={0x40046312}], 0x0, 0x0, 0x0}) 05:44:10 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2885.436832][ T2654] binder: 2649:2654 ioctl c0306201 200000c0 returned -14 05:44:10 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000280)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3c00000010008506080000000000000000004000e7c457bb3ff78e68a22e5e2c07013db23ade41eb4e8d40be708c0762984cb7cb58785da2bb8c74cbcca84773874d88c7a28f7f3ae1277c12538890c7a660675f899162fcd03b2dcb00000454ae52fe2375a491d6e58a1969c0e24437d358b0f5ec73e91ede5fbad3b1acef99899c8e132fc61cb1feccb68cc6000000000000000000000000000000175d80ef1d0c166d3f8e3362b4", @ANYRES32=r6, @ANYBLOB="139b0000000000801c0012000c000100626f6e64"], 0x3c}}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000080)='NLBL_MGMT\x00') sendmsg$NLBL_MGMT_C_REMOVE(r7, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000140)={&(0x7f00000002c0)={0x44, r8, 0x300, 0x70bd26, 0x25dfdbff, {}, [@NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @empty}, @NLBL_MGMT_A_FAMILY={0x6, 0xb, 0xb}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @dev={0xfe, 0x80, [], 0x12}}]}, 0x44}, 0x1, 0x0, 0x0, 0x50}, 0x4000811) sendmsg$NLBL_MGMT_C_ADDDEF(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB='d\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="00022bbd7000fddbdf250400000014000600fe8000000000000000000000000000aa08000800ffffffff08000700ac1414bb08000c000000000008000800ac1414a214000500ff0200000000000000000000000000010800040002000000"], 0x64}, 0x1, 0x0, 0x0, 0x4004014}, 0x4) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000440)={{0xdd}, 0x1, 0x6, 0x0, {0x1, 0x9}, 0x6, 0x1}) ioctl$KVM_RUN(r4, 0xae80, 0x0) 05:44:10 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x300000000000000, 0x0, 0x0}) 05:44:10 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2885.491287][ T2663] binder: 2657:2663 unknown command 0 [ 2885.496332][ T2664] binder: 2658:2664 unknown command 0 [ 2885.516828][ T2663] binder: 2657:2663 ioctl c0306201 20000200 returned -22 [ 2885.529056][ T2664] binder: 2658:2664 ioctl c0306201 20000200 returned -22 [ 2885.570307][ T2674] binder: 2658:2674 unknown command 1074029330 [ 2885.582182][ T2663] binder: 2657:2663 ioctl c018620c 200000c0 returned -14 05:44:10 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2885.636249][ T2681] binder: 2676:2681 ioctl c0306201 200000c0 returned -14 [ 2885.648506][ T2674] binder: 2658:2674 ioctl c0306201 200000c0 returned -22 [ 2885.714107][ T2664] binder: 2658:2664 unknown command 0 [ 2885.715380][ T2674] binder: 2658:2674 unknown command 1074029330 [ 2885.719715][ T2664] binder: 2658:2664 ioctl c0306201 20000200 returned -22 05:44:10 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r4, @ANYBLOB="139b0000000000801c0012000c000100626f6e64"], 0x3c}}, 0x0) r5 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000040)='NLBL_CALIPSO\x00') sendmsg$NLBL_CALIPSO_C_LIST(r2, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000100)={0x4c, r5, 0x200, 0x70bd2d, 0x25dfdbfb, {}, [@NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x2}]}, 0x4c}, 0x1, 0x0, 0x0, 0x90}, 0x20004050) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(r8, 0x4090ae82, 0x0) ioctl$KVM_RUN(r8, 0xae80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000440)={{}, 0x1, 0x6, 0x0, {}, 0x6, 0x1}) ioctl$KVM_RUN(r8, 0xae80, 0x0) ioctl$KVM_NMI(r8, 0xae9a) 05:44:10 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x800000000000000, 0x0, 0x0}) 05:44:10 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x400000000000000, 0x0, 0x0}) [ 2885.778692][ T2674] binder: 2658:2674 ioctl c0306201 200000c0 returned -22 05:44:10 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x12], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:10 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2885.878441][ T2705] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.1'. [ 2885.907359][ T2708] binder: 2707:2708 ioctl c0306201 200000c0 returned -14 [ 2885.948326][ T2710] binder: 2706:2710 unknown command 0 05:44:10 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x500000000000000, 0x0, 0x0}) 05:44:10 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release={0x40046314}], 0x0, 0x0, 0x0}) [ 2886.005693][ T2745] binder: 2706:2745 ioctl c018620c 200000c0 returned -14 [ 2886.032031][ T2710] binder: 2706:2710 ioctl c0306201 20000200 returned -14 05:44:11 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1d], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2886.094702][ T2773] binder: 2772:2773 unknown command 0 [ 2886.100682][ T2773] binder: 2772:2773 ioctl c0306201 20000200 returned -22 [ 2886.125596][ T2773] binder: 2772:2773 unknown command 1074029332 05:44:11 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2886.145079][ T2773] binder: 2772:2773 ioctl c0306201 200000c0 returned -22 [ 2886.157453][ T2777] binder: 2766:2777 ioctl c0306201 200000c0 returned -14 [ 2886.182241][ T2773] binder: 2772:2773 unknown command 0 [ 2886.197946][ T2796] binder: 2772:2796 unknown command 1074029332 [ 2886.208296][ T2773] binder: 2772:2773 ioctl c0306201 20000200 returned -22 [ 2886.234795][ T2796] binder: 2772:2796 ioctl c0306201 200000c0 returned -22 05:44:11 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:11 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x2000000000000000, 0x0, 0x0}) 05:44:11 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x600000000000000, 0x0, 0x0}) [ 2886.402682][ T2812] binder: 2809:2812 unknown command 0 [ 2886.422456][ T2812] binder: 2809:2812 ioctl c0306201 20000200 returned -22 [ 2886.449712][ T2818] binder: 2815:2818 ioctl c0306201 200000c0 returned -14 [ 2886.461280][ T2812] binder: 2809:2812 ioctl c018620c 200000c0 returned -14 [ 2886.656202][ T2768] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.1'. [ 2887.079649][ T2744] warn_alloc: 6 callbacks suppressed [ 2887.079667][ T2744] syz-executor.1: page allocation failure: order:0, mode:0x400cc4(GFP_KERNEL_ACCOUNT|GFP_DMA32), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 2887.100146][ T2744] CPU: 0 PID: 2744 Comm: syz-executor.1 Not tainted 5.8.0-rc5-syzkaller #0 [ 2887.108838][ T2744] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2887.119889][ T2744] Call Trace: [ 2887.123386][ T2744] dump_stack+0x18f/0x20d [ 2887.127887][ T2744] warn_alloc.cold+0x87/0x17a [ 2887.132584][ T2744] ? zone_watermark_ok_safe+0x260/0x260 [ 2887.138147][ T2744] ? wait_for_completion+0x260/0x260 [ 2887.143966][ T2744] __alloc_pages_slowpath.constprop.0+0x2197/0x2780 [ 2887.150675][ T2744] ? warn_alloc+0x120/0x120 [ 2887.155277][ T2744] ? __alloc_pages_nodemask+0x3e5/0x930 [ 2887.160826][ T2744] ? lock_is_held_type+0xb0/0xe0 [ 2887.166169][ T2744] ? find_held_lock+0x2d/0x110 [ 2887.171190][ T2744] __alloc_pages_nodemask+0x68f/0x930 [ 2887.176572][ T2744] ? __zone_watermark_ok+0x370/0x370 [ 2887.181871][ T2744] ? __alloc_pages_slowpath.constprop.0+0x2780/0x2780 [ 2887.188733][ T2744] ? lock_is_held_type+0xb0/0xe0 [ 2887.193783][ T2744] ? rcu_read_lock_sched_held+0x3a/0xb0 [ 2887.199350][ T2744] ? __alloc_pages_nodemask+0x6b1/0x930 [ 2887.205133][ T2744] alloc_pages_current+0x187/0x280 [ 2887.210420][ T2744] alloc_mmu_pages+0x7f/0x170 [ 2887.215094][ T2744] kvm_mmu_create+0x3cb/0x560 [ 2887.219905][ T2744] kvm_arch_vcpu_create+0x16d/0xb70 [ 2887.225206][ T2744] kvm_vm_ioctl+0x1547/0x23c0 [ 2887.229977][ T2744] ? lock_downgrade+0x820/0x820 [ 2887.234936][ T2744] ? kvm_unregister_device_ops+0x60/0x60 [ 2887.240793][ T2744] ? trace_hardirqs_on+0x5f/0x220 [ 2887.245934][ T2744] ? lockdep_hardirqs_on+0x6a/0xe0 [ 2887.251067][ T2744] ? tomoyo_path_number_perm+0x244/0x4d0 [ 2887.256716][ T2744] ? tomoyo_execute_permission+0x470/0x470 [ 2887.262708][ T2744] ? __might_fault+0x11f/0x1d0 [ 2887.267504][ T2744] ? __sanitizer_cov_trace_switch+0x45/0x70 [ 2887.273504][ T2744] ? do_vfs_ioctl+0x27d/0x1090 [ 2887.278281][ T2744] ? generic_block_fiemap+0x60/0x60 [ 2887.283607][ T2744] ? __might_fault+0x190/0x1d0 [ 2887.288484][ T2744] ? _copy_to_user+0x126/0x160 [ 2887.293404][ T2744] ? __fget_files+0x294/0x400 [ 2887.298230][ T2744] ? kvm_unregister_device_ops+0x60/0x60 [ 2887.303956][ T2744] ksys_ioctl+0x11a/0x180 [ 2887.308442][ T2744] __x64_sys_ioctl+0x6f/0xb0 [ 2887.313038][ T2744] ? lockdep_hardirqs_on+0x6a/0xe0 [ 2887.318220][ T2744] do_syscall_64+0x60/0xe0 [ 2887.322652][ T2744] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2887.328650][ T2744] RIP: 0033:0x45c1d9 [ 2887.332619][ T2744] Code: Bad RIP value. [ 2887.337822][ T2744] RSP: 002b:00007f58ffb5ec78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2887.346402][ T2744] RAX: ffffffffffffffda RBX: 000000000000edc0 RCX: 000000000045c1d9 [ 2887.354649][ T2744] RDX: 0000000000000000 RSI: 000000000000ae41 RDI: 0000000000000008 [ 2887.363441][ T2744] RBP: 000000000078c080 R08: 0000000000000000 R09: 0000000000000000 [ 2887.371953][ T2744] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000078c04c [ 2887.380101][ T2744] R13: 0000000000c9fb6f R14: 00007f58ffb5f9c0 R15: 000000000078c04c [ 2887.395273][ T2744] Mem-Info: [ 2887.398455][ T2744] active_anon:319865 inactive_anon:20516 isolated_anon:0 [ 2887.398455][ T2744] active_file:2314 inactive_file:46421 isolated_file:0 [ 2887.398455][ T2744] unevictable:0 dirty:75 writeback:0 [ 2887.398455][ T2744] slab_reclaimable:22923 slab_unreclaimable:211667 [ 2887.398455][ T2744] mapped:63017 shmem:20760 pagetables:126062 bounce:0 [ 2887.398455][ T2744] free:676044 free_pcp:727 free_cma:0 [ 2887.436377][ T2744] Node 0 active_anon:966308kB inactive_anon:47800kB active_file:32kB inactive_file:3096kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:224064kB dirty:16kB writeback:0kB shmem:48760kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 323584kB writeback_tmp:0kB all_unreclaimable? yes [ 2887.464825][ T2744] Node 1 active_anon:313152kB inactive_anon:34264kB active_file:9224kB inactive_file:182588kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:28004kB dirty:284kB writeback:0kB shmem:34280kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB all_unreclaimable? no [ 2887.493477][ T2744] Node 0 DMA free:10264kB min:220kB low:272kB high:324kB reserved_highatomic:0KB active_anon:3964kB inactive_anon:272kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15908kB mlocked:0kB kernel_stack:124kB pagetables:272kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2887.537632][ T2744] lowmem_reserve[]: 0 2515 2515 2515 2515 [ 2887.545250][ T2744] Node 0 DMA32 free:33856kB min:35916kB low:44892kB high:53868kB reserved_highatomic:0KB active_anon:962344kB inactive_anon:47528kB active_file:32kB inactive_file:3096kB unevictable:0kB writepending:16kB present:3129332kB managed:2578200kB mlocked:0kB kernel_stack:85656kB pagetables:245232kB bounce:0kB free_pcp:376kB local_pcp:96kB free_cma:0kB [ 2887.581396][ T2744] lowmem_reserve[]: 0 0 0 0 0 [ 2887.586846][ T2744] Node 0 Normal free:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:786432kB managed:0kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2887.618644][ T2744] lowmem_reserve[]: 0 0 0 0 0 [ 2887.624250][ T2744] Node 1 Normal free:2659872kB min:53972kB low:67464kB high:80956kB reserved_highatomic:0KB active_anon:313148kB inactive_anon:34264kB active_file:9224kB inactive_file:182588kB unevictable:0kB writepending:320kB present:3932160kB managed:3870200kB mlocked:0kB kernel_stack:82412kB pagetables:258684kB bounce:0kB free_pcp:2512kB local_pcp:1460kB free_cma:0kB [ 2887.659429][ T2744] lowmem_reserve[]: 0 0 0 0 0 [ 2887.665752][ T2744] Node 0 DMA: 4*4kB (ME) 5*8kB (UM) 6*16kB (UM) 8*32kB (U) 8*64kB (UME) 7*128kB (ME) 7*256kB (UME) 5*512kB (UME) 2*1024kB (UE) 1*2048kB (M) 0*4096kB = 10264kB [ 2887.682961][ T2744] Node 0 DMA32: 176*4kB (M) 1042*8kB (UME) 410*16kB (UME) 184*32kB (UME) 132*64kB (UME) 21*128kB (UME) 7*256kB (UME) 0*512kB 0*1024kB 0*2048kB 0*4096kB = 34416kB [ 2887.700438][ T2744] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 2887.712682][ T2744] Node 1 Normal: 4*4kB (UM) 185*8kB (UME) 126*16kB (UME) 17*32kB (UE) 9*64kB (UME) 4*128kB (UE) 3*256kB (UE) 1*512kB (E) 3*1024kB (UME) 2*2048kB (UE) 646*4096kB (UM) = 2659608kB [ 2887.735671][ T2744] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 2887.746336][ T2744] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 2887.756179][ T2744] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 2887.766983][ T2744] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 2887.777059][ T2744] 30827 total pagecache pages [ 2887.782791][ T2744] 0 pages in swap cache [ 2887.786960][ T2744] Swap cache stats: add 0, delete 0, find 0/0 [ 2887.795110][ T2744] Free swap = 0kB [ 2887.798851][ T2744] Total swap = 0kB [ 2887.803575][ T2744] 1965979 pages RAM [ 2887.807523][ T2744] 0 pages HighMem/MovableOnly [ 2887.813335][ T2744] 349902 pages reserved [ 2887.817612][ T2744] 0 pages cma reserved 05:44:12 executing program 1: r0 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) setsockopt$inet_icmp_ICMP_FILTER(r0, 0x1, 0x1, &(0x7f0000000000)={0xbfa7}, 0x4) r1 = socket$unix(0x1, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(r5, 0x4090ae82, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000440)={{}, 0x1, 0x200006, 0x0, {}, 0x6, 0x1}) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_NMI(r5, 0xae9a) 05:44:12 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:44:12 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release={0x40086303}], 0x0, 0x0, 0x0}) 05:44:12 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:12 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x700000000000000, 0x0, 0x0}) 05:44:12 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x3f00000000000000, 0x0, 0x0}) [ 2887.903567][ T2832] binder: 2825:2832 unknown command 0 [ 2887.910916][ T2833] connmark_tg_check: 69 callbacks suppressed [ 2887.910925][ T2833] cannot load conntrack support for proto=3 [ 2887.925720][ T2832] binder: 2825:2832 ioctl c0306201 20000200 returned -22 [ 2887.927331][ T2834] binder_alloc_new_buf_locked: 13 callbacks suppressed [ 2887.927339][ T2834] binder_alloc: 12546: binder_alloc_buf, no vma [ 2887.940429][ T2832] binder: 2825:2832 unknown command 0 [ 2887.957796][ T2836] binder: 2828:2836 unknown command 0 [ 2887.964914][ T2839] cannot load conntrack support for proto=3 [ 2887.975678][ T2836] binder: 2828:2836 ioctl c0306201 20000200 returned -22 [ 2887.984187][ T2838] cannot load conntrack support for proto=3 05:44:12 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:44:12 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2888.011253][ T2832] binder: 2825:2832 ioctl c0306201 20000200 returned -22 [ 2888.028870][ T2836] binder: 2828:2836 ioctl c018620c 200000c0 returned -14 [ 2888.037677][ T2834] binder: 2829:2834 ioctl c0306201 200000c0 returned -14 05:44:12 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release={0x4008630a}], 0x0, 0x0, 0x0}) 05:44:13 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x1200000000000000, 0x0, 0x0}) 05:44:13 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x4000000000000000, 0x0, 0x0}) 05:44:13 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1d], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2888.171308][ T2861] cannot load conntrack support for proto=3 [ 2888.222045][ T2868] cannot load conntrack support for proto=3 [ 2888.228503][ T2869] binder: 2864:2869 unknown command 0 [ 2888.245415][ T2869] binder: 2864:2869 ioctl c0306201 20000200 returned -22 [ 2888.255148][ T2872] cannot load conntrack support for proto=3 [ 2888.262763][ T2873] binder: BC_ATTEMPT_ACQUIRE not supported [ 2888.288391][ T2874] binder_alloc: 12546: binder_alloc_buf, no vma [ 2888.301959][ T2873] binder: 2864:2873 ioctl c0306201 200000c0 returned -22 [ 2888.306305][ T2876] binder: 2871:2876 unknown command 0 [ 2888.322934][ T2874] binder: 2870:2874 ioctl c0306201 200000c0 returned -14 [ 2888.339976][ T2876] binder: 2871:2876 ioctl c0306201 20000200 returned -22 [ 2888.349437][ T2869] binder: 2864:2869 unknown command 0 [ 2888.356619][ T2873] binder: BC_ATTEMPT_ACQUIRE not supported [ 2888.368783][ T2869] binder: 2864:2869 ioctl c0306201 20000200 returned -22 [ 2888.378710][ T2873] binder: 2864:2873 ioctl c0306201 200000c0 returned -22 [ 2888.382691][ T2880] binder: 2871:2880 ioctl c018620c 200000c0 returned -14 05:44:14 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x2000000400202) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000440)={{}, 0x1, 0x6, 0x0, {}, 0x6, 0x1}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_NMI(r4, 0xae9a) syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x1a0, 0x20002) 05:44:14 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:14 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:44:14 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x2000000000000000, 0x0, 0x0}) 05:44:14 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release={0x40086310}], 0x0, 0x0, 0x0}) 05:44:14 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x4800000000000000, 0x0, 0x0}) 05:44:14 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2889.364617][ T2900] cannot load conntrack support for proto=3 [ 2889.368039][ T2899] binder: 2896:2899 unknown command 0 [ 2889.375214][ T2903] binder: 2897:2903 unknown command 0 [ 2889.384139][ T2901] binder_alloc: 12546: binder_alloc_buf, no vma [ 2889.392693][ T2906] cannot load conntrack support for proto=3 [ 2889.401458][ T2903] binder: 2897:2903 ioctl c0306201 20000200 returned -22 [ 2889.422171][ T2899] binder: 2896:2899 ioctl c0306201 20000200 returned -22 [ 2889.440454][ T2901] binder: 2893:2901 ioctl c0306201 200000c0 returned -14 [ 2889.453635][ T2903] binder: 2897:2903 ioctl c018620c 200000c0 returned -14 05:44:14 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2889.468114][ T2899] binder: 2896:2899 unknown command 0 05:44:14 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x4800000000000000, 0x0, 0x0}) [ 2889.501805][ T2899] binder: 2896:2899 ioctl c0306201 20000200 returned -22 05:44:14 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x4c00000000000000, 0x0, 0x0}) 05:44:14 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) 05:44:14 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2889.595895][ T2921] cannot load conntrack support for proto=3 [ 2889.621396][ T2925] cannot load conntrack support for proto=3 [ 2889.656647][ T2932] binder_alloc: 12546: binder_alloc_buf, no vma [ 2889.687531][ T2932] binder: 2924:2932 ioctl c0306201 200000c0 returned -14 [ 2889.705783][ T2938] binder: 2934:2938 unknown command 0 [ 2889.719078][ T2938] binder: 2934:2938 ioctl c0306201 20000200 returned -22 [ 2889.752285][ T2941] binder: 2936:2941 unknown command 0 [ 2889.775005][ T2941] binder: 2936:2941 ioctl c0306201 20000200 returned -22 [ 2889.787708][ T2938] binder: 2934:2938 ioctl c018620c 200000c0 returned -14 05:44:14 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x4c00000000000000, 0x0, 0x0}) 05:44:14 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x74], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:14 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:44:14 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x6000000000000000, 0x0, 0x0}) 05:44:14 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release={0x400c630f}], 0x0, 0x0, 0x0}) 05:44:14 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280)='/dev/kvm\x00', 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(r6, 0x4090ae82, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r7, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r7, 0x0) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, 0xffffffffffffffff, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000440)={{}, 0x1, 0x6, 0x0, {}, 0x6, 0x1}) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$KVM_NMI(r6, 0xae9a) 05:44:14 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2890.003128][ T2962] binder: 2960:2962 unknown command 0 [ 2890.010662][ T2966] binder_alloc: 12546: binder_alloc_buf, no vma [ 2890.013611][ T2970] binder: 2961:2970 unknown command 0 [ 2890.032811][ T2962] binder: 2960:2962 ioctl c0306201 20000200 returned -22 [ 2890.045651][ T2966] binder: 2956:2966 ioctl c0306201 200000c0 returned -14 05:44:14 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2890.067181][ T2970] binder: 2961:2970 ioctl c0306201 20000200 returned -22 [ 2890.083655][ T2962] binder: 2960:2962 ioctl c018620c 200000c0 returned -14 05:44:15 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release={0x40106308}], 0x0, 0x0, 0x0}) 05:44:15 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x6000000000000000, 0x0, 0x0}) 05:44:15 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x74], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:44:15 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x6800000000000000, 0x0, 0x0}) [ 2890.257650][ T3004] binder: 3003:3004 unknown command 0 [ 2890.285102][ T3004] binder: 3003:3004 ioctl c0306201 20000200 returned -22 [ 2890.315957][ T3004] binder: 3003:3004 unknown command 0 [ 2890.321557][ T3004] binder: 3003:3004 ioctl c0306201 20000200 returned -22 05:44:15 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x88], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:15 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2890.406354][ T3013] binder: 3012:3013 unknown command 0 [ 2890.416943][ T3016] binder_alloc: 12546: binder_alloc_buf, no vma [ 2890.442279][ T3013] binder: 3012:3013 ioctl c0306201 20000200 returned -22 [ 2890.445984][ T3016] binder: 3007:3016 ioctl c0306201 200000c0 returned -14 05:44:15 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release={0x40106309}], 0x0, 0x0, 0x0}) [ 2890.475211][ T3013] binder: 3012:3013 ioctl c018620c 200000c0 returned -14 05:44:15 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x6c00000000000000, 0x0, 0x0}) 05:44:15 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x6800000000000000, 0x0, 0x0}) [ 2890.628835][ T3031] binder: 3026:3031 unknown command 0 [ 2890.649730][ T3031] binder: 3026:3031 ioctl c0306201 20000200 returned -22 05:44:15 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r3, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r3, 0x0) ioctl$SNDCTL_DSP_SETTRIGGER(r3, 0x40045010, &(0x7f0000000000)=0x9) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) clock_gettime(0xb, &(0x7f0000000d80)) r6 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(r7, 0x4090ae82, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000440)={{}, 0x1, 0x6, 0x0, {}, 0x6, 0x1}) ioctl$KVM_RUN(r7, 0xae80, 0x0) ioctl$KVM_NMI(r7, 0xae9a) 05:44:15 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:15 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x88], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2890.689379][ T3042] binder_alloc: 12546: binder_alloc_buf, no vma [ 2890.707635][ T3042] binder: 3034:3042 ioctl c0306201 200000c0 returned -14 [ 2890.713589][ T3031] binder: 3026:3031 unknown command 0 [ 2890.722472][ T3031] binder: 3026:3031 ioctl c0306201 20000200 returned -22 [ 2890.762580][ T3046] binder: 3038:3046 unknown command 0 [ 2890.799163][ T3046] binder: 3038:3046 ioctl c0306201 20000200 returned -22 05:44:15 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x6c00000000000000, 0x0, 0x0}) 05:44:15 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release={0x40406300}], 0x0, 0x0, 0x0}) [ 2890.810326][ T3051] binder: 3038:3051 ioctl c018620c 200000c0 returned -14 05:44:15 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:15 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2890.902475][ T3062] binder: 3058:3062 unknown command 0 [ 2890.921910][ T3063] binder_alloc: 12546: binder_alloc_buf, no vma 05:44:15 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x7400000000000000, 0x0, 0x0}) [ 2890.962064][ T3063] binder: 3061:3063 ioctl c0306201 200000c0 returned -14 [ 2890.997172][ T3062] binder: 3058:3062 ioctl c0306201 20000200 returned -22 05:44:15 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x7400000000000000, 0x0, 0x0}) 05:44:15 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) ioctl$FS_IOC_FSGETXATTR(0xffffffffffffffff, 0x801c581f, &(0x7f0000000080)={0x8, 0x1, 0x2, 0x7, 0x3}) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) setsockopt$IP_VS_SO_SET_EDIT(r3, 0x0, 0x483, &(0x7f0000000040)={0x3, @empty, 0x4e24, 0x3, 'lblcr\x00', 0x21, 0x2f8, 0x17}, 0x2c) r4 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(r5, 0x4090ae82, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000440)={{}, 0x1, 0x6, 0x1ff, {}, 0x6, 0x1}) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_DROP(r1, 0x40045730, &(0x7f0000000000)=0x7) ioctl$KVM_NMI(r5, 0xae9a) [ 2891.028396][ T3062] binder: 3058:3062 unknown command 0 [ 2891.059488][ T3062] binder: 3058:3062 ioctl c0306201 20000200 returned -22 [ 2891.106380][ T3082] binder: 3077:3082 unknown command 0 [ 2891.134436][ T3082] binder: 3077:3082 ioctl c0306201 20000200 returned -22 05:44:16 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:16 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:44:16 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release={0x40406301}], 0x0, 0x0, 0x0}) [ 2891.153552][ T3090] binder_alloc: 12546: binder_alloc_buf, no vma [ 2891.176735][ T3092] binder: 3077:3092 ioctl c018620c 200000c0 returned -14 [ 2891.189798][ T3090] binder: 3086:3090 ioctl c0306201 200000c0 returned -14 05:44:16 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x7a00000000000000, 0x0, 0x0}) 05:44:16 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x7a00000000000000, 0x0, 0x0}) 05:44:16 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:16 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2891.329691][ T3110] binder: 3105:3110 unknown command 0 [ 2891.361805][ T3110] binder: 3105:3110 ioctl c0306201 20000200 returned -22 [ 2891.393608][ T3122] binder_alloc: 12546: binder_alloc_buf, no vma [ 2891.394129][ T3121] binder: 3114:3121 unknown command 0 [ 2891.411463][ T3122] binder: 3111:3122 ioctl c0306201 200000c0 returned -14 [ 2891.413650][ T3110] binder: 3105:3110 unknown command 0 05:44:16 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0xfdfdffff00000000, 0x0, 0x0}) [ 2891.443734][ T3126] binder: 3114:3126 ioctl c018620c 200000c0 returned -14 [ 2891.448998][ T3121] binder: 3114:3121 ioctl c0306201 20000200 returned -14 [ 2891.464571][ T3110] binder: 3105:3110 ioctl c0306201 20000200 returned -22 05:44:16 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release={0x40486311}], 0x0, 0x0, 0x0}) 05:44:16 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x8000000000000000, 0x0, 0x0}) 05:44:16 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2891.597462][ T3141] binder: 3136:3141 ioctl c0306201 200000c0 returned -14 05:44:16 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000440)={{}, 0x1, 0x6, 0x0, {}, 0x6, 0x1}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_NMI(r4, 0xae9a) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$NFT_MSG_GETSETELEM(r5, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000040)={&(0x7f00000004c0)={0x2800, 0xd, 0xa, 0x401, 0x0, 0x0, {0x0, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_SET_ID={0x8}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x27d8, 0x3, 0x0, 0x1, [{0x14fc, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY_END={0x4}, @NFTA_SET_ELEM_KEY_END={0x14, 0xa, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x10, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}]}]}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz0\x00'}, @NFTA_SET_ELEM_USERDATA={0xff, 0x6, 0x1, 0x0, "ccf3fb06a757ba37376a41e030e79c9e5841e202052e33f9da343be5889114a44ed1991105f4e310ac1734ae22b6cfef0bbd0d819a49da6f2999b0ca0a60416261a3b1c2c288841b9568e08d469751cd9df7514b31bed45599ed76b8c35578f03bd36bb0dce851e9ae1e4397cfcc55d32afd7f7ddd3ced90a079eb612267789a18eab71790e2dca778a88b4a5f41463597e30655ad24a16be855e4dceaa66664d1d48b4118bca1bf925139ee7fe093d08761df271d01c8cf73953ad95a129d656a7b59d253d2c072c619bc48d061ec3ff5ffce0bdc6d27010565282a2e44444727a856272da0ea19bef96728d5e9937abf6ad7b399c01349efe274"}, @NFTA_SET_ELEM_USERDATA={0x6c, 0x6, 0x1, 0x0, "e15b8efd94130e6986d58f1a5b8ebb4866f753134d9683083188749ceaa871470aae53c02e813c033c7e03f8e97f711381b51ef8c9f4e816f0ef80ef31fdbe7dfe1cfb9063ef1caa8efa8a079dd9b9cbb4b795757c81e714ba891508571cd0ed4a273aa2b1199fad"}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz2\x00'}, @NFTA_SET_ELEM_DATA={0xbc, 0x2, 0x0, 0x1, [@NFTA_DATA_VALUE={0xb6, 0x1, "b0a99aff121f3a56e32b8e2b78230ef4e7a2ef7bebbfc7d487a717e1202ca326ffd182f0477f09b097b704490de5effbf53e9e2e4d74948c68683480d7e52231a4e8e5e9974bb7b388032f6f4ac15b6c265ef34fb7cc3cc237d0bee6e7fe23602b5f509d2a4c82f64e47e6848913db71df5e2fc6753081768f8c3056d5ca4132d9c8ba320297951e2ed8887af3c56dcd657a314a0739a4ff0bde3433e38ea93260b950e2df5b24e1cbd9c788ae76a89a6ea9"}]}, @NFTA_SET_ELEM_KEY_END={0x11e8, 0xa, 0x0, 0x1, [@NFTA_DATA_VALUE={0x1004, 0x1, "c5e9b1a1c8210232fac28d12cd28fc9b480774121f8b15a932dea002d0f4ecde204ec9d882b945c29ee93d99a6adc6bb5eed30b4b851569bb9fca4f57511cf4c2c68d6aaf3d4e88654a9812cc678ef9481c08ac25dc0cead35d60946efe89cac126ce964113ba046f6200937e94bc8a4e2b527429439637e8d165a7d34ae56953ea4c3518f2c15e711ca0d7ca33c9f30b3cd741a5307298067180d86b300aeec27fe48fcc7d8deb1da33b45c50bb76fe78e0ff07a307dce88a8dc82be62aecd936377dddc7b314a25fd6e7da6161bc97ed86e2f26c19f321827728efb53968a111c7359cd9106b24624c4265755a8d0637616aa426d30c2aafbc1021c0d895938be3cf9b740f215395628fc864c5ccd73966d3cb60c1892b08e45607d137ffaf34091abd0102ffd47d2be8b66bb2507adbb462d841088fd4dcf978f9e20da51aceab84b4bdeadacb38a4a5153d80bf220d5be913ad3053ec7e3e28f33f472d0e8c4bb572d94db04e9d66d4c8c4ee04973d765b050f9f362a4d93fac2029d025e1a5f360e574fc27886e4332a6a7ed69038efbd63fe30f82c539942b4d325b86cd7667e1db5521a49bbbdfb3815df78d1fa1ce6ebec42c49e79aebb5c7432dba2a19fdfd089944e5bf13a247f302f38d2c8322dbb7cf6018836eb3e500ee138a1ba1e2acbd756b03ed935002b1e25842afc7dee948f28c83760258412235b428b29978cc9f5c4fd59aca60b57084461a96ffdc22dcb3a8451d50cf11cf9ba9b96186c3f9c8592c420c026122e904b2bc51d026f95ef4c0a39787c37c7eb9f96de230e141c2824e8eaf8bec451c06abb1bc2681a2eade651f715b9e1c28cec8c850cbffcb235b0624eaf0c50f51b3ce27615015dd4feeef7e22d3d69a5bcb0cc24e6064eddbf5461d5148b2da170c958604c4b14ee60adeb7c742adaa83b3acb03f90e9ab137e7b74cd5d5c5082dc2b93a2c6228dcde83004f20c404eb20b18c8b3de480f7268c88babe82e6a4a73dd7bd58c9e2740aec12dc714bb8582e86c576768c83bde891dd12534368e18dae12ec6f2e397ed201d71857e6bcb42ccc11ab294579b56c6ed9a26b1582d4cd9959ba6c299f30d0d1ac87e675d2f182f41e98e1ecda8ae1dfdce328bde6527db552881dfa5eabb578b44698e916c868f9ed3c8c529e48a55b706c85bae2ac2178a5cd3f8db33aef354e97a608df852a56fe46ff92048e3dcf39e75aa482458858c4c6ebe08a5c74bedc6b320514222d1aeb177f2fbf5fd7fdc2740e15f3d4570d2ba8d848de90e64e283ece8d840fae15e3260cd0ffd1d93a78232119401729fb5dd95ee32248e18bd4368afdc805505bd04685e1d5022a8ed29db6f48dc8d92548c90199e990975db7d64eb945e941a99bf11d8ed839c4cc6599c0a47622d70517fd6633ef82eee0bd31ab95f73b06451ae953ee4beed1ec4a92d5531fd193a59e0cc70f3066f7300c52502771f607a93cfb5a4bf928c41f2c9ec10bf50221bac7e7cb0ea85680e36812ce660df534b6560ca747c6360166b78d7c991434edec24eab97ae72e706d93d19109cd05086404ce65cc57a8ffec8efb3db160e7ca8c006e43c2c0cfc9c1210ff34bc17bff23eedc322a7c0fef39de9d914534a46e58e00819efc5aeabe1373bf145dcde73edeb4fb6ed6506b5ce3821fc92de457a6a30a58f27feadb72a328edc02dccc04b58069985b9557f844d98342dbf3e44132d1e648e2b6d3f02171ffda1f9a4a79a54a2fcf5077a9e4f932cc617b5ab5b29a0ae83d317d38e7af49d9c49b4db15da309100c00e42769a52d9306719e24fdc080474c7bca2972d13c6b57da3e40822030dcf0480757f380ebcbd437cb1933de6695c43cc00415d7fb9eea79632489e6313d734ecc90e75ef6bb5637479ba346a3c63be0c69837d87e0e74384d4101ff974d30332f549d4a0ffee614dd9b9f621f70f804fd277aab7474700fa2e2dce824e15a1e4ca2aea5a549ccda9e3e3152ac0cd791d63188a4807786a70e9c9e5b956c5bb8376a091c4dbcf6d3f2fe5718bb2bdd6a27543b0366df2adc18099c78b0303893b63b7cf1128c335e476425c87c6b4922b80a15d5af0b8956fd21ff2d4a511607428dd1b3967f15cef4f157a44e2378aee15ef70d370159e68a09ca95c117b83d02567360d26af305b276adba7c67f32e48c6b23ddbb791cf76ee7fce070529217df4b8456ef260e4a31765cbe93275dad89fb5aa5739841a200dc3cfd083239c7684d17b71bc42609c3b29a0e4977163d1ba71a58fa2514e724ee0be30f6b486cf9785826a54629309e1e69f0c5f5c609a2785a99c6026570ae544dc5d79bcf22dc147a74a367f6512c49da4cff0f00375cd8516b874afdacfd3f5875f53549dc7d8983f31fc109bdcfc88c2464ee743e7a8d79deddfc5c4d9fa625ce721f734132641c9ffa3918ac4e2959ce6f4f2f86280fd9e0005d8f4da468814a5af96c632a843f4724151bdfb6b79df366440dbb5ee6f08ef88c5f1ad67df42f40510ddb4962d302f3494382c0473fb3b503fb6eab981a5eeae6ccfd1b72c2e2315c38986410a8bc11d9385b4b72151b44fe8dff46e1629454912fa2e1cbdb0fbb982ed83bd98e876b9b4dfcfd2a8ceb70db4a1d55d331a5435578f12f9df32b1f098558a3a5f9e399613ef72700f60057c727eb04268c1edc12ea0d38c01177bfca864b88da870747197f1703ec3ab7122b67cf64399424534b0e3899baacfe1433ebc945d2b7cd20eabf7757219984d9a341a36ffb0164ea5345edcddfb1f0f7682179784f2e79cd3f4a35f795c81cde026f45c8dd2b63e6fb3336da1cbba7d41133e9a1125a3e7ccdf77330b9934207d406df8ba4cc36cf8e95f5999c70e4c911d7845bf0abcc4e65bb8f005809b6ed16f3832f09993105910ac41c87d242b73e4f6f267ab9432220db334f67fa89a6d377c949c17ba974a7490a6b3e46ca3ca562a6dc522aca95a1806ec85c10cd37367634b7bcbd0e9d09f3fe89a6769e56f4bb7f848be0584483a0a06c0b45b9aa41fe11b3c783a56ca668adef23f17662e9df0726887d7b44da6d1b83958eb49f1d781036e37ffa9f88bb8ff330d932f95bf2c01c7be0bff88954c1fb33c8e6752a60f760503ba1e235c1e4556314a8f012003b1bb821b6ab0393e40c37d077f6cd71c3f1c2d8f47c22bfe88a356bafb8ad254b6a3351decbed5c5f70b459aaa6d45880b2027de1797a6af4a2893f887741b074590fa7ec07c94c55be15c0d5d33d504201d5cf79c89aa35b2526168bc6506825f74ba9936a1e4d58ed66464191e6c4676f006ab9a0a16e8fabc0b255730346a24d89089fbe80770fc20921ad0e3a60c18dcce11356f4cc56eccc8b511e4501cfa78acfa047d08cc445c96a3ba252636707aeeacb4f1170cc132eed7705d2ea52226c83a58e94f1a42ff44f4664e0e925f8992cc20c648d4ee76e953a4ccde5b3e9b56aeb85ed85a8aa702c5a1e437948a34e113415717a846fee6ed7fffa8304ad6a43c513213cf8e55b636c60180d1451a7d6fdd99510ccb42daf80427d08fa9e78ca200dfb39c3d4b4fc8dcb107c89850e57a529ca15f60a2da26dee92ad9e5379cf9edc38e1c2264c1e192bb8e5107f6a64824f4db70a257016b83e04b6c891304f8cb902d09af0fd42f48e35a620f322af808ead451765990e2a62c5c07579c94ed7879814af393f12ba2979e2c24719cfc82e4486109c32fdfaced5cebcb229992f791273ccbef673687801c830c940bbc5315294994c280c2179e1b199d1b0e20cec2a44c0341db8845a8dac2413ae05f84cd7af5cd276be7bfbd797b5881363b2739cd345aaf82bdc60c3029d6096b407e589dc0f5f211e734ec9b2fdd483a665b7c611e68fa5a80929fe0c46dc310fa06b7bdf1c2cd6c1d6464f2f339cdf131bd836b0945232d23eadba9d4fee1e7369b8b97b3d04adf7e5d9bdd088f565ce502e8e9c1129d31417984f9a0dfe9f1bb1d4ae1d47253ae51e3b3bf400d891111f85d331c33205e80d75afc8a88b7a24cbbf68fb5ad05c9cfb91a371105444f17b6deafcc5cbbf43b4fecb568277f7aab841f29cc72878c799fbe9fe3bc1eef5c7916aaa44265d18c1381f27d08281a361ca2c6d98f2d57249c8d027bf7c72d425d37eab820f92699e083e5920aa3c7a82be5aa9f090e6732b97a12fe9ad2c3dc488c3d761660423ccb65ca915826936baa73fe3b00226593a117282aa2820370bd8724e11d8b95cb0d5b220ca9cbf4ef577389235057d2cadec14403ea36fd69e356d1fff107c1d36b73f6517ccb9a12f7065859802f77d2f0c836e7705490a09473e6225ad20f81629530673d716a9d3c1a9030bff88bb04021b54476832543ee30197029298974536384055a8af9efaa4969fe5e0d1863a8a8eaa6721559a22b6f92cc01fccda681c0e3cf62ebbfa1b4583d106f37e2d22479c59ba0c479676f133b4b3034681f342d10a7d96367135155874dfb44d1556d5eee7b900c21e5c749ab75e9635ca007f6f012ad22bf352c32896012b0dbcdc63d8a3d2e9e913f22ac2f9e33fa390aca57a6376f36cf46c191ed473a453fef29275096b4f1b98bfcd1b0ca2a6758ed14be9b35bead3f5785e7d0b9a39d4ead692975c028b8ebc3b1fcc08c652cdf1873b883863dcb9582365e4b9e265dee8090e5ee4ed3b207c24bc43ab20902ec3dde20f20df1db940ff83134db146cb9446dfdc40daf77d7c61a9e38f92a19791e4f21e52307877d2bfaab22dc3e9546eed94556bed24cbbb7731653af228b31023f517ce8885a4bf42ec3226217e07a2b425fc87326bfd0c1899d1a50ada0795b571d1aa584927f96b150e7ad9ede864bd2f46e1d30eb7560708471ba6d5ac4a9af69e976323359dcdb56ff597bb33315bb3e08f657fd397614dcffe61c06ec2bb97ba6b2bda84a165f4b79a226c073d9c86a3a63565e93495c6b3530ad0bd252701ca459becf28d52dc2ab3ff7828bf47b173a92fcebf09c8f6fa0f1b2ca372e314fbb8064ef6016a95c9cc99bcc5e989286b71e5901a7de0f73d461ff6899b9e65a774775661db2354a003bd46e968e55074a9490f44c52961d135167aa37c7a090096ed9a4662f3aa3c18950fde457df9425cf5905f16181cbaa13e30068b261cf97d38a6d5fb3bdcb6fd3df995e21cb7639ec3d18fadf6714e57d342761ddc073c605e4905c0ddc1acdd9493951ba7d0d619128a9d56ec7cbc110d62853d9af57f9c8a72ada1faada83d0c886bd6d519a105c8c8bd5844b6e2300564859b4d69e0e6be2169eeecf51ec6e1dffd910a57f1646763610b9299a97a9d78edfa807d81114c7be72e49ee3b830747e603fb15f973566e0b4ef1fd93894a3532393eb6b29e8b5bc211dce18d0b2a28d97fe6bbb8ce91ef52f83c3d8fbcfc4d5d629ef39bd26552847686ffdba0fa73e57c3e136f02b392ef21a83e5142aa32c5cab4cf03d0941cf4cd13a67d6b7eeb557a1f015513226c568182cfa2f27b52f155810631b629bef8827bfcd6ad170d281f997501e6a86922fab77f77e78d6ccd73c42bd832ac8d228f2119bf0fae9ee6bcfda8481767dbc5776ab1413f8f3c257a1db62306919a6d5cf19e9a8ffa61d162c1f0516cc1563e14e35fd8aa55cfa88fcbfce8398b6d77f04486ed03be1d1739c139f11342ab2d8288be9a29a0f975b302ebf249bd8f6cdc20a114835885ddab19c75f542ff3c1ee269109e268a392710a99bd6c968bfbd90461f33b347d669ded1f3"}, @NFTA_DATA_VERDICT={0x18, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}]}, @NFTA_DATA_VALUE={0x40, 0x1, "7b228f38ae9f942a9d1485e872a4d4a42e671b7991c8df8690affa61041fdd2e250cad2f21d7c2868339f5326cdb41da58888126e488f0ac96b52187"}, @NFTA_DATA_VALUE={0xcf, 0x1, "f414c8a8dec782756442ce989b942f693a0a8c67540e9893d0a34465f5773353e76d5a2d448c51141f1424bf0f24ec58a420b50c60e4f35a1be4ec91196d9e63f5d71a373600328a6f0a07579ac4fd8cff0ecf78fcb6d9a13a74169f1aa5d1693fba1c5473f9bac0b1b0b6e7182eeb046243ae330fdaa5f6c587bfb54259c3ebd46051d83e8f514c44ad64958dcb221e5ddc378909963e9d6cda5cc8bdece066ac48a779abb9f762553e4409fe6a2089fca18b3f7cdf5f449783dd0287e53c1dec929e5ed09058e480a222"}, @NFTA_DATA_VALUE={0xb5, 0x1, "6ee1b577a53f64d2f8cd11888cd5a2e67cb8432776bbf690af5124f815c3c85fd0c20c43ec6e39f6174f3af4118cfa16192450447d95b4ab510aa0ea719889a0cb3eb8e19ceed79eacab3d9555a3d6a891cd6d9e453ad1c1c3bec74b0aa2d6804418a71d819693e36be65e26e6dbdb0efcc2a622b116191f83fd188b499453930b2f2a9a5263cd7af731c72405956d5e800867c91a205f33691f8e96981ea83616f75e11f6238392daa3c7820928d5f3ce"}]}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz0\x00'}, @NFTA_SET_ELEM_KEY={0xac, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x2f, 0x1, "012c3a6ff96af2197c7d7f36cac83c7408568f1f6253014e2892c648923c60354567472e52ae39d4428c77"}, @NFTA_DATA_VERDICT={0x20, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}]}, @NFTA_DATA_VALUE={0x4b, 0x1, "719b6eb08b207e2a6de73ea0f1db362127b360dc0d8d62defd4024b64d3f97432bc90b9ec9af9300a56d5428294c4808f3ff4588cf6a9e62b2c7281eb7e0d8dc659328c14e6ad2"}, @NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}]}]}]}, {0x2e4, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz0\x00'}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_SET_ELEM_KEY_END={0xec, 0xa, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x60, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}]}, @NFTA_DATA_VERDICT={0x58, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}]}, @NFTA_DATA_VERDICT={0x30, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}]}]}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x4}, @NFTA_SET_ELEM_KEY={0x154, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x101, 0x1, "ba9823028e5fa88386381cd6609562fa563d0163b5c5ad2a082c735fe905d8062cd42e4511ebd7272e3a2eba9748ca40ee093ec3b74497a304e27722e3836c8d21da0cb866a33b097d8223af2585e483eadbb0ba387621c7ad5ec79ddab1a2148a3c3ac57985762642ca30e86d128aab9c7fe479d8b554a61395aadff46574bb862522ff2b1761455986a1b03270b4c13f1a20a8a06c4a2e3861bc81f6eeae7e16bf99c74b6fc9b84ffc2485c50af004b739616cbb4d52bdf2fd89913a7460a6c1951dd7ea214bdf73b6202dc7f406e8a684db5640e8e8eedb9aaf848582de03b83f65e338c6d658935bdecba637f60f22ef441366c280ad325a7055d9"}, @NFTA_DATA_VERDICT={0x4c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}]}]}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x8}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x1}, @NFTA_SET_ELEM_KEY_END={0x60, 0xa, 0x0, 0x1, [@NFTA_DATA_VALUE={0x4b, 0x1, "c34301bf1842b1c86b5c8064d3dbd2231b2d077ac5d73fd05bae0334f103dbef5d9330390a0255e0c4a47df8108bca6a8479e478a19a03bf78f7145b53b475c63a69e9e0bf7b51"}, @NFTA_DATA_VERDICT={0x10, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}]}]}]}, {0x584, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY_END={0xd4, 0xa, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x24, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}]}, @NFTA_DATA_VALUE={0xac, 0x1, "06cce31a51594abdf0731de98ca7610c333be918ce1eca6cd6fdac4ec75d56782b29c6fdbac71d3977b6a4aec7b02f6fb0cb0106c937add6a427fa58fe5af48ae3e55fc86abd4e2efa71ffdfeb8d09d85b59490c0b1584258f84c7199387356b1ea64bd05673e48926004231dfafaa1ad739426b3f62fb979b7331c913033ccb539c50bc6fcac8b17b22669e0bd37c4ee5e236975cb47a812ee0e7458f1fc0c638018732e0f936d6"}]}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x80000001}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz1\x00'}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0xa713}, @NFTA_SET_ELEM_EXPR={0x4}, @NFTA_SET_ELEM_DATA={0x484, 0x2, 0x0, 0x1, [@NFTA_DATA_VALUE={0xfc, 0x1, "debf4197a047215083fa85cf3e16fdda1bc9e920720df0c3ad1a6dbbc4d003dd29afd0c932e014b98d9b72a4199c8b229d4812a2055c11622b4ac9bc9c76c30eb6ce064315961d15a308a766badd9a4a3ed38babf01d54ee33a785b18de648f3a8759c4f37506cf93779e7beadf086ccd428b28edd8867134badb27ce06ff102de1ef4ef908fd6c90dd9e84b127976d4ff1b6ccb145f1e5a7b6f2447b955cf56d852e7426565256aa58503ad33180d1277590ab98bb7452fd584eafdad0da695a354226fdf4b29d0d741d08b892cae536956bc11afc19d847eb4aeb00668f7b77a63db5df76cc4f6cd745eca30b757f7ceaf4d7820c23b69"}, @NFTA_DATA_VALUE={0x4d, 0x1, "4d4986d80a3aedee9d6e038ef06036f24f7a7c530605daa106399234c3f02bbf7bd1b6eeed044d7a87b69bedeac869c805f5e0049f2d5c631a1ebbe37b374996949bad68b2961be9d5"}, @NFTA_DATA_VALUE={0xb7, 0x1, "b1d116c22c9441adff76dc90f5c49ab36f737fb0746ae7e27b544d94410d8f178f5e55afe66c439e7658914699c85361627b4433dbae2a2667ff5d37f4b37e60fac04a4d9b0e680d791b7d2b1a0d24352a47959e6bf16a7762277bb1f39b4d0db70f967412ca9ee7142cd5991436cfae3ae245c04efd31b4e3b6a0246067d05d767864e4d14f946ebe37b7daaf9c29d59637c3d88ee641d9c95425baead254fbd7be6a9b038adba0284b74a1e74c980d9cf7b9"}, @NFTA_DATA_VALUE={0xee, 0x1, "d53fa6d2ab196f8db9181138542ca08cfa70ea5273d297ce4e03f4fe81e7ec1f3026fa586cc4785d9f74078c174d21de37c7299c35e79777b53ebee90c63b935a43f00e6679629a8abd57779202659588593ea3b37ac31cda9b0d603c33488ce4ffad616c403b1b1498f499994ddf4d23f026701fdd25f1b6c88057faf9f24b22fe62db93ee2efec84198c457eb38737c92ba800b150f52309771854df23fe2a8ebe86d380c702cf7485682a17e288cb515b2236a4283456abb80c116202ee530e634f80d3e3bf3506b66e72dcdbba1bf7014dd7dc483f4e795682d8c1df2345884490c3fbaea24c6a37"}, @NFTA_DATA_VALUE={0xfb, 0x1, "23cf94de318baacb2d97bd8346ef41c592f1faa49580b11bae6e13fc1fd778ef1aaac390cf592716225c6c33a83377ca5dd1b1bbdefdff4522b85ab11031a889a3afdaa809732c6f1419d8e2ea0fbae6d5043c8867669eee6f83ed0c622d25f49fab977d0438e077f132ae81b30e15f6c68821da9b6e9f81472603dd089dd58f08e22f9a06efc22c82ff7e369de2577c89daef52ca679a64104c8ca4ad0c023ed1ebc9a9f08878848832813edc999d5ce9c65bb2426501c739cba3ac958c2375061fb34b6d3436764f24fad311f95edd19e69d30c5bcb892ab5a9e7854017947e554fd18d435463b7939911d9d0242b9792ef601563c42"}, @NFTA_DATA_VALUE={0x45, 0x1, "ce593ec3b35e9de731d8eae109a2d1afd15dc872d5c3302c3f42b961a1aa88212d046e9b2c06307443ba93616ebd102ed4ba2e8f3e0b2a612ccf9f7b072ebbc816"}, @NFTA_DATA_VERDICT={0x48, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0x4}]}]}]}, {0x6a4, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x268, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x9f, 0x1, "0f67b1db94ad323cee853c2485c4f4bc06b5023a9c5e7f4c62a0898c9684bfc18e44b277253a62df50a3cf3699086742a67ed1d131401a302459ffaca26536f222efd301925f7432aa7710ce66e11e5b7270dd35774f1ee5800699be8fb006cb9ddf81e79a0225d7251ab0da4e1779b3a92d120e3bfac321cb54057f0fd024390be5212fa7514b604c77b11bd2b43ff9e8fd4987df65ea004d6f49"}, @NFTA_DATA_VALUE={0xb2, 0x1, "23950b68596095ed726db20d8a108112d2eaacda143379c049d0e199ece9efb230dd16e772a07a48f6fddfef9beb5b7af312fb7dfb87fffe6de940a03b93e01ecb433cca38a7d0778398346352ff50cbf7551b8109d290b005bb5e090f45fc31a5f7d64d9bbe8ae8f6fb371335261ef9e1186cb992ac785ea6dfed34b76c7e5fb58fab440f8bef617b796b76a53fa59693803bde8bd9514ed490db98c62e5ce152154fd66920922256078060b17a"}, @NFTA_DATA_VERDICT={0x60, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}]}, @NFTA_DATA_VALUE={0x76, 0x1, "6a1c45b31215b694c1c6d12412f3404810e6070e03576667cf02810f5a6ef2fadbed7e9c2fa369e126de6c24b5a1130fe98e20bef42a1e2e52b0e2aed471e00810baf071985b53f38e74680a7b6132192d205591576eebf7fe858fc5c365f11fc2cc8dddca748b70b021377a6a5d05ef24b7"}, @NFTA_DATA_VERDICT={0x2c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}]}, @NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8}]}]}, @NFTA_SET_ELEM_EXPR={0x4}, @NFTA_SET_ELEM_EXPR={0x4}, @NFTA_SET_ELEM_FLAGS={0x8}, @NFTA_SET_ELEM_KEY={0x41c, 0x1, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x58, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}]}, @NFTA_DATA_VERDICT={0x34, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}]}, @NFTA_DATA_VALUE={0xfd, 0x1, "1c66ea30f9cd4c7faff5387c5cc8f7fc370ef1235ffd81c1ad8579750bfd443126c3f879ebbea3d63a888a10ce30b8840118c52abb4360b8dc2768b53116cdaf21e12a3bca6e280e477fe9fff6cdc89f69d39fcc3baa66126940d5a4d89ac33e83afc1005cb976cd7da468879894d8f5b35403cf1453eb85a1c8b32bdf61d86c25506b9a8d5c73ffd03470f91974501ad1fa6246fd2f2950a93d552900122fe43e74b50ec7d9eea110ce87fe1ef3a5d616b01d5dd43e55d3456bacd63f3808479c935aa42ab81e4b1f73f211d44b61ab14ef645d82c093c0c9284743ce80e7652fc2be9241088c4c7e134ba63d921dab16eda92a0a2a24be54"}, @NFTA_DATA_VERDICT={0x3c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}]}, @NFTA_DATA_VALUE={0x85, 0x1, "e4aab647abba173946427c3675cf708cdb249a3cd4952c25f90cc85f83db83cb1e193323dc1b1b16b8e4d8fea945b22dff944b47807e803ec5dc40afd01be0bce0b1e485d449aebd79d110d825e8f532307e8baf7ff9e819365eca47f4bd4a7908c23d92efd34716a4cf1a630e8d354a4d2d61268afef5ce52c4c2e56124efb14c"}, @NFTA_DATA_VALUE={0x8a, 0x1, "973ba03bdbb9c6d695d65d37829ba5a4622c817fa936985d03db06d4d55cfd652b7376cd1227ac5eebc9f5807b83486b8678ddc22eb91ea4d87527894087839ed9c1d6a851a0220e575fdf81883be6e7b5dca5e3a38d88c1d7cd3cafb259bf77af53bdc228013e11205770c407488a44b3df8530002b36426a4853a9050ea69d6a97dc16b91b"}, @NFTA_DATA_VERDICT={0x38, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffff9}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}]}, @NFTA_DATA_VERDICT={0x10, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}]}, @NFTA_DATA_VALUE={0xf1, 0x1, "f9d5508b243d0d844c79db3c572b78682c94b20d3d4e3cc3b9b32ac35985ecb7632d02a0f0d8114414757c045944985e943b127221069509183d0e8d1158dfd5e828488307f326a2ad730018833c34900dd8f7473bbae9d6dca2093876d2d76e866fb1d447161700a964cf064dcc14ed48612987f78463a30296335ed887ea9983f1af92bd1aff9402600986adb4b214efc067d56427d196044c8ce2575aadb02cc6a2676693df1fe53a03a86f176d2e940032e7d6ebbb42e6384f3bdbf6d7aed93e0b2584f819954f6fc746d5505c5fbd395927f50601ea9c8fd91aa16b7ea450b0e99dd257f80a87fbde49fc"}]}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz2\x00'}]}, {0x3cc, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x5}, @NFTA_SET_ELEM_DATA={0x2ec, 0x2, 0x0, 0x1, [@NFTA_DATA_VALUE={0xf6, 0x1, "74fa786065c5f1c914f0664308150b2e922b093ceb77bfe9aa15f0d2198fec94d493e6a30a6a718bacdcc019c1e8ea69fd6aae35d8d047dd8d232ba97fd1dcfdd5888896d39571c5bc705e27d60e8ab13ba94b65b09d5a1a0ccdc59a007dce380092bb8561fb5a0a14f64910e752f2b96f3a64dcab039789ed058bb479040dd99af4373ade5cbff68157da0634e811bcaebff44fa3342d98372bed4d41e9ff5022f065577ee3ee38b0647c283d3b30c007495a074e98f5697ae7e7c37bce5ed06ffa260817a58a0799b6ba7842bb42968e81e89d451464a8487d0c067b370215d3d24362f51584b3f74d5334ae6eb225ca3b"}, @NFTA_DATA_VALUE={0xc3, 0x1, "1a5672feed47655b4baf4e25790ea34b323c55deb91006b55c8f7bce28657a5374eb57a2d82b16eeead2fa9d26b0bdd4b6a84624d0712c645cecabb075dfaef5e0b738020c0804bfd31786a45ecf46b4005d46cd6aef6a54a917d41a64c18e461547949c345a5b048d770177dd19caefcd190a14d7c4368163c4eb4171185e870db4e621222b6768357394a9740a98d29b60269249821c4ae828058f1ab345e83f045ecd2dd69685bcc74230833342068f7f67a83718c5a25a5b67382fec69"}, @NFTA_DATA_VALUE={0x44, 0x1, "3de4958f0e97271c3ce0579202df6c271fd1f403ced2aef3b1287cb62c73d578d7bda3a0152f9d4f5a03250f1ee234d8113b4ea1b5299d10a6424a555eb4e713"}, @NFTA_DATA_VERDICT={0x60, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0x2}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}]}, @NFTA_DATA_VALUE={0x3a, 0x1, "c4f005ca0cc534c49b524d482676388be1df4e227739e0558ba2377c8a9db23f88ed2f96b4edef9d027505beeb24a3c3580b144968f6"}, @NFTA_DATA_VERDICT={0x4c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}]}]}, @NFTA_SET_ELEM_FLAGS={0x8}, @NFTA_SET_ELEM_KEY_END={0xb4, 0xa, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x60, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0x7ffffffffffffffd}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CODE={0x8}]}, @NFTA_DATA_VERDICT={0x48, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0x34bf6100b51397f0}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}]}, @NFTA_DATA_VALUE={0x6, 0x1, "6df6"}]}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x1000}, @NFTA_SET_ELEM_FLAGS={0x8}]}]}]}, 0x2800}, 0x1, 0x0, 0x0, 0x81}, 0x1) 05:44:16 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:44:16 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x0, 0x2, 0x0}) [ 2891.663252][ T3157] binder: 3150:3157 unknown command 0 [ 2891.680724][ T3157] binder: 3150:3157 ioctl c0306201 20000200 returned -22 [ 2891.701063][ T3160] binder: 3154:3160 unknown command 0 05:44:16 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2891.735663][ T3160] binder: 3154:3160 ioctl c0306201 20000200 returned -22 [ 2891.749560][ T3169] binder: 3154:3169 ioctl c018620c 200000c0 returned -14 [ 2891.759247][ T3157] binder: 3150:3157 unknown command 0 05:44:16 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2891.808845][ T3157] binder: 3150:3157 ioctl c0306201 20000200 returned -22 05:44:16 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xff00000000000000, 0x0, 0x0}) 05:44:16 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x0, 0x3, 0x0}) 05:44:16 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release={0x40486312}], 0x0, 0x0, 0x0}) 05:44:16 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:16 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:44:16 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x0, 0x4, 0x0}) [ 2892.010873][ T3198] binder: 3196:3198 unknown command 0 [ 2892.046360][ T3198] binder: 3196:3198 ioctl c0306201 20000200 returned -22 [ 2892.076568][ T3210] binder: 3196:3210 ioctl c018620c 200000c0 returned -14 [ 2892.087002][ T3211] binder: 3209:3211 unknown command 0 [ 2892.108081][ T3211] binder: 3209:3211 ioctl c0306201 20000200 returned -22 05:44:17 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:17 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000440)={{}, 0x1, 0x6, 0x0, {}, 0x6, 0x1}) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) getsockname$packet(r5, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000040)=0x14) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_NMI(r4, 0xae9a) 05:44:17 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x0, 0x5, 0x0}) 05:44:17 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x2, 0x0}) 05:44:17 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x0, 0x0, 0x0}) 05:44:17 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2892.309586][ T3246] binder: 3240:3246 unknown command 0 [ 2892.343628][ T3255] binder: 3244:3255 unknown command 0 [ 2892.349222][ T3246] binder: 3240:3246 ioctl c0306201 20000200 returned -22 05:44:17 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x0, 0x6, 0x0}) [ 2892.379971][ T3246] binder: 3240:3246 ioctl c018620c 200000c0 returned -14 05:44:17 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:17 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2892.441877][ T3255] binder: 3244:3255 ioctl c0306201 20000200 returned -22 05:44:17 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x3, 0x0}) 05:44:17 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x0, 0x7, 0x0}) 05:44:17 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release={0x40046306, 0x2}], 0x0, 0x0, 0x0}) 05:44:17 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2892.692582][ T3297] binder: 3288:3297 unknown command 0 [ 2892.703677][ T3299] binder: 3294:3299 unknown command 0 [ 2892.709701][ T3299] binder: 3294:3299 ioctl c0306201 20000200 returned -22 [ 2892.716228][ T3297] binder: 3288:3297 ioctl c0306201 20000200 returned -22 [ 2892.725319][ T3299] binder: 3294:3299 ioctl c018620c 200000c0 returned -14 05:44:18 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) sendmsg$RDMA_NLDEV_CMD_STAT_DEL(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x10, 0x1412, 0x200, 0x70bd2a, 0x25dfdbfd}, 0x10}, 0x1, 0x0, 0x0, 0x40084}, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000440)={{}, 0x1, 0x6, 0x0, {}, 0x6, 0x1}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_NMI(r4, 0xae9a) r5 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/btrfs-control\x00', 0x321000, 0x0) bind$phonet(r5, &(0x7f0000000380)={0x23, 0x5, 0x78, 0x72}, 0x10) 05:44:18 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:44:18 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x0, 0x12, 0x0}) 05:44:18 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:18 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x4, 0x0}) 05:44:18 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release={0x40046306, 0x3}], 0x0, 0x0, 0x0}) [ 2893.370284][ T3321] binder: 3315:3321 unknown command 0 [ 2893.376955][ T3319] connmark_tg_check: 46 callbacks suppressed [ 2893.376979][ T3319] cannot load conntrack support for proto=3 [ 2893.394835][ T3326] binder: 3320:3326 unknown command 0 [ 2893.395618][ T3327] cannot load conntrack support for proto=3 [ 2893.406909][ T3321] binder: 3315:3321 ioctl c0306201 20000200 returned -22 05:44:18 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2893.417427][ T3328] binder_alloc_new_buf_locked: 7 callbacks suppressed [ 2893.417437][ T3328] binder_alloc: 12546: binder_alloc_buf, no vma [ 2893.420998][ T3326] binder: 3320:3326 ioctl c0306201 20000200 returned -22 [ 2893.446518][ T3336] binder: 3315:3336 ioctl c018620c 200000c0 returned -14 05:44:18 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x12], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:18 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x0, 0x48, 0x0}) 05:44:18 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x5, 0x0}) 05:44:18 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release={0x40046306, 0x4}], 0x0, 0x0, 0x0}) [ 2893.605708][ T3351] cannot load conntrack support for proto=3 [ 2893.607333][ T3356] cannot load conntrack support for proto=3 [ 2893.619516][ T3359] binder_alloc: 12546: binder_alloc_buf, no vma 05:44:18 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1d], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2893.653727][ T3366] cannot load conntrack support for proto=3 [ 2893.709193][ T3375] binder: 3362:3375 unknown command 0 [ 2893.710745][ T3373] binder: 3363:3373 unknown command 0 [ 2893.736508][ T3375] binder: 3362:3375 ioctl c0306201 20000200 returned -22 [ 2893.738939][ T3373] binder: 3363:3373 ioctl c0306201 20000200 returned -22 [ 2893.758786][ T3375] binder: 3362:3375 unknown command 0 [ 2893.767902][ T3378] binder: 3363:3378 ioctl c018620c 200000c0 returned -14 [ 2893.781787][ T3375] binder: 3362:3375 ioctl c0306201 20000200 returned -22 05:44:18 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000440)={{}, 0x1, 0x6, 0x0, {}, 0x6, 0x1}) ioctl$KVM_GET_LAPIC(r1, 0x8400ae8e, &(0x7f00000004c0)={"788fdf9a0b95661aa246baf4fcb8205590b99a16c0386ceb2c8a7a3cf3f53e67f6ffc1e91bd9fc7f1e796ab5ec55a041c102a6543e0f85502a13190c7339a41d91a11039d1a54ead3c73a9da6ff87b28a2c7de791e1d71af13c037fd0b4146a310e444c85d815d476059f89f60acc487e57f2c5ca0b12e0a4c52451907bf654678fec8142b247eebca4f66222d08079e0f73eae129fd719d2510ced1f9ed0d2a3e5ac64f4170cb3b36299d797320745b4f742c7805a0d20e0a82d83bfbb2d63acdc082c007029817a1626019a62bcb5dbf5281b574cd13b72f14c8dff362c1c572ccc54e6fffce51edb8a641ad2227aa3694649177996081271ba2da0add0998ff9914761ef60e4b4c14292f19783274638b06ed4f519f6d60db0e08f59500d208b6d7b616f5ee1aeb923c30b470753a663ea74317304f91346dc34ab2f8e312335a4ce19fb815b5c3f967b1b7f586ab5b3c85eb46ec329e643aa46f9227aeaa1cd47a9c352a16fd499361b2ac96bc36f90b1dc6692ed52d1db442b7d1e3e208724ec05e55a96e134b90026e4c440f9bf937623d1ade4927084bd64a4193b341ae50ca38e616583422939f17109544cff48586512bf2bfa530772a05718d187af2447fea4ecce930de8d00215f59c60bc95fce2c3745d3e2db713a4c24ff7f2dede9ad73ad9464034beffb826c307e7b5d6fb842280e7dd6a946c50f5adeb56dfd45382c0cb84e65a29bdb7ed02e984efca2e4b70abdd2a45a736c20c45fc92020a1d4c83676db6dbf1e55dc58f347e03eddcdfe114d783d8543778ce2a9de1e290459244581f64b83af61f400d1be25835fa32bb0f1ec33569b5361d997e8ff3b3ad69080ad06d4e41f2ea027b27d3f63b7ea3bd4a2154387c3cf54a8eafeb236bbf538a066aef3a787692e0d7224a30a19a2ff6ddbfa9826649c75a8f061a03c0a7033e2688c859bb1254643bcbc56098ccae85557c56bf45a90ab59573854b4394de4d389391fff28178ab13515fdfa1fa01f9b7dd6368324a607e1c4a03f099173fa50b6309d31419467542b9e8fa1d7cbd6701e318a1419c1f570795bbdd523bef9b2f449b4ff47bf382fce3a05e12abd3eccdfc658e77ad6d731a668650f7f63ebbaa2d47307ba8c124c90bc8972a2574995492d0a8288fd483f1ab8baac032b3dfddf9e66f62b8524af095414b28d96d1bea6021d6625896cd2096abebe97d6c222bf3d394780cb6dda0c0b4b8a412726e11f1a66aff3272436288586f53b6d0030c3bc01d5c4f383c51e2564f1deff0d69eff7e3606bd21b27f18558fd57fb41b88390bd918e16546a2e9cbcdcc1f5b71f1507f0bf3f21b86ef267d82a832900136c550efe560d3c41158e3260d100b712a8b657d441e0e86e933d874bbb7df6c9099022c78593f24cf05f99776bcf8ed999de39e8088cd5fb086d4c"}) ioctl$KVM_RUN(r4, 0xae80, 0x0) epoll_create(0xc631) setsockopt$inet6_udp_encap(r1, 0x11, 0x64, &(0x7f0000000000)=0x2, 0x4) ioctl$KVM_NMI(r4, 0xae9a) 05:44:18 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x0, 0x4c, 0x0}) 05:44:18 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1d], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:18 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x6, 0x0}) 05:44:18 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release={0x40046306, 0x5}], 0x0, 0x0, 0x0}) 05:44:18 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2893.871214][ T3382] cannot load conntrack support for proto=3 [ 2893.925195][ T3398] cannot load conntrack support for proto=3 [ 2893.940342][ T3399] binder_alloc: 12546: binder_alloc_buf, no vma [ 2893.947299][ T3404] binder: 3397:3404 unknown command 0 [ 2893.964933][ T3410] cannot load conntrack support for proto=3 [ 2893.967042][ T3408] binder: 3394:3408 unknown command 0 [ 2893.985908][ T3404] binder: 3397:3404 ioctl c0306201 20000200 returned -22 05:44:18 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2894.015989][ T3408] binder: 3394:3408 ioctl c0306201 20000200 returned -22 [ 2894.032571][ T3412] cannot load conntrack support for proto=3 [ 2894.040319][ T3404] binder: 3397:3404 unknown command 0 [ 2894.054871][ T3424] binder: 3394:3424 ioctl c018620c 200000c0 returned -14 05:44:18 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x0, 0x60, 0x0}) 05:44:18 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2894.069085][ T3404] binder: 3397:3404 ioctl c0306201 20000200 returned -22 05:44:19 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x7, 0x0}) [ 2894.149016][ T3443] cannot load conntrack support for proto=3 [ 2894.185435][ T3446] binder_alloc: 12546: binder_alloc_buf, no vma 05:44:19 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:44:19 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release={0x40046306, 0x6}], 0x0, 0x0, 0x0}) [ 2894.304660][ T3455] binder: 3454:3455 unknown command 0 [ 2894.310963][ T3455] binder: 3454:3455 ioctl c0306201 20000200 returned -22 [ 2894.335900][ T3458] binder: 3456:3458 unknown command 0 [ 2894.348681][ T3458] binder: 3456:3458 ioctl c0306201 20000200 returned -22 [ 2894.364441][ T3455] binder: 3454:3455 ioctl c018620c 200000c0 returned -14 [ 2894.396785][ T3458] binder: 3456:3458 unknown command 0 [ 2894.419775][ T3458] binder: 3456:3458 ioctl c0306201 20000200 returned -22 05:44:19 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x0, 0x68, 0x0}) 05:44:19 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:19 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:44:19 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x8, 0x0}) 05:44:19 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release={0x40046306, 0x7}], 0x0, 0x0, 0x0}) 05:44:19 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000440)={{}, 0x1, 0x6, 0x0, {}, 0x6, 0x3}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000280)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_PIT2(0xffffffffffffffff, 0x4040ae77, &(0x7f0000000000)) ioctl$KVM_INTERRUPT(r1, 0x4004ae86, &(0x7f0000000040)=0x7) read(r3, &(0x7f0000000100)=""/227, 0xe3) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_NMI(r2, 0xae9a) [ 2894.559930][ T3473] binder_alloc: 12546: binder_alloc_buf, no vma [ 2894.601397][ T3481] binder: 3474:3481 unknown command 0 [ 2894.607542][ T3485] binder: 3476:3485 unknown command 0 05:44:19 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:19 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x0, 0x6c, 0x0}) [ 2894.645585][ T3485] binder: 3476:3485 ioctl c0306201 20000200 returned -22 [ 2894.656174][ T3481] binder: 3474:3481 ioctl c0306201 20000200 returned -22 [ 2894.669182][ T3491] binder: 3474:3491 ioctl c018620c 200000c0 returned -14 05:44:19 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, 0x0) getsockopt$IPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x41, &(0x7f0000000000)={'filter\x00', 0x59, "4937e0031981293895d210c2cafd5ec5cf7b855c3ccab951216fded34778272b6e3d869a11d5ae1a5bfad195a4d77b568999624af3930dd501175a4c970b0baebec5e339fe9e848430ae3768f768ff28e782ea0bbe29fa84ea"}, &(0x7f0000000080)=0x7d) ioctl$KVM_SET_REGS(r4, 0x4090ae82, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000440)={{}, 0x1, 0x6, 0x0, {0x0, 0xff}, 0x6, 0x7fffffff}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_NMI(r4, 0xae9a) 05:44:19 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2894.716632][ T3485] binder: 3476:3485 unknown command 0 [ 2894.747190][ T3485] binder: 3476:3485 ioctl c0306201 20000200 returned -22 05:44:19 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release={0x40046306, 0x300}], 0x0, 0x0, 0x0}) 05:44:19 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x48, 0x0}) 05:44:19 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2894.821362][ T3513] binder_alloc: 12546: binder_alloc_buf, no vma 05:44:19 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x0, 0x74, 0x0}) [ 2894.922828][ T3527] binder: 3523:3527 unknown command 0 [ 2894.941409][ T3534] binder: 3526:3534 unknown command 0 [ 2894.954316][ T3527] binder: 3523:3527 ioctl c0306201 20000200 returned -22 [ 2894.975801][ T3534] binder: 3526:3534 ioctl c0306201 20000200 returned -22 [ 2894.995251][ T3537] binder: 3523:3537 ioctl c018620c 200000c0 returned -14 [ 2895.017059][ T3534] binder: 3526:3534 unknown command 0 05:44:19 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x74], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:44:19 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2895.026630][ T3534] binder: 3526:3534 ioctl c0306201 20000200 returned -22 05:44:20 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release={0x40046306, 0x500}], 0x0, 0x0, 0x0}) 05:44:20 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x4c, 0x0}) [ 2895.085591][ T3542] binder_alloc: 12546: binder_alloc_buf, no vma 05:44:20 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x0, 0x7a, 0x0}) 05:44:20 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2895.260085][ T3559] binder: 3557:3559 unknown command 0 [ 2895.261180][ T3561] binder: 3555:3561 unknown command 0 [ 2895.269229][ T3560] binder_alloc: 12546: binder_alloc_buf, no vma [ 2895.282678][ T3559] binder: 3557:3559 ioctl c0306201 20000200 returned -22 [ 2895.291035][ T3561] binder: 3555:3561 ioctl c0306201 20000200 returned -22 [ 2895.315884][ T3561] binder: 3555:3561 unknown command 0 [ 2895.317845][ T3563] binder: 3557:3563 ioctl c018620c 200000c0 returned -14 [ 2895.340918][ T3561] binder: 3555:3561 ioctl c0306201 20000200 returned -22 05:44:21 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xfffffffffffffed3, &(0x7f0000000080)=[{&(0x7f0000000040)="0aa4000035000505d25a80648c63940d0224fc6b10000a400a000048053582c137153e370948018000f01700d1bd", 0x33fe0}], 0x1}, 0x7a000000) r1 = socket$unix(0x1, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r6, 0x0) ioctl$EVIOCGBITSW(r6, 0x80404525, &(0x7f00000004c0)=""/4096) ioctl$KVM_SET_REGS(r5, 0x4090ae82, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000440)={{}, 0x1, 0x6, 0x0, {}, 0x6, 0x1}) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_NMI(r5, 0xae9a) 05:44:21 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x0, 0x300, 0x0}) 05:44:21 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x74], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:21 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x88], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:44:21 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x60, 0x0}) 05:44:21 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release={0x40046306, 0x600}], 0x0, 0x0, 0x0}) [ 2896.599978][ T3587] binder: 3585:3587 unknown command 0 [ 2896.602715][ T3592] binder: 3586:3592 unknown command 0 [ 2896.613819][ T3595] binder_alloc: 12546: binder_alloc_buf, no vma [ 2896.616564][ T3594] netlink: 23514 bytes leftover after parsing attributes in process `syz-executor.1'. [ 2896.636050][ T3592] binder: 3586:3592 ioctl c0306201 20000200 returned -22 05:44:21 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:21 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x0, 0x500, 0x0}) [ 2896.664698][ T3599] binder: 3585:3599 ioctl c018620c 200000c0 returned -14 [ 2896.671184][ T3587] binder: 3585:3587 ioctl c0306201 20000200 returned -14 05:44:21 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:44:21 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x88], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:21 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release={0x40046306, 0x700}], 0x0, 0x0, 0x0}) [ 2896.771376][ T3594] openvswitch: netlink: Message has 18437 unknown bytes. [ 2896.808888][ T3616] binder_alloc: 12546: binder_alloc_buf, no vma 05:44:21 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x68, 0x0}) [ 2896.882685][ T3623] binder: 3621:3623 unknown command 0 [ 2896.893288][ T3623] binder: 3621:3623 ioctl c0306201 20000200 returned -22 [ 2896.911383][ T3623] binder: 3621:3623 unknown command 0 [ 2896.945627][ T3623] binder: 3621:3623 ioctl c0306201 20000200 returned -22 [ 2896.961242][ T3629] binder: 3627:3629 unknown command 0 [ 2896.975028][ T3629] binder: 3627:3629 ioctl c0306201 20000200 returned -22 [ 2896.997140][ T3629] binder: 3627:3629 ioctl c018620c 200000c0 returned -14 05:44:21 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) r5 = dup(r3) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(r1, 0x89f7, &(0x7f0000000580)={'syztnl0\x00', &(0x7f0000000500)={'ip6tnl0\x00', 0x0, 0x4, 0xa5, 0x80, 0xbc, 0x24, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @loopback, 0x20, 0x7800, 0x2, 0xc5}}) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r7, @ANYBLOB="139b0000000000801c0012000c000100626f6e64"], 0x3c}}, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000001580)=@newqdisc={0x88, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb, 0x1, 'mqprio\x00'}, {0x58, 0x2, {{0x1, [], 0x0, [0x10]}}}}]}, 0x88}}, 0x0) setsockopt(r8, 0x7, 0x2, &(0x7f0000000000)="0979227733cfa51edc1b1dc64c1263a2e6b7da750df614031f3433d3aaecb815cc61da848b0718ddfb2b9c3fa6cf2eeb8ef62a22cf1356ecb243a363d546dfcb5ba7705fc6ab2b21d1da8b1a6a35c9637797ea0967e711965140b5145e5decbd4e", 0x61) bind$can_raw(r5, &(0x7f00000005c0)={0x1d, r6}, 0x10) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000440)={{}, 0x1, 0x6, 0x0, {}, 0x6, 0x1}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_NMI(r4, 0xae9a) 05:44:21 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x6c, 0x0}) 05:44:21 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x0, 0x600, 0x0}) 05:44:21 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:21 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:44:21 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release={0x40046306, 0x3f00}], 0x0, 0x0, 0x0}) [ 2897.134509][ T3647] binder: 3640:3647 unknown command 0 [ 2897.142263][ T3648] binder: 3641:3648 unknown command 0 [ 2897.173562][ T3648] binder: 3641:3648 ioctl c0306201 20000200 returned -22 05:44:22 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x0, 0x700, 0x0}) [ 2897.176293][ T3647] binder: 3640:3647 ioctl c0306201 20000200 returned -22 05:44:22 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:22 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2897.218678][ T3657] binder: 3641:3657 ioctl c018620c 200000c0 returned -14 05:44:22 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x74, 0x0}) 05:44:22 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release={0x40046306, 0x1000000}], 0x0, 0x0, 0x0}) 05:44:22 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x0, 0x1200, 0x0}) [ 2897.424741][ T3690] binder: 3684:3690 unknown command 0 [ 2897.430372][ T3690] binder: 3684:3690 ioctl c0306201 20000200 returned -22 [ 2897.442282][ T3690] binder: 3684:3690 unknown command 0 [ 2897.450771][ T3690] binder: 3684:3690 ioctl c0306201 20000200 returned -22 [ 2897.458578][ T3693] binder: 3686:3693 unknown command 0 [ 2897.464199][ T3693] binder: 3686:3693 ioctl c0306201 20000200 returned -22 [ 2897.490961][ T3693] binder: 3686:3693 ioctl c018620c 200000c0 returned -14 [ 2898.329574][ T3654] warn_alloc: 5 callbacks suppressed [ 2898.329593][ T3654] syz-executor.1: page allocation failure: order:0, mode:0x400cc4(GFP_KERNEL_ACCOUNT|GFP_DMA32), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 2898.358793][ T3654] CPU: 0 PID: 3654 Comm: syz-executor.1 Not tainted 5.8.0-rc5-syzkaller #0 [ 2898.367468][ T3654] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2898.377513][ T3654] Call Trace: [ 2898.380804][ T3654] dump_stack+0x18f/0x20d [ 2898.385147][ T3654] warn_alloc.cold+0x87/0x17a [ 2898.389826][ T3654] ? zone_watermark_ok_safe+0x260/0x260 [ 2898.395380][ T3654] ? wait_for_completion+0x260/0x260 [ 2898.400673][ T3654] __alloc_pages_slowpath.constprop.0+0x2197/0x2780 [ 2898.407277][ T3654] ? warn_alloc+0x120/0x120 [ 2898.411781][ T3654] ? __alloc_pages_nodemask+0x3e5/0x930 [ 2898.417351][ T3654] ? lock_is_held_type+0xb0/0xe0 [ 2898.422389][ T3654] ? find_held_lock+0x2d/0x110 [ 2898.427161][ T3654] __alloc_pages_nodemask+0x68f/0x930 [ 2898.432530][ T3654] ? __zone_watermark_ok+0x370/0x370 [ 2898.437817][ T3654] ? __alloc_pages_slowpath.constprop.0+0x2780/0x2780 [ 2898.444582][ T3654] ? lock_is_held_type+0xb0/0xe0 [ 2898.449523][ T3654] ? rcu_read_lock_sched_held+0x3a/0xb0 [ 2898.455065][ T3654] ? __alloc_pages_nodemask+0x6b1/0x930 [ 2898.460612][ T3654] alloc_pages_current+0x187/0x280 [ 2898.465733][ T3654] alloc_mmu_pages+0x7f/0x170 [ 2898.470413][ T3654] kvm_mmu_create+0x3cb/0x560 [ 2898.475093][ T3654] kvm_arch_vcpu_create+0x16d/0xb70 [ 2898.480301][ T3654] kvm_vm_ioctl+0x1547/0x23c0 [ 2898.484981][ T3654] ? lock_downgrade+0x820/0x820 [ 2898.489831][ T3654] ? kvm_unregister_device_ops+0x60/0x60 [ 2898.495459][ T3654] ? trace_hardirqs_on+0x5f/0x220 [ 2898.500481][ T3654] ? lockdep_hardirqs_on+0x6a/0xe0 [ 2898.505593][ T3654] ? tomoyo_path_number_perm+0x244/0x4d0 [ 2898.511225][ T3654] ? tomoyo_execute_permission+0x470/0x470 [ 2898.517038][ T3654] ? __might_fault+0x11f/0x1d0 [ 2898.521809][ T3654] ? __sanitizer_cov_trace_switch+0x45/0x70 [ 2898.527735][ T3654] ? do_vfs_ioctl+0x27d/0x1090 [ 2898.532504][ T3654] ? generic_block_fiemap+0x60/0x60 [ 2898.537699][ T3654] ? __might_fault+0x190/0x1d0 [ 2898.542465][ T3654] ? _copy_to_user+0x126/0x160 [ 2898.547228][ T3654] ? __fget_files+0x294/0x400 [ 2898.552082][ T3654] ? kvm_unregister_device_ops+0x60/0x60 [ 2898.557711][ T3654] ksys_ioctl+0x11a/0x180 [ 2898.562045][ T3654] __x64_sys_ioctl+0x6f/0xb0 [ 2898.566638][ T3654] ? lockdep_hardirqs_on+0x6a/0xe0 [ 2898.571752][ T3654] do_syscall_64+0x60/0xe0 [ 2898.576168][ T3654] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2898.582056][ T3654] RIP: 0033:0x45c1d9 [ 2898.585937][ T3654] Code: Bad RIP value. [ 2898.590004][ T3654] RSP: 002b:00007f58ffba0c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2898.598414][ T3654] RAX: ffffffffffffffda RBX: 000000000000edc0 RCX: 000000000045c1d9 [ 2898.606383][ T3654] RDX: 0000000000000000 RSI: 000000000000ae41 RDI: 0000000000000006 [ 2898.614348][ T3654] RBP: 000000000078bf40 R08: 0000000000000000 R09: 0000000000000000 [ 2898.622317][ T3654] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000078bf0c [ 2898.630298][ T3654] R13: 0000000000c9fb6f R14: 00007f58ffba19c0 R15: 000000000078bf0c [ 2898.653350][ T3654] Mem-Info: [ 2898.657744][ T3654] active_anon:320486 inactive_anon:20516 isolated_anon:0 [ 2898.657744][ T3654] active_file:2306 inactive_file:46478 isolated_file:0 [ 2898.657744][ T3654] unevictable:0 dirty:61 writeback:0 [ 2898.657744][ T3654] slab_reclaimable:22931 slab_unreclaimable:211951 [ 2898.657744][ T3654] mapped:63055 shmem:20759 pagetables:126567 bounce:0 [ 2898.657744][ T3654] free:673572 free_pcp:833 free_cma:0 [ 2898.709376][ T3654] Node 0 active_anon:966300kB inactive_anon:47796kB active_file:0kB inactive_file:3096kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:224064kB dirty:20kB writeback:0kB shmem:48756kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 323584kB writeback_tmp:0kB all_unreclaimable? yes [ 2898.738036][ T3654] Node 1 active_anon:315644kB inactive_anon:34268kB active_file:9224kB inactive_file:182816kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:28156kB dirty:224kB writeback:0kB shmem:34280kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB all_unreclaimable? no [ 2898.768144][ T3654] Node 0 DMA free:10264kB min:220kB low:272kB high:324kB reserved_highatomic:0KB active_anon:3964kB inactive_anon:272kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15908kB mlocked:0kB kernel_stack:124kB pagetables:272kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2898.798946][ T3654] lowmem_reserve[]: 0 2515 2515 2515 2515 [ 2898.805652][ T3654] Node 0 DMA32 free:34252kB min:35916kB low:44892kB high:53868kB reserved_highatomic:0KB active_anon:962336kB inactive_anon:47524kB active_file:0kB inactive_file:3096kB unevictable:0kB writepending:20kB present:3129332kB managed:2578200kB mlocked:0kB kernel_stack:85656kB pagetables:245232kB bounce:0kB free_pcp:880kB local_pcp:444kB free_cma:0kB [ 2898.847494][ T3654] lowmem_reserve[]: 0 0 0 0 0 [ 2898.852885][ T3654] Node 0 Normal free:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:786432kB managed:0kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2898.881825][ T3654] lowmem_reserve[]: 0 0 0 0 0 [ 2898.886520][ T3654] Node 1 Normal free:2649356kB min:53972kB low:67464kB high:80956kB reserved_highatomic:0KB active_anon:315644kB inactive_anon:34268kB active_file:9224kB inactive_file:182816kB unevictable:0kB writepending:224kB present:3932160kB managed:3870200kB mlocked:0kB kernel_stack:83116kB pagetables:260764kB bounce:0kB free_pcp:2436kB local_pcp:1368kB free_cma:0kB [ 2898.923021][ T3654] lowmem_reserve[]: 0 0 0 0 0 [ 2898.927715][ T3654] Node 0 DMA: 4*4kB (ME) 5*8kB (UM) 6*16kB (UM) 8*32kB (U) 8*64kB (UME) 7*128kB (ME) 7*256kB (UME) 5*512kB (UME) 2*1024kB (UE) 1*2048kB (M) 0*4096kB = 10264kB [ 2898.944789][ T3654] Node 0 DMA32: 177*4kB (ME) 961*8kB (UME) 429*16kB (UM) 204*32kB (UME) 132*64kB (UME) 21*128kB (UME) 7*256kB (UME) 0*512kB 0*1024kB 0*2048kB 0*4096kB = 34716kB [ 2898.961670][ T3654] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 2898.973349][ T3654] Node 1 Normal: 3*4kB (ME) 117*8kB (UME) 17*16kB (UE) 37*32kB (UE) 20*64kB (UME) 6*128kB (UME) 3*256kB (UE) 3*512kB (UME) 1*1024kB (E) 2*2048kB (ME) 644*4096kB (UM) = 2649700kB [ 2898.992596][ T3654] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 2899.002943][ T3654] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 2899.012903][ T3654] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 2899.023188][ T3654] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 2899.033318][ T3654] 30879 total pagecache pages [ 2899.037998][ T3654] 0 pages in swap cache [ 2899.046774][ T3654] Swap cache stats: add 0, delete 0, find 0/0 [ 2899.061754][ T3654] Free swap = 0kB [ 2899.065532][ T3654] Total swap = 0kB [ 2899.069247][ T3654] 1965979 pages RAM [ 2899.075113][ T3654] 0 pages HighMem/MovableOnly 05:44:24 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r2, 0x0) read$fb(r2, &(0x7f0000000100)=""/220, 0xdc) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(r5, 0x4090ae82, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000440)={{}, 0x1, 0x6, 0x0, {}, 0x6, 0x1}) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_NMI(r5, 0xae9a) 05:44:24 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:44:24 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:24 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x0, 0x2000, 0x0}) 05:44:24 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release={0x40046306, 0x2000000}], 0x0, 0x0, 0x0}) 05:44:24 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x7a, 0x0}) [ 2899.079789][ T3654] 349902 pages reserved [ 2899.085317][ T3654] 0 pages cma reserved [ 2899.165830][ T3724] connmark_tg_check: 31 callbacks suppressed [ 2899.165838][ T3724] cannot load conntrack support for proto=3 [ 2899.190688][ T3722] cannot load conntrack support for proto=3 [ 2899.197875][ T3730] binder_alloc_new_buf_locked: 3 callbacks suppressed [ 2899.197885][ T3730] binder_alloc: 12546: binder_alloc_buf, no vma 05:44:24 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2899.206697][ T3727] binder: 3719:3727 unknown command 0 [ 2899.215406][ T3728] binder: 3723:3728 unknown command 0 [ 2899.218847][ T3734] cannot load conntrack support for proto=3 [ 2899.239002][ T3727] binder: 3719:3727 ioctl c0306201 20000200 returned -22 05:44:24 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000440)={{}, 0x1, 0x6, 0x0, {}, 0x6, 0x1}) ioctl$SG_NEXT_CMD_LEN(r1, 0x2283, &(0x7f0000000000)=0x61) r5 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/conn_reuse_mode\x00', 0x2, 0x0) connect$unix(r5, &(0x7f0000000100)=@abs={0x0, 0x0, 0x4e20}, 0x6e) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_NMI(r4, 0xae9a) [ 2899.261291][ T3728] binder: 3723:3728 ioctl c0306201 20000200 returned -22 05:44:24 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:24 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release={0x40046306, 0x3000000}], 0x0, 0x0, 0x0}) [ 2899.291442][ T3740] binder: 3723:3740 ioctl c018620c 200000c0 returned -14 05:44:24 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x0, 0x4800, 0x0}) 05:44:24 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x300, 0x0}) [ 2899.416057][ T3755] cannot load conntrack support for proto=3 [ 2899.435662][ T3759] binder: 3751:3759 unknown command 0 [ 2899.439916][ T3760] binder_alloc: 12546: binder_alloc_buf, no vma [ 2899.458266][ T3761] cannot load conntrack support for proto=3 [ 2899.481618][ T3762] cannot load conntrack support for proto=3 [ 2899.496050][ T3759] binder: 3751:3759 ioctl c0306201 20000200 returned -22 05:44:24 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:44:24 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x0, 0x4c00, 0x0}) 05:44:24 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:24 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release={0x40046306, 0x4000000}], 0x0, 0x0, 0x0}) [ 2899.593934][ T3771] binder: 3770:3771 unknown command 0 [ 2899.606681][ T3771] binder: 3770:3771 ioctl c0306201 20000200 returned -22 [ 2899.629720][ T3771] binder: 3770:3771 ioctl c018620c 200000c0 returned -14 05:44:24 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x500, 0x0}) [ 2899.680712][ T3780] cannot load conntrack support for proto=3 [ 2899.705401][ T3779] binder_alloc: 12546: binder_alloc_buf, no vma [ 2899.710648][ T3783] cannot load conntrack support for proto=3 05:44:24 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2899.747793][ T3781] cannot load conntrack support for proto=3 [ 2899.768526][ T3789] binder: 3785:3789 unknown command 0 05:44:24 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2899.796803][ T3789] binder: 3785:3789 ioctl c0306201 20000200 returned -22 [ 2899.939959][ T3803] cannot load conntrack support for proto=3 05:44:24 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:24 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x0, 0x6000, 0x0}) 05:44:24 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release={0x40046306, 0x5000000}], 0x0, 0x0, 0x0}) 05:44:24 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:44:24 executing program 1: r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x2, 0x0) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000040)=0x1, 0x4) r1 = socket$unix(0x1, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r6, @ANYBLOB="139b0000000000801c0012000c000100626f6e64"], 0x3c}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000001580)=@newqdisc={0x88, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb, 0x1, 'mqprio\x00'}, {0x58, 0x2, {{0x1, [], 0x0, [0x10]}}}}]}, 0x88}}, 0x0) bind(r7, &(0x7f0000000100)=@phonet={0x23, 0x7f, 0x8, 0x6d}, 0x80) ioctl$KVM_SET_REGS(r5, 0x4090ae82, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000440)={{}, 0x1, 0x6, 0x0, {}, 0x6, 0x1}) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_NMI(r5, 0xae9a) [ 2899.985461][ T3807] binder: 3802:3807 unknown command 0 [ 2900.016811][ T3807] binder: 3802:3807 ioctl c0306201 20000200 returned -22 [ 2900.054961][ T3815] binder: 3802:3815 ioctl c018620c 200000c0 returned -14 [ 2900.085583][ T3818] binder: 3817:3818 unknown command 0 [ 2900.091277][ T3822] binder_alloc: 12546: binder_alloc_buf, no vma [ 2900.118319][ T3818] binder: 3817:3818 ioctl c0306201 20000200 returned -22 05:44:25 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x600, 0x0}) 05:44:25 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x0, 0x6800, 0x0}) 05:44:25 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:44:25 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:25 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release={0x40046306, 0x6000000}], 0x0, 0x0, 0x0}) [ 2900.297160][ T3859] binder_alloc: 12546: binder_alloc_buf, no vma [ 2900.313704][ T3857] binder: 3856:3857 unknown command 0 [ 2900.331108][ T3864] binder: 3858:3864 unknown command 0 [ 2900.350335][ T3857] binder: 3856:3857 ioctl c0306201 20000200 returned -22 [ 2900.388884][ T3864] binder: 3858:3864 ioctl c0306201 20000200 returned -22 05:44:25 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x0, 0x6c00, 0x0}) 05:44:25 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:25 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2900.397796][ T3857] binder: 3856:3857 unknown command 0 [ 2900.407920][ T3871] binder: 3858:3871 ioctl c018620c 200000c0 returned -14 [ 2900.445620][ T3857] binder: 3856:3857 ioctl c0306201 20000200 returned -22 05:44:25 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release={0x40046306, 0x7000000}], 0x0, 0x0, 0x0}) 05:44:25 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x700, 0x0}) [ 2900.523560][ T3880] binder_alloc: 12546: binder_alloc_buf, no vma 05:44:25 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2900.645922][ T3893] binder: 3888:3893 unknown command 0 05:44:25 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='vegas\x00', 0x6) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040)='batadv\x00') r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000440)={{}, 0x1, 0x6, 0x0, {}, 0x6, 0x1}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_NMI(r4, 0xae9a) 05:44:25 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x0, 0x7400, 0x0}) 05:44:25 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1d], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2900.689288][ T3899] binder: 3890:3899 unknown command 0 [ 2900.692837][ T3893] binder: 3888:3893 ioctl c0306201 20000200 returned -22 [ 2900.714092][ T3899] binder: 3890:3899 ioctl c0306201 20000200 returned -22 [ 2900.729102][ T3899] binder: 3890:3899 ioctl c018620c 200000c0 returned -14 [ 2900.744713][ T3905] binder_alloc: 12546: binder_alloc_buf, no vma 05:44:25 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:25 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x2000, 0x0}) 05:44:25 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x0, 0x7a00, 0x0}) 05:44:25 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release={0x40046306, 0x3f000000}], 0x0, 0x0, 0x0}) 05:44:25 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2900.959518][ T3936] binder_alloc: 12546: binder_alloc_buf, no vma [ 2900.972487][ T3933] binder: 3926:3933 unknown command 0 [ 2900.977483][ T3938] binder: 3928:3938 unknown command 0 05:44:25 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x0, 0x1000000, 0x0}) 05:44:25 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2901.006987][ T3938] binder: 3928:3938 ioctl c0306201 20000200 returned -22 [ 2901.023592][ T3933] binder: 3926:3933 ioctl c0306201 20000200 returned -22 [ 2901.039157][ T3940] binder: 3926:3940 ioctl c018620c 200000c0 returned -14 05:44:25 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x12], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:26 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release={0x40046306, 0xfdfdffff}], 0x0, 0x0, 0x0}) [ 2901.180250][ T3955] binder_alloc: 12546: binder_alloc_buf, no vma [ 2901.209851][ T3960] binder: 3957:3960 unknown command 0 [ 2901.234597][ T3960] binder: 3957:3960 ioctl c0306201 20000200 returned -22 [ 2901.265248][ T3960] binder: 3957:3960 unknown command 0 [ 2901.272870][ T3960] binder: 3957:3960 ioctl c0306201 20000200 returned -22 05:44:26 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140)='batadv\x00') sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, r3, 0x400, 0x70bd2c, 0x25dfdbff}, 0x14}}, 0x20000000) r4 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(r5, 0x4090ae82, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, &(0x7f0000000000)={0x1, 0x0, [{0xb, 0x9, 0x4, 0x8, 0x1, 0x8, 0x3}]}) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000440)={{}, 0x1, 0x6, 0x0, {}, 0x6, 0x1}) ioctl$KVM_RUN(r5, 0xae80, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r6, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r6, 0x4010640d, &(0x7f0000000040)={0x1}) ioctl$KVM_NMI(r5, 0xae9a) 05:44:26 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release={0x40046306, 0xfffffdfd}], 0x0, 0x0, 0x0}) 05:44:26 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x3f00, 0x0}) 05:44:26 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:44:26 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x0, 0x2000000, 0x0}) 05:44:26 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1d], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2902.031022][ T3986] binder: 3979:3986 unknown command 0 [ 2902.038458][ T3987] binder_alloc: 12546: binder_alloc_buf, no vma [ 2902.045672][ T3986] binder: 3979:3986 ioctl c0306201 20000200 returned -22 [ 2902.067288][ T3990] binder: 3978:3990 unknown command 0 05:44:26 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:44:27 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2902.076912][ T3986] binder: 3979:3986 ioctl c018620c 200000c0 returned -14 [ 2902.097697][ T3990] binder: 3978:3990 ioctl c0306201 20000200 returned -22 05:44:27 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x0, 0x3000000, 0x0}) 05:44:27 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x4000, 0x0}) 05:44:27 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x2, 0x0, 0x0}) 05:44:27 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2902.333786][ T4021] binder: 4016:4021 unknown command 0 [ 2902.339389][ T4021] binder: 4016:4021 ioctl c0306201 20000200 returned -22 [ 2902.362821][ T4023] binder: 4019:4023 unknown command 0 [ 2902.369683][ T4023] binder: 4019:4023 ioctl c0306201 20000200 returned -22 [ 2902.388823][ T4021] binder: 4016:4021 ioctl c018620c 200000c0 returned -14 [ 2902.392910][ T4023] binder: 4019:4023 ioctl c0306201 200000c0 returned -14 [ 2902.430726][ T4023] binder: 4019:4023 unknown command 0 [ 2902.458426][ T4035] binder: 4019:4035 ioctl c0306201 200000c0 returned -14 [ 2902.477132][ T4023] binder: 4019:4023 ioctl c0306201 20000200 returned -22 05:44:27 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x4800, 0x0}) 05:44:27 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x0, 0x4000000, 0x0}) 05:44:27 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:27 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x74], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:44:27 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(r1, 0xc0205648, &(0x7f0000000080)={0x9e0000, 0xddcb, 0x67111d08, r2, 0x0, &(0x7f0000000040)={0x990903, 0x8000, [], @p_u32=&(0x7f0000000000)=0x3}}) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280)='/dev/kvm\x00', 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_SET_REGS(r7, 0x4090ae82, &(0x7f0000000140)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_RUN(r7, 0xae80, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000440)={{}, 0x1, 0x6, 0x0, {}, 0x6, 0x1}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_NMI(r4, 0xae9a) 05:44:27 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x3, 0x0, 0x0}) [ 2902.596333][ T4052] binder: 4044:4052 unknown command 0 [ 2902.622705][ T4055] binder: 4047:4055 unknown command 0 [ 2902.630897][ T4052] binder: 4044:4052 ioctl c0306201 20000200 returned -22 05:44:27 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:27 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:44:27 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x0, 0x5000000, 0x0}) [ 2902.644664][ T4061] binder: 4044:4061 ioctl c0306201 200000c0 returned -14 [ 2902.655470][ T4055] binder: 4047:4055 ioctl c0306201 20000200 returned -22 [ 2902.675001][ T4052] binder: 4044:4052 unknown command 0 [ 2902.694496][ T4062] binder: 4047:4062 ioctl c018620c 200000c0 returned -14 [ 2902.698622][ T4061] binder: 4044:4061 ioctl c0306201 200000c0 returned -14 [ 2902.719809][ T4052] binder: 4044:4052 ioctl c0306201 20000200 returned -22 05:44:27 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x4c00, 0x0}) 05:44:27 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x4, 0x0, 0x0}) 05:44:27 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:27 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x0, 0x6000000, 0x0}) 05:44:27 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x88], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2903.009650][ T4098] binder: 4091:4098 unknown command 0 [ 2903.015422][ T4095] binder: 4089:4095 unknown command 0 [ 2903.037312][ T4095] binder: 4089:4095 ioctl c0306201 20000200 returned -22 05:44:27 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:28 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x0, 0x7000000, 0x0}) [ 2903.053693][ T4098] binder: 4091:4098 ioctl c0306201 20000200 returned -22 [ 2903.064775][ T4106] binder: 4089:4106 ioctl c0306201 200000c0 returned -14 [ 2903.082470][ T4102] binder: 4091:4102 ioctl c018620c 200000c0 returned -14 [ 2903.114107][ T4095] binder: 4089:4095 unknown command 0 [ 2903.119772][ T4106] binder: 4089:4106 ioctl c0306201 200000c0 returned -14 [ 2903.141907][ T4095] binder: 4089:4095 ioctl c0306201 20000200 returned -22 05:44:29 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000440)={{0x1f}, 0x1, 0xfffffff9, 0x2, {}, 0x6, 0x1}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_NMI(r4, 0xae9a) 05:44:29 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:44:29 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x6000, 0x0}) 05:44:29 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x5, 0x0, 0x0}) 05:44:29 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x74], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:29 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x0, 0x12000000, 0x0}) [ 2904.551187][ T4144] binder: 4139:4144 unknown command 0 [ 2904.558453][ T4145] connmark_tg_check: 42 callbacks suppressed [ 2904.558461][ T4145] cannot load conntrack support for proto=3 [ 2904.558480][ T4147] binder: 4142:4147 unknown command 0 [ 2904.567789][ T4149] binder_alloc_new_buf_locked: 5 callbacks suppressed [ 2904.567807][ T4149] binder_alloc: 12546: binder_alloc_buf, no vma 05:44:29 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2904.594755][ T4144] binder: 4139:4144 ioctl c0306201 20000200 returned -22 [ 2904.605960][ T4154] binder: 4139:4154 ioctl c0306201 200000c0 returned -14 [ 2904.609042][ T4157] cannot load conntrack support for proto=3 [ 2904.617697][ T4147] binder: 4142:4147 ioctl c0306201 20000200 returned -22 [ 2904.631198][ T4155] binder: 4142:4155 ioctl c018620c 200000c0 returned -14 [ 2904.651650][ T4154] binder: 4139:4154 ioctl c0306201 200000c0 returned -14 [ 2904.651657][ T4144] binder: 4139:4144 unknown command 0 [ 2904.651673][ T4144] binder: 4139:4144 ioctl c0306201 20000200 returned -22 05:44:29 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:29 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:44:29 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x6800, 0x0}) [ 2904.763763][ T4165] cannot load conntrack support for proto=3 05:44:29 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x0, 0x20000000, 0x0}) 05:44:29 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x6, 0x0, 0x0}) [ 2904.842939][ T4173] cannot load conntrack support for proto=3 [ 2904.857841][ T4177] cannot load conntrack support for proto=3 [ 2904.924609][ T4181] binder_alloc: 12546: binder_alloc_buf, no vma [ 2904.941293][ T4179] cannot load conntrack support for proto=3 [ 2904.948852][ T4183] binder: 4178:4183 unknown command 0 [ 2904.975076][ T4183] binder: 4178:4183 ioctl c0306201 20000200 returned -22 [ 2904.983435][ T4188] binder: 4184:4188 unknown command 0 [ 2904.988832][ T4188] binder: 4184:4188 ioctl c0306201 20000200 returned -22 [ 2905.012688][ T4183] binder: 4178:4183 ioctl c018620c 200000c0 returned -14 [ 2905.020708][ T4190] binder: 4184:4190 ioctl c0306201 200000c0 returned -14 [ 2905.049848][ T4188] binder: 4184:4188 unknown command 0 [ 2905.061952][ T4190] binder: 4184:4190 ioctl c0306201 200000c0 returned -14 [ 2905.084342][ T4188] binder: 4184:4188 ioctl c0306201 20000200 returned -22 05:44:30 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:44:30 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x88], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:30 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x0, 0x48000000, 0x0}) 05:44:30 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x6c00, 0x0}) 05:44:30 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x7, 0x0, 0x0}) 05:44:30 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x406, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r1, 0xc058534f, &(0x7f0000000000)={{}, 0x1, 0x6, 0x0, {}, 0x9, 0x1000001}) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280)='/dev/kvm\x00', 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_SET_REGS(r7, 0x4090ae82, &(0x7f0000000140)={[0x0, 0x0, 0x400000000000, 0x2000, 0x20000, 0x0, 0x3, 0xfffffffffffffffc, 0x4, 0x0, 0x4, 0x0, 0x0, 0x0, 0x493]}) ioctl$KVM_RUN(r7, 0xae80, 0x0) ioctl$KVM_RUN(r1, 0xae80, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000280)='/dev/kvm\x00', 0x200402, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) ioctl$KVM_NMI(r4, 0xae9a) [ 2905.864831][ T4219] binder: 4208:4219 unknown command 0 [ 2905.873293][ T4222] binder_alloc: 12546: binder_alloc_buf, no vma [ 2905.877432][ T4221] binder: 4215:4221 unknown command 0 [ 2905.886651][ T4223] cannot load conntrack support for proto=3 [ 2905.895067][ T4219] binder: 4208:4219 ioctl c0306201 20000200 returned -22 [ 2905.911379][ T4217] cannot load conntrack support for proto=3 [ 2905.911700][ T4221] binder: 4215:4221 ioctl c0306201 20000200 returned -22 [ 2905.924373][ T4227] binder: 4208:4227 ioctl c018620c 200000c0 returned -14 [ 2905.936900][ T4234] binder: 4215:4234 ioctl c0306201 200000c0 returned -14 [ 2905.944837][ T4229] cannot load conntrack support for proto=3 05:44:30 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x0, 0x4c000000, 0x0}) 05:44:30 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x7400, 0x0}) [ 2905.968540][ T4221] binder: 4215:4221 unknown command 0 [ 2905.974622][ T4234] binder: 4215:4234 ioctl c0306201 200000c0 returned -14 [ 2905.985430][ T4221] binder: 4215:4221 ioctl c0306201 20000200 returned -22 [ 2906.006866][ T4217] cannot load conntrack support for proto=3 05:44:30 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:30 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x300, 0x0, 0x0}) 05:44:31 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2906.144127][ T4254] binder_alloc: 12546: binder_alloc_buf, no vma 05:44:31 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x0, 0x60000000, 0x0}) [ 2906.226366][ T4263] binder: 4259:4263 unknown command 0 [ 2906.236006][ T4262] binder: 4256:4262 unknown command 0 [ 2906.253421][ T4263] binder: 4259:4263 ioctl c0306201 20000200 returned -22 [ 2906.265051][ T4262] binder: 4256:4262 ioctl c0306201 20000200 returned -22 05:44:31 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2906.277354][ T4267] binder: 4259:4267 ioctl c0306201 200000c0 returned -14 [ 2906.313090][ T4263] binder: 4259:4263 unknown command 0 [ 2906.321197][ T4262] binder: 4256:4262 ioctl c018620c 200000c0 returned -14 [ 2906.329128][ T4267] binder: 4259:4267 ioctl c0306201 200000c0 returned -14 [ 2906.339951][ T4271] binder_alloc: 12546: binder_alloc_buf, no vma [ 2906.347621][ T4263] binder: 4259:4263 ioctl c0306201 20000200 returned -22 05:44:31 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:44:31 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x7a00, 0x0}) 05:44:31 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x0, 0x68000000, 0x0}) 05:44:31 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x500, 0x0, 0x0}) [ 2906.545696][ T4290] binder_alloc: 12546: binder_alloc_buf, no vma [ 2906.559770][ T4291] binder: 4285:4291 unknown command 0 [ 2906.569699][ T4293] binder: 4286:4293 unknown command 0 [ 2906.583802][ T4293] binder: 4286:4293 ioctl c0306201 20000200 returned -22 [ 2906.593364][ T4291] binder: 4285:4291 ioctl c0306201 20000200 returned -22 [ 2906.603563][ T4293] binder: 4286:4293 ioctl c0306201 200000c0 returned -14 [ 2906.620674][ T4295] binder: 4285:4295 ioctl c018620c 200000c0 returned -14 [ 2906.637449][ T4293] binder: 4286:4293 unknown command 0 [ 2906.649019][ T4296] binder: 4286:4296 ioctl c0306201 200000c0 returned -14 [ 2906.660969][ T4293] binder: 4286:4293 ioctl c0306201 20000200 returned -22 05:44:32 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, 0x0) ioctl$KVM_SET_REGS(r4, 0x4090ae82, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000440)={{}, 0x1, 0x6, 0x0, {}, 0x6, 0x1}) syz_open_dev$vcsn(&(0x7f0000000100)='/dev/vcs#\x00', 0xdc9, 0x161042) ioctl$KVM_RUN(r4, 0xae80, 0x0) stat(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)) ioctl$KVM_NMI(r4, 0xae9a) 05:44:32 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:44:32 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:32 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0xff00, 0x0}) 05:44:32 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x0, 0x6c000000, 0x0}) 05:44:32 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x600, 0x0, 0x0}) [ 2907.561096][ T4327] binder: 4322:4327 unknown command 0 [ 2907.568392][ T4328] binder_alloc: 12546: binder_alloc_buf, no vma [ 2907.577806][ T4333] binder: 4325:4333 unknown command 0 [ 2907.593536][ T4327] binder: 4322:4327 ioctl c0306201 20000200 returned -22 [ 2907.598866][ T4333] binder: 4325:4333 ioctl c0306201 20000200 returned -22 05:44:32 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:44:32 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2907.620747][ T4341] binder: 4322:4341 ioctl c018620c 200000c0 returned -14 [ 2907.642964][ T4346] binder: 4325:4346 ioctl c0306201 200000c0 returned -14 [ 2907.664160][ T4346] binder: 4325:4346 ioctl c0306201 200000c0 returned -14 05:44:32 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x0, 0x74000000, 0x0}) 05:44:32 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x1000000, 0x0}) 05:44:32 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x700, 0x0, 0x0}) [ 2907.780278][ T4364] binder_alloc: 12546: binder_alloc_buf, no vma 05:44:32 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2907.880722][ T4371] binder: 4368:4371 unknown command 0 [ 2907.893186][ T4370] binder: 4367:4370 unknown command 0 [ 2907.895333][ T4371] binder: 4368:4371 ioctl c0306201 20000200 returned -22 [ 2907.904054][ T4370] binder: 4367:4370 ioctl c0306201 20000200 returned -22 [ 2907.922052][ T4371] binder: 4368:4371 ioctl c0306201 200000c0 returned -14 [ 2907.936566][ T4370] binder: 4367:4370 ioctl c018620c 200000c0 returned -14 [ 2907.946713][ T4371] binder: 4368:4371 unknown command 0 [ 2907.953851][ T4376] binder: 4368:4376 ioctl c0306201 200000c0 returned -14 [ 2907.961388][ T4371] binder: 4368:4371 ioctl c0306201 20000200 returned -22 [ 2908.640058][ T4338] warn_alloc: 10 callbacks suppressed [ 2908.640078][ T4338] syz-executor.1: page allocation failure: order:0, mode:0x400cc4(GFP_KERNEL_ACCOUNT|GFP_DMA32), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 2908.661691][ T4338] CPU: 1 PID: 4338 Comm: syz-executor.1 Not tainted 5.8.0-rc5-syzkaller #0 [ 2908.670294][ T4338] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2908.680349][ T4338] Call Trace: [ 2908.683671][ T4338] dump_stack+0x18f/0x20d [ 2908.688006][ T4338] warn_alloc.cold+0x87/0x17a [ 2908.692689][ T4338] ? zone_watermark_ok_safe+0x260/0x260 [ 2908.698245][ T4338] ? wait_for_completion+0x260/0x260 [ 2908.703543][ T4338] __alloc_pages_slowpath.constprop.0+0x2197/0x2780 [ 2908.710146][ T4338] ? warn_alloc+0x120/0x120 [ 2908.714645][ T4338] ? __alloc_pages_nodemask+0x3e5/0x930 [ 2908.720191][ T4338] ? lock_is_held_type+0xb0/0xe0 [ 2908.725123][ T4338] ? find_held_lock+0x2d/0x110 [ 2908.729892][ T4338] __alloc_pages_nodemask+0x68f/0x930 [ 2908.735266][ T4338] ? __zone_watermark_ok+0x370/0x370 [ 2908.740552][ T4338] ? __alloc_pages_slowpath.constprop.0+0x2780/0x2780 [ 2908.747311][ T4338] ? lock_is_held_type+0xb0/0xe0 [ 2908.752249][ T4338] ? rcu_read_lock_sched_held+0x3a/0xb0 [ 2908.757808][ T4338] ? __alloc_pages_nodemask+0x6b1/0x930 [ 2908.763358][ T4338] alloc_pages_current+0x187/0x280 [ 2908.768475][ T4338] alloc_mmu_pages+0x7f/0x170 [ 2908.773149][ T4338] kvm_mmu_create+0x3cb/0x560 [ 2908.778015][ T4338] kvm_arch_vcpu_create+0x16d/0xb70 [ 2908.783241][ T4338] kvm_vm_ioctl+0x1547/0x23c0 [ 2908.787921][ T4338] ? lock_downgrade+0x820/0x820 [ 2908.792774][ T4338] ? kvm_unregister_device_ops+0x60/0x60 [ 2908.798411][ T4338] ? trace_hardirqs_on+0x5f/0x220 [ 2908.803434][ T4338] ? lockdep_hardirqs_on+0x6a/0xe0 [ 2908.808545][ T4338] ? tomoyo_path_number_perm+0x244/0x4d0 [ 2908.814178][ T4338] ? tomoyo_execute_permission+0x470/0x470 [ 2908.819985][ T4338] ? __might_fault+0x11f/0x1d0 [ 2908.824758][ T4338] ? __sanitizer_cov_trace_switch+0x45/0x70 [ 2908.830677][ T4338] ? do_vfs_ioctl+0x27d/0x1090 [ 2908.836115][ T4338] ? generic_block_fiemap+0x60/0x60 [ 2908.841313][ T4338] ? __might_fault+0x190/0x1d0 [ 2908.846078][ T4338] ? _copy_to_user+0x126/0x160 [ 2908.850847][ T4338] ? __fget_files+0x294/0x400 [ 2908.855533][ T4338] ? kvm_unregister_device_ops+0x60/0x60 [ 2908.861190][ T4338] ksys_ioctl+0x11a/0x180 [ 2908.865524][ T4338] __x64_sys_ioctl+0x6f/0xb0 [ 2908.870113][ T4338] ? lockdep_hardirqs_on+0x6a/0xe0 [ 2908.875222][ T4338] do_syscall_64+0x60/0xe0 [ 2908.879643][ T4338] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 2908.885538][ T4338] RIP: 0033:0x45c1d9 [ 2908.889424][ T4338] Code: Bad RIP value. [ 2908.893480][ T4338] RSP: 002b:00007f58ffba0c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2908.901912][ T4338] RAX: ffffffffffffffda RBX: 000000000000edc0 RCX: 000000000045c1d9 [ 2908.909881][ T4338] RDX: 0000000000000000 RSI: 000000000000ae41 RDI: 0000000000000006 [ 2908.917852][ T4338] RBP: 000000000078bf40 R08: 0000000000000000 R09: 0000000000000000 [ 2908.925822][ T4338] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000078bf0c [ 2908.933808][ T4338] R13: 0000000000c9fb6f R14: 00007f58ffba19c0 R15: 000000000078bf0c [ 2908.956511][ T4338] Mem-Info: [ 2908.959675][ T4338] active_anon:320990 inactive_anon:20516 isolated_anon:0 [ 2908.959675][ T4338] active_file:2310 inactive_file:46486 isolated_file:0 [ 2908.959675][ T4338] unevictable:0 dirty:57 writeback:0 [ 2908.959675][ T4338] slab_reclaimable:22921 slab_unreclaimable:211494 [ 2908.959675][ T4338] mapped:63084 shmem:20759 pagetables:126983 bounce:0 [ 2908.959675][ T4338] free:674000 free_pcp:579 free_cma:0 [ 2909.011529][ T4338] Node 0 active_anon:966300kB inactive_anon:47796kB active_file:16kB inactive_file:3048kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:224064kB dirty:20kB writeback:0kB shmem:48756kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 323584kB writeback_tmp:0kB all_unreclaimable? yes [ 2909.040135][ T4338] Node 1 active_anon:317660kB inactive_anon:34268kB active_file:9224kB inactive_file:182896kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:28272kB dirty:208kB writeback:0kB shmem:34280kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB all_unreclaimable? no [ 2909.074233][ T4338] Node 0 DMA free:10264kB min:220kB low:272kB high:324kB reserved_highatomic:0KB active_anon:3964kB inactive_anon:272kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15908kB mlocked:0kB kernel_stack:124kB pagetables:272kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2909.105968][ T4338] lowmem_reserve[]: 0 2515 2515 2515 2515 [ 2909.111709][ T4338] Node 0 DMA32 free:33524kB min:35916kB low:44892kB high:53868kB reserved_highatomic:0KB active_anon:962336kB inactive_anon:47524kB active_file:16kB inactive_file:3048kB unevictable:0kB writepending:20kB present:3129332kB managed:2578200kB mlocked:0kB kernel_stack:85656kB pagetables:245232kB bounce:0kB free_pcp:604kB local_pcp:224kB free_cma:0kB [ 2909.145106][ T4338] lowmem_reserve[]: 0 0 0 0 0 [ 2909.149814][ T4338] Node 0 Normal free:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:786432kB managed:0kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2909.180796][ T4338] lowmem_reserve[]: 0 0 0 0 0 [ 2909.188553][ T4338] Node 1 Normal free:2651588kB min:53972kB low:67464kB high:80956kB reserved_highatomic:0KB active_anon:317660kB inactive_anon:34268kB active_file:9224kB inactive_file:182896kB unevictable:0kB writepending:208kB present:3932160kB managed:3870200kB mlocked:0kB kernel_stack:83628kB pagetables:262428kB bounce:0kB free_pcp:1712kB local_pcp:400kB free_cma:0kB [ 2909.223291][ T4338] lowmem_reserve[]: 0 0 0 0 0 [ 2909.227992][ T4338] Node 0 DMA: 4*4kB (ME) 5*8kB (UM) 6*16kB (UM) 8*32kB (U) 8*64kB (UME) 7*128kB (ME) 7*256kB (UME) 5*512kB (UME) 2*1024kB (UE) 1*2048kB (M) 0*4096kB = 10264kB [ 2909.245809][ T4338] Node 0 DMA32: 177*4kB (ME) 917*8kB (UME) 395*16kB (UM) 193*32kB (UME) 133*64kB (UME) 21*128kB (UME) 7*256kB (UME) 0*512kB 0*1024kB 0*2048kB 0*4096kB = 33532kB [ 2909.262816][ T4338] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 2909.275014][ T4338] Node 1 Normal: 129*4kB (UME) 42*8kB (UME) 88*16kB (UE) 89*32kB (UE) 29*64kB (UE) 14*128kB (UE) 4*256kB (UE) 2*512kB (ME) 1*1024kB (E) 1*2048kB (E) 644*4096kB (UM) = 2651700kB [ 2909.297444][ T4338] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 2909.307702][ T4338] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 2909.318694][ T4338] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 2909.328991][ T4338] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 2909.339112][ T4338] 30899 total pagecache pages [ 2909.344444][ T4338] 0 pages in swap cache [ 2909.348610][ T4338] Swap cache stats: add 0, delete 0, find 0/0 [ 2909.355965][ T4338] Free swap = 0kB [ 2909.359704][ T4338] Total swap = 0kB [ 2909.364592][ T4338] 1965979 pages RAM [ 2909.368420][ T4338] 0 pages HighMem/MovableOnly [ 2909.375143][ T4338] 349902 pages reserved [ 2909.379317][ T4338] 0 pages cma reserved 05:44:34 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x3f00, 0x0, 0x0}) 05:44:34 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:44:34 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x0, 0x7a000000, 0x0}) 05:44:34 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:34 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0}) [ 2909.560319][ T4402] binder_alloc: 12546: binder_alloc_buf, no vma [ 2909.568954][ T4404] connmark_tg_check: 15 callbacks suppressed [ 2909.568961][ T4404] cannot load conntrack support for proto=3 [ 2909.576850][ T4394] cannot load conntrack support for proto=3 [ 2909.588692][ T4398] binder: 4393:4398 unknown command 0 05:44:34 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x0, 0xfdfdffff, 0x0}) [ 2909.608122][ T4407] binder: 4397:4407 unknown command 0 [ 2909.615153][ T4398] binder: 4393:4398 ioctl c0306201 20000200 returned -22 [ 2909.631501][ T4407] binder: 4397:4407 ioctl c0306201 20000200 returned -22 05:44:34 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) 05:44:34 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2909.661608][ T4408] binder: 4393:4408 ioctl c018620c 200000c0 returned -14 [ 2909.672123][ T4411] binder: 4397:4411 ioctl c0306201 200000c0 returned -14 [ 2909.681505][ T4407] binder: 4397:4407 unknown command 0 05:44:34 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x3000000, 0x0}) [ 2909.709604][ T4411] binder: 4397:4411 ioctl c0306201 200000c0 returned -14 [ 2909.719098][ T4407] binder: 4397:4407 ioctl c0306201 20000200 returned -22 [ 2909.744697][ T4414] binder_alloc: 12546: binder_alloc_buf, no vma 05:44:34 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x1000000, 0x0, 0x0}) 05:44:34 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x0, 0xfffffdfd, 0x0}) [ 2909.787682][ T4417] cannot load conntrack support for proto=3 [ 2909.821218][ T4422] cannot load conntrack support for proto=3 [ 2909.823053][ T4418] cannot load conntrack support for proto=3 05:44:34 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1d], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2909.858462][ T4423] binder: 4420:4423 unknown command 0 [ 2909.888047][ T4423] binder: 4420:4423 ioctl c0306201 20000200 returned -22 05:44:34 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2909.906683][ T4431] binder_alloc: 12546: binder_alloc_buf, no vma [ 2909.913583][ T4432] binder: 4427:4432 unknown command 0 [ 2909.913830][ T4430] binder: 4420:4430 ioctl c018620c 200000c0 returned -14 [ 2909.918968][ T4432] binder: 4427:4432 ioctl c0306201 20000200 returned -22 [ 2909.933578][ T4432] binder: 4427:4432 ioctl c0306201 200000c0 returned -14 05:44:34 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x0, 0x100000000000000, 0x0}) [ 2909.966294][ T4432] binder: 4427:4432 unknown command 0 [ 2909.982969][ T4436] binder: 4427:4436 ioctl c0306201 200000c0 returned -14 05:44:34 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2910.006747][ T4435] cannot load conntrack support for proto=3 [ 2910.019711][ T4432] binder: 4427:4432 ioctl c0306201 20000200 returned -22 [ 2910.040106][ T4441] cannot load conntrack support for proto=3 05:44:34 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x4000000, 0x0}) 05:44:35 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x2000000, 0x0, 0x0}) [ 2910.066705][ T4447] binder_alloc: 12546: binder_alloc_buf, no vma [ 2910.082181][ T4448] cannot load conntrack support for proto=3 05:44:35 executing program 1: r0 = socket$unix(0x1, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) prctl$PR_MPX_DISABLE_MANAGEMENT(0x2c) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, 0x0) r5 = socket$xdp(0x2c, 0x3, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000180)={0xffffffffffffffff, 0xc0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)=0x88, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x10) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000002c0)={r6}, 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000040)={0xffffffffffffffff, r1, 0x0, 0x4, &(0x7f0000000000)='::$\x00', r6}, 0x30) ioctl$sock_FIOSETOWN(r5, 0x8901, &(0x7f0000000080)=r7) write$binfmt_elf32(r4, &(0x7f0000000900)=ANY=[@ANYBLOB="7f454c464020e1de050000000000000002000300f900000081030000380000004802000001000080030020000200030000011f000000000051e57464060000000600000002000000050000000500000006000000080000008ceb9e4f56e2c9ae49928db57069276943e5c864c6ac56be35a7c7fb8d74d196b41a2f837ea5e1a0b46e2b732232a87fe6ef16057b4a66b202c0012442ccc3401aae7c3a574c466fad8c3052e7a6aa25c19cc69c231bc5cf1a8cb64f4527793a415f626dc81e3d0a5b814df9aad8bece0730804c384c61d94baa2f41a3961cfb8dd3a99bf3c2e22a3c3a3ea2d6c549d4ffc32e0e94f8ff7c615f40ec5dd3fe128669b552c63115f86f20b1d221418aefc165da39cbec3bedd42d65ff761c00bd4178000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000094dbe66c1d907a30641f3f6697ddd8bebbd"], 0x41a) ioctl$PIO_CMAP(0xffffffffffffffff, 0x4b71, &(0x7f0000000140)={0x7fffffff, 0x9992, 0xd329, 0x4000, 0x1f, 0x2}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000440)={{}, 0x1, 0x6, 0x0, {}, 0x6, 0x1}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_NMI(r4, 0xae9a) 05:44:35 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:35 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x0, 0x200000000000000, 0x0}) [ 2910.178444][ T4456] binder: 4453:4456 unknown command 0 [ 2910.199570][ T4465] binder: 4451:4465 unknown command 0 [ 2910.223913][ T4465] binder: 4451:4465 ioctl c0306201 20000200 returned -22 [ 2910.228371][ T4456] binder: 4453:4456 ioctl c0306201 20000200 returned -22 [ 2910.243776][ T4460] cannot load conntrack support for proto=3 [ 2910.252231][ T4474] binder: 4453:4474 ioctl c0306201 200000c0 returned -14 [ 2910.253658][ T4449] cgroup: fork rejected by pids controller in /system.slice/ssh.service [ 2910.285664][ T4476] binder: 4451:4476 ioctl c018620c 200000c0 returned -14 [ 2910.319920][ T4548] binder_alloc: 12546: binder_alloc_buf, no vma [ 2910.324133][ T4474] binder: 4453:4474 ioctl c0306201 200000c0 returned -14 05:44:35 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2910.336342][ T4456] binder: 4453:4456 unknown command 0 05:44:35 executing program 0: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000140)=ANY=[], 0x8) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x13, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x5000000, 0x0}) 05:44:35 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) 05:44:35 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x0, 0x300000000000000, 0x0}) [ 2910.374490][ T4456] binder: 4453:4456 ioctl c0306201 20000200 returned -22 05:44:35 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x3000000, 0x0, 0x0}) 05:44:35 executing program 4: socket$netlink(0x10, 0x3, 0x12) getpid() socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000a00)=0x1f, 0x4) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) ioctl$TUNSETSNDBUF(0xffffffffffffffff, 0x400454d4, &(0x7f0000000080)=0x5) getpgid(0x0) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60], @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000040)='nv\x00', 0x3) [ 2910.474837][ T4568] cannot load conntrack support for proto=3 [ 2910.500374][ T4577] binder_alloc: 12546: binder_alloc_buf, no vma [ 2910.507316][ T4580] binder: 4569:4580 unknown command 0 [ 2910.516945][ T4580] binder: 4569:4580 ioctl c0306201 20000200 returned -22 05:44:35 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000840)={'filter\x00', 0x1002, 0x4, 0x3d0, 0x0, 0x0, 0xe8, 0x2e8, 0x2e8, 0x2e8, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth1_vlan\x00', 'tunl0\x00'}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1d8}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'netdevsim0\x00', 'ip6tnl0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11], 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev, @empty, @local, @loopback}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x420) connect$inet(0xffffffffffffffff, 0x0, 0x0) [ 2910.540095][ T4580] binder: 4569:4580 ioctl c0306201 200000c0 returned -14 [ 2910.549420][ T4580] binder: 4569:4580 unknown command 0 [ 2910.555642][ T4596] binder: 4569:4596 ioctl c0306201 200000c0 returned -14 [ 2910.562925][ T4580] binder: 4569:4580 ioctl c0306201 20000200 returned -22 05:44:35 executing program 2: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x10, 0x0, &(0x7f0000000140)=[@clear_death={0x40406300}], 0x0, 0x400000000000000, 0x0}) 05:44:35 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f00000004c0)=[@transaction={0x40046305, {0x0, 0x400c630e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000140)=[@release], 0x4000000, 0x0, 0x0}) [ 2910.594592][ T4597] binder: 4575:4597 unknown command 0 [ 2910.613543][ T4597] binder: 4575:4597 ioctl c0306201 20000200 returned -22 [ 2910.646342][ T4597] binder: 4575:4597 ioctl c018620c 200000c0 returned -14 [ 2940.477560][ T4606] binder: 4601:4606 unknown command 0 [ 2954.192030][ T4606] binder: 4601:4606 ioctl c0306201 20000200 returned -22 [ 3015.682135][ C0] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 3015.695065][ C0] rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): [ 3015.695070][ C0] ------------[ cut here ]------------ [ 3015.707831][ C0] IRQs not enabled as expected [ 3015.712620][ C0] WARNING: CPU: 0 PID: 7649 at kernel/sched/core.c:2698 try_invoke_on_locked_down_task+0x2bf/0x370 [ 3015.723259][ C0] Kernel panic - not syncing: panic_on_warn set ... [ 3015.729824][ C0] CPU: 0 PID: 7649 Comm: syz-executor.4 Not tainted 5.8.0-rc5-syzkaller #0 [ 3015.738379][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3015.748405][ C0] Call Trace: [ 3015.751662][ C0] [ 3015.754500][ C0] dump_stack+0x18f/0x20d [ 3015.758818][ C0] panic+0x2e3/0x75c [ 3015.762684][ C0] ? __warn_printk+0xf3/0xf3 [ 3015.767257][ C0] ? console_unlock+0x7f0/0xf30 [ 3015.772079][ C0] ? __warn.cold+0x5/0x45 [ 3015.776378][ C0] ? __warn+0xd6/0x1f2 [ 3015.780429][ C0] ? try_invoke_on_locked_down_task+0x2bf/0x370 [ 3015.786639][ C0] __warn.cold+0x20/0x45 [ 3015.790862][ C0] ? wake_up_klogd.part.0+0x8c/0xc0 [ 3015.796035][ C0] ? try_invoke_on_locked_down_task+0x2bf/0x370 [ 3015.802248][ C0] report_bug+0x1bd/0x210 [ 3015.806555][ C0] handle_bug+0x38/0x90 [ 3015.810695][ C0] exc_invalid_op+0x13/0x40 [ 3015.815256][ C0] asm_exc_invalid_op+0x12/0x20 [ 3015.820079][ C0] RIP: 0010:try_invoke_on_locked_down_task+0x2bf/0x370 [ 3015.826985][ C0] Code: ff d4 41 89 c6 e9 18 ff ff ff 80 3d a9 39 59 09 00 0f 85 6f fe ff ff 48 c7 c7 80 41 4b 88 c6 05 95 39 59 09 01 e8 b3 47 f4 ff <0f> 0b e9 55 fe ff ff 4c 89 04 24 4c 89 ee 48 89 ef 41 ff d4 4c 8b [ 3015.846577][ C0] RSP: 0018:ffffc90000007bd8 EFLAGS: 00010086 [ 3015.852616][ C0] RAX: 0000000000000000 RBX: 1ffff92000000f7d RCX: 0000000000000000 [ 3015.860567][ C0] RDX: ffff88808e112400 RSI: ffffffff815d4f87 RDI: fffff52000000f6d [ 3015.868510][ C0] RBP: ffff88804c0ae0c0 R08: 0000000000000001 R09: ffff8880ae620fcb [ 3015.876453][ C0] R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff8160c5c0 [ 3015.884396][ C0] R13: ffffc90000007d00 R14: ffff88808e112400 R15: ffff8880ae636c00 [ 3015.892362][ C0] ? force_qs_rnp+0x470/0x470 [ 3015.897012][ C0] ? vprintk_func+0x97/0x1a6 [ 3015.901588][ C0] ? try_invoke_on_locked_down_task+0x2bf/0x370 [ 3015.907804][ C0] ? cpus_share_cache+0x100/0x100 [ 3015.912813][ C0] ? lock_is_held_type+0xb0/0xe0 [ 3015.917719][ C0] ? lockdep_hardirqs_off+0x66/0xa0 [ 3015.922893][ C0] rcu_sched_clock_irq.cold+0x92e/0xccc [ 3015.928424][ C0] ? lock_downgrade+0x820/0x820 [ 3015.933257][ C0] ? rcutree_dead_cpu+0x10/0x10 [ 3015.938083][ C0] ? lockdep_hardirqs_off+0x66/0xa0 [ 3015.943252][ C0] ? trace_hardirqs_off+0x27/0x210 [ 3015.948339][ C0] update_process_times+0x25/0x60 [ 3015.953341][ C0] tick_sched_handle+0x9b/0x180 [ 3015.958173][ C0] tick_sched_timer+0x108/0x290 [ 3015.962996][ C0] __hrtimer_run_queues+0x1d5/0xfc0 [ 3015.968177][ C0] ? can_stop_idle_tick+0x290/0x290 [ 3015.973350][ C0] ? hrtimer_sleeper_start_expires+0x80/0x80 [ 3015.979299][ C0] ? ktime_get_update_offsets_now+0x1c4/0x250 [ 3015.985340][ C0] hrtimer_interrupt+0x32a/0x930 [ 3015.990259][ C0] __sysvec_apic_timer_interrupt+0x142/0x5e0 [ 3015.996220][ C0] asm_call_on_stack+0xf/0x20 [ 3016.000863][ C0] [ 3016.003776][ C0] sysvec_apic_timer_interrupt+0xe0/0x120 [ 3016.009471][ C0] asm_sysvec_apic_timer_interrupt+0x12/0x20 [ 3016.015422][ C0] RIP: 0010:check_memory_region+0x34/0x180 [ 3016.021211][ C0] Code: 89 f9 41 54 44 0f b6 c2 49 01 f1 55 53 0f 82 18 01 00 00 48 b8 ff ff ff ff ff 7f ff ff 48 39 c7 0f 86 05 01 00 00 49 83 e9 01 <48> 89 fd 48 b8 00 00 00 00 00 fc ff df 4d 89 ca 48 c1 ed 03 49 c1 [ 3016.040808][ C0] RSP: 0018:ffffc90000cbf638 EFLAGS: 00000282 [ 3016.047368][ C0] RAX: ffff7fffffffffff RBX: ffffea00012dc334 RCX: ffffffff8197a08c [ 3016.055310][ C0] RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffffea00012dc334 [ 3016.063264][ C0] RBP: 0000000000000191 R08: 0000000000000001 R09: ffffea00012dc337 [ 3016.071309][ C0] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000097 [ 3016.079252][ C0] R13: ffffea00012dc300 R14: ffff88801ad5bca0 R15: dffffc0000000000 [ 3016.087212][ C0] ? release_pages+0x1cc/0x17a0 [ 3016.092038][ C0] release_pages+0x1cc/0x17a0 [ 3016.096686][ C0] ? free_swap_cache+0x10c/0x300 [ 3016.101595][ C0] ? put_devmap_managed_page+0x160/0x160 [ 3016.107203][ C0] tlb_flush_mmu+0xe9/0x6b0 [ 3016.111680][ C0] unmap_page_range+0x1bd4/0x2940 [ 3016.116686][ C0] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 3016.122648][ C0] ? vm_normal_page_pmd+0x5b0/0x5b0 [ 3016.127825][ C0] ? asm_sysvec_apic_timer_interrupt+0x12/0x20 [ 3016.133958][ C0] ? uprobe_munmap+0x1c/0x560 [ 3016.138607][ C0] unmap_single_vma+0x198/0x300 [ 3016.143433][ C0] unmap_vmas+0x16f/0x2f0 [ 3016.147742][ C0] ? zap_vma_ptes+0x100/0x100 [ 3016.152393][ C0] ? sched_clock+0x2a/0x40 [ 3016.156804][ C0] exit_mmap+0x2b1/0x510 [ 3016.161044][ C0] ? asm_sysvec_apic_timer_interrupt+0x12/0x20 [ 3016.167176][ C0] ? __ia32_sys_remap_file_pages+0x150/0x150 [ 3016.173135][ C0] ? __khugepaged_exit+0x2b8/0x3f0 [ 3016.178257][ C0] ? kmem_cache_free+0x261/0x310 [ 3016.183173][ C0] ? __khugepaged_exit+0x2d9/0x3f0 [ 3016.188256][ C0] __mmput+0x122/0x470 [ 3016.192308][ C0] mmput+0x53/0x60 [ 3016.196013][ C0] do_exit+0xa8f/0x2a40 [ 3016.200155][ C0] ? asm_sysvec_apic_timer_interrupt+0x12/0x20 [ 3016.206291][ C0] ? mm_update_next_owner+0x7a0/0x7a0 [ 3016.211644][ C0] ? trace_hardirqs_on+0x5f/0x220 [ 3016.216650][ C0] ? lockdep_hardirqs_on+0x6a/0xe0 [ 3016.221759][ C0] ? asm_sysvec_apic_timer_interrupt+0x12/0x20 [ 3016.227889][ C0] do_group_exit+0x125/0x310 [ 3016.232455][ C0] get_signal+0x40b/0x1ee0 [ 3016.236843][ C0] ? futex_exit_release+0x220/0x220 [ 3016.242125][ C0] ? trace_hardirqs_off+0x27/0x210 [ 3016.247208][ C0] do_signal+0x82/0x2520 [ 3016.251421][ C0] ? sched_clock+0x2a/0x40 [ 3016.255819][ C0] ? sched_clock_cpu+0x18/0x1b0 [ 3016.260652][ C0] ? sched_clock_cpu+0x18/0x1b0 [ 3016.265912][ C0] ? copy_siginfo_to_user32+0xa0/0xa0 [ 3016.271251][ C0] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 3016.277202][ C0] ? trace_hardirqs_on+0x5f/0x220 [ 3016.282218][ C0] ? lockdep_hardirqs_on+0x6a/0xe0 [ 3016.287313][ C0] __prepare_exit_to_usermode+0x156/0x1f0 [ 3016.293023][ C0] do_syscall_64+0x6c/0xe0 [ 3016.297461][ C0] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 3016.303359][ C0] RIP: 0033:0x45c1d9 [ 3016.307249][ C0] Code: Bad RIP value. [ 3016.311284][ C0] RSP: 002b:00007f94a57bfcf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 3016.319674][ C0] RAX: fffffffffffffe00 RBX: 000000000078bf08 RCX: 000000000045c1d9 [ 3016.327650][ C0] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000078bf08 [ 3016.335605][ C0] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 3016.343569][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000078bf0c [ 3016.351521][ C0] R13: 0000000000c9fb6f R14: 00007f94a57c09c0 R15: 000000000078bf0c [ 3017.432550][ C0] Shutting down cpus with NMI [ 3017.438630][ C0] Kernel Offset: disabled [ 3017.443231][ C0] Rebooting in 86400 seconds..