0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x4000000000000000, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:30 executing program 3: openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) [ 2850.757166][T17246] binder: 17245:17246 ioctl c0306201 20000100 returned -14 [ 2850.846145][T17250] binder: BINDER_SET_CONTEXT_MGR already set [ 2850.856548][T17250] binder: 17249:17250 ioctl 40046207 0 returned -16 [ 2850.872836][ C0] net_ratelimit: 4 callbacks suppressed [ 2850.872845][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2850.884254][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2851.073624][T17000] netlink: 'syz-executor.5': attribute type 12 has an invalid length. [ 2851.122901][T17193] netlink: 'syz-executor.5': attribute type 12 has an invalid length. [ 2851.180874][T17358] netlink: 'syz-executor.0': attribute type 12 has an invalid length. 08:54:30 executing program 2: r0 = syz_open_dev$sndmidi(&(0x7f0000000000)='/dev/snd/midiC#D#\x00', 0x200, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x2, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, 0x0) r2 = dup2(r0, r1) getsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r2, 0x84, 0x12, &(0x7f0000000040), &(0x7f0000000080)=0x4) 08:54:30 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:30 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x8000000000000000, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:30 executing program 3: syz_open_dev$audion(0x0, 0x0, 0x400) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:30 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) syz_open_procfs(0x0, &(0x7f0000272000)) 08:54:30 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x37ea, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) [ 2851.352777][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2851.356264][T17368] netlink: 'syz-executor.5': attribute type 12 has an invalid length. [ 2851.358634][ C0] protocol 88fb is buggy, dev hsr_slave_1 08:54:30 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:30 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IP_VS_SO_SET_EDITDEST(r0, 0x0, 0x489, &(0x7f0000000040)={{0x21, @loopback, 0x4e20, 0x3, 'lc\x00', 0x1, 0x1, 0x35}, {@local, 0x4e21, 0x10000, 0x3, 0x6, 0x9}}, 0x44) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100)='/dev/zero\x00', 0x10000, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x12, r1, 0x0) 08:54:31 executing program 3: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:31 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0xfdfdffff00000000, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) [ 2851.603643][T17484] IPVS: set_ctl: invalid protocol: 33 127.0.0.1:20000 08:54:31 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) [ 2851.714226][T17484] IPVS: set_ctl: invalid protocol: 33 127.0.0.1:20000 [ 2851.789340][T17489] binder: 17487:17489 ioctl c0306201 20000100 returned -14 [ 2851.831327][T17492] binder: BINDER_SET_CONTEXT_MGR already set [ 2851.842770][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2851.848710][ C1] protocol 88fb is buggy, dev hsr_slave_1 08:54:31 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = syz_open_dev$midi(&(0x7f0000000240)='/dev/midi#\x00', 0x51fb, 0x4000) getpeername$tipc(r1, &(0x7f0000000280)=@id, &(0x7f00000002c0)=0x10) r2 = syz_open_dev$media(&(0x7f0000000000)='/dev/media#\x00', 0x7, 0x400000) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={r2, &(0x7f0000000040)="39c9fc74de14de7d9687837684042e21d471d0b4aa2d5f464025aa00d015a64c577e8c8cc59b5a09458ed4cad5362c92320c913abdb9a4053acbeb1590e12614f5aa777802b9eedb4c8c83b8fec9252f53d493952e444a906b34f334e395a3f45201c4f1eb7e3a6b2f", &(0x7f00000000c0)="3f49c376e0988d483d5c7928c503ec1118d5486bfc1493d120f715f20829442eb2cd02c959a57042693f750a330ce193f10e4b0b3fac2f52ae07c73127a07aebbc353851417dbed11b9ce30d97f8b8a8f416fef8051d0205772918c7f3c1ea87bb0153b9c41f201ce648b7", 0x4}, 0x20) ioctl(r0, 0x1000008912, &(0x7f0000001180)="11dca5055e0bcfec7be070") fspick(0xffffffffffffffff, 0x0, 0x800000000000009) lsetxattr$security_evm(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)='security.evm\x00', &(0x7f0000000200)=@md5={0x1, "64731fed649027b453e5bf7d05a54c6f"}, 0x11, 0x1) [ 2851.874796][T17492] binder: 17490:17492 ioctl 40046207 0 returned -16 [ 2851.958751][T17547] binder: BINDER_SET_CONTEXT_MGR already set 08:54:31 executing program 3: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:31 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0xffffffff00000000, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) [ 2852.021779][T17547] binder: 17546:17547 ioctl 40046207 0 returned -16 08:54:31 executing program 2: r0 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x800) ioctl$RTC_ALM_READ(r0, 0x80247008, &(0x7f0000000040)) r1 = socket$inet6(0x10, 0x2, 0x0) sendmsg(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f00000000c0)="5500000018007fafb62d1cb2a4a280930206000200a843096c2623692500080021000000000000000000a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1}, 0x0) 08:54:31 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) [ 2852.168431][T17605] binder: 17603:17605 ioctl c0306201 20000100 returned -14 [ 2852.224028][T17607] binder: BINDER_SET_CONTEXT_MGR already set [ 2852.230253][T17607] binder: 17604:17607 ioctl 40046207 0 returned -16 [ 2852.327591][T17383] netlink: 'syz-executor.0': attribute type 12 has an invalid length. [ 2852.347557][T17661] binder: BINDER_SET_CONTEXT_MGR already set [ 2852.369545][T17709] netlink: 17 bytes leftover after parsing attributes in process `syz-executor.2'. [ 2852.383789][T17661] binder: 17613:17661 ioctl 40046207 0 returned -16 [ 2852.505972][T17709] netlink: 17 bytes leftover after parsing attributes in process `syz-executor.2'. [ 2852.571047][T17609] netlink: 'syz-executor.5': attribute type 12 has an invalid length. 08:54:32 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) syz_open_procfs(0x0, &(0x7f0000272000)) 08:54:32 executing program 3: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:32 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x2, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:32 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:32 executing program 2: r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000500)='/dev/dlm-control\x00', 0x1, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000540)={&(0x7f0000ffc000/0x3000)=nil, 0x3000}, &(0x7f0000000580)=0x10) r1 = socket$inet6(0xa, 0x8000000000005, 0x0) shutdown(r1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x1000000000021, &(0x7f0000000000)=0x1, 0x4) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback}, 0x1c) r2 = openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000340)='memory.max\x00', 0x2, 0x0) vmsplice(r2, &(0x7f00000004c0)=[{&(0x7f0000000380)="4ddc9b81cf330e5edbdcb54e831805fa5c575de44d79d2c09f808ff82428f0ea7a69d0ddc9cfa5efe40d07996f3d1e3c9163ada516e4f2e189d2ad837efe72cb45116c19c4dd1fb95777722d1e092285419f176cff8482c61a3ee2ddc1c70cb09df70d7465", 0x65}, {&(0x7f0000000400)="b36f7dc515b43e15d05fc64c4c0955fb5bad0ca5e85c3c472b", 0x19}, {&(0x7f0000000440)="9b2ad72064f48fff696921e88092803c220bf0301acd36bca9a01e31663c89c5eb62857cf93d4017483838c9a4368227fc5d5e3f75a56b73", 0x38}, {&(0x7f0000000480)="f692154777b46135f516144db294a5df32928c9e8f051ab3a25199d42832144c", 0x20}], 0x4, 0xe) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000240)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r3, &(0x7f00000002c0)={0x1, 0x10, 0xfa00, {&(0x7f0000000200), r5}}, 0x18) ioctl$sock_SIOCINQ(r4, 0x541b, &(0x7f0000000300)) setxattr$trusted_overlay_redirect(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='trusted.overlay.redirect\x00', &(0x7f00000000c0)='./file0\x00', 0x8, 0x2) flistxattr(r4, &(0x7f00000005c0)=""/52, 0x34) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000001980)={{{@in6=@mcast1, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in=@remote}}, &(0x7f0000001a80)=0xe8) ioctl$sock_inet6_SIOCDIFADDR(r0, 0x8936, &(0x7f0000001ac0)={@initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x0, r6}) r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vga_arbiter\x00', 0x100, 0x0) epoll_ctl$EPOLL_CTL_ADD(r7, 0x1, r1, &(0x7f0000000140)={0x9}) 08:54:32 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x3f00, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) [ 2852.894376][T17737] binder: BINDER_SET_CONTEXT_MGR already set [ 2852.921749][T17737] binder: 17731:17737 ioctl 40046207 0 returned -16 [ 2852.952876][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2852.958781][ C0] protocol 88fb is buggy, dev hsr_slave_1 08:54:32 executing program 3: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:32 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:32 executing program 2: r0 = socket$inet(0x10, 0x3, 0xc) r1 = syz_open_dev$amidi(&(0x7f00000000c0)='/dev/amidi#\x00', 0x7, 0x8380) setns(r1, 0x0) write$P9_RREMOVE(r1, &(0x7f0000000100)={0x7, 0x7b, 0x2}, 0x7) r2 = socket$inet6(0xa, 0x800000010b, 0x6) setsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f0000000080)=0x1ff, 0x4) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000009ff0), 0x1, 0x0, 0xffffffffffffff3b}, 0x0) [ 2853.164315][T17850] binder: BINDER_SET_CONTEXT_MGR already set 08:54:32 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x3, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) [ 2853.210159][T17850] binder: 17833:17850 ioctl 40046207 0 returned -16 [ 2853.219566][T17852] binder: BINDER_SET_CONTEXT_MGR already set [ 2853.270722][T17852] binder: 17851:17852 ioctl 40046207 0 returned -16 08:54:32 executing program 3: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:32 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) [ 2853.432818][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2853.438723][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2853.568686][T17871] binder: BINDER_SET_CONTEXT_MGR already set [ 2853.595419][T17871] binder: 17867:17871 ioctl 40046207 0 returned -16 [ 2853.625761][T17936] binder: BINDER_SET_CONTEXT_MGR already set [ 2853.656873][T17936] binder: 17908:17936 ioctl 40046207 0 returned -16 08:54:33 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) syz_open_procfs(0x0, &(0x7f0000272000)) 08:54:33 executing program 2: r0 = syz_open_dev$video(&(0x7f0000000080)='/dev/video#\x00', 0x2000400000000009, 0x0) read(r0, &(0x7f0000000000)=""/110, 0x6e) 08:54:33 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x4, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:33 executing program 3: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:33 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:33 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x4000, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) [ 2854.116429][T17991] binder: BINDER_SET_CONTEXT_MGR already set [ 2854.152288][T17991] binder: 17980:17991 ioctl 40046207 0 returned -16 [ 2854.162360][T17988] binder: BINDER_SET_CONTEXT_MGR already set [ 2854.171450][T17988] binder: 17981:17988 ioctl 40046207 0 returned -16 08:54:33 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:33 executing program 3: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:33 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000b40)={0x26, 'aead\x00', 0x0, 0x0, 'morus1280-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000740)={&(0x7f00000005c0)=@deltclass={0xa0, 0x29, 0x526, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, {0x5, 0xffff}, {0xffff, 0xfffd}, {0xf, 0x4}}, [@tclass_kind_options=@c_hfsc={{0xc, 0x1, 'hfsc\x00'}, {0x34, 0x2, [@TCA_HFSC_FSC={0x10}, @TCA_HFSC_FSC={0x10, 0x2, {0x0, 0x1}}, @TCA_HFSC_RSC={0x10, 0x1, {0x80000000, 0x3, 0x10001}}]}}, @tclass_kind_options=@c_qfq={{0x8, 0x1, 'qfq\x00'}, {0x14, 0x2, [@TCA_QFQ_LMAX={0x8}, @TCA_QFQ_WEIGHT={0x8, 0x1, 0x3}]}}, @tclass_kind_options=@c_hfsc={{0xc, 0x1, 'hfsc\x00'}, {0x14, 0x2, [@TCA_HFSC_RSC={0x10, 0x1, {0x50}}]}}]}, 0xa0}, 0x1, 0x0, 0x0, 0x24040000}, 0x20000000) clock_gettime(0x0, &(0x7f0000000900)) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000040)='/dev/btrfs-control\x00', 0x24000, 0x0) r2 = accept$alg(r0, 0x0, 0x0) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f00000002c0)='TIPCv2\x00') sendmsg$TIPC_NL_PEER_REMOVE(r1, &(0x7f0000000440)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x804}, 0xc, &(0x7f0000000400)={&(0x7f0000000300)={0xd4, r3, 0xc00, 0x70bd2d, 0x25dfdbfb, {}, [@TIPC_NLA_LINK={0xac, 0x4, [@TIPC_NLA_LINK_PROP={0xc, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffffffffe00}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1f}]}, @TIPC_NLA_LINK_PROP={0x24, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffffffffffd}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}]}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x24, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}]}, @TIPC_NLA_MON={0x14, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x56f2}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x6}]}]}, 0xd4}, 0x1, 0x0, 0x0, 0x48000}, 0x10) sendmsg$alg(r2, &(0x7f0000001380)={0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=[@op={0x18, 0x117, 0x3, 0x1}, @assoc={0x18, 0x117, 0x4, 0x2f5}], 0x30}, 0x0) r4 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000140)='SEG6\x00') sendmsg$SEG6_CMD_DUMPHMAC(r1, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x1020000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000480)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="000126bd7000fddbdf25020000000800060004000000080005000500000014000100ff02000000000000000000000000000169905ffd00077f7c27ac0518a24ecfa2ce0d38608cb9b2d251de"], 0x38}, 0x1, 0x0, 0x0, 0x4004040}, 0x4) write$binfmt_script(r2, &(0x7f0000000600)=ANY=[], 0xfec8) syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x5, 0x0) recvmmsg(r2, &(0x7f0000007e00)=[{{&(0x7f0000001240)=@alg, 0x80, &(0x7f0000004700)=[{&(0x7f00000012c0)=""/167, 0xf}, {&(0x7f00000023c0)=""/49, 0x200023f1}, {&(0x7f0000003580)=""/4096, 0x1000}], 0x3, &(0x7f0000004780)=""/245, 0xf5}}], 0x30, 0x0, &(0x7f0000008000)={0x0, 0x989680}) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000240)='/proc/thread-self/attr/current\x00', 0x2, 0x0) 08:54:33 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x5, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) [ 2854.479253][T18103] binder: BINDER_SET_CONTEXT_MGR already set 08:54:33 executing program 3: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) [ 2854.533577][T18103] binder: 18102:18103 ioctl 40046207 0 returned -16 08:54:34 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) [ 2854.736209][T18205] binder: BINDER_SET_CONTEXT_MGR already set [ 2854.775732][T18205] binder: 18181:18205 ioctl 40046207 0 returned -16 [ 2854.844591][T18227] binder: BINDER_SET_CONTEXT_MGR already set [ 2854.884680][T18227] binder: 18226:18227 ioctl 40046207 0 returned -16 [ 2854.989557][T17994] validate_nla: 6 callbacks suppressed [ 2854.989566][T17994] netlink: 'syz-executor.5': attribute type 12 has an invalid length. [ 2855.156051][T18229] netlink: 'syz-executor.5': attribute type 12 has an invalid length. [ 2855.227562][T18233] netlink: 'syz-executor.0': attribute type 12 has an invalid length. 08:54:34 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) syz_open_procfs(0x0, &(0x7f0000272000)) 08:54:34 executing program 3: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:34 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x6, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:34 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:34 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x6000, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) 08:54:34 executing program 2: openat$kvm(0xffffffffffffff9c, 0x0, 0x258001, 0x0) ioctl$KVM_GET_CPUID2(0xffffffffffffffff, 0xc008ae91, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0xfffffffffffffce4, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer\x00', 0x40000, 0x0) ioctl$KVM_SET_DEVICE_ATTR(r1, 0x4018aee1, &(0x7f00000001c0)={0x0, 0x80, 0x10001, &(0x7f0000000180)=0x6}) r2 = dup2(r0, r0) sendmsg$IPVS_CMD_GET_CONFIG(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000540)=ANY=[@ANYBLOB="38c183773816eaab1fd81d3423f154985709e4205abf7dd45c0ea184f602d7052a56bd960e4e45bb7f660d8c38567c87593dae0e5a62120215260aa9762166c677f6217defd347fd163254d1b2151e3c10a029f5d75fefabb6b02a2a6e2700000000000000000000000000902d2e335bc51fd4e40000000000000000282773e3e04760"], 0x1}}, 0x2404c840) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0xfffffdef, 0xc0, 0x0, 0x142800) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, 0x0) syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f00000002c0)='\xde\x92\xc1I\xc8d\xabb\x98\xff\x15q\xfb=\x98\x97g\xbe\x18JC\xff\x7f\x00\x00\xff\x01\xff\xff\x00\x17\f\x00\x00\xbd\x98\x8a\x95M1\x03\x9b\n\xb8\xff\xdc\x90\xaf*\xad\xa4CEmI\xd5\xba\x9c\xe1qb\xd9\xb43\xe5\xe2\xda\x9a\n\xee\xbf\x06:\xe2\xaf\x1dwd!=\xf1\xc6\x01\xebFK\xe6\x10K\x80\xd1\f\x8fyH\xb7\x00@\x00\x00\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x110) 08:54:34 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) [ 2855.454929][T18243] netlink: 'syz-executor.5': attribute type 12 has an invalid length. 08:54:34 executing program 3: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:35 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x7, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) [ 2855.665470][T18352] binder: BINDER_SET_CONTEXT_MGR already set 08:54:35 executing program 3: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) [ 2855.744576][T18352] binder: 18280:18352 ioctl 40046207 0 returned -16 08:54:35 executing program 2: r0 = creat(&(0x7f0000000580)='./file0\x00', 0x1) sendmsg$kcm(r0, &(0x7f0000000540)={&(0x7f00000000c0)=@isdn={0x22, 0x2, 0x40, 0x81, 0x40}, 0x80, &(0x7f00000003c0)=[{&(0x7f0000000140)='QZN\aJ', 0x5}, {&(0x7f0000000180)="14cc3f7c150e4202458573e749b680d8d1a7b5e0f7892bda71a9690a565754b28f8fcc1229565b3155283534e57b680dcca0e77c8697deb8c8bcf12d0ec5ab808be4aa0521a2e381c458a0249041ee0f74aed40bfd6d7a9feef52c7bbe351c74fda082ed36995dd6cf90b08945616b71e68846dd31fd09291377ae3eae3b1b471b357ba32d9d8e127906bca57a61a29506bfa66054eb5b8faa311c92b16f6fd34b05a311a4c8d53cb4cf318c5ede4396dbba17302e60a292428051d76b39362f0bb61a82e818c31a85ddffb8e6b0a2f6e37daa7d930198a0d6a66f4228222f8484810b4c8cd5cd91d4840d3bdc", 0xed}, {&(0x7f0000000280)="3eb868ebd4b41740ec7b86d14daf3eb39955f2365027feaaaec67b9042961af22234a1850500ac766d0616cefd95d93623f8016923b17c723f87bc2673ead8faef90e64398dd211b872ea1bee58984fb7b3a32f125bf2f050957315307fe9e0767c1219516e9535e3839ae0955b2e7e4cd0c3969592f7015e2e3a1d9c02b7ff12e9981f450104e91bcf6079363e06c5a30ed790ddf1d44541023c22e0fbacb9590d28ce1d825fad6f3a447906d3bb3844523360b8292e7e29f2ce82fd926cf039bb0b005aaa3", 0xc6}, {&(0x7f0000000380)="f168c9f41cf78d08d10543afde8a8491230a07cc197c61ba13c282c40a0111253edddc4996da659b92994e79054ed2955ab844088a9d85", 0x37}], 0x4, &(0x7f0000000400)=[{0x30, 0x100, 0x26d7, "c7d00e6b10b034a99a0c6fd06ae811c982ded37a9a6cacd52aea85"}, {0x30, 0x1ff, 0x7, "6f8dc37b2e4b0b04793189ad216ffcfe9c3f96022a8f6db014d69d3798"}, {0x48, 0x116, 0x1, "d725c5815f585f7cea68ecb3d3a63e36a459ec98e3ac21f8c0d68bb98c83ed30f3840ae1bf4ceef83015de0e81fbacab4bac"}, {0x68, 0x11f, 0x6, "d1f3bb3a57793ad8ad83bba6be2e93c8d7d15b4a2732192f3478fd32d6d8cba8a665f59acca31e9ee79f087aadd7e87aad2b5f8dde164eaf3641b8089efb3f62b843e861979735b7f01f521d7a17e2e457"}, {0x10, 0x6, 0x5}], 0x120}, 0x8800) mincore(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0xffffffffffffffff) 08:54:35 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) [ 2855.983228][T18377] binder: BINDER_SET_CONTEXT_MGR already set [ 2855.992768][ C1] net_ratelimit: 6 callbacks suppressed [ 2855.992779][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2856.004527][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2856.021561][T18377] binder: 18374:18377 ioctl 40046207 0 returned -16 [ 2856.333443][T18249] netlink: 'syz-executor.0': attribute type 12 has an invalid length. 08:54:35 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) syz_open_procfs(0x0, &(0x7f0000272000)) 08:54:35 executing program 2: r0 = socket$inet6(0xa, 0x22000000002, 0x0) r1 = syz_open_dev$usb(&(0x7f0000000080)='/dev/bus/usb/00#/00#\x00', 0xae0, 0x40000) bind$pptp(r1, &(0x7f00000000c0)={0x18, 0x2, {0x3, @local}}, 0x1e) sendmmsg$inet(r0, &(0x7f0000001b80)=[{{&(0x7f0000000000)={0x2, 0x4e23, @remote}, 0x10, 0x0}}, {{&(0x7f0000000380)={0x2, 0x4e23, @remote}, 0x10, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="d016bbc7787b8c967ee52141a210000000bb84a46ab3effad708000000"], 0x10}}], 0x2, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:54:35 executing program 3: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:35 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x8, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) [ 2856.389866][T18370] netlink: 'syz-executor.5': attribute type 12 has an invalid length. 08:54:36 executing program 2: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x7, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:36 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:36 executing program 3: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:36 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0xea37, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) 08:54:36 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x300, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) [ 2856.705355][T18498] netlink: 'syz-executor.0': attribute type 12 has an invalid length. 08:54:36 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:36 executing program 3: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) [ 2856.896408][T18607] binder: BINDER_SET_CONTEXT_MGR already set [ 2856.926671][T18607] binder: 18606:18607 ioctl 40046207 0 returned -16 08:54:36 executing program 2: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x7, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) [ 2857.112814][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2857.118667][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2857.131664][T18725] binder: BINDER_SET_CONTEXT_MGR already set [ 2857.183872][T18725] binder: 18724:18725 ioctl 40046207 0 returned -16 [ 2857.478858][T18616] netlink: 'syz-executor.5': attribute type 12 has an invalid length. [ 2857.594827][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2857.601906][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2857.693423][T18736] netlink: 'syz-executor.0': attribute type 12 has an invalid length. 08:54:37 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) syz_open_procfs(0x0, &(0x7f0000272000)) 08:54:37 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x500, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:37 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:37 executing program 3: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:37 executing program 2: socketpair(0xa, 0x2, 0x4, &(0x7f00000000c0)={0xffffffffffffffff}) sendmsg$key(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="02020609100000007e6c5c2c7f52c24f0200130002000020000000000000000105000600200000000a000000000000ff0f0000000000000000001f00000000000009200000000000020001000000000000000002000098ba05000500000000000a00000000ff7f00ff170000000000000000000000000017000000ff00000000"], 0x80}}, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='maps\x00') ioctl$KVM_SIGNAL_MSI(r2, 0x4020aea5, &(0x7f0000000080)={0x1000, 0x6001, 0x4, 0xfff, 0x3}) sendmmsg(r1, &(0x7f0000000180), 0x393, 0x0) [ 2857.743457][T18723] netlink: 'syz-executor.5': attribute type 12 has an invalid length. 08:54:37 executing program 3: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:37 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) [ 2858.048111][T18810] binder: BINDER_SET_CONTEXT_MGR already set [ 2858.072770][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2858.078835][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2858.079504][T18810] binder: 18790:18810 ioctl 40046207 0 returned -16 08:54:37 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0xf000, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) 08:54:37 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="275a61635e0bcfec7be070") r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000300)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000240), 0x106, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_BIND_IP(r1, &(0x7f0000000180)={0x2, 0x28, 0xfa00, {0x0, {0x2, 0x0, 0x0, @rand_addr="047cbb3edb0e31264e093aae15c9fc30"}, r2}}, 0x30) r3 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm_plock\x00', 0x442000, 0x0) ioctl$DRM_IOCTL_RES_CTX(r3, 0xc0106426, &(0x7f00000002c0)={0x2000000000000174, &(0x7f0000000200)=[{0x0}, {}, {}, {}]}) ioctl$DRM_IOCTL_LOCK(r3, 0x4008642a, &(0x7f0000000280)={r4, 0x21}) ioctl$sock_bt_hidp_HIDPCONNDEL(r3, 0x400448c9, &(0x7f0000000080)={{0x81, 0x4, 0x1965f64f, 0x26f5c000000000, 0x3, 0x6}, 0x100000000}) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r0, 0x40106614, &(0x7f00000001c0)={0x0, @speck128}) 08:54:37 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x600, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:37 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:37 executing program 3: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:38 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) syz_open_procfs(0x0, &(0x7f0000272000)) 08:54:38 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:38 executing program 3: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:38 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x700, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:38 executing program 2: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x600, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:38 executing program 3: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:38 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) [ 2859.192856][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2859.198725][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2859.223110][T19001] binder: BINDER_SET_CONTEXT_MGR already set 08:54:38 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0xf0ffff, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) [ 2859.313139][T19001] binder: 18999:19001 ioctl 40046207 0 returned -16 08:54:38 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x3f00, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) [ 2859.490962][T19112] binder: BINDER_SET_CONTEXT_MGR already set 08:54:38 executing program 2: r0 = socket$inet(0x2b, 0x0, 0x10000000080000) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000340)={0x0, 0x0, 0x0}, &(0x7f0000000380)=0xc) keyctl$chown(0x4, 0x0, r1, r2) [ 2859.594918][T19112] binder: 19111:19112 ioctl 40046207 0 returned -16 08:54:39 executing program 3: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:39 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) [ 2859.923016][T19236] binder: BINDER_SET_CONTEXT_MGR already set [ 2859.943775][T19236] binder: 19235:19236 ioctl 40046207 0 returned -16 [ 2860.170887][T19117] validate_nla: 5 callbacks suppressed [ 2860.170916][T19117] netlink: 'syz-executor.5': attribute type 12 has an invalid length. [ 2860.291896][T19243] netlink: 'syz-executor.0': attribute type 12 has an invalid length. 08:54:39 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) syz_open_procfs(0x0, &(0x7f0000272000)) 08:54:39 executing program 2: mmap(&(0x7f0000600000/0x4000)=nil, 0x4000, 0x0, 0x44032, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$video4linux(&(0x7f0000000000)='/dev/v4l-subdev#\x00', 0x2, 0x400080) flistxattr(r0, &(0x7f0000000280)=""/208, 0xd0) r1 = socket$kcm(0x29, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) recvfrom(r1, &(0x7f00000000c0)=""/253, 0xfd, 0x60, &(0x7f0000000200)=@hci={0x1f, r2, 0x2}, 0x80) r3 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000380)='/dev/mixer\x00', 0x22000, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffff9c, 0x8933, &(0x7f00000003c0)={'vcan0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000400)={'vcan0\x00', r4}) ioctl$VIDIOC_SUBDEV_S_EDID(r0, 0xc0285629, &(0x7f0000000080)={0x0, 0x20, 0x8, [], &(0x7f0000000040)=0x9620}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) 08:54:39 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:54:39 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x4000, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:39 executing program 3: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) [ 2860.342610][T19244] netlink: 'syz-executor.5': attribute type 12 has an invalid length. [ 2860.487589][T19251] binder: BINDER_SET_CONTEXT_MGR already set [ 2860.517741][T19251] binder: 19250:19251 ioctl 40046207 0 returned -16 [ 2860.525651][T19249] binder: BINDER_SET_CONTEXT_MGR already set 08:54:40 executing program 2: memfd_create(0x0, 0x6) openat$ptmx(0xffffffffffffff9c, 0x0, 0x60101, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$VIDIOC_ENUM_FRAMESIZES(0xffffffffffffffff, 0xc02c564a, 0x0) r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/snapshot\x00', 0x0, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$FUSE_CREATE_OPEN(r0, &(0x7f00000005c0)={0xa0, 0x0, 0x5, {{0x5, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x807c, 0x6, 0x0, 0x2, 0x0, 0x0, 0xcb1}}}}, 0xa0) getsockopt$IP_VS_SO_GET_SERVICE(0xffffffffffffffff, 0x0, 0x483, 0x0, &(0x7f0000000500)) close(r0) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) sync() r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$TCSETSW(0xffffffffffffffff, 0x5403, &(0x7f0000000080)={0x0, 0x0, 0x1f}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$sock_proto_private(r0, 0x89ed, &(0x7f0000000080)="bdfadb85c1d1118378cd55afa76cb05f84040c85376e08821dd2531f8cbec7e15db519c4fc528192e4431e4de18786b0627c6aa25707f01c51980af0f81b618badc2fcae0ae24a93f697d7fdeab5f2b600cffa4fc10a69b24d474efd76067b7b5b2ebc5dec2fc313b8c403b3f3c11d1e0a1d4591887820b46ffa5bd915b2171ba54e1d4ee98018077729fca0abc63a30610c6a") getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000000000)={0x80000001, 0x1000, 0x4, 0xde0, 0x9, 0x7, 0xfffffffffffffffd, 0x7, 0x0}, &(0x7f0000000040)=0x20) setsockopt$inet_sctp6_SCTP_RESET_ASSOC(r0, 0x84, 0x78, &(0x7f0000000140)=r4, 0x4) [ 2860.549019][T19249] binder: 19248:19249 ioctl 40046207 0 returned -16 08:54:40 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2860.646420][T19268] netlink: 'syz-executor.0': attribute type 12 has an invalid length. 08:54:40 executing program 3: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:40 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x1000000, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:40 executing program 1 (fault-call:4 fault-nth:0): ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:54:40 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x1000000, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) 08:54:40 executing program 3: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) [ 2861.272859][ C0] net_ratelimit: 4 callbacks suppressed [ 2861.272869][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2861.284355][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2861.316212][T19397] FAULT_INJECTION: forcing a failure. [ 2861.316212][T19397] name failslab, interval 1, probability 0, space 0, times 0 [ 2861.411184][T19397] CPU: 0 PID: 19397 Comm: syz-executor.1 Not tainted 5.2.0-rc5+ #57 [ 2861.419231][T19397] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2861.429313][T19397] Call Trace: [ 2861.432654][T19397] dump_stack+0x172/0x1f0 [ 2861.437046][T19397] should_fail.cold+0xa/0x15 [ 2861.441684][T19397] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 2861.447547][T19397] __should_failslab+0x121/0x190 [ 2861.452520][T19397] should_failslab+0x9/0x14 [ 2861.457050][T19397] __kmalloc+0x2d9/0x740 [ 2861.461330][T19397] ? tomoyo_realpath_from_path+0xcd/0x7a0 [ 2861.467087][T19397] tomoyo_realpath_from_path+0xcd/0x7a0 [ 2861.474500][T19397] ? tomoyo_path_number_perm+0x193/0x520 [ 2861.480182][T19397] tomoyo_path_number_perm+0x1dd/0x520 [ 2861.485670][T19397] ? tomoyo_path_number_perm+0x193/0x520 [ 2861.491370][T19397] ? tomoyo_execute_permission+0x4a0/0x4a0 [ 2861.497220][T19397] ? __lockdep_free_key_range+0x120/0x120 [ 2861.502978][T19397] ? retint_kernel+0x2b/0x2b [ 2861.507604][T19397] ? trace_hardirqs_on_caller+0x6a/0x220 [ 2861.513283][T19397] ? __fget+0x35a/0x550 [ 2861.517520][T19397] ? __fget+0x381/0x550 [ 2861.521703][T19397] ? ksys_dup3+0x3e0/0x3e0 [ 2861.526152][T19397] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2861.532424][T19397] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2861.538701][T19397] tomoyo_file_ioctl+0x23/0x30 [ 2861.538720][T19397] security_file_ioctl+0x77/0xc0 [ 2861.538740][T19397] ksys_ioctl+0x57/0xd0 [ 2861.538759][T19397] __x64_sys_ioctl+0x73/0xb0 [ 2861.538782][T19397] do_syscall_64+0xfd/0x680 [ 2861.538804][T19397] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2861.538830][T19397] RIP: 0033:0x4592c9 [ 2861.552687][T19397] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2861.552698][T19397] RSP: 002b:00007fcea7c12c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2861.552713][T19397] RAX: ffffffffffffffda RBX: 00007fcea7c12c90 RCX: 00000000004592c9 [ 2861.552721][T19397] RDX: 0000000000000000 RSI: 0000000040046207 RDI: 0000000000000005 [ 2861.552730][T19397] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 2861.552740][T19397] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcea7c136d4 [ 2861.552749][T19397] R13: 00000000004c073b R14: 00000000004d31e8 R15: 0000000000000006 [ 2861.642864][T19397] ERROR: Out of memory at tomoyo_realpath_from_path. [ 2861.752788][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2861.758695][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2861.781156][T19383] netlink: 'syz-executor.5': attribute type 12 has an invalid length. [ 2861.866651][T19268] netlink: 'syz-executor.0': attribute type 12 has an invalid length. 08:54:41 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) syz_open_procfs(0x0, &(0x7f0000272000)) 08:54:41 executing program 3: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:41 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x2000000, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:41 executing program 2: openat$cgroup_subtree(0xffffffffffffff9c, 0x0, 0x2, 0x0) fcntl$setown(0xffffffffffffffff, 0x8, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)}, 0x0) r0 = syz_open_dev$mouse(&(0x7f00000000c0)='/dev/input/mouse#\x00', 0x10001, 0x200) setsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(r0, 0x84, 0xc, &(0x7f0000000100)=0xffffffffffffffe0, 0x4) openat$btrfs_control(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'bcsh0\x00', 0x21}) r1 = syz_open_procfs(0x0, &(0x7f0000000240)='ns\x00') ioctl$sock_inet_SIOCGIFBRDADDR(r1, 0x8919, &(0x7f0000000000)={'team_slave_1\x00', {0x2, 0x4e21, @local}}) getdents(r1, &(0x7f0000000040)=""/46, 0x2e) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair(0x1, 0x5, 0x0, &(0x7f0000000740)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$getown(r2, 0x9) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x89f1, &(0x7f0000000080)='ip6tnl0\x00') 08:54:41 executing program 1 (fault-call:4 fault-nth:1): ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2861.919311][T19498] netlink: 'syz-executor.5': attribute type 12 has an invalid length. 08:54:41 executing program 3: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) [ 2862.154431][T19509] FAULT_INJECTION: forcing a failure. [ 2862.154431][T19509] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 2862.167688][T19509] CPU: 1 PID: 19509 Comm: syz-executor.1 Not tainted 5.2.0-rc5+ #57 [ 2862.175674][T19509] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2862.185749][T19509] Call Trace: [ 2862.189071][T19509] dump_stack+0x172/0x1f0 [ 2862.193430][T19509] should_fail.cold+0xa/0x15 [ 2862.198139][T19509] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 2862.203991][T19509] should_fail_alloc_page+0x50/0x60 [ 2862.209218][T19509] __alloc_pages_nodemask+0x1a1/0x8d0 [ 2862.214625][T19509] ? __lock_acquire+0x54f/0x5490 [ 2862.219608][T19509] ? __alloc_pages_slowpath+0x28f0/0x28f0 [ 2862.225371][T19509] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 2862.231222][T19509] cache_grow_begin+0x9d/0x650 [ 2862.236051][T19509] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 2862.242337][T19509] __kmalloc+0x67c/0x740 [ 2862.246630][T19509] ? tomoyo_realpath_from_path+0xcd/0x7a0 [ 2862.252385][T19509] tomoyo_realpath_from_path+0xcd/0x7a0 [ 2862.257966][T19509] ? tomoyo_path_number_perm+0x193/0x520 [ 2862.263646][T19509] tomoyo_path_number_perm+0x1dd/0x520 [ 2862.269133][T19509] ? tomoyo_path_number_perm+0x193/0x520 [ 2862.277343][T19509] ? tomoyo_execute_permission+0x4a0/0x4a0 [ 2862.283191][T19509] ? __lockdep_free_key_range+0x120/0x120 [ 2862.283207][T19509] ? lockdep_hardirqs_on+0x418/0x5d0 [ 2862.283222][T19509] ? retint_kernel+0x2b/0x2b [ 2862.283243][T19509] ? __fget+0x35a/0x550 [ 2862.283275][T19509] ? trace_hardirqs_on_caller+0x6a/0x220 [ 2862.283296][T19509] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 2862.283318][T19509] ? retint_kernel+0x2b/0x2b [ 2862.283340][T19509] tomoyo_file_ioctl+0x23/0x30 [ 2862.283357][T19509] security_file_ioctl+0x77/0xc0 [ 2862.283374][T19509] ksys_ioctl+0x57/0xd0 [ 2862.283395][T19509] __x64_sys_ioctl+0x73/0xb0 [ 2862.294450][T19509] do_syscall_64+0xfd/0x680 [ 2862.342504][T19509] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2862.348419][T19509] RIP: 0033:0x4592c9 [ 2862.352345][T19509] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2862.371969][T19509] RSP: 002b:00007fcea7c12c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2862.380411][T19509] RAX: ffffffffffffffda RBX: 00007fcea7c12c90 RCX: 00000000004592c9 [ 2862.388421][T19509] RDX: 0000000000000000 RSI: 0000000040046207 RDI: 0000000000000005 [ 2862.396420][T19509] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 08:54:41 executing program 3: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:41 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x3000000, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) [ 2862.404411][T19509] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcea7c136d4 [ 2862.412435][T19509] R13: 00000000004c073b R14: 00000000004d31e8 R15: 0000000000000006 [ 2862.425001][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2862.431654][ C1] protocol 88fb is buggy, dev hsr_slave_1 08:54:41 executing program 1 (fault-call:4 fault-nth:2): ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:54:42 executing program 3: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) [ 2862.557007][T19510] netlink: 'syz-executor.0': attribute type 12 has an invalid length. 08:54:42 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x2000000, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) 08:54:42 executing program 2: r0 = syz_open_dev$media(&(0x7f00000001c0)='/dev/media#\x00', 0x0, 0x0) ioctl$VIDIOC_G_AUDIO(r0, 0x80345621, &(0x7f0000000140)) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000000c0)=@nat={'nat\x00', 0x19, 0x2, 0x494, [0x20000200, 0x0, 0x0, 0x20000230, 0x20000526], 0x0, &(0x7f0000000080), &(0x7f0000000200)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0x0, 0x1, [{0x9, 0x44, 0x6017, 'veth0_to_bond\x00', 'ip6gretap0\x00', 'gretap0\x00', 'team_slave_1\x00', @random="f5b6452a261a", [0xff, 0xff, 0xff, 0x0, 0xff], @empty, [0xff, 0xff, 0x0, 0x0, 0x0, 0xff], 0x116, 0x27e, 0x2c6, [@cluster={'cluster\x00', 0x10, {{0x7, 0x6, 0x1, 0x1}}}, @rateest={'rateest\x00', 0x48, {{'team_slave_1\x00', 'sit0\x00', 0x0, 0x0, 0xfffffffffffffff8, 0xb279, 0x2, 0x3ff, 0x6, 0xffffffffffffffdb}}}], [@common=@SECMARK={'SECMARK\x00', 0x108, {{0x1, 0x7, 'system_u:object_r:shell_exec_t:s0\x00'}}}, @arpreply={'arpreply\x00', 0x10, {{@empty, 0xffffffffffffffff}}}], @common=@ERROR={'ERROR\x00', 0x20, {"01c0627d586b583726be9445d70e1687258ab11c128b4de375601dd2ec04"}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{0x9, 0x38, 0x888e, 'veth1_to_bond\x00', 'teql0\x00', 'ip6gretap0\x00', 'nr0\x00', @broadcast, [0xff, 0xff, 0xff, 0xff, 0x0, 0xff], @local, [0xff, 0x0, 0xff, 0x0, 0x0, 0xff], 0x106, 0x106, 0x13e, [@physdev={'physdev\x00', 0x70, {{'veth1_to_team\x00', {0xff}, 'lo\x00', {0xff}, 0x5, 0x1c}}}], [], @snat={'snat\x00', 0x10}}]}]}, 0x50c) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x400001, 0x0) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'bcsh0\x00', 0x200}) read(r0, 0x0, 0xffffff17) [ 2862.920297][T19730] FAULT_INJECTION: forcing a failure. [ 2862.920297][T19730] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 2862.933606][T19730] CPU: 1 PID: 19730 Comm: syz-executor.1 Not tainted 5.2.0-rc5+ #57 [ 2862.941658][T19730] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2862.951911][T19730] Call Trace: [ 2862.955241][T19730] dump_stack+0x172/0x1f0 [ 2862.959607][T19730] should_fail.cold+0xa/0x15 [ 2862.964237][T19730] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 2862.969727][T19730] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 2862.975573][T19730] ? perf_trace_lock+0xeb/0x4c0 [ 2862.975595][T19730] should_fail_alloc_page+0x50/0x60 [ 2862.975612][T19730] __alloc_pages_nodemask+0x1a1/0x8d0 [ 2862.975634][T19730] ? ____cache_alloc_node+0x162/0x1e0 [ 2862.975651][T19730] ? __alloc_pages_slowpath+0x28f0/0x28f0 [ 2862.975664][T19730] ? ____cache_alloc_node+0x162/0x1e0 [ 2862.975685][T19730] ? lock_downgrade+0x880/0x880 [ 2862.975703][T19730] cache_grow_begin+0x9d/0x650 [ 2862.975720][T19730] ? do_raw_spin_unlock+0x57/0x270 [ 2862.975738][T19730] ____cache_alloc_node+0x17c/0x1e0 [ 2862.975756][T19730] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 2862.975775][T19730] __kmalloc+0x219/0x740 [ 2862.975807][T19730] ? tomoyo_realpath_from_path+0xcd/0x7a0 [ 2862.996614][T19730] tomoyo_realpath_from_path+0xcd/0x7a0 [ 2863.049584][T19730] ? tomoyo_path_number_perm+0x193/0x520 [ 2863.055264][T19730] tomoyo_path_number_perm+0x1dd/0x520 [ 2863.060770][T19730] ? tomoyo_path_number_perm+0x193/0x520 [ 2863.066436][T19730] ? tomoyo_execute_permission+0x4a0/0x4a0 [ 2863.072275][T19730] ? __lockdep_free_key_range+0x120/0x120 [ 2863.078026][T19730] ? lockdep_hardirqs_on+0x418/0x5d0 [ 2863.083342][T19730] ? retint_kernel+0x2b/0x2b [ 2863.087967][T19730] ? __fget+0x35a/0x550 [ 2863.092174][T19730] ? __fget+0x381/0x550 [ 2863.096365][T19730] ? ksys_dup3+0x3e0/0x3e0 [ 2863.100818][T19730] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 2863.106316][T19730] tomoyo_file_ioctl+0x23/0x30 [ 2863.111112][T19730] security_file_ioctl+0x77/0xc0 [ 2863.116122][T19730] ksys_ioctl+0x57/0xd0 [ 2863.120315][T19730] __x64_sys_ioctl+0x73/0xb0 [ 2863.124942][T19730] do_syscall_64+0xfd/0x680 [ 2863.124966][T19730] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2863.124980][T19730] RIP: 0033:0x4592c9 [ 2863.124998][T19730] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2863.125005][T19730] RSP: 002b:00007fcea7c12c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2863.125019][T19730] RAX: ffffffffffffffda RBX: 00007fcea7c12c90 RCX: 00000000004592c9 [ 2863.125027][T19730] RDX: 0000000000000000 RSI: 0000000040046207 RDI: 0000000000000005 [ 2863.125036][T19730] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 2863.125044][T19730] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcea7c136d4 [ 2863.125052][T19730] R13: 00000000004c073b R14: 00000000004d31e8 R15: 0000000000000006 [ 2863.231827][T19735] netlink: 'syz-executor.5': attribute type 12 has an invalid length. [ 2863.353840][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2863.359881][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2863.450019][T19736] netlink: 'syz-executor.0': attribute type 12 has an invalid length. 08:54:42 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) syz_open_procfs(0x0, &(0x7f0000272000)) 08:54:42 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x4000000, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:42 executing program 1 (fault-call:4 fault-nth:3): ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:54:42 executing program 3: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:42 executing program 2: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x3000000, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) [ 2863.659796][T19752] binder: BINDER_SET_CONTEXT_MGR already set [ 2863.707604][T19752] binder: 19749:19752 ioctl 40046207 0 returned -16 [ 2863.712884][T19751] binder: BINDER_SET_CONTEXT_MGR already set [ 2863.720588][T19751] binder: 19747:19751 ioctl 40046207 0 returned -16 [ 2863.764492][T19756] binder: BINDER_SET_CONTEXT_MGR already set [ 2863.780961][T19756] binder: 19748:19756 ioctl 40046207 0 returned -16 08:54:43 executing program 2: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bind$inet(r0, &(0x7f0000000180)={0x2, 0x4e23, @multicast1}, 0x10) r1 = open(&(0x7f0000000000)='./file0\x00', 0x309800, 0x41) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000080)={0x6, 0x1, 0x7, 0x100000000, 0x1000}, 0x14) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000240)='lp\x00', 0x3) ioctl$DRM_IOCTL_MODE_SETCRTC(0xffffffffffffffff, 0xc06864a2, &(0x7f00000001c0)={&(0x7f0000000040)=[0x0, 0x0, 0x0], 0x3, 0x0, 0x0, 0xffffffff, 0x7, 0x0, {0x0, 0xdd, 0x61, 0x0, 0xfff, 0x0, 0x10000, 0x2, 0x0, 0x0, 0x1, 0x4, 0x2c9c, 0x7fff, "07c92e40a5249e960693bf49da4ee73570f9f3fbec0dc131e5ff79fd1b41bf96"}}) write$binfmt_elf64(r0, &(0x7f0000000100)=ANY=[@ANYRES32, @ANYRES16=0x0], 0xff5a) openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0xc001, 0x0) 08:54:43 executing program 3: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) [ 2863.832786][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2863.838660][ C0] protocol 88fb is buggy, dev hsr_slave_1 08:54:43 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:54:43 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x5000000, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:43 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x4000000, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) 08:54:43 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet_sctp6_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x14) bind$inet6(r0, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) listen(r0, 0x4) r1 = socket$inet_sctp(0x2, 0x801, 0x84) sendmsg(r1, &(0x7f0000000180)={&(0x7f0000000000)=@in={0x2, 0x4e23, @local}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000200)='#', 0x1}], 0x1}, 0x0) 08:54:43 executing program 3: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) [ 2864.215771][T19875] binder: BINDER_SET_CONTEXT_MGR already set [ 2864.269800][T19875] binder: 19873:19875 ioctl 40046207 0 returned -16 08:54:44 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) syz_open_procfs(0x0, &(0x7f0000272000)) 08:54:44 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x2, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:54:44 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x6000000, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:44 executing program 3: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:54:44 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/netlink\x00') ioctl$sock_SIOCGSKNS(r0, 0x894c, &(0x7f0000000040)=0x4) ioctl$sock_SIOCGSKNS(r0, 0x894c, &(0x7f0000000080)=0x401) fcntl$F_GET_RW_HINT(r0, 0x40b, &(0x7f00000000c0)) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r0, 0x110, 0x3) timer_create(0x7, &(0x7f0000000100)={0x0, 0x25}, &(0x7f0000000140)=0x0) timer_gettime(r1, &(0x7f0000000180)) ioctl$int_in(r0, 0x5421, &(0x7f00000001c0)=0x26) r2 = semget$private(0x0, 0x0, 0x1) semctl$SEM_STAT(r2, 0x3, 0x12, &(0x7f0000000200)=""/98) r3 = dup(r0) recvfrom(r3, &(0x7f0000000280)=""/33, 0x21, 0x2, 0x0, 0x0) recvfrom(r3, &(0x7f00000002c0)=""/213, 0xd5, 0x2000, &(0x7f00000003c0)=@alg={0x26, 'hash\x00', 0x0, 0x0, 'ghash-clmulni\x00'}, 0x80) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000440)={0x2, 0x4, 0x0, 0x7, 0x3f}, 0x14) getsockopt$inet_sctp_SCTP_RECVRCVINFO(r3, 0x84, 0x20, &(0x7f0000000480), &(0x7f00000004c0)=0x4) ioctl$VHOST_GET_FEATURES(r3, 0x8008af00, &(0x7f0000000500)) socket$rxrpc(0x21, 0x2, 0xa) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r0, 0xc0bc5351, &(0x7f0000000540)={0x1f, 0x2, 'client1\x00', 0xffffffff80000000, "3de68d0ba0bd6d4a", "5f204b749179b54229b110e8d556302c42553f8403a2b9a84a70a6a75edde3a4", 0x5, 0x3}) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000600)=0x0) ptrace$setregs(0xf, r4, 0x400, &(0x7f0000000640)="9cb83fa43ef9d1893eced6e978831281febcda782933879a45b18a92bd74ab9596f3e8b1d97ba80f98ceb2cf86984c99e900f055c967dd44cba8837be30ca76e6a6460ed5bfbbf7e785c06b0d8184f079e7005fcdc2b127869fc0e16f500ffdf7adf0c86c5ed347717b4b2fbe00da5c0b09b2b0b7b259a7fbd4d9e9ed1ec97b2bd7021a75153861662538745c154ec1917cb59cd15068c3e90e6925ea1f7f5942aaf48e4e73ab19ff8adfbfc3f9c72c61f20a7d7e33a4b7da5a2b479e5620ec9a57b33c49e3eecebf13b5163c42fffa6d66959700bb2bcf77a6ba64e769bae2cf603558a3ba38b411153fdb20796e9ba20a5a23399d49178091efe098f80e2448c4e561721b1362f4fd7ab8d63e93b3339075bf58edbec4f17416cf0dd46b389391ab69c1b84d96ab8441734791cf163af2c21c7744389c862ed1f064364377debdd80ccf257adf6f15bd7ec56f230ac4f9df8033f681ccc2acbb90da057154b7e9941cd2b3e4b056eb5e275ab037269160fa6fde0f110a20c144e4611f9afce2a80b6d5b07b876dda02e14e7c900b0605e2c74c60e0514d9c84581251097b86f4e365cbc1dd3f6d141e44bdfc10f6e9bf4f4e4b0ec05790e239fd9af67b81ac7ad37074f4e64282fd36b9d8fb0e5e2a2444176ac64df21f2d0c944106d88b3a841128947c66a695decc99d2b752055942e4527a1e9449dfec226473dec7888247e72b0aabc18c12be47048b152f3d508e0818e37641fcabc0c88cedb714fa230990388838e41a7152b9fb153a4ded5be717fd5b4eeacebde5f3cd7456caf86ea0abac6dcdc42ca7d63fc0ad337de430d11acbd180edee356c199e0d9d43bdcd658e4137fc10f15b9a01b43291b3d8140759116a01b3d991b7f948a0ea5799095dfec17f798900a970bfe4d4de5d9399ce1ad57f3d8dc053165e7dc55a23ff766a66d02248205fcaaaa334312ba01019f7f9df41f7d455a869233439bdfcf071c9ccd6133943386e459534dda79c3b3147a5deeb998e6600d09cd48ac592c01c9a45ec68be4d645572b4515695f2f2a306dedf3e9a09a5367c712a3acaace62f088ac839b4cf34428de71ea310518da8a3efbf0e45f63e31b472c1e9ee23f8e3cbc2cdb722632deee6122b501db7bad08d6300433af4dc95dcf90871b0e879e35e3da139fed92ce010e3a5d40a3f84191342de46415e3c36c6d4484f2d16c1717f2732ec82b61c3d0c17a701f6d976f7d4c084d012e95f099c07f19179443c122fbef52ceeda1d91d5cf2ec2bddbba48357ec635c30251639790c5283816db7f774fe7c7d6ea84b1afee4ad4b78bcf4e1363690f8b65ec8a9664b0d48841ec8fb238c70b8042d9c45e4c98e03d306606806fc9b6054ae5448393dc46d7576a66b1fe7b8e6621fc4003b2ea501bd099c5ff61924c48109a00dacbc7a35f1179e7866baaa01bda76b954c02e264bc196a67f56d5d7fa0b5f167b8a82141e91fd087c1363b3f588793b676d4abcf84c4d1d27e22d930415825afa7b543129a8f13fe2b5f77daae08aba6175ccc0c4b641bbc8b0b7c0cd48b918027556849c93c2cb003e4d8907cd71fa7dca605d7f6b665079980ba82e7f61dd0698045e16f0fc80870c49bcb52d5ab2c3971c2cde679f24292d194416bc980385a243848cb5495af3e2ec93faf0aa28a3573ef9a51d47ac9a422067b5c520f0cb4dfbe818755934dd559a66207dc0878b4a9641886156f3e8c4a2c8be59d391bea6ec8237d739c40541ef433f06f356036867baa36bf13981877db91b2675129e817745741a47032ccf84db6ca7db44a30efcf244702b70e066aca1747183e0dc89faec223b325f72556a0f1b327aa5acb0682ab15ac345ad5afefc425b8849d73bf80f4fb869e763134bebe1696bf50f4cd1ea241b4cf81dc1f392864f16062b8cb0976cabe64a4591ea6b8f018a4700211866d5293c65babf4d928045fe256c3fb44f80784f3212464f2d0b5c6d48ef31e92115d1c18ae3875083b191c336abcb09cc14584bfd61cb66181e429da9e62b774ec310ce5d9dd2282df2362670fceba76c10678ec6d3cc2fa31ed1022c07724ff2c18f6c2ef56126ac5080865d8e7ddc0f86c47385b1def091a3dceba960ec68a95df11f6f42cb77b245916a8ae7c990a0d17eea6888694f54a3a0d82400e9562fd144695b6795de0f40583171a854e3843430ffdea9a8722de44e35e12d7469371c8842b3ce3c0c70590076fe3888f640811bc1744329e8651e3e9b8cfbc28c13e0e87e6849f66094fc7b6a45c0d6f030fb9d03d363c7620f6dfd096bc65ab2fc58035165a11b68e477ef1806d2823637f8d232b8781e73421afa816592b7fbad9bce9677153fda53428eb668c3436212ca0710a43fdb05fa633b4c25ac778bce83561313ae188b3360d75b9f1e3db013e286dccf9bea5c30fa6331a43b5d4926d876b7075ede755d227fae09c50cd165e3be0ff33a3e1ddbdaaa3249f5aaa9ba7625e99db2cb22074d3be0704ba470f55fa74c13512e5f71a2f0b90de225c236bd182b85aaa9d00419c390a371fcd26ea42a7846b001fcff8c00dfbdbb3f966be68a24e8a24c703186b8dff48819f6a00f564c47f5bd7f4c774c567a669f439aab725442fcc0e2048c93513a0e7308002e28ecaa37cdd1cc3cd7c00e53bdc935a0260ee43a1069d780f0dee5f4c146d5388b62c3ba0c2a8316f294c5b63aace792bb18e012771ab59da34359a18bc74b6604b6f98b602bbbbdae84c6b5952d862e17ff2e66336e8b497a4177b15d0ef87969a159a499841b35eb1f5bc037a4863d1eeb978ee87ddc75f8899ee3f0acca9f27a9ca4ead0c80ba90c79e3aae2ee736a548f37b8bc1cf6d9de1de15ff77be13c1234b6918e3404aeae4c69cc2f234062e04e9e57a5c52a8c960b6f98992d29d4bdffe51d94deed61cf09816c0ef94fd11586ea7d7ae4c7f125e6e3b974e1c305a0fd6c693dd130e716140e0f1c354922fc58f126d70c5dde1d73e43f63f141996daddab4c1586a464b7522464a3d9449883534016dd11256e4869623642fd65a004b78cad3d4e26b6d20b5a5df9635e7a3f31ffc67c83848df0cc4dad7a2e0254305b09fbdc39f439303f1c2d9ea834e46dfff0ebf4273727f3459ca5c5292431eb63f5c842db8952e608d2635967fbcace42750d7dfc0b4ef1f1def66e9c586fd664b6012a97d6f75e1b55df9d4898359ebe0928014f0f71f98be29dc1f9ef474988cf8085250ab9c28e55a0cdfa1527d5d264f54b4418a58a03044cd5d4bae3fd9fd441ab56b6da6e9c1442b06a4955533dddc637706e8525b6a5e726d2520c0493adc5b388f7b25c5318e552c54119f7c1a1e99a2a4feee2ade451e622fbde4217be72de13b597efb963062cfc2d441b85867c512e493508294ff7d24804bdde34543c156912052b04a8f8a228888a88a704fddec40706aa5a2551fe08b9abc135ef7e13f4d0db08566c904826a057962d1cec0068cc45743eb3242dcdd0208fa4cdc1b830fff735470266da6650321525735fa0c3cc6738dac9183992f35e8e894fa09094ee9f13a82b8add0157704fe9dcd0b6c83b1a50ffa61d2b034d4e2f291e35e3befd9337ae201024ef11ee75afbb3d0ccea04c3174eb64994663b680796be810812f37014b3aa8d212f3a67a8b88521e214f3f78528dc00c4f91f21fa1ebe947f10036246064d3ce5d779a00801e6f952026d990715390a36687656561da8529e51534b57e70d686ec5100c828921bc487dc164ee843f5d8ca480c436d5fd46b274a3ace1ee93e8bd0595c2b860b0289957c7073679cf715d28298604f3ae111ed3569468b4be8a690377f3bd4a25f44f1d5a8194c4daba561bd7b3442793172a5cd849899a256fd72655374cfbaaad3dd9f4860987e4464400654eaa1d3b1aec6799e729238c27b970c328f8e50cc241521df6c6155a6b8e05588cc58e5b809ab016b5a6c2d45c55fe8ba4e1f15135d1ae6f0d8d353e6394921fc526b78fe199521865403d745cb951132f9f686e8e51bcf2029df42a9442b82c90a308db3eaf518ad5bce322a09a58530b129c9ec385662f9c106fd25cdbda4c022cf01a3949fdae967e612208bb88d5c37c95626c9428ba037b9ca45ab40cf4ea09d6a3d717b614bb2632af35f211f9b4a20339644daad70f073061010dddd5defd94cbf8b8147d9c48c4cefbc57ec7a5a0238d50c60db18162adc320ba26f7996fa468073f989c4627c527aa8d3a6d801bbbfcb5fbcdbd5ade790759e012f4487c90cd013e5e3cb4c0991206cecca8ffcef9fb175b5cd24f998e437ca3543ce677f0c63c0f5f02a35d9f29ecd5937ecb5e845e621d6f076a90d915a139580775f1be1cd445c121c37da3a2e4c8a7b3622c6ca18c2e5fd5a611e1c11d7bef39fbb4896177cd3bbe3c8546a20aa9c9cd1b3e601447b250f69ad02eb5d2e56f3b55ad05eadab35ea9aa8e2172215deac1970de0c0d7234eb0b5d534aac67ef6f0ed6a2b166a7f87a8ceb71619d589ee74ad928ef885ec0bad99d3f243743f1143e3c350a7b884510d1d05547d46d8878ddde0e48e1dfb15ad84a171df05544bc51db348762ba229590968601631e5ca237a228150b07500fd7ada5722b44f0e0e946608f2bf2aaf6a9f497261b45f75e5bcb93cc966590565732e900a6f2ef842ade36d0b09eab1e13af44808ac702b47ea309df5154969d0976838498ff8ad56c2f2e1ab78bef5a890f4c648ecd79e9f54719c5b4abe3a472b4b51f9e6e53de66d8f57779df3c8370ed9ae198a9e4f1832d0b15bb2c9eb228441efb2300ff25682a989f0bef7d906ad5da48b1bd171142d56fe3bbc79126c26dfbc8516b36dbff84e8dd25a394bb400f35991641792169045c8b96827719a36c2d1ba6c8da68f17b67dbd97d766e15a8cf6a2ddcc922c567062143d2eb3fd2d8ce7b149211499bacdfb2dd81ba9bc2be5d38a8a8e2a0f31a315a51a445c2cc4a61ccaca3eeaa42d40c668686699bc23ad899d24d648c2a0a7af6d405a01ae71cfaa737f922554e3418525817ad691be37ed8bcfddf69de2c160bdd117ac3343d8c778c2c367b4b78ea8a524add5bff86c9fd2d6ba562d627eef9797366c507719fc10290fdbd70be54ead99a8eaef17b45d58c8a39e2da5578a7ed2eac607c08d1d1accdecb258023a6ed5b01cc8e80136bcc87d38ecda516f7ec1e2e0f33a7866355b473e8e705db63d2718daae5d9da82a14dbe76dfec54f01a00ba1ee1c5e2b4670d53418dcb19b73086a3d5ae2f8d74dc54365ac1cd87dab57ff8ddf1c18942d9984d07e7c95c6b3cd78bc85e7b4eff090f33f2ab979b9ec25116dc5f81609099f9718f17796cb9802491ed2ad3eabfe254b8b38846ac495c447414239025e0fddc361a3c85f14f57f191571ea3c63cf14bf7100335c7cfa32097286b332006e2e01b9304412b479c6ffa60b59bb3fef95e9ce6e1e738df592a25ab508a5f8f4421d4b8fa936b71aec246a10b99f97bb07faef5889038bea5069f1e5e0db7cebc87b0f63c111262846984cc010c1895c99ae816a5562e28bc36b4d253f6b85cebc5252a41b096b260ab13c690386dcf502d43033d68a226be80bbd4c6213bc469968ba4d46f43dc8e0dc8e11dcb63fc3ef54c6b846e8c657a0a71d659f00f3fb4dc568cdd6b578889ad590f8b5f66045eab0951253ec79827b5f9f7ff3e27c405cc7cf3fafa157df90b9cdadd42daf204a18b881f6d322621a7963c23fda5952c700b47db4ec46") setsockopt$inet_sctp6_SCTP_AUTOCLOSE(r0, 0x84, 0x4, &(0x7f0000001640)=0x16c0000, 0x4) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f00000016c0)=@raw={'raw\x00', 0x9, 0x3, 0x340, 0x0, 0x140, 0x0, 0x140, 0x140, 0x270, 0x270, 0x270, 0x270, 0x270, 0x3, &(0x7f0000001680), {[{{@ipv6={@dev={0xfe, 0x80, [], 0x20}, @rand_addr="0cc17355bb88ec93839411422ad9147c", [0xffffffff, 0x0, 0xffffffff, 0xffffffff], [0xffffffff, 0xffffff00, 0xffffffff, 0xffffff00], 'bond_slave_0\x00', 'veth0_to_hsr\x00', {}, {}, 0x6, 0x7b0, 0x2}, 0x0, 0xf8, 0x140, 0x0, {}, [@common=@srh={0x30, 'srh\x00', 0x0, {0x6, 0x3f, 0x5, 0x100000001, 0xe46f, 0x8, 0x1480}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x4, 0x10000, 0x100000001, 'netbios-ns\x00', 0xffff}}}, {{@uncond, 0x0, 0xc8, 0x130}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x1e, 0x1, 0x6, 0x9, 'snmp\x00', 'syz1\x00', 0x8001}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3a0) ioctl$KDGETLED(r0, 0x4b31, &(0x7f0000001a80)) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001b00)='TIPCv2\x00') sendmsg$TIPC_NL_NET_SET(r3, &(0x7f0000001c40)={&(0x7f0000001ac0)={0x10, 0x0, 0x0, 0x12000}, 0xc, &(0x7f0000001c00)={&(0x7f0000001b40)={0x90, r5, 0x1, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_SOCK={0x1c, 0x2, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x7fff}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x3ff}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x1}]}, @TIPC_NLA_MON={0x2c, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x9}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x7}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x2}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x20}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1ff}]}, @TIPC_NLA_NET={0x34, 0x7, [@TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_ID={0x8, 0x1, 0xc4c}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x9}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x1}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x80}]}]}, 0x90}, 0x1, 0x0, 0x0, 0x40}, 0x48001) r6 = syz_genetlink_get_family_id$net_dm(&(0x7f0000001cc0)='NET_DM\x00') sendmsg$NET_DM_CMD_START(r0, &(0x7f0000001d80)={&(0x7f0000001c80)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001d40)={&(0x7f0000001d00)={0x14, r6, 0x2, 0x70bd2b, 0x25dfdbfd, {}, ["", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x4004) fsetxattr$security_smack_entry(r0, &(0x7f0000001dc0)='security.SMACK64MMAP\x00', &(0x7f0000001e00)='$c:nodev\x00', 0x9, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000002080)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000002040)={0xffffffffffffffff}}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f00000020c0)={0x5, 0x10, 0xfa00, {&(0x7f0000001e40), r7}}, 0x18) [ 2864.991689][T20002] binder: BINDER_SET_CONTEXT_MGR already set [ 2865.009415][T20002] binder: 19998:20002 ioctl 40046207 0 returned -16 [ 2865.034491][T20000] binder: 19999:20000 ioctl c0306201 0 returned -14 08:54:44 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x6, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:54:44 executing program 3: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:54:44 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0xa000000, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) 08:54:44 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x7000000, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) [ 2865.466247][T20122] binder: BINDER_SET_CONTEXT_MGR already set [ 2865.480469][T20117] binder: 20116:20117 ioctl c0306201 0 returned -14 [ 2865.496215][T20125] binder: 20120:20125 ioctl 6 0 returned -22 08:54:44 executing program 3: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 2865.508540][T20122] binder: 20121:20122 ioctl 40046207 0 returned -16 [ 2865.532087][T20136] binder: 20120:20136 ioctl 6 0 returned -22 08:54:45 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x10, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:54:45 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x8000000, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) [ 2865.795543][T20240] binder: 20233:20240 ioctl c0306201 0 returned -14 [ 2865.850242][T20238] binder: 20237:20238 ioctl 10 0 returned -22 [ 2865.891557][T20242] binder: BINDER_SET_CONTEXT_MGR already set [ 2865.906362][T20242] binder: 20241:20242 ioctl 40046207 0 returned -16 [ 2865.908952][T20246] binder: 20237:20246 ioctl 10 0 returned -22 [ 2866.199682][T20124] validate_nla: 6 callbacks suppressed [ 2866.199693][T20124] netlink: 'syz-executor.5': attribute type 12 has an invalid length. [ 2866.278260][T20351] netlink: 'syz-executor.5': attribute type 12 has an invalid length. [ 2866.373820][T20353] netlink: 'syz-executor.0': attribute type 12 has an invalid length. 08:54:45 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) syz_open_procfs(0x0, &(0x7f0000272000)) 08:54:45 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x4000000, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) 08:54:45 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x3f000000, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:45 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x1264, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:54:45 executing program 2 (fault-call:5 fault-nth:0): syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:54:45 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0xe000000, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) [ 2866.535462][T20366] netlink: 'syz-executor.3': attribute type 12 has an invalid length. [ 2866.553470][ C1] net_ratelimit: 6 callbacks suppressed [ 2866.553496][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2866.565874][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2866.593880][T20364] binder: 20362:20364 ioctl 1264 0 returned -22 [ 2866.625715][T20361] FAULT_INJECTION: forcing a failure. [ 2866.625715][T20361] name failslab, interval 1, probability 0, space 0, times 0 [ 2866.676789][T20387] binder: 20362:20387 ioctl 1264 0 returned -22 [ 2866.692002][T20361] CPU: 0 PID: 20361 Comm: syz-executor.2 Not tainted 5.2.0-rc5+ #57 [ 2866.692099][T20433] binder: 20360:20433 ioctl c0306201 0 returned -14 [ 2866.700067][T20361] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2866.700076][T20361] Call Trace: [ 2866.700112][T20361] dump_stack+0x172/0x1f0 [ 2866.700148][T20361] should_fail.cold+0xa/0x15 [ 2866.700173][T20361] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 2866.700198][T20361] ? ___might_sleep+0x163/0x280 [ 2866.700225][T20361] __should_failslab+0x121/0x190 [ 2866.700252][T20361] should_failslab+0x9/0x14 [ 2866.700269][T20361] __kmalloc+0x2d9/0x740 [ 2866.700290][T20361] ? tomoyo_realpath_from_path+0xc0/0x7a0 [ 2866.700313][T20361] ? rcu_read_lock_sched_held+0x110/0x130 [ 2866.700329][T20361] ? tomoyo_realpath_from_path+0xcd/0x7a0 [ 2866.700352][T20361] tomoyo_realpath_from_path+0xcd/0x7a0 [ 2866.700375][T20361] tomoyo_path_number_perm+0x1dd/0x520 [ 2866.700392][T20361] ? tomoyo_path_number_perm+0x193/0x520 [ 2866.700412][T20361] ? tomoyo_execute_permission+0x4a0/0x4a0 [ 2866.700431][T20361] ? __lockdep_free_key_range+0x120/0x120 [ 2866.700446][T20361] ? __f_unlock_pos+0x19/0x20 [ 2866.700472][T20361] ? __fget+0x35a/0x550 [ 2866.717181][T20361] ? __fget+0x381/0x550 [ 2866.717203][T20361] ? ksys_dup3+0x3e0/0x3e0 [ 2866.717221][T20361] ? trace_hardirqs_on_thunk+0x1a/0x1c 08:54:46 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x1276, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2866.717242][T20361] tomoyo_file_ioctl+0x23/0x30 [ 2866.717260][T20361] security_file_ioctl+0x77/0xc0 [ 2866.717278][T20361] ksys_ioctl+0x57/0xd0 [ 2866.717293][T20361] __x64_sys_ioctl+0x73/0xb0 [ 2866.717313][T20361] do_syscall_64+0xfd/0x680 [ 2866.717335][T20361] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2866.717348][T20361] RIP: 0033:0x4592c9 08:54:46 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x40000000, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) [ 2866.717367][T20361] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2866.717375][T20361] RSP: 002b:00007f1091f31c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2866.717389][T20361] RAX: ffffffffffffffda RBX: 00007f1091f31c90 RCX: 00000000004592c9 [ 2866.717397][T20361] RDX: 0000000000000000 RSI: 0000000040046207 RDI: 0000000000000005 [ 2866.717405][T20361] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 2866.717414][T20361] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f1091f326d4 [ 2866.717423][T20361] R13: 00000000004c073b R14: 00000000004d31e8 R15: 0000000000000006 [ 2866.728206][T20361] ERROR: Out of memory at tomoyo_realpath_from_path. [ 2866.762423][T20361] binder: BINDER_SET_CONTEXT_MGR already set [ 2866.802360][T20361] binder: 20360:20361 ioctl 40046207 0 returned -16 [ 2866.959575][T20477] binder: 20475:20477 ioctl 1276 0 returned -22 08:54:46 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x4b40, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:54:46 executing program 2 (fault-call:5 fault-nth:1): syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 2867.257915][T20587] binder: 20559:20587 ioctl 4b40 0 returned -22 08:54:46 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0xfdfdffff, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) [ 2867.326397][T20588] FAULT_INJECTION: forcing a failure. [ 2867.326397][T20588] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 2867.339660][T20588] CPU: 0 PID: 20588 Comm: syz-executor.2 Not tainted 5.2.0-rc5+ #57 [ 2867.339674][T20588] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2867.339679][T20588] Call Trace: [ 2867.339711][T20588] dump_stack+0x172/0x1f0 [ 2867.339738][T20588] should_fail.cold+0xa/0x15 [ 2867.339760][T20588] ? trace_hardirqs_on_caller+0x6a/0x220 [ 2867.339782][T20588] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 2867.339804][T20588] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 2867.339832][T20588] should_fail_alloc_page+0x50/0x60 [ 2867.339849][T20588] __alloc_pages_nodemask+0x1a1/0x8d0 [ 2867.339874][T20588] ? __alloc_pages_slowpath+0x28f0/0x28f0 [ 2867.403416][T20588] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 2867.403444][T20588] cache_grow_begin+0x9d/0x650 [ 2867.403464][T20588] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 2867.403483][T20588] __kmalloc+0x67c/0x740 [ 2867.403504][T20588] ? tomoyo_realpath_from_path+0xcd/0x7a0 [ 2867.403523][T20588] tomoyo_realpath_from_path+0xcd/0x7a0 [ 2867.403537][T20588] ? tomoyo_path_number_perm+0x193/0x520 [ 2867.403560][T20588] tomoyo_path_number_perm+0x1dd/0x520 [ 2867.403573][T20588] ? tomoyo_path_number_perm+0x193/0x520 [ 2867.403594][T20588] ? tomoyo_execute_permission+0x4a0/0x4a0 [ 2867.458537][T20588] ? __lockdep_free_key_range+0x120/0x120 [ 2867.464295][T20588] ? __f_unlock_pos+0x19/0x20 [ 2867.469016][T20588] ? __fget+0x35a/0x550 [ 2867.473223][T20588] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 2867.478716][T20588] ? retint_kernel+0x2b/0x2b [ 2867.483351][T20588] tomoyo_file_ioctl+0x23/0x30 [ 2867.488149][T20588] security_file_ioctl+0x77/0xc0 [ 2867.493135][T20588] ksys_ioctl+0x57/0xd0 [ 2867.497321][T20588] __x64_sys_ioctl+0x73/0xb0 [ 2867.501944][T20588] do_syscall_64+0xfd/0x680 [ 2867.506483][T20588] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2867.512403][T20588] RIP: 0033:0x4592c9 [ 2867.516320][T20588] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2867.535951][T20588] RSP: 002b:00007f1091f31c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2867.544398][T20588] RAX: ffffffffffffffda RBX: 00007f1091f31c90 RCX: 00000000004592c9 [ 2867.552395][T20588] RDX: 0000000000000000 RSI: 0000000040046207 RDI: 0000000000000005 [ 2867.560397][T20588] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 2867.568399][T20588] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f1091f326d4 [ 2867.576399][T20588] R13: 00000000004c073b R14: 00000000004d31e8 R15: 0000000000000006 [ 2867.586335][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2867.592882][ C0] protocol 88fb is buggy, dev hsr_slave_1 08:54:47 executing program 2 (fault-call:5 fault-nth:2): syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 2867.619489][T20602] binder: 20533:20602 ioctl c0306201 0 returned -14 [ 2867.804834][T20365] netlink: 'syz-executor.5': attribute type 12 has an invalid length. [ 2867.908022][T20369] netlink: 'syz-executor.0': attribute type 12 has an invalid length. [ 2867.914482][T20690] binder: 20615:20690 ioctl c0306201 0 returned -14 [ 2867.922291][T20624] FAULT_INJECTION: forcing a failure. [ 2867.922291][T20624] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 2867.936188][T20624] CPU: 1 PID: 20624 Comm: syz-executor.2 Not tainted 5.2.0-rc5+ #57 [ 2867.944285][T20624] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2867.954362][T20624] Call Trace: [ 2867.954395][T20624] dump_stack+0x172/0x1f0 [ 2867.954425][T20624] should_fail.cold+0xa/0x15 [ 2867.954455][T20624] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 2867.962099][T20624] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 2867.962119][T20624] ? perf_trace_lock+0xeb/0x4c0 [ 2867.962142][T20624] should_fail_alloc_page+0x50/0x60 [ 2867.962158][T20624] __alloc_pages_nodemask+0x1a1/0x8d0 [ 2867.962184][T20624] ? ____cache_alloc_node+0x162/0x1e0 [ 2867.972271][T20624] ? __alloc_pages_slowpath+0x28f0/0x28f0 [ 2867.972286][T20624] ? ____cache_alloc_node+0x162/0x1e0 [ 2867.972312][T20624] ? lock_downgrade+0x880/0x880 [ 2867.972330][T20624] cache_grow_begin+0x9d/0x650 [ 2867.972355][T20624] ? do_raw_spin_unlock+0x57/0x270 [ 2867.988232][T20624] ____cache_alloc_node+0x17c/0x1e0 [ 2867.988254][T20624] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 2867.988279][T20624] __kmalloc+0x219/0x740 [ 2867.999069][T20624] ? tomoyo_realpath_from_path+0xcd/0x7a0 [ 2867.999089][T20624] tomoyo_realpath_from_path+0xcd/0x7a0 [ 2867.999104][T20624] ? tomoyo_path_number_perm+0x193/0x520 [ 2867.999124][T20624] tomoyo_path_number_perm+0x1dd/0x520 [ 2867.999138][T20624] ? tomoyo_path_number_perm+0x193/0x520 [ 2867.999160][T20624] ? tomoyo_execute_permission+0x4a0/0x4a0 [ 2868.015223][T20624] ? __lockdep_free_key_range+0x120/0x120 [ 2868.015240][T20624] ? lockdep_hardirqs_on+0x418/0x5d0 [ 2868.015257][T20624] ? retint_kernel+0x2b/0x2b [ 2868.015280][T20624] ? __fget+0x35a/0x550 [ 2868.025231][T20624] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 2868.025258][T20624] ? retint_kernel+0x2b/0x2b [ 2868.025286][T20624] tomoyo_file_ioctl+0x23/0x30 [ 2868.025302][T20624] security_file_ioctl+0x77/0xc0 [ 2868.025321][T20624] ksys_ioctl+0x57/0xd0 [ 2868.025341][T20624] __x64_sys_ioctl+0x73/0xb0 [ 2868.036822][T20624] do_syscall_64+0xfd/0x680 [ 2868.036845][T20624] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2868.036858][T20624] RIP: 0033:0x4592c9 [ 2868.036875][T20624] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2868.036883][T20624] RSP: 002b:00007f1091f31c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2868.036897][T20624] RAX: ffffffffffffffda RBX: 00007f1091f31c90 RCX: 00000000004592c9 [ 2868.036906][T20624] RDX: 0000000000000000 RSI: 0000000040046207 RDI: 0000000000000005 [ 2868.036913][T20624] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 2868.036931][T20624] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f1091f326d4 [ 2868.046901][T20624] R13: 00000000004c073b R14: 00000000004d31e8 R15: 0000000000000006 [ 2868.052966][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2868.053048][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2868.055187][T20624] binder: BINDER_SET_CONTEXT_MGR already set [ 2868.199408][T20624] binder: 20615:20624 ioctl 40046207 0 returned -16 [ 2868.288875][T20595] netlink: 'syz-executor.5': attribute type 12 has an invalid length. [ 2868.360269][T20600] netlink: 'syz-executor.0': attribute type 12 has an invalid length. 08:54:47 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) syz_open_procfs(0x0, &(0x7f0000272000)) 08:54:47 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x4b4d, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:54:47 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x4000000, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) 08:54:47 executing program 2 (fault-call:5 fault-nth:3): syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:54:47 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0xfffffdfd, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:47 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x3f000000, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) [ 2868.562787][T20720] netlink: 'syz-executor.3': attribute type 12 has an invalid length. [ 2868.584347][T20721] binder: 20716:20721 ioctl 4b4d 0 returned -22 [ 2868.617172][T20714] FAULT_INJECTION: forcing a failure. [ 2868.617172][T20714] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 2868.632730][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2868.638663][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2868.657759][T20728] binder: 20716:20728 ioctl 4b4d 0 returned -22 [ 2868.686375][T20714] CPU: 1 PID: 20714 Comm: syz-executor.2 Not tainted 5.2.0-rc5+ #57 [ 2868.694425][T20714] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2868.704509][T20714] Call Trace: [ 2868.707838][T20714] dump_stack+0x172/0x1f0 [ 2868.712220][T20714] should_fail.cold+0xa/0x15 [ 2868.716858][T20714] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 2868.722796][T20714] ? ___might_sleep+0x163/0x280 [ 2868.727700][T20714] should_fail_alloc_page+0x50/0x60 [ 2868.732915][T20714] __alloc_pages_nodemask+0x1a1/0x8d0 [ 2868.738309][T20714] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 2868.743794][T20714] ? __alloc_pages_slowpath+0x28f0/0x28f0 [ 2868.749529][T20714] ? retint_kernel+0x2b/0x2b [ 2868.754145][T20714] cache_grow_begin+0x9d/0x650 [ 2868.758927][T20714] ? __cpuset_node_allowed+0x136/0x540 [ 2868.764404][T20714] fallback_alloc+0x1fd/0x2d0 [ 2868.769096][T20714] ____cache_alloc_node+0x1be/0x1e0 [ 2868.774315][T20714] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 2868.780579][T20714] __kmalloc+0x219/0x740 [ 2868.784852][T20714] ? tomoyo_realpath_from_path+0xcd/0x7a0 [ 2868.790591][T20714] tomoyo_realpath_from_path+0xcd/0x7a0 [ 2868.796171][T20714] ? tomoyo_path_number_perm+0x193/0x520 [ 2868.801828][T20714] tomoyo_path_number_perm+0x1dd/0x520 [ 2868.807310][T20714] ? tomoyo_path_number_perm+0x193/0x520 [ 2868.812965][T20714] ? tomoyo_execute_permission+0x4a0/0x4a0 [ 2868.818796][T20714] ? __lockdep_free_key_range+0x120/0x120 [ 2868.824534][T20714] ? retint_kernel+0x2b/0x2b [ 2868.829170][T20714] ? trace_hardirqs_on_caller+0x6a/0x220 [ 2868.835009][T20714] ? __fget+0x35a/0x550 [ 2868.839209][T20714] ? retint_kernel+0x2b/0x2b [ 2868.843843][T20714] tomoyo_file_ioctl+0x23/0x30 [ 2868.848641][T20714] security_file_ioctl+0x77/0xc0 [ 2868.853600][T20714] ksys_ioctl+0x57/0xd0 [ 2868.857873][T20714] __x64_sys_ioctl+0x73/0xb0 [ 2868.862494][T20714] do_syscall_64+0xfd/0x680 [ 2868.867059][T20714] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2868.872964][T20714] RIP: 0033:0x4592c9 [ 2868.876870][T20714] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2868.896491][T20714] RSP: 002b:00007f1091f31c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2868.904931][T20714] RAX: ffffffffffffffda RBX: 00007f1091f31c90 RCX: 00000000004592c9 [ 2868.912928][T20714] RDX: 0000000000000000 RSI: 0000000040046207 RDI: 0000000000000005 [ 2868.915298][T20834] binder: 20833:20834 ioctl 4c01 0 returned -22 [ 2868.920917][T20714] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 08:54:48 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x4c01, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:54:48 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x100000000000000, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) [ 2868.920927][T20714] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f1091f326d4 [ 2868.920935][T20714] R13: 00000000004c073b R14: 00000000004d31e8 R15: 0000000000000006 [ 2868.954990][T20714] ERROR: Out of memory at tomoyo_realpath_from_path. [ 2869.021518][T20844] binder: 20713:20844 ioctl c0306201 0 returned -14 08:54:48 executing program 2 (fault-call:5 fault-nth:4): syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:54:48 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x200000000000000, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:48 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x4c81, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2869.393973][T20952] binder: 20948:20952 ioctl 4c81 0 returned -22 [ 2869.401028][T20976] binder: 20943:20976 ioctl c0306201 0 returned -14 [ 2869.441871][T20949] FAULT_INJECTION: forcing a failure. [ 2869.441871][T20949] name failslab, interval 1, probability 0, space 0, times 0 [ 2869.482002][T20949] CPU: 1 PID: 20949 Comm: syz-executor.2 Not tainted 5.2.0-rc5+ #57 [ 2869.490038][T20949] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2869.500123][T20949] Call Trace: [ 2869.503459][T20949] dump_stack+0x172/0x1f0 [ 2869.507825][T20949] should_fail.cold+0xa/0x15 [ 2869.512450][T20949] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 2869.518292][T20949] __should_failslab+0x121/0x190 [ 2869.523254][T20949] should_failslab+0x9/0x14 [ 2869.527780][T20949] __kmalloc+0x2d9/0x740 [ 2869.532051][T20949] ? tomoyo_encode2.part.0+0xf5/0x400 [ 2869.537447][T20949] tomoyo_encode2.part.0+0xf5/0x400 [ 2869.542674][T20949] tomoyo_encode+0x2b/0x50 [ 2869.547109][T20949] tomoyo_realpath_from_path+0x1d3/0x7a0 [ 2869.552764][T20949] tomoyo_path_number_perm+0x1dd/0x520 [ 2869.558258][T20949] ? tomoyo_path_number_perm+0x193/0x520 [ 2869.563918][T20949] ? tomoyo_execute_permission+0x4a0/0x4a0 [ 2869.569761][T20949] ? __lockdep_free_key_range+0x120/0x120 [ 2869.575511][T20949] ? lockdep_hardirqs_on+0x418/0x5d0 [ 2869.580919][T20949] ? retint_kernel+0x2b/0x2b [ 2869.585643][T20949] ? __fget+0x35a/0x550 08:54:48 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x300000000000000, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) [ 2869.589860][T20949] ? retint_kernel+0x2b/0x2b [ 2869.594505][T20949] tomoyo_file_ioctl+0x23/0x30 [ 2869.599307][T20949] security_file_ioctl+0x77/0xc0 [ 2869.604284][T20949] ksys_ioctl+0x57/0xd0 [ 2869.608473][T20949] __x64_sys_ioctl+0x73/0xb0 [ 2869.613096][T20949] do_syscall_64+0xfd/0x680 [ 2869.613120][T20949] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2869.613132][T20949] RIP: 0033:0x4592c9 [ 2869.613150][T20949] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2869.613159][T20949] RSP: 002b:00007f1091f31c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2869.613174][T20949] RAX: ffffffffffffffda RBX: 00007f1091f31c90 RCX: 00000000004592c9 [ 2869.613183][T20949] RDX: 0000000000000000 RSI: 0000000040046207 RDI: 0000000000000005 [ 2869.613191][T20949] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 2869.613199][T20949] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f1091f326d4 [ 2869.613207][T20949] R13: 00000000004c073b R14: 00000000004d31e8 R15: 0000000000000006 [ 2869.673902][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2869.674641][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2869.808703][T20949] ERROR: Out of memory at tomoyo_realpath_from_path. [ 2869.817813][T20949] binder: BINDER_SET_CONTEXT_MGR already set [ 2869.830928][T20949] binder: 20943:20949 ioctl 40046207 0 returned -16 [ 2869.975482][T20718] netlink: 'syz-executor.5': attribute type 12 has an invalid length. 08:54:49 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) syz_open_procfs(0x0, &(0x7f0000272000)) 08:54:49 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x5405, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:54:49 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x400000000000000, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:49 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x4000000, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) 08:54:49 executing program 2 (fault-call:5 fault-nth:5): syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:54:49 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x40000000, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) [ 2870.346434][T21174] binder: 21169:21174 ioctl 5405 0 returned -22 [ 2870.398175][T21181] binder: 21169:21181 ioctl 5405 0 returned -22 08:54:49 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x541a, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2870.464829][T21230] binder: 21170:21230 ioctl c0306201 0 returned -14 [ 2870.479016][T21178] binder: BINDER_SET_CONTEXT_MGR already set [ 2870.489151][T21178] binder: 21170:21178 ioctl 40046207 0 returned -16 08:54:50 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x500000000000000, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:50 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 2870.675184][T21289] binder: 21288:21289 ioctl 541a 0 returned -22 [ 2870.763631][T21308] binder: 21288:21308 ioctl 541a 0 returned -22 08:54:50 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x5421, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2870.826930][T21310] binder: BINDER_SET_CONTEXT_MGR already set [ 2870.847571][T21310] binder: 21293:21310 ioctl 40046207 0 returned -16 [ 2870.871311][T21398] binder: 21293:21398 ioctl c0306201 0 returned -14 08:54:50 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x600000000000000, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:50 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 2871.201326][T21408] binder: 21407:21408 ioctl c0306201 0 returned -14 [ 2871.240561][T21490] binder: 21407:21490 ioctl c0306201 0 returned -14 [ 2871.264429][T21180] validate_nla: 4 callbacks suppressed [ 2871.264440][T21180] netlink: 'syz-executor.0': attribute type 12 has an invalid length. [ 2871.398832][T21175] netlink: 'syz-executor.3': attribute type 12 has an invalid length. [ 2871.468049][T21278] netlink: 'syz-executor.0': attribute type 12 has an invalid length. 08:54:51 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) syz_open_procfs(0x0, &(0x7f0000272000)) 08:54:51 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x5423, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:54:51 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x700000000000000, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:51 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x10, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:54:51 executing program 3: [ 2871.560704][T21499] netlink: 'syz-executor.5': attribute type 12 has an invalid length. [ 2871.710376][T21519] binder: 21518:21519 ioctl 5423 0 returned -22 [ 2871.730111][T21523] binder: 21522:21523 ioctl 10 0 returned -22 [ 2871.752833][ C0] net_ratelimit: 4 callbacks suppressed [ 2871.752842][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2871.764329][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2871.781810][T21561] binder: 21522:21561 ioctl c0306201 0 returned -14 [ 2871.794922][T21563] binder: 21518:21563 ioctl 5423 0 returned -22 [ 2871.810591][T21527] netlink: 'syz-executor.0': attribute type 12 has an invalid length. [ 2871.862269][T21617] binder: 21522:21617 ioctl c0306201 0 returned -14 08:54:51 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x60000000, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) 08:54:51 executing program 3: 08:54:51 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x5427, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:54:51 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x800000000000000, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:51 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x4c01, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 2871.992569][T21637] binder: 21636:21637 ioctl 5427 0 returned -22 08:54:51 executing program 3: [ 2872.081685][T21639] binder: 21636:21639 ioctl 5427 0 returned -22 [ 2872.152745][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2872.158617][ C0] protocol 88fb is buggy, dev hsr_slave_1 08:54:51 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x5450, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2872.296723][T21649] binder: 21648:21649 ioctl 4c01 0 returned -22 [ 2872.350962][T21694] binder: 21648:21694 ioctl c0306201 0 returned -14 [ 2872.591887][T21644] netlink: 'syz-executor.5': attribute type 12 has an invalid length. [ 2872.792870][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2872.798916][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2872.846980][T21762] netlink: 'syz-executor.0': attribute type 12 has an invalid length. 08:54:52 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) syz_open_procfs(0x0, &(0x7f0000272000)) 08:54:52 executing program 3: 08:54:52 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x3f00000000000000, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:52 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x5421, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:54:52 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x5451, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2872.906902][T21765] netlink: 'syz-executor.5': attribute type 12 has an invalid length. 08:54:52 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x9effffff, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) 08:54:52 executing program 3: [ 2873.116005][T21772] binder: 21766:21772 ioctl c0306201 0 returned -14 [ 2873.129101][T21775] netlink: 'syz-executor.0': attribute type 12 has an invalid length. 08:54:52 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x5452, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2873.197556][T21828] binder: 21766:21828 ioctl c0306201 0 returned -14 08:54:52 executing program 3: 08:54:52 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x5450, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:54:52 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x4000000000000000, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:52 executing program 3: [ 2873.633420][T21897] binder: 21892:21897 ioctl c0306201 0 returned -14 [ 2873.706996][T21943] binder: 21892:21943 ioctl c0306201 0 returned -14 [ 2873.832824][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2873.838692][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2874.033111][T21843] netlink: 'syz-executor.5': attribute type 12 has an invalid length. 08:54:53 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) syz_open_procfs(0x0, &(0x7f0000272000)) 08:54:53 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x5459, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:54:53 executing program 3: 08:54:53 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x5451, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:54:53 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x8000000000000000, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:53 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0xea370000, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) [ 2874.232803][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2874.238678][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2874.339835][T22015] binder: 22012:22015 ioctl 5459 0 returned -22 08:54:53 executing program 3: 08:54:53 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x5460, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2874.459637][T22036] binder: 22009:22036 ioctl c0306201 0 returned -14 08:54:54 executing program 3: 08:54:54 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x5452, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:54:54 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0xfdfdffff00000000, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:54 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x6364, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2874.964039][T22142] binder: 22139:22142 ioctl c0306201 0 returned -14 [ 2875.068991][T22231] binder: 22139:22231 ioctl c0306201 0 returned -14 [ 2875.121668][T22165] binder: 22146:22165 ioctl 6364 0 returned -22 [ 2875.164485][T22252] binder: 22146:22252 ioctl 6364 0 returned -22 08:54:54 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) syz_open_procfs(0x0, &(0x7f0000272000)) 08:54:54 executing program 3: 08:54:54 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0xffffffff00000000, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:54 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x5460, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:54:54 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x8903, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:54:54 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0xf0ffffff, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) 08:54:54 executing program 3: [ 2875.581604][T22261] binder: 22260:22261 ioctl 8903 0 returned -22 [ 2875.629594][T22272] binder: 22258:22272 ioctl c0306201 0 returned -14 [ 2875.662454][T22271] binder: 22260:22271 ioctl 8903 0 returned -22 [ 2875.708003][T22272] binder: 22258:22272 ioctl c0306201 0 returned -14 08:54:55 executing program 3: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x400000000000000, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:55 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x8912, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:54:55 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$UI_SET_PROPBIT(r0, 0x4004556e, 0x10) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fsetxattr$security_capability(r1, &(0x7f0000000080)='security.capability\x00', &(0x7f0000000280)=@v1={0x1000000, [{0x3, 0x800}]}, 0xc, 0x2) r2 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x4, 0x20002) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$sock_bt_hidp_HIDPCONNDEL(r0, 0x400448c9, &(0x7f0000000000)={{0x40, 0xfd72, 0x1, 0x8, 0x1, 0x7fffffff}, 0x2}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="116348400000000000000000000000000000991acf79b7360a37311382972d9a8b0043daa2f9a99c6c1cf336f5efe98f4ce4ef903f8104eedac3c3b536f74132170c7003852c3cdb97a398d0b3973566079e8104d056f1f9193388ca1e101c822858f53f05587fa096b1f6f3dfc2d0367044333cbbaebc72547b8da1002ec69decc0c71bc028eef1e8de508d599422a7e5e32c0d3f1f62c32dbdd49bdcc63449b124658119b6543c04000000000000002c906dac0000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:55 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x6364, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 2875.968428][T22384] binder: 22379:22384 ioctl 8912 0 returned -22 [ 2876.038666][T22388] binder: 22379:22388 ioctl 8912 0 returned -22 08:54:55 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x8933, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2876.140940][T22391] binder: 22390:22391 ioctl 6364 0 returned -22 [ 2876.174916][T22437] binder: 22390:22437 ioctl c0306201 0 returned -14 [ 2876.297344][T22391] binder: 22390:22391 ioctl 6364 0 returned -22 [ 2876.344577][T22437] binder: 22390:22437 ioctl c0306201 0 returned -14 [ 2876.370139][T22499] binder: 22480:22499 ioctl 8933 0 returned -22 [ 2876.569851][T22270] validate_nla: 7 callbacks suppressed [ 2876.569862][T22270] netlink: 'syz-executor.0': attribute type 12 has an invalid length. [ 2876.649761][T22501] netlink: 'syz-executor.5': attribute type 12 has an invalid length. [ 2876.702294][T22503] netlink: 'syz-executor.0': attribute type 12 has an invalid length. 08:54:56 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) syz_open_procfs(0x0, &(0x7f0000272000)) 08:54:56 executing program 3: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x400000000000000, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:56 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x8918, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:54:56 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x8943, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:54:56 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:56 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0xfffff000, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) [ 2876.880900][T22515] netlink: 'syz-executor.5': attribute type 12 has an invalid length. [ 2876.912570][T22519] binder: 22514:22519 ioctl 8918 0 returned -22 [ 2876.920040][T22511] binder: 22510:22511 ioctl 8943 0 returned -22 [ 2876.952816][ C1] net_ratelimit: 6 callbacks suppressed [ 2876.952825][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2876.958635][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2876.970868][T22524] binder: 22514:22524 ioctl c0306201 0 returned -14 [ 2876.993611][T22518] binder: BINDER_SET_CONTEXT_MGR already set [ 2877.023970][T22518] binder: 22512:22518 ioctl 40046207 0 returned -16 [ 2877.037633][T22590] binder: 22510:22590 ioctl 8943 0 returned -22 [ 2877.052519][T22519] binder: 22514:22519 ioctl 8918 0 returned -22 08:54:56 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x4, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x80000000000000, 0x0, 0xfffffffffffffffd, 0x0, 0xa8, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0xff, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$P9_RLERROR(r0, &(0x7f0000000040)={0x17, 0x7, 0x1, {0xe, '/dev/snapshot\x00'}}, 0x17) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="352ae541000000000000000000000000000000009bd9a9d1e04e0d00000a1e4cde82b1fef60b89cf76fdd8d650a8bdefcabb3359e96ca912239fbfc1b1bc18eb5930e3200717dd2be7a15a1922fa3c75f15c9544ae5d7a68010000003493f1fb111fca3505a4c039fba7db150aa4ef05ac5c1080ef4d"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x008\x00\x00'], 0x0, 0x0, 0x0}) 08:54:56 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x89e2, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2877.114104][T22524] binder: 22514:22524 ioctl c0306201 0 returned -14 08:54:56 executing program 3: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x300000000000000, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:56 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x8933, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 2877.358910][T22645] binder: 22641:22645 ioctl 89e2 0 returned -22 08:54:56 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x89f0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:54:56 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) timer_create(0x7, &(0x7f0000000000)={0x0, 0x13, 0x3, @tid=0xffffffffffffffff}, &(0x7f0000000040)=0x0) ioctl$TIOCNOTTY(r0, 0x5422) timer_delete(r1) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000140)='/dev/snapshot\x00', 0x400000000000, 0x0) ioctl$GIO_FONTX(r2, 0x4b6b, &(0x7f0000000200)=""/95) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0x0, 0x802) ioctl$VT_RESIZEX(r0, 0x560a, &(0x7f0000000080)={0x8, 0x0, 0x100, 0x3, 0x6, 0x1cb8}) setsockopt$IP_VS_SO_SET_FLUSH(r2, 0x0, 0x485, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) [ 2877.547983][T22736] binder: 22694:22736 ioctl 8933 0 returned -22 [ 2877.587776][T22754] binder: 22694:22754 ioctl c0306201 0 returned -14 [ 2877.669383][T22736] binder: 22694:22736 ioctl 8933 0 returned -22 [ 2877.687171][T22754] binder: 22694:22754 ioctl c0306201 0 returned -14 [ 2877.715526][T22756] binder: 22755:22756 ioctl 89f0 0 returned -22 [ 2877.783568][T22522] netlink: 'syz-executor.0': attribute type 12 has an invalid length. [ 2877.969555][T22591] netlink: 'syz-executor.5': attribute type 12 has an invalid length. [ 2878.003807][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2878.010339][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2878.095795][T22763] netlink: 'syz-executor.0': attribute type 12 has an invalid length. 08:54:57 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) syz_open_procfs(0x0, &(0x7f0000272000)) 08:54:57 executing program 3: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x40000000, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:57 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x897f, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:54:57 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0xae01, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:54:57 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000140)={&(0x7f0000000040)=""/72, 0x220000, 0x1800, 0x80}, 0x18) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1163484000000000140000eaffffffffffffff007c3129573814c636345db2b0f708db1b4f"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="7ff4d51089931056588497a0575797fe03796f12562848cc260856777ce85617c9003bf41fd781a9b363cf44b0c6d663b822547c9d21b6850b157e508bf2cf6911701821734e73bfba6ced89409fdd0446d9350be035690228ce2ad8e94ce7400fa214f8f8ac6d77d2ccda081135ef1341b478dcbe19a44b091ea40c982520cf2fcb8c26ca1ebc730df1d4a288572a2bce28a054d305820021e28b467b2bb5ea0aebaccd5a9c38888ca6cfd4690c94c4b7643d99e82be82b7c393c969cec7c190876c92fd0e3fed0002d250281d56739c9b67be69b927e5283f2669bcc56a1d9bccfeb3360f7ec5cb022816f4958fc7271b05cbfe2e0e760a30048a540e583e0d6bf599fceae1451d012a14ccb49e12ce505b51167cb55f53f8abc3ac7654855b0818d1750c5a81709297b70af5fc0e0c49f130c7a6f17976aef5c4d2280a01e873dcaa6baba2e07eb8c2d367e865b7cd103f00d5f6fe1c1035b95126adc5728d6933211489d3a0680e3a1dd0cafc437f26ec190ef07de61216caff7d366e2400d143741107f56a167c64e5927503a10f1f166004f7ef642be1d32b8d82f0926129ea8b11470e78a8ee94deb772a22e5e60ec2b58751e8c2481bbd81c0ece45e541008d3f2357729015849db011576fdbd9dc4baa461497e3368a2997f91df4e616b05e1c212f8b884e307c9d56a61417b324b98374aeea4b694656f3a470b60f4204a888d4e29e2ca3253cf36c9f0388192b64f7a5e"], 0x0, 0x0, 0x0}) 08:54:57 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0xffffff7f, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) [ 2878.291563][T22878] binder: 22876:22878 ioctl 897f 0 returned -22 [ 2878.311740][T22879] netlink: 'syz-executor.5': attribute type 12 has an invalid length. [ 2878.328382][T22874] binder: 22873:22874 ioctl ae01 0 returned -22 [ 2878.348412][T22880] binder: 22877:22880 unknown command 282457215 [ 2878.364338][T22872] binder: BINDER_SET_CONTEXT_MGR already set [ 2878.380418][T22880] binder: 22877:22880 ioctl c0306201 200002c0 returned -22 [ 2878.389756][T22872] binder: 22871:22872 ioctl 40046207 0 returned -16 [ 2878.403637][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2878.410855][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2878.419826][T22887] binder: 22876:22887 ioctl c0306201 0 returned -14 [ 2878.463983][T22874] binder: 22873:22874 ioctl ae01 0 returned -22 [ 2878.494955][T22898] binder: 22876:22898 ioctl c0306201 0 returned -14 08:54:57 executing program 3: r0 = socket$inet6(0xa, 0x6, 0x2000000000000000) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20}, 0x1c) r1 = socket$inet_dccp(0x2, 0x6, 0x0) listen(r0, 0x80002) setsockopt$inet_opts(r1, 0x0, 0x4, 0x0, 0x0) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}, 0x55) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dsp\x00', 0x2, 0x0) write$binfmt_misc(r0, &(0x7f0000000200)={'syz0', "ed6173581b3cd444187713d67c465f780294b35266cf545b61688513d5b274fdf79c18f34d92e6bc2a6863bf7876b4ea98d9675518157dead85c8c17a35a6229853b4d1a787e51b46999383418012a04800811de7324ae5d26fe5e316ad99593f590d239e2bdc93187a51eb4c893221083ea3bd8102cafc1cc7705e9ad2796f6458b2897b141dac5a3543ab05ca0432b5283ff0eee3ea562b2878556718794b9dcbd54ff6960945f86bf3ef10cbb38e16aaf565800c323125e7e5c7f5a"}, 0xc1) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TIMER(r2, 0xc0605345, &(0x7f0000000100)={0x1ff, 0x2, {0x0, 0x0, 0x1ff, 0x3, 0xb5}}) getsockopt$TIPC_SRC_DROPPABLE(r2, 0x10f, 0x80, &(0x7f0000000080), &(0x7f00000000c0)=0x4) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r0, 0x28, 0x2, &(0x7f00000001c0)=0x2, 0x8) 08:54:57 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0xae41, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2878.522573][T22887] binder: 22876:22887 ioctl 897f 0 returned -22 08:54:58 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000300)={{{@in6=@dev, @in6=@ipv4={[], [], @loopback}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in=@initdev}}, &(0x7f0000000000)=0xe8) getresuid(&(0x7f0000000040)=0x0, &(0x7f0000000080), &(0x7f0000000140)) setsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000004c0)={{{@in=@dev={0xac, 0x14, 0x14, 0x1d}, @in6=@remote, 0x4e21, 0x3c5bdb88, 0x4e20, 0x3, 0xa, 0x0, 0xa0, 0xff, r2, r3}, {0x4, 0x7f, 0xffffffff00000000, 0xec7, 0x10000, 0x800, 0x7, 0x6}, {0xfffffffffffffffc, 0x8000, 0x1}, 0x6, 0x6e6bb3, 0x0, 0x1, 0x3, 0x3}, {{@in=@remote, 0x4d2, 0xff}, 0xa, @in=@dev={0xac, 0x14, 0x14, 0x21}, 0x3502, 0x7, 0x2, 0x10000, 0x1bf9, 0x3, 0x8}}, 0xe8) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) ioctl$UI_SET_SNDBIT(r0, 0x4004556a, 0x7) 08:54:58 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x8980, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 2878.747677][T22996] binder: 22995:22996 ioctl ae41 0 returned -22 08:54:58 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0xae80, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2878.883075][T23004] binder: 23002:23004 ioctl 8980 0 returned -22 [ 2878.899842][T23004] binder: 23002:23004 ioctl c0306201 0 returned -14 08:54:58 executing program 3: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000140)={&(0x7f0000000040)=""/72, 0x220000, 0x1800, 0x80}, 0x18) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1163484000000000140000eaffffffffffffff007c3129573814c636345db2b0f708db1b4f"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="7ff4d51089931056588497a0575797fe03796f12562848cc260856777ce85617c9003bf41fd781a9b363cf44b0c6d663b822547c9d21b6850b157e508bf2cf6911701821734e73bfba6ced89409fdd0446d9350be035690228ce2ad8e94ce7400fa214f8f8ac6d77d2ccda081135ef1341b478dcbe19a44b091ea40c982520cf2fcb8c26ca1ebc730df1d4a288572a2bce28a054d305820021e28b467b2bb5ea0aebaccd5a9c38888ca6cfd4690c94c4b7643d99e82be82b7c393c969cec7c190876c92fd0e3fed0002d250281d56739c9b67be69b927e5283f2669bcc56a1d9bccfeb3360f7ec5cb022816f4958fc7271b05cbfe2e0e760a30048a540e583e0d6bf599fceae1451d012a14ccb49e12ce505b51167cb55f53f8abc3ac7654855b0818d1750c5a81709297b70af5fc0e0c49f130c7a6f17976aef5c4d2280a01e873dcaa6baba2e07eb8c2d367e865b7cd103f00d5f6fe1c1035b95126adc5728d6933211489d3a0680e3a1dd0cafc437f26ec190ef07de61216caff7d366e2400d143741107f56a167c64e5927503a10f1f166004f7ef642be1d32b8d82f0926129ea8b11470e78a8ee94deb772a22e5e60ec2b58751e8c2481bbd81c0ece45e541008d3f2357729015849db011576fdbd9dc4baa461497e3368a2997f91df4e616b05e1c212f8b884e307c9d56a61417b324b98374aeea4b694656f3a470b60f4204a888d4e29e2ca3253cf36c9f0388192b64f7a5e"], 0x0, 0x0, 0x0}) [ 2878.949827][T23004] binder: 23002:23004 ioctl 8980 0 returned -22 [ 2878.980895][T23007] binder: 23002:23007 ioctl c0306201 0 returned -14 [ 2879.033568][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2879.040237][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2879.095241][T23009] binder: 23008:23009 ioctl ae80 0 returned -22 [ 2879.176356][T23081] binder: BINDER_SET_CONTEXT_MGR already set [ 2879.182547][T23081] binder: 23062:23081 ioctl 40046207 0 returned -16 [ 2879.220281][T23123] binder: 23062:23123 unknown command 282457215 [ 2879.228522][T22883] netlink: 'syz-executor.0': attribute type 12 has an invalid length. [ 2879.234319][T23123] binder: 23062:23123 ioctl c0306201 200002c0 returned -22 [ 2879.362741][T23120] netlink: 'syz-executor.0': attribute type 12 has an invalid length. 08:54:58 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) syz_open_procfs(0x0, &(0x7f0000272000)) 08:54:58 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x400454ca, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:54:58 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0xae9a, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:54:58 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:58 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) shmat(0x0, &(0x7f0000000000/0x2000)=nil, 0x5000) prlimit64(0x0, 0x6, &(0x7f0000000000), 0x0) r0 = syz_open_dev$vcsn(0x0, 0x0, 0x0) ioctl$TUNSETVNETLE(r0, 0x400454dc, &(0x7f0000000040)=0x1) ioctl$BLKROTATIONAL(0xffffffffffffffff, 0x127e, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000180)='IPVS\x00') r1 = accept4$tipc(r0, &(0x7f0000000080)=@name, &(0x7f00000000c0)=0x10, 0x80000) sendmsg$IPVS_CMD_GET_CONFIG(r0, 0x0, 0x0) ioctl$DRM_IOCTL_AUTH_MAGIC(r0, 0x40046411, &(0x7f0000000300)) getsockopt$inet_sctp_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f00000001c0)=@assoc_value={0x0}, &(0x7f0000000200)=0x8) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r0, 0x84, 0x1b, &(0x7f0000000340)={r2, 0xfd, "13de9cab08dd3f244a76ad8839ba5a27d9b327640d3bff1f5b16fc0c5ca25735d3e38d883497572f1b55681492a229532533f39dd2531c79a4a091f836c272fd374831b836ea84687f2d9001494772fc1059dfcc130841d4edff786ac5cc0a8ed6f905744ca27554d93025e63ceb62531b4b47d4053ecbdf20cd655b983642b8a417169d7cf09483ec6e2d638bbbe5f43ac05e3f99fab8de40b8a0fe190aa04a716cde84b8baf3a5ae769443c7232f384848f681435dc8e14c5552acb6a855d385f9a8e5b5eee7ba0806feeca809715fabac960a923805b0b3431481b75feec45b974f455ad5cdf0b07e333bcc48e4048f277b01d041b5a8b72a703ab4"}, &(0x7f0000000240)=0x105) getsockname$tipc(r1, &(0x7f0000000100)=@id, &(0x7f0000000140)=0x10) [ 2879.550779][T23128] binder: 23127:23128 ioctl 400454ca 0 returned -22 [ 2879.577683][T23128] binder: 23127:23128 ioctl c0306201 0 returned -14 [ 2879.601166][T23134] binder: 23129:23134 ioctl ae9a 0 returned -22 [ 2879.630514][T23138] binder: 23127:23138 ioctl c0306201 0 returned -14 [ 2879.648316][T23128] binder: 23127:23128 ioctl 400454ca 0 returned -22 [ 2879.659564][T23162] binder: 23129:23162 ioctl ae9a 0 returned -22 08:54:59 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0xffffff9e, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) 08:54:59 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046203, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:54:59 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40042409, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:54:59 executing program 4: r0 = syz_open_dev$audion(0x0, 0x50000000000000, 0x639af39b52cf3a32) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCBRADDBR(r0, 0x89a0, &(0x7f0000000040)='bond_slave_1\x00') mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) r4 = getpid() ioctl$sock_FIOSETOWN(r0, 0x8901, &(0x7f0000000000)=r4) [ 2880.072858][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2880.078754][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2880.244497][T23248] binder: 23247:23248 ioctl 40046203 0 returned -22 [ 2880.305088][T23252] binder: 23251:23252 ioctl 40042409 0 returned -22 [ 2880.308233][T23294] binder: 23247:23294 ioctl c0306201 0 returned -14 08:54:59 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$CAPI_SET_FLAGS(r0, 0x80044324, &(0x7f0000000000)=0x1) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_CLOCK(r0, 0x4030ae7b, &(0x7f0000000180)={0x8, 0x4}) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f00000001c0), 0x4) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="11634840000000000000fb995adcd6b1d37478331900"/31], 0x0, 0x0, 0x0}) ioctl$BLKROGET(r1, 0x125e, &(0x7f0000000300)) ioctl$NBD_DISCONNECT(r1, 0xab08) getsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r0, 0x84, 0x12, &(0x7f0000000080), &(0x7f0000000140)=0x4) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000040)=[@in={0x2, 0x4e23, @rand_addr=0x5}, @in={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}, @in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x2a}}], 0x30) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:54:59 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40045431, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:54:59 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046205, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 2880.662579][T23367] binder: 23366:23367 ioctl 40045431 0 returned -22 [ 2880.756382][T23371] binder: 23369:23371 ioctl 40046205 0 returned -22 [ 2880.811541][T23435] binder: 23369:23435 ioctl c0306201 0 returned -14 [ 2880.834957][T23458] binder: 23369:23458 ioctl c0306201 0 returned -14 08:55:00 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) syz_open_procfs(0x0, &(0x7f0000272000)) 08:55:00 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x400454ca, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:00 executing program 4: r0 = syz_open_dev$audion(0x0, 0xffff, 0x82) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) r2 = perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000080)='/dev/snd/pcmC#D#p\x00', 0x9, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = mq_open(&(0x7f0000000000)='wlan0\x00', 0x40, 0x0, &(0x7f0000000040)={0x1, 0x0, 0x5, 0x2f7, 0xbea3, 0x3, 0x6, 0x9}) getsockopt$inet_sctp_SCTP_RECVNXTINFO(r2, 0x84, 0x21, &(0x7f0000000340), &(0x7f0000000380)=0x4) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) close(r5) ioctl$VIDIOC_G_AUDIO(r0, 0x80345621, &(0x7f0000000140)) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0)='TIPCv2\x00') sendmsg$TIPC_NL_NAME_TABLE_GET(r1, &(0x7f0000000300)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000740)=ANY=[@ANYBLOB="b8010000d6de23befb2f462b31a5eba8aca6f39ef37738ad70bd3f3c0f9459fed2727d3a8991b55eddf721f76385bd1f5336d1501e366a5386de0edf390048f5eb00000100477d88ef93e67146783badbccf2394d258115c6f2c064cc1d33a38f820d720ee5e7c7529ff1912a53066d4120673237267f16e804853066356c73763c9185924cb772315217b5d4ee0822dbfc47ee8c1b776173771c97be5d25b12408bb52e0dc43d6868d8", @ANYRES16=r6, @ANYBLOB="000229bd7000fddbdf2510000000340007000c00030000000000000000000c000300fdf4ffffffffffff0800010004000000080002000300000008000200000001005400070008000200060000000c00040008000000000000000c000300010000800000000008000200ac0100000800010000000000080002008a0b00000c00040000000000000000000c000400f7ffffffffffffff28000200040004000800020008000000040004000800020005000000080001000400000004000400f4000100080003000008000038000400200001000a004e2200000000ff020000000000000000000000000001050000001400020002004e20000000020000000000000000180001006574683a76657468315f746f5f7465616d000000380004001400010002004e21ac1e00010000000000000000200002000a004e2200000009fe8000000000000000000000000000aa0300000008000300feffffff0c000200080003007e000000180001006574683a76657468305f746f5f7465616d00000034000200080002000500000008000200942300000800010002000000080003000100000008000400fbffffff0800020001010000"], 0x1b8}, 0x1, 0x0, 0x0, 0x40}, 0x1) 08:55:00 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046206, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:55:00 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$mixer(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = syz_open_dev$usb(&(0x7f0000000140)='/dev/bus/usb/00#/00#\x00', 0xfffffffffffffffe, 0x0) r2 = socket(0x1, 0x0, 0x0) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) getsockopt$inet_mtu(0xffffffffffffffff, 0x0, 0xa, 0x0, 0x0) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x373) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, 0x0) fdatasync(0xffffffffffffffff) write$P9_RREMOVE(0xffffffffffffffff, 0x0, 0x0) write$FUSE_OPEN(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_TIOCOUTQ(r2, 0x5411, 0x0) ioctl$EXT4_IOC_PRECACHE_EXTENTS(0xffffffffffffffff, 0x6612) bpf$OBJ_GET_PROG(0x7, 0x0, 0x0) sendto$inet6(r4, 0x0, 0x0, 0x20000001, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(0xffffffffffffffff, 0x84, 0x6b, 0x0, 0x0) splice(r4, 0x0, r3, 0x0, 0x100000000020c49a, 0x0) getsockopt$XDP_MMAP_OFFSETS(0xffffffffffffffff, 0x11b, 0x1, 0x0, 0x0) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r1, 0x84, 0x1b, &(0x7f00000003c0)=ANY=[@ANYBLOB="97374b1b23be334463974a9b076be289916abd3bc4e907bb1ce1b8d843ca87ebbe6528694b6bb1a9cf63d91da325ab881f415192aa9a3e4ac036dc7d252c193d9405e3cd84472fd280b789d89751d11be5200cc0d162006446cfb702b660345763e0a4d0b4e00c3a57cd0a254d6e6d76a96767023d14fcae5b6d197f64bd35c49ea2bd6c48035d4ec24b00513b8b3af21accf93238568aa2671b3ba4bb206c5fd571130deb4abbf3ba682577a8d6abc4979379e7ac306a0c606f4fc1e3bc40a772d1f30b3356498345c1e995aec3d80f5fb1e86df6cda2d9303834add4ed19af1449e2de3fc9f2de09b7f1355fc864cb4e8495a4210b178ae55f91f48f90bb906720117fc7c4c7ba579ae784f81959dabe8b55f4e46f575a91be11e853a28f25ec78ad5aa92f6cdadb6c9ecec411af7cd2047723fd5e27853c20ee3eb2777d6e0aad8a055ee674646eb90a3191832ff2dccd86e4f4f32950b903994905f9589462251f1748035daa8914986e873329b4fc6d9b1e8330e074e1af99bb74ff8117da9ba980ad05a8c1aefb9c395b0c9f02b04a794580f1c5ffa685f8fff7414b618bf80bceb3f1bc5ae1f18987d2da358ad3400cee7d3bab8f852921ff904cdf7c250100010000000000cc50016185798994c8cd785ad01ec6f2ae87967fdeafc8f19b1048e85c92d85f8226bac0560d44e21570ba9fd37e2eb86d5491f69c87c7966b43ab349300"/531], 0x0) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r1, 0x84, 0x6c, 0x0, 0x0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) socket$netlink(0x10, 0x3, 0x0) mkdir(0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) ioctl$GIO_UNISCRNMAP(0xffffffffffffffff, 0x4b69, 0x0) sendto$packet(r4, &(0x7f0000000340), 0xfffffffffffffd4d, 0x0, 0x0, 0x0) [ 2881.309670][T23488] binder: 23486:23488 ioctl 400454ca 0 returned -22 [ 2881.318898][T23482] binder: 23481:23482 ioctl 40046206 0 returned -22 [ 2881.339420][T23482] binder: 23481:23482 ioctl c0306201 0 returned -14 [ 2881.411301][T23493] binder: 23481:23493 ioctl 40046206 0 returned -22 08:55:01 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0xfffffff0, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) 08:55:01 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:55:01 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x400454cb, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2881.796223][T23603] binder: 23602:23603 ioctl c0306201 0 returned -14 [ 2881.815042][T23605] binder: 23604:23605 ioctl 400454cb 0 returned -22 [ 2881.865969][T23610] binder: 23602:23610 ioctl c0306201 0 returned -14 08:55:01 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40045568, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:01 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046214, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 2882.152827][ C0] net_ratelimit: 4 callbacks suppressed [ 2882.152836][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2882.164379][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2882.166494][T23615] binder: 23613:23615 ioctl 40045568 0 returned -22 [ 2882.203913][T23608] validate_nla: 6 callbacks suppressed [ 2882.203941][T23608] netlink: 'syz-executor.5': attribute type 12 has an invalid length. [ 2882.209730][T23619] binder: 23613:23619 ioctl 40045568 0 returned -22 08:55:01 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40045613, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2882.298680][T23617] binder: 23616:23617 ioctl 40046214 0 returned -22 [ 2882.338003][T23622] binder: 23616:23622 ioctl c0306201 0 returned -14 08:55:01 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046242, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 2882.521624][T23627] binder: 23625:23627 ioctl 40045613 0 returned -22 [ 2882.552817][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2882.558899][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2882.660453][T23632] binder: 23628:23632 ioctl 40046242 0 returned -22 [ 2882.723357][T23636] binder: 23628:23636 ioctl c0306201 0 returned -14 [ 2882.785220][T23632] binder: 23628:23632 ioctl 40046242 0 returned -22 [ 2882.793962][T23636] binder: 23628:23636 ioctl c0306201 0 returned -14 [ 2882.796719][T23491] netlink: 'syz-executor.0': attribute type 12 has an invalid length. 08:55:02 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) syz_open_procfs(0x0, &(0x7f0000272000)) 08:55:02 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_SET_TIME(r0, 0x4024700a, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x44ff}) getsockopt$inet6_buf(r0, 0x29, 0x1f, &(0x7f00000000c0)=""/150, &(0x7f0000000000)=0x96) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000002900)='/dev/null\x00', 0x80000, 0x0) ioctl$ASHMEM_GET_PROT_MASK(r1, 0x7706, &(0x7f0000000240)) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r1, 0x28, 0x1, &(0x7f00000001c0)=0x800, 0x8) preadv(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = fcntl$dupfd(0xffffffffffffff9c, 0x0, 0xffffffffffffffff) signalfd4(r2, 0x0, 0x0, 0x0) r3 = creat(&(0x7f0000000300)='./bus\x00', 0xffffffefffffffff) r4 = socket$inet6(0xa, 0x400000000001, 0x0) r5 = dup(r4) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) ioctl$TCFLSH(r3, 0x540b, 0x0) tee(0xffffffffffffffff, 0xffffffffffffffff, 0x4a, 0x0) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000280)=0x7f, 0x4) bind$inet6(r4, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r6, 0x2007fff) sendfile(r5, r6, 0x0, 0x8000fffffffe) close(r4) 08:55:02 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046203, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:02 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) 08:55:02 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046249, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 2882.897308][T23634] netlink: 'syz-executor.5': attribute type 12 has an invalid length. [ 2883.067466][T23647] binder: 23645:23647 unknown command 0 [ 2883.075802][T23646] binder: 23642:23646 ioctl 40046203 0 returned -22 [ 2883.096572][T23647] binder: 23645:23647 ioctl c0306201 200002c0 returned -22 [ 2883.098457][T23644] binder: 23643:23644 ioctl 40046249 0 returned -22 [ 2883.147530][T23655] binder: 23643:23655 ioctl c0306201 0 returned -14 [ 2883.192856][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2883.198843][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2883.241604][T23650] netlink: 'syz-executor.0': attribute type 12 has an invalid length. 08:55:02 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0xf0ffffffffffff, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) 08:55:02 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046205, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:02 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="e38fa5055e0bcfec7be070") r1 = socket$key(0xf, 0x3, 0x2) r2 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x1, 0x2) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000180)='IPVS\x00') ioctl$SCSI_IOCTL_GET_PCI(r2, 0x5387, &(0x7f0000000300)) sendmsg$IPVS_CMD_DEL_DAEMON(r2, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0xac, r3, 0x400, 0x70bd25, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xfffffffffffffff8}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x5}, @IPVS_DEST_ATTR_TUN_PORT={0x8, 0xe, 0x4e24}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_DAEMON={0x54, 0x3, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast1}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @remote}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x4}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x10000}]}, @IPVS_CMD_ATTR_DEST={0x18, 0x2, [@IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@remote}]}]}, 0xac}, 0x1, 0x0, 0x0, 0x40}, 0x90) sendmsg$key(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x2, 0x3, 0x0, 0x3, 0xb, 0x0, 0x0, 0x0, [@sadb_key={0x1, 0x9}, @sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @multicast1}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x3, 0xb}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @multicast1}}]}, 0x58}}, 0x0) 08:55:02 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40049409, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:55:02 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) [ 2883.604138][T23771] binder: 23765:23771 ioctl c0306201 0 returned -14 [ 2883.628563][T23773] binder: 23762:23773 ioctl 40046205 0 returned -22 08:55:03 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r1, 0x4, &(0x7f0000000000)='/dev/snapshot\x00', &(0x7f0000000040)='./file0\x00', r0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:55:03 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046206, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2883.700794][T23874] binder: 23765:23874 ioctl c0306201 0 returned -14 [ 2883.948854][T23882] binder: 23881:23882 ioctl 40046206 0 returned -22 [ 2884.029170][T23886] binder: 23881:23886 ioctl 40046206 0 returned -22 [ 2884.102940][T23772] netlink: 'syz-executor.5': attribute type 12 has an invalid length. 08:55:03 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) syz_open_procfs(0x0, &(0x7f0000272000)) 08:55:03 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40086408, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:55:03 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:03 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) fsconfig$FSCONFIG_CMD_RECONFIGURE(r0, 0x7, 0x0, 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="116348400000000038969f4941636b654d370000"], 0x0, 0x0, 0x0}) ioctl$SNDRV_TIMER_IOCTL_INFO(r0, 0x80e85411, &(0x7f0000000300)=""/211) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="b527ff7f9c2078beeda68d9f6fb5aea411642310e568a17e3f93a98ef060520ec0ede0d25ce50ba6dcd157ef23c4b0cd52520a9b71fe84ccc647d25f283deab064b67fd75481c2c8af0c9be17b54cd606c3b03c6cd4b82b134a84f0b72c5de003e54141a01e7c2b338d8e2848cd1a668b5c499f54da967fe4174de5c43c9de384fc22b"], 0x0, 0x0, 0x0}) [ 2884.242958][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2884.248910][ C0] protocol 88fb is buggy, dev hsr_slave_1 08:55:03 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046210, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2884.377126][T23994] binder: 23992:23994 ioctl 40086408 0 returned -22 [ 2884.410220][T24008] binder: 23992:24008 ioctl c0306201 0 returned -14 [ 2884.597372][T24110] binder: 24085:24110 ioctl 40046210 0 returned -22 [ 2884.632763][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2884.638656][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2884.643007][T23999] netlink: 'syz-executor.0': attribute type 12 has an invalid length. 08:55:04 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x100000000000000, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) 08:55:04 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000000)=r0, 0x4) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$UI_BEGIN_FF_ERASE(r0, 0xc00c55ca, &(0x7f0000000040)={0x1, 0x7ff, 0x9}) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="116348000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:55:04 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x400c4301, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:55:04 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046214, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:04 executing program 3: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046205, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2884.881443][T24116] binder: 24114:24116 ioctl 400c4301 0 returned -22 [ 2884.906832][T24117] binder: 24115:24117 unknown command 4743953 [ 2884.924054][T24117] binder: 24115:24117 ioctl c0306201 20000100 returned -22 [ 2884.967669][T24116] binder: 24114:24116 ioctl c0306201 0 returned -14 [ 2885.057365][T24126] binder: 24122:24126 ioctl 40046205 0 returned -22 [ 2885.076506][T24116] binder: 24114:24116 ioctl 400c4301 0 returned -22 [ 2885.077283][T24151] binder: 24114:24151 ioctl c0306201 0 returned -14 08:55:04 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) ioctl$TUNSETFILTEREBPF(r0, 0x800454e1, &(0x7f0000000000)=r1) [ 2885.152364][T24123] binder: 24119:24123 ioctl 40046214 0 returned -22 08:55:04 executing program 3: socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f000072eff0)=[{&(0x7f0000000400)="480000001400257f09004b01fcfc8c860aff72050017e0060200e30900000000000000000000ffff5bf109000000ed5e0000008e0d8615004b76006203005b000000000000000000", 0x48}], 0x1) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x2, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r1, 0xc0a85352, &(0x7f0000000040)={{0x19d9, 0x1}, 'port0\x00', 0x8, 0x800, 0x6, 0x0, 0x3, 0x7, 0x4, 0x0, 0x5, 0xffffffffffffdf24}) [ 2885.206903][T24125] netlink: 'syz-executor.5': attribute type 12 has an invalid length. [ 2885.758806][T23999] netlink: 'syz-executor.0': attribute type 12 has an invalid length. 08:55:05 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) syz_open_procfs(0x0, &(0x7f0000272000)) 08:55:05 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x4018620d, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:55:05 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="12630df54683bb4dec33c4510fd3785fc3644840835e2ff491d4a66410e239a19f1efc3074b6b61a0122c425"], 0x0, 0x0, 0x0}) 08:55:05 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046242, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:05 executing program 3: r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x44000, 0x0) setsockopt$inet_udp_int(r0, 0x11, 0x67, &(0x7f0000000040)=0xa589, 0x4) r1 = open(&(0x7f00009e1000)='./file0\x00', 0x8044, 0x0) fcntl$setlease(r1, 0x400, 0x0) fcntl$getflags(r1, 0x401) [ 2885.813491][T24344] netlink: 'syz-executor.5': attribute type 12 has an invalid length. [ 2885.940583][T24347] binder: 24345:24347 ioctl 4018620d 0 returned -22 [ 2885.964031][T24356] binder: 24349:24356 ioctl 40046242 0 returned -22 [ 2885.985305][T24357] binder: 24345:24357 ioctl c0306201 0 returned -14 [ 2886.001270][T24355] binder: 24346:24355 unknown command -183672046 [ 2886.021271][T24355] binder: 24346:24355 ioctl c0306201 200002c0 returned -22 [ 2886.040088][T24354] netlink: 'syz-executor.0': attribute type 12 has an invalid length. [ 2886.040985][T24347] binder: 24345:24347 ioctl 4018620d 0 returned -22 08:55:05 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x200000000000000, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) 08:55:05 executing program 3: r0 = socket$inet6(0xa, 0x801, 0x0) bind$inet6(r0, &(0x7f0000000380)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000200)={@in6={{0xa, 0x0, 0x0, @loopback}}, 0x0, 0x5, 0x0, "913fa7c292d3d3841feaa73b24735180b4fadafbd0ae8fdf06dc1c0fffaedf7b3cf0239733e29abbc5d501554cc12846eb3ebd34bab758954fc222777a53c4c0a8e473b6e9bb9bd5b5f2ee63c9774539"}, 0xd8) r1 = dup(r0) sendto$inet6(r0, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r1, 0x84, 0x6d, &(0x7f0000000000)=ANY=[@ANYRES32=0x0, @ANYBLOB="00f57ae13d46d8b0d48ab98ba152926bf2"], 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, &(0x7f0000000340)={r2, 0x6}, &(0x7f00000003c0)=0x8) ioctl$RNDADDTOENTCNT(0xffffffffffffffff, 0x40045201, &(0x7f0000000140)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) fchown(0xffffffffffffffff, 0x0, 0x0) sendto$inet(r1, &(0x7f0000000040)="a8b2cc", 0x3, 0x40051, 0x0, 0x0) r3 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) socket$inet(0x2, 0x0, 0x0) ioctl$BLKFRASET(0xffffffffffffffff, 0x1264, 0x0) ftruncate(r3, 0x2007fff) sendfile(r1, r3, 0x0, 0x87ff7) [ 2886.101806][T24357] binder: 24345:24357 ioctl c0306201 0 returned -14 08:55:05 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046249, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:05 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x4020940d, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:55:05 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf88, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) connect$tipc(r0, &(0x7f0000000000)=@name={0x1e, 0x2, 0x3, {{0x43, 0x3}, 0x3}}, 0x10) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) [ 2886.392048][T24454] binder: 24451:24454 ioctl 40046249 0 returned -22 [ 2886.466539][T24480] binder: 24478:24480 ioctl c0306201 0 returned -14 08:55:06 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40049409, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2886.548826][T24487] binder: 24478:24487 ioctl c0306201 0 returned -14 08:55:06 executing program 3: syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x0) inotify_init() pipe(&(0x7f0000000400)={0xffffffffffffffff}) openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/fuse\x00', 0x2, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200), 0x0) vmsplice(r0, &(0x7f0000000000), 0x0, 0x0) timer_create(0x3, &(0x7f0000000080)={0x0, 0x2c, 0x0, @thr={&(0x7f0000000240)="90053d0e1ff1929542b3b20cab762cca657e5d1fbd0e4f0866aead1168981f6924326dd6bfb66cf66926fb9d5aff7da1f4ce5b4ac61cf9f8c3f131f86f17e0ddc2781e0629202a97057df85ca404ee5608524cef3f02f4c4c3f6533562483dc397dc93b66c143bd90a53aadc167b4931fc1d0d62f42dafd876564b6eaca248bb5870a1f5267d5743f9a941537f220a001ea8e28b06e8904be1bc8c919de76b92d1de6c21c5e4a156823b76943e6539dccf462aa8bdf3589d3017287b29c157f41c6df58c22077a697e30e4d268e725d790dffa00ff2f", &(0x7f0000000000)="e92e4fae6080a94905577756"}}, &(0x7f0000000100)) 08:55:06 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) syz_open_procfs(0x0, &(0x7f0000272000)) 08:55:06 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x800454d2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:55:06 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) r2 = perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x66, 0x0, &(0x7f0000000400)=ANY=[@ANYRESOCT, @ANYRESDEC=r3, @ANYRES32=r3, @ANYRESOCT=r3, @ANYPTR=&(0x7f0000000140)=ANY=[@ANYRESDEC=r2, @ANYRESDEC=r2, @ANYPTR64=&(0x7f0000000300)=ANY=[@ANYRESOCT=r3, @ANYBLOB="c66b1bdc61db85d82a21ade70a5fd4de3270c139644d03cb115d1c3468b2ea0072c49db34fb5f072e4c41ce005065ad5f87b6e480d16ef995bced8f74ac7e26697608b9d1cd05fb207c945178b39b230898f5910d75c776ad791e48930132a50228f7d73293e6667d35962a19d41a93ccdbff5b5fa979276d79a81202c06bd3928", @ANYRESOCT=0x0, @ANYRES32=r3, @ANYRES16=r4, @ANYRES64=r2, @ANYRESHEX=r3, @ANYBLOB="82c4ef4ee376a548c9a75cca"], @ANYRES32=0x0, @ANYPTR=&(0x7f0000000040)=ANY=[@ANYRESHEX=r1], @ANYRESDEC=r4, @ANYRESOCT=r0], @ANYRES32=r1, @ANYRESDEC], 0x0, 0x0, 0x0}) 08:55:06 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000140)="11dd86055e0bceec7be070") r1 = timerfd_create(0x8, 0x0) r2 = openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x1, 0x50) ioctl$VT_OPENQRY(r2, 0x5600, &(0x7f0000000040)) timerfd_gettime(r1, &(0x7f0000000080)) 08:55:06 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40082404, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:06 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x400000000000000, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) [ 2887.352793][ C1] net_ratelimit: 6 callbacks suppressed [ 2887.352802][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2887.364751][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2887.384366][T24614] validate_nla: 3 callbacks suppressed [ 2887.384395][T24614] netlink: 'syz-executor.5': attribute type 12 has an invalid length. [ 2887.405856][T24619] binder: 24609:24619 unknown command 926363952 [ 2887.419697][T24619] binder: 24609:24619 ioctl c0306201 200002c0 returned -22 [ 2887.440764][T24611] binder: 24610:24611 ioctl 800454d2 0 returned -22 08:55:06 executing program 3: r0 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x4200, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0x1ff, 0x100000001, 0xfff, 0x6, 0xffffffff00000001}, 0x14) r1 = syz_open_dev$midi(&(0x7f0000000080)='/dev/midi#\x00', 0x1, 0x80000) ioctl$KVM_GET_SREGS(r0, 0x8138ae83, &(0x7f00000000c0)) ioctl$FS_IOC_FIEMAP(r1, 0xc020660b, &(0x7f0000000200)={0x100000000, 0xffffffffffffffff, 0x7, 0x1, 0x1, [{0x7fff, 0x1, 0x2, 0x0, 0x0, 0x2001}]}) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f0000000280)='ppp0!^,\x00') mq_timedsend(r1, &(0x7f00000002c0)="cc60e33dbe1cb0e966bb1235acb134ce6986f23bdcae28f55ad958f2e52e16f45f392f88a4a3ad5307ad3b43f10ae43dc2d187846729559325a88e084d1d285194ad6dbdf49d7efb86d1361459bbb8d581a2fcc3bedc835c7b12e6d549a191814fe7bece9b2753ba8bc78d392c4e8d40d6904e2f7ff0958895aff2b231ea90170998185d5aa12f77243180b722487ff7a4cbff924d27e10119e417a9c64df1b1ef4db385532d5a9c9bc84cd02a4573edc47270", 0xb3, 0x8, &(0x7f0000000380)={0x77359400}) r2 = syz_open_dev$evdev(&(0x7f00000003c0)='/dev/input/event#\x00', 0x6, 0x4800) ioctl$DRM_IOCTL_GET_STATS(r2, 0x80f86406, &(0x7f0000000400)=""/96) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r1, 0xc00c642d, &(0x7f0000000480)={0x0, 0x80000, r1}) ioctl$DRM_IOCTL_VERSION(r3, 0xc0406400, &(0x7f00000006c0)={0x80, 0x8000, 0x1, 0x7b, &(0x7f00000004c0)=""/123, 0x9e, &(0x7f0000000540)=""/158, 0x93, &(0x7f0000000600)=""/147}) prctl$PR_MCE_KILL(0x21, 0x1, 0x2) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000700)=0x2) ioctl$VIDIOC_G_PARM(r1, 0xc0cc5615, &(0x7f0000000740)={0x0, @raw_data="334904b66e6d2f5f13116c9c23b5537b23aa531ce8e53ac53cad63c7ae01be6d4e3d67fc0d2a571e47fa773873a585e960b81263d4fcc54e89b3eec4c2a75f330597f1a7253a837d60c87a907bc2f4c584d2b342b7fa8443a9adcc1d7036f95913b879825b9a57c121f60498178ceae53c6053812e17a3f2c8fcfb4356b0351f0e301f75ba1aca64cbc31279993bcff02927cf5efc4e41098d89a716ca678cf56feed99657432b672e781e75740d5e38821e91cb4e3e8f28b9f186fe2f89b16a165966fa1893b4e0"}) prctl$PR_GET_NO_NEW_PRIVS(0x27) ioctl$SNDRV_RAWMIDI_IOCTL_DRAIN(r0, 0x40045731, &(0x7f0000000840)) r4 = ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) ioctl$VIDIOC_G_PARM(r1, 0xc0cc5615, &(0x7f0000000880)={0x0, @output={0x1000, 0x1, {0x7fff, 0x1d81}, 0x1, 0x1f}}) getsockopt$inet_sctp_SCTP_MAXSEG(r1, 0x84, 0xd, &(0x7f0000000980)=@assoc_value={0x0, 0x9}, &(0x7f00000009c0)=0x8) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r0, 0x84, 0x73, &(0x7f0000000a00)={r5, 0x13a, 0x10, 0x200}, &(0x7f0000000a40)=0x18) signalfd(r4, &(0x7f0000000a80)={0x7f}, 0x8) syz_open_dev$swradio(&(0x7f0000000ac0)='/dev/swradio#\x00', 0x1, 0x2) getsockopt$inet_mreqn(r0, 0x0, 0x24, &(0x7f0000000b00)={@multicast2, @local, 0x0}, &(0x7f0000000b40)=0xc) connect$can_bcm(r0, &(0x7f0000000b80)={0x1d, r7}, 0x10) ioctl$TCSETAF(r1, 0x5408, &(0x7f0000000bc0)={0x0, 0x3, 0x3, 0x7, 0x7, 0x846a, 0x1, 0xb54, 0x1, 0x3}) recvmmsg(r3, &(0x7f0000003dc0)=[{{&(0x7f0000000c00)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, 0x80, &(0x7f00000021c0)=[{&(0x7f0000000c80)=""/66, 0x42}, {&(0x7f0000000d00)=""/191, 0xbf}, {&(0x7f0000000dc0)=""/97, 0x61}, {&(0x7f0000000e40)=""/225, 0xe1}, {&(0x7f0000000f40)=""/211, 0xd3}, {&(0x7f0000001040)=""/4096, 0x1000}, {&(0x7f0000002040)=""/83, 0x53}, {&(0x7f00000020c0)=""/246, 0xf6}], 0x8, &(0x7f0000002240)=""/225, 0xe1}, 0x6}, {{&(0x7f0000002340)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f00000025c0)=[{&(0x7f00000023c0)=""/199, 0xc7}, {&(0x7f00000024c0)=""/132, 0x84}, {&(0x7f0000002580)=""/12, 0xc}], 0x3, &(0x7f0000002600)=""/4096, 0x1000}, 0x2}, {{&(0x7f0000003600)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x80, &(0x7f0000003800)=[{&(0x7f0000003680)=""/184, 0xb8}, {&(0x7f0000003740)=""/171, 0xab}], 0x2, &(0x7f0000003840)=""/19, 0x13}, 0x9}, {{&(0x7f0000003880)=@ax25={{0x3, @rose}, [@null, @rose, @remote, @null, @netrom, @netrom, @rose, @netrom]}, 0x80, &(0x7f0000003d40)=[{&(0x7f0000003900)=""/255, 0xff}, {&(0x7f0000003a00)=""/170, 0xaa}, {&(0x7f0000003ac0)=""/255, 0xff}, {&(0x7f0000003bc0)=""/104, 0x68}, {&(0x7f0000003c40)=""/243, 0xf3}], 0x5}, 0x8ea8}], 0x4, 0x2000, &(0x7f0000003ec0)) setsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000003f00)=@assoc_value={r6}, 0x8) setsockopt$inet6_tcp_TLS_TX(r1, 0x6, 0x1, &(0x7f0000003f40)=@gcm_128={{0x304}, "b854ac26970aa2cd", "129d6b9e7e726b64a138592c6230bc66", "298cc93c", "0b142d43fda30986"}, 0x28) ioctl$sock_inet_SIOCSIFNETMASK(r0, 0x891c, &(0x7f0000003f80)={'team0\x00', {0x2, 0x4e23, @multicast2}}) ioctl$DRM_IOCTL_SET_MASTER(r2, 0x641e) [ 2887.452258][T24615] binder: 24608:24615 ioctl 40082404 0 returned -22 [ 2887.470106][T24611] binder: 24610:24611 ioctl c0306201 0 returned -14 [ 2887.543812][T24611] binder: 24610:24611 ioctl 800454d2 0 returned -22 [ 2887.549820][T24652] binder: 24608:24652 ioctl 40082404 0 returned -22 [ 2887.612978][T24650] binder: 24610:24650 ioctl c0306201 0 returned -14 08:55:07 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40101283, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:07 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x80086301, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:55:07 executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x484100, 0x0) ioctl$SNDRV_SEQ_IOCTL_DELETE_QUEUE(r1, 0x408c5333, &(0x7f0000000100)={0x5000000000, 0x9, 0x3, 'queue0\x00', 0x1}) syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x8, 0x300) getsockopt$netlink(r0, 0x10e, 0x3, 0x0, &(0x7f00000000c0)=0x334) 08:55:07 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_DEVICE_ATTR(r1, 0x4018aee1, &(0x7f0000000040)={0x0, 0x4, 0xd32, &(0x7f0000000000)=0x9}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="1163484000000000000000002837316e00000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) [ 2887.865102][T24732] binder: 24731:24732 ioctl 40101283 0 returned -22 08:55:07 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x401070c9, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2888.025169][T24743] binder: 24741:24743 unknown command 0 [ 2888.028666][T24735] binder: 24734:24735 ioctl 80086301 0 returned -22 [ 2888.031286][T24744] binder: 24734:24744 ioctl c0306201 0 returned -14 [ 2888.059274][T24743] binder: 24741:24743 ioctl c0306201 200002c0 returned -22 [ 2888.224026][T24763] binder: 24762:24763 ioctl 401070c9 0 returned -22 [ 2888.252514][T24848] binder: 24762:24848 ioctl 401070c9 0 returned -22 [ 2888.276815][T24620] netlink: 'syz-executor.0': attribute type 12 has an invalid length. [ 2888.392838][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2888.398712][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2888.452407][T24789] netlink: 'syz-executor.5': attribute type 12 has an invalid length. [ 2888.504979][T24845] netlink: 'syz-executor.0': attribute type 12 has an invalid length. 08:55:08 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) syz_open_procfs(0x0, &(0x7f0000272000)) 08:55:08 executing program 3: r0 = shmget$private(0x0, 0x4000, 0x0, &(0x7f0000ffc000/0x4000)=nil) shmat(r0, &(0x7f0000ffc000/0x4000)=nil, 0x4000) mlock2(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1) shmctl$SHM_LOCK(r0, 0xb) syz_open_dev$sndctrl(&(0x7f0000000000)='/dev/snd/controlC#\x00', 0xffffffffffffb51b, 0x80040) shmctl$SHM_UNLOCK(r0, 0xc) 08:55:08 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0xc0045878, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:55:08 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x4018620d, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:08 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$INOTIFY_IOC_SETNEXTWD(r0, 0x40044900, 0xe5) ioctl$sock_TIOCINQ(r0, 0x541b, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:55:08 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0xa00000000000000, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) [ 2888.729287][T24868] netlink: 'syz-executor.5': attribute type 12 has an invalid length. [ 2888.739103][T24865] binder: 24863:24865 ioctl c0306201 0 returned -14 08:55:08 executing program 3: ioctl$UI_GET_VERSION(0xffffffffffffffff, 0x400c55cb, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r0, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) ioctl$EXT4_IOC_SWAP_BOOT(0xffffffffffffffff, 0x6611) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000280)={0x1}, 0x8) listen(r0, 0x8) r1 = socket$inet6_sctp(0xa, 0xffffffffffffffff, 0x84) syz_open_dev$cec(0x0, 0x0, 0x2) r2 = accept4(r0, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f000055bfe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0x3) close(r2) ioctl$VIDIOC_SUBDEV_S_CROP(r0, 0xc038563c, &(0x7f0000000000)={0x0, 0x0, {0x8, 0x1ff, 0x8, 0x20}}) [ 2888.776487][T24871] binder: 24864:24871 ioctl 4018620d 0 returned -22 [ 2888.786804][T24915] binder: 24863:24915 ioctl c0306201 0 returned -14 [ 2888.794308][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2888.794877][ C0] protocol 88fb is buggy, dev hsr_slave_1 08:55:08 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0xc0045878, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:55:08 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x800) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="116348400000000000000000000081000000000009d1287571b51cb90504326fea7e1404e0c4c79dd1827e8f1b0ed9132834610e506f0f3598767ed9fc8c0fccfec4065b9c97542b2bfebda15138f72b5f8d9de1c0ec087ffca1688dbd9589aa3a51fba640fc4ae37c87d7a21057a39a42fd2dcd0121ea73ea42e1f1de5efddfa62b1c458c22858606b4be755924bbe20288908d7e3f1d48295c3b5132ad009d756395715a690386c40f002c927d4b165820ad279b0fae6a0810dfaaba6e6e97"], 0x0, 0x0, 0x0}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000280)={r0, 0xc0, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=0x1, 0x0, 0x0, 0x0, &(0x7f0000000080)={0x6, 0x1}, 0x0, 0x0, &(0x7f0000000140)={0x2, 0x4, 0x8, 0x3}, &(0x7f0000000180)=0x7, 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)=0x4}}, 0x10) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f00000003c0)=r3, 0x4) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:55:08 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x4020940d, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:08 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x4020ae46, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2889.152569][T24989] binder: 24984:24989 ioctl c0306201 0 returned -14 [ 2889.210216][T25039] binder: 24984:25039 ioctl c0306201 0 returned -14 08:55:08 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0xc0046209, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 2889.409868][T25103] binder: 25102:25103 ioctl 4020ae46 0 returned -22 [ 2889.432807][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2889.438822][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2889.467758][T25109] binder: 25102:25109 ioctl 4020ae46 0 returned -22 [ 2889.572150][T24875] netlink: 'syz-executor.0': attribute type 12 has an invalid length. [ 2889.719456][T25112] netlink: 'syz-executor.5': attribute type 12 has an invalid length. [ 2889.809963][T25116] netlink: 'syz-executor.0': attribute type 12 has an invalid length. 08:55:09 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) syz_open_procfs(0x0, &(0x7f0000272000)) 08:55:09 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) setsockopt$inet_int(r1, 0x0, 0x18, &(0x7f0000000000)=0x489, 0x4) 08:55:09 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40286608, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:09 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:55:09 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0xe00000000000000, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) 08:55:09 executing program 3: ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000040)=0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/zero\x00', 0x80800, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001bc0)={r1, &(0x7f0000001a40)="e9c858c39b36ec5c12a06788ce1711b8300afef27c87c97afd14119bfa962f88d4d87d02abc416cc919c3f219d2e3ea994c1cb9fda50f293b571d5e2ab1954a50facb9b230f5def77ad12e678747f78bc3e996c289fc57d2095a42f0d107c98c15e687810ef5ac0c68d75d8c24d16c9282ada2d3a2bd427917c82523053a3ed76dfa77dd8f06ba89f0567fbd8be5a86a581f9b680054fb79dcea879e90084c3a63c2bc38d748c8a9baf365a8ebac90d3dc02d12fd112", &(0x7f0000001b00)=""/135}, 0x18) process_vm_writev(r0, &(0x7f00000006c0)=[{&(0x7f00000008c0)=""/4096, 0x1000}, {&(0x7f0000000440)=""/210, 0xd2}, {&(0x7f0000000100)=""/44, 0x2c}, {&(0x7f0000000540)=""/244, 0xf4}, {&(0x7f0000000640)=""/113, 0x71}], 0x5, &(0x7f00000019c0)=[{&(0x7f00000018c0)=""/182, 0xb6}, {&(0x7f0000000140)=""/48, 0x30}, {&(0x7f0000001980)=""/19, 0x13}], 0x3, 0x0) r2 = socket$kcm(0x2, 0x200000000000001, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000740)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x92\xee2\xc2$Wx\x15^\xdaM\xeaB\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WZ;\xce\x05\xfc\x95\xd9\x88\x1f|\x8b\xf1\xbf\xf2u\xdd\xd8AV\xd87\x96M\xea\xd2\xa2iM\xe9\xa1\xbc\xba}\xbe\xa1\x05J\"\f\xf9\b\xcf\xb8J\x13#\xecT\xdf\xe0\x9dOA>\xe9\x99\xf8\xaf@{dw\b\xe7{\xaf\x9a\x1e3\xc1\x83&\x89\xc2\xa5\xb1\xe2NN\xdf\xd3\x0f{\x8c\xc1\xc8y\x01\x04\x00\xc7\x94\xe3\x89|\xd7\x9f\xd3\x06\x17\xe6]\xd7\x81q\x1d\x1dN\x9e\xf4c\x83\x86_\xfc\xbc\xdd\xd4{\xde\xc4\xe5\xb6\b;L\x1cN\xa2\xc9k\xd7 \xc3\xe4\x19\x96\x8c\x04\xea\x9c9\xfa\xe3\xc1\x8dDuTHL\n\xe8\xb7oSx\'\xfd=\xfc\xa4\xa51\b\x02j\xb7\x98{`\x89\x8c\xd3\xc6\xe8\xe2\x9b\xd7\xab\xd1s\xfb\xaa\xcd\x9d\xf1\x9e\xee\xe3e\xf1\x91\xf7\xee%\xf8\xc7G', 0x2761, 0x0) setsockopt$sock_attach_bpf(r2, 0x1, 0x3e, &(0x7f00000000c0)=r3, 0x4) sendmsg(r2, &(0x7f0000000080)={&(0x7f00000003c0)=@in={0x2, 0x0, @loopback}, 0x80, 0x0}, 0x20000000) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000b7a000)={0x1, 0x3, &(0x7f0000001dc0)=ANY=[@ANYBLOB="180000000000000000000000000000009500000054a789154a6c5e8ad1c5d948833de500000000"], &(0x7f0000f6bffb)='GPL\x00', 0x1, 0x35b5d52e40a6d39b, &(0x7f00000002c0)=""/251}, 0x48) r5 = socket$kcm(0x29, 0xfffffffffffffffc, 0x0) ioctl$EVIOCGPHYS(r3, 0x80404507, &(0x7f00000001c0)=""/224) ioctl$sock_kcm_SIOCKCMATTACH(r5, 0x89e0, &(0x7f0000000180)={r2, r4}) getsockopt$inet_sctp6_SCTP_STATUS(r4, 0x84, 0xe, &(0x7f0000001c40)={0x0, 0xab, 0x7, 0x101, 0x3f, 0x2, 0x4, 0x8000, {0x0, @in6={{0xa, 0x4e21, 0x9, @mcast1, 0x3}}, 0xaeb, 0x7f, 0x3f, 0x2, 0xffffffffffffff81}}, &(0x7f0000001d00)=0xb0) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r1, 0x84, 0x10, &(0x7f0000001d40)=@assoc_value={r6, 0xffffffffffffffa4}, &(0x7f0000001d80)=0x8) ioctl$TIOCGSID(r3, 0x5429, &(0x7f0000001c00)) close(r5) [ 2890.044749][T25128] binder: 25127:25128 ioctl 40286608 0 returned -22 [ 2890.044814][T25126] binder: 25125:25126 ioctl c018620b 0 returned -14 [ 2890.074090][T25134] netlink: 'syz-executor.0': attribute type 12 has an invalid length. [ 2890.084748][T25150] binder: 25125:25150 ioctl c0306201 0 returned -14 08:55:09 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40345410, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:09 executing program 3: r0 = syz_open_dev$sndpcmc(&(0x7f00000002c0)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffff9c, 0x84, 0x1f, &(0x7f00000004c0)={0x0, @in={{0x2, 0x4e22, @dev}}, 0x6}, 0x0) process_vm_readv(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r0) socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$XDP_RX_RING(0xffffffffffffffff, 0x11b, 0x2, 0x0, 0x0) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x0) ioctl$KVM_HAS_DEVICE_ATTR(r0, 0x4018aee3, &(0x7f00000001c0)={0x0, 0x1, 0x6, &(0x7f0000000000)=0x80000001}) lstat(0x0, &(0x7f0000000100)) ioctl$VIDIOC_G_FMT(r0, 0xc0d05604, &(0x7f0000000580)={0xd, @vbi={0x2, 0x100, 0x7f, 0x30313953, [0xffffffffffffffe1, 0x6], [0x5, 0xffffffffffffff7c], 0x1}}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000480)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) inotify_init() lsetxattr$trusted_overlay_nlink(&(0x7f0000000280)='./file0/bus\x00', &(0x7f0000000400)='trusted.overlay.nlink\x00', &(0x7f0000000440)={'L-', 0x6}, 0x28, 0x2) inotify_add_watch(r0, &(0x7f0000000200)='./file0/bus\x00', 0x8000ff) ioctl$DRM_IOCTL_GET_MAGIC(r0, 0x80046402, &(0x7f0000000240)=0x400) umount2(&(0x7f0000000040)='./file0\x00', 0x0) ioctl$NBD_SET_TIMEOUT(0xffffffffffffffff, 0xab09, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, 0x0, 0x0) ioctl$VIDIOC_G_FMT(0xffffffffffffffff, 0xc0d05604, &(0x7f0000000300)={0x2, @sdr}) 08:55:09 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) getdents(r0, &(0x7f0000000040)=""/42, 0x2a) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e24, @rand_addr=0x132}, 0x10) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$SCSI_IOCTL_START_UNIT(r1, 0x5) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="116348400000000400"/20], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:55:09 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0xc018620c, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 2890.477860][T25251] binder: 25250:25251 ioctl 40345410 0 returned -22 [ 2890.483717][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2890.491324][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2890.512234][T25273] binder: 25250:25273 ioctl 40345410 0 returned -22 08:55:10 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000800000000, 0x800) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="fb9e3e60d41f9511634840c8be000000002cb214da688eeecc6de1354c80586c8f5728a32ed8c0bcd9701ed6130317154e742fc331e2484fecdbc875b6d2223fd4354c672e6097fcc2a889d560b500d829f357a91a9c3fc5057b5285ae3a3a4625402608264a0e6b15c5ef"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:55:10 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40405514, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2890.655234][T25358] binder: 25252:25358 ioctl c0306201 0 returned -14 [ 2890.711371][T25271] binder: 25252:25271 ioctl c018620c 0 returned -14 [ 2890.920037][T25363] binder: 25362:25363 ioctl 40405514 0 returned -22 [ 2890.980162][T25365] binder: 25361:25365 unknown command 1614716667 [ 2891.023324][T25365] binder: 25361:25365 ioctl c0306201 20000100 returned -22 [ 2891.097885][T25130] netlink: 'syz-executor.5': attribute type 12 has an invalid length. 08:55:10 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) syz_open_procfs(0x0, &(0x7f0000272000)) 08:55:10 executing program 3: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) getdents(r0, &(0x7f0000000040)=""/42, 0x2a) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e24, @rand_addr=0x132}, 0x10) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$SCSI_IOCTL_START_UNIT(r1, 0x5) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="116348400000000400"/20], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:55:10 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x4040ae75, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:10 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:55:10 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x3f00000000000000, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) 08:55:10 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0xc0189436, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 2891.450620][T25480] binder: 25479:25480 ioctl 4040ae75 0 returned -22 [ 2891.480706][T25484] binder: 25482:25484 ioctl c0306201 0 returned -14 [ 2891.515521][T25486] binder: BINDER_SET_CONTEXT_MGR already set [ 2891.538423][T25486] binder: 25485:25486 ioctl 40046207 0 returned -16 [ 2891.563972][T25524] binder: 25482:25524 ioctl c0306201 0 returned -14 08:55:11 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x4090ae82, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:11 executing program 3: r0 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mISDNtimer\x00', 0x0, 0x0) ioctl$IMADDTIMER(r0, 0x80044940, &(0x7f0000000180)=0x32) readv(r0, &(0x7f0000001140)=[{&(0x7f0000000040)=""/13, 0xd}], 0x1) 08:55:11 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0xc020660b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:55:11 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000bbc86d8363d0324099db"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:55:11 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x80045430, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:11 executing program 3: r0 = syz_open_dev$video(&(0x7f00000000c0)='/dev/video#\x00', 0x80200000002, 0x1ffc) ioctl$VIDIOC_ENUMSTD(r0, 0xc0485619, &(0x7f0000000040)={0x10000, 0x0, "05247141bf62b63b1b7fa7cd58c396de14d0725b23359e0e"}) [ 2892.009070][T25613] binder: 25611:25613 ioctl 80045430 0 returned -22 [ 2892.014167][T25612] binder: 25605:25612 ioctl c0306201 0 returned -14 [ 2892.031427][T25616] binder: 25611:25616 ioctl 80045430 0 returned -22 [ 2892.057442][T25612] binder: 25605:25612 ioctl c0306201 0 returned -14 [ 2892.442053][T25720] validate_nla: 4 callbacks suppressed [ 2892.442065][T25720] netlink: 'syz-executor.0': attribute type 12 has an invalid length. 08:55:11 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) syz_open_procfs(0x0, &(0x7f0000272000)) 08:55:11 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x800454d2, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:11 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:55:11 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x2, 0x4, 0x4, 0x9}, 0x3c) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x10020000600, 0x0}, 0x2c) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) socket$inet(0x2b, 0x1, 0x50000) r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000640)='/proc/self/net/pfkey\x00', 0x24ffff, 0x0) getsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000080), &(0x7f00000000c0)=0x4) openat$dsp(0xffffffffffffff9c, &(0x7f0000000180)='/dev/dsp\x00', 0x591000, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket(0x3, 0x0, 0xc1b) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000480)='/dev/sequencer\x00', 0x7fff, 0x0) ioctl$KVM_S390_INTERRUPT_CPU(r1, 0x4010ae94, &(0x7f0000000500)={0x8, 0x0, 0x7}) r2 = socket$inet(0x10, 0x3, 0xc) r3 = syz_open_dev$dmmidi(0x0, 0x6, 0x10000) ioctl$KVM_RUN(r1, 0xae80, 0x0) setsockopt$inet6_dccp_int(r3, 0x21, 0x0, &(0x7f0000000300), 0x4) select(0x40, &(0x7f00000001c0)={0x200, 0x6, 0x4, 0x10001, 0x6, 0x0, 0x7, 0x8}, &(0x7f0000000200)={0x200, 0x0, 0x7, 0x0, 0x7, 0x0, 0x0, 0x10000}, &(0x7f0000000240)={0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x20, 0xfffffffffffffff9}, &(0x7f0000000280)={0x77359400}) ioctl$TIOCGPGRP(r3, 0x540f, &(0x7f00000002c0)=0x0) r5 = fcntl$getown(0xffffffffffffffff, 0x9) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) setsockopt$sock_attach_bpf(r6, 0x10f, 0x87, &(0x7f0000000700), 0x4) kcmp(r4, r5, 0x0, r2, r1) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000880)={{{@in6=@remote, @in6=@remote}}, {{@in=@multicast1}, 0x0, @in6=@ipv4}}, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000580), &(0x7f00000005c0)=0xc) mount$fuseblk(&(0x7f0000000380)='/dev/loop0\x00', &(0x7f00000003c0)='\x00', &(0x7f0000000400)='fuseblk\x00', 0x1000030, &(0x7f0000000980)=ANY=[@ANYBLOB="2cbc04b397b28b67af8874d76d61b586e0eaeef7a4624cdd693809532d9f5e4568ca41a8c41b7bab5c78253f3078f50f956a522ebdeb6bfa6aa15d130700c9154a8c5c3f7d61fe1d01765e05a2ca7284f1dbdaf800e7323e1a99f7d6b296c6193c7a38aac537422da4ecf141140538188053f519ae5e130a5e8c80b5334b4881cbdef3b6dcdc06599ce5eb6ac8976b91e8d31c97b222c5ead7fd7ccfdc52deac74594acaeec8610f1d1074d00000000000000006000000000000fb4e404de650d0b4576154d1c6070f40d5f803c29b2bee9160c433a94bcda7bdfcc633df565c41c5f0e45be5917a61a5521bc8b11c005f021a0381ce3dde997dcaff26c4bc982e2498c344e97c57e2eb94a1a90f3cf67cc934c72b8b48bfed058c8a414bcd65be35946a1fea7928982d0965afb9edb4a0bb867ce8f12e7072c72bda00caa41f159f"]) sendmsg(0xffffffffffffffff, 0x0, 0x0) ioctl$UI_DEV_CREATE(r0, 0x5501) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f0000000340)={&(0x7f0000ffc000/0x4000)=nil, 0x4000}, &(0x7f0000000540)=0x10) getrandom(&(0x7f0000000040)=""/153, 0xfffffffffffffe4b, 0x4000000003) [ 2892.498624][T25487] netlink: 'syz-executor.5': attribute type 12 has an invalid length. [ 2892.562839][ C0] net_ratelimit: 4 callbacks suppressed [ 2892.562846][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2892.574456][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2892.619873][T25729] binder: 25726:25729 ioctl 800454d2 0 returned -22 [ 2892.620869][T25730] binder: 25727:25730 ioctl c0306201 0 returned -14 [ 2892.698941][T25735] netlink: 'syz-executor.0': attribute type 12 has an invalid length. [ 2892.719666][T25729] binder: 25726:25729 ioctl 800454d2 0 returned -22 [ 2892.727761][T25733] binder: 25727:25733 ioctl c0306201 0 returned -14 08:55:12 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x4000000000000000, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) 08:55:12 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) r2 = perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$NBD_SET_SIZE(r0, 0xab02, 0x3b800000000000) r3 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0x1, 0x1000}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x1f, &(0x7f0000000140)={r5, @in6={{0xa, 0x4e21, 0x9, @remote, 0x6}}, 0x517, 0x4}, 0x90) connect$rxrpc(r1, &(0x7f0000000080)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}}, 0x24) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) io_setup(0x1, &(0x7f0000000280)=0x0) io_submit(r6, 0x1, &(0x7f0000000440)=[&(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x1, r2, &(0x7f0000000300)="e0fbe5a0503743b5fa1404ffe3158cdeb662e888ea61e77a6367dfb313be9f01076252acfe40a1c1d87b335248cb0d67fee6b48e655438f2059511cc214ce6f19d0a33e4d1266f10668ddedf5b2fe9b178bf88a7045ccd3377220a89325c3933e7489a6e9a0bc6c3900ef4eb621fa41c923e46d3bad1265ae9f7cc4c48d8cc8271f79d5c0733f5eb02c1330d655e8cf2c5881552045cd40cb76c7e3224b1f364f114efb1bc7401fcde52ff48a6ebde1f9415c270890434b1cda1a7d3bd35beaee67989f34e1a0146904c0e519d911e2a335ae72a0c365c72cf37c847ce3d0d65df6687786d0b0c58e441a13f7dd38ca783c1", 0xf2, 0x6, 0x0, 0x3, 0xffffffffffffff9c}]) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="5e72b911"], 0x0, 0x0, 0x0}) 08:55:12 executing program 3: mlock(&(0x7f0000007000/0x3000)=nil, 0x3000) r0 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x0, 0x0) write$P9_RCLUNK(r0, &(0x7f0000000040)={0x7, 0x79, 0x1}, 0x7) mlock2(&(0x7f0000006000/0x3000)=nil, 0x3000, 0x1) ioctl$FS_IOC_GETVERSION(r0, 0x80087601, &(0x7f0000000080)) [ 2892.772178][T25730] binder: 25727:25730 ioctl c0306201 0 returned -14 [ 2892.794291][T25733] binder: 25727:25733 ioctl c0306201 0 returned -14 08:55:12 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x80086301, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2892.886883][T25740] binder: 25739:25740 unknown command 297366110 08:55:12 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0xc0884123, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 2892.938123][T25740] binder: 25739:25740 ioctl c0306201 200002c0 returned -22 [ 2892.939147][T25747] Unknown ioctl -2146929151 [ 2892.952767][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2892.958620][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2893.054665][T25805] Unknown ioctl -2146929151 08:55:12 executing program 3: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/rpc\x00') sendto$inet(r0, &(0x7f0000000180)="80500c57516b1d72afe351de9a5138fa18a55c88aae1f47c8b5e3a5bffced2ce0a297118601fc3be7d21b61d7ec69896ed145fcc5c9cc2a1ee6b87b617be9290ec1ca72693f302fe2f8e793f76117160fe61cb755e22d2802cf92bf7836e4203e7e61a7eae6495ba392d557e0e66e3cd64395ebf80adcba4b7f1507442240d78b78a39071ca4e3635a", 0x89, 0x80, &(0x7f00000000c0)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0xc}}, 0x10) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) openat$vimc1(0xffffffffffffff9c, &(0x7f0000000040)='/dev/video1\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x111, 0xe}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r1, &(0x7f0000000400)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @dev, 0x1}, {0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}, 0x3}}}, 0x48) write$RDMA_USER_CM_CMD_GET_EVENT(r1, &(0x7f0000000080)={0xc, 0x8, 0xfa00, {&(0x7f0000000480)}}, 0x10) [ 2893.115614][T25770] binder: 25769:25770 ioctl c0884123 0 returned -22 [ 2893.151237][T25770] binder: 25769:25770 ioctl c0306201 0 returned -14 [ 2893.190052][T25828] binder: 25812:25828 ioctl 80086301 0 returned -22 [ 2893.224787][T25770] binder: 25769:25770 ioctl c0884123 0 returned -22 08:55:12 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$EVIOCSFF(r0, 0x40304580, &(0x7f0000000000)={0x53, 0xffffffff, 0xfffffffffffffffa, {0x1, 0xb461}, {0x100000001, 0x1000}, @ramp={0x2d0, 0x1, {0x10000, 0x8000, 0xffffffff, 0x5}}}) setsockopt$XDP_UMEM_COMPLETION_RING(r1, 0x11b, 0x6, &(0x7f0000000040)=0x4000, 0x4) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) [ 2893.240983][T25864] binder: 25812:25864 ioctl 80086301 0 returned -22 [ 2893.284829][T25862] binder: 25769:25862 ioctl c0306201 0 returned -14 08:55:12 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 2893.531634][T25951] binder: BINDER_SET_CONTEXT_MGR already set [ 2893.551083][T25951] binder: 25947:25951 ioctl 40046207 2 returned -16 [ 2893.562387][T25951] binder: 25947:25951 ioctl c0306201 0 returned -14 [ 2893.577741][T25951] binder: BINDER_SET_CONTEXT_MGR already set [ 2893.587820][T25977] binder: 25947:25977 ioctl c0306201 0 returned -14 [ 2893.592779][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2893.596447][T25951] binder: 25947:25951 ioctl 40046207 2 returned -16 [ 2893.600507][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2893.741716][T25745] netlink: 'syz-executor.5': attribute type 12 has an invalid length. [ 2893.799347][T25978] netlink: 'syz-executor.5': attribute type 12 has an invalid length. [ 2893.851755][T25852] netlink: 'syz-executor.0': attribute type 12 has an invalid length. 08:55:13 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) syz_open_procfs(0x0, &(0x7f0000272000)) 08:55:13 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x800c6613, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:13 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$DRM_IOCTL_MARK_BUFS(r0, 0x40206417, &(0x7f0000000000)={0xfffffffffffffa65, 0x2, 0x84, 0x0, 0x8, 0x8}) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:55:13 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x3) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:55:13 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x6000000000000000, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) [ 2894.061691][T25988] binder: 25986:25988 ioctl 800c6613 0 returned -22 [ 2894.084019][T25991] binder: BINDER_SET_CONTEXT_MGR already set [ 2894.090259][T25991] binder: 25985:25991 ioctl 40046207 3 returned -16 [ 2894.103931][T25995] netlink: 'syz-executor.5': attribute type 12 has an invalid length. 08:55:13 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000000000)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}, 0xfffffffffffffffd}], 0x166, 0x40002060, 0x0) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000080)) fcntl$getown(r0, 0x9) r1 = fcntl$getown(r0, 0x9) r2 = syz_open_procfs(r1, &(0x7f0000000180)='\x9d!&\xae|\x1b\xa3|\xe8*\v\x13\aBn9\xb7\x11\xea\x95\xbd\x8d\xe3\"\xeav\x10\x17\xee+V\x90\x9f\xa6D\xc2za\x01\xbc\xc8?\x9c\xbeq/\xca\xc1g\xa0\xc5\xd8\x830\x9d\xbf\xe9\xf6\xa4\xe7f(A\x17\x95U>\xaaG%zSR8\xe3\xcd\xea\xc5C~\x86+[\xbc\xc2\x92\xce]\xcc^\x7f\x17\x93\"\xeb\xf3=\x83I\xe0U\xd5c') fsetxattr$trusted_overlay_redirect(r2, &(0x7f00000000c0)='trusted.overlay.redirect\x00', &(0x7f0000000100)='./file0\x00', 0x8, 0x3) preadv(r2, &(0x7f00000017c0), 0x3da, 0x0) [ 2894.134586][T25996] binder: 25986:25996 ioctl 800c6613 0 returned -22 [ 2894.157154][T25991] binder: 25985:25991 ioctl c0306201 0 returned -14 08:55:13 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x801c581f, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2894.229203][T25991] binder: BINDER_SET_CONTEXT_MGR already set [ 2894.264611][T26068] binder: 25985:26068 ioctl c0306201 0 returned -14 [ 2894.305961][T25991] binder: 25985:25991 ioctl 40046207 3 returned -16 08:55:13 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) connect$unix(r1, &(0x7f0000000000)=@file={0x0, './file0\x00'}, 0x6e) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:55:13 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 2894.483432][T26110] binder: 26108:26110 ioctl 801c581f 0 returned -22 08:55:13 executing program 3: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$DRM_IOCTL_MARK_BUFS(r0, 0x40206417, &(0x7f0000000000)={0xfffffffffffffa65, 0x2, 0x84, 0x0, 0x8, 0x8}) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:55:14 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x80404508, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2894.632849][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2894.638508][T26119] binder: BINDER_SET_CONTEXT_MGR already set [ 2894.638774][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2894.682209][T26119] binder: 26118:26119 ioctl 40046207 4 returned -16 [ 2894.752235][T26188] binder: 26118:26188 ioctl c0306201 0 returned -14 08:55:14 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000140)='/dev/snapshot\x00', 0x20001, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) [ 2895.022865][T25999] netlink: 'syz-executor.0': attribute type 12 has an invalid length. [ 2895.042797][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2895.048701][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2895.162444][T26252] netlink: 'syz-executor.0': attribute type 12 has an invalid length. 08:55:14 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) syz_open_procfs(0x0, &(0x7f0000272000)) 08:55:14 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0xc0045878, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:14 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x5) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 2895.247754][T26273] netlink: 'syz-executor.5': attribute type 12 has an invalid length. 08:55:14 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") r1 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000280)='/dev/uhid\x00', 0x802, 0x0) write$UHID_CREATE2(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB="0b00000073797a3000000000000000000000000000000000000000000000000000000000000000000000000000050000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a0000e69200000000000003000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006877797a30f300000000000000000000000000000000b9312ef87bd573e30000000000000000000000000000000000000000000000000000000000000000000000001d8a0d1ac051d64ba428af00000000000100000000000000000000000000000000c0f56d7d7f110000008000000000000000fe65d3433e8a489ef366acce90c49c92cf872c948df4b2d050ecc1a425daad7a8b9ebf4e3748e5b7afe8112a6290e1d531ce8edbabef98f7ba35c526feefac2f1d962b459cebfed2d5de0eda7b12d0f077"], 0x1) getsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000000), &(0x7f0000000080)=0x10) readv(r0, &(0x7f00000000c0)=[{&(0x7f00000002c0)=""/175, 0xaf}], 0x1) clone(0x4100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) rt_sigprocmask(0x1, &(0x7f0000000240)={0xfffffffffffffffc}, &(0x7f0000000380), 0x8) r2 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) ptrace$cont(0x4207, r2, 0x0, 0x0) [ 2895.330716][T26345] binder: 26341:26345 ioctl c0306201 0 returned -14 [ 2895.402470][T26352] binder: 26341:26352 ioctl c0306201 0 returned -14 08:55:14 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x9effffff00000000, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) 08:55:14 executing program 4: r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000080)={0xffffffffffffffff}, 0x0, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_QUERY(r0, &(0x7f0000000180)={0x13, 0x10, 0xfa00, {&(0x7f00000004c0), r1, 0x3}}, 0x18) r2 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) r3 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000780)='/dev/dsp\x00', 0x400, 0x0) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$sock_ifreq(r0, 0x89ff, &(0x7f00000001c0)={'veth0_to_bond\x00', @ifru_mtu=0x9}) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snapshot\x00', 0x1, 0x0) r5 = perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(r4, 0x4004af61, &(0x7f0000000480)=0x1) r6 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r7 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) dup3(r4, r5, 0x80000) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r7, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r7, 0x40046207, 0x0) ioctl$TIOCLINUX3(r4, 0x541c, &(0x7f0000000240)) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r0, 0x84, 0x70, &(0x7f0000000300)={0x0, @in={{0x2, 0x4e24, @broadcast}}, [0x1, 0x8000, 0x2, 0x6e, 0x0, 0x8, 0xdfd, 0x2, 0x40, 0xffff, 0x0, 0x8, 0x9, 0x2, 0x9]}, &(0x7f0000000400)=0x100) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r2, 0x84, 0x77, &(0x7f0000000440)={r8, 0xa460, 0x7, [0xff, 0x6, 0x4, 0x3, 0x2, 0x3ff, 0x0]}, 0x16) poll(&(0x7f0000000280)=[{r0, 0x1}, {r7, 0x10}, {r2, 0x1}, {r7}, {r0, 0x1000}], 0x5, 0x6) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0000cae1be6172ba9f29256d6740d0dcf26dfa5a35b9d9790136f13dbb0000d1b75b11ad21e62cbdf318c30b911dbbedf930c6f66427f3321ac99626c057a0a6233ad4d0349421f04c"], 0x0, 0x0, 0x0}) ioctl$BLKBSZGET(r4, 0x80081270, &(0x7f0000000840)) connect$inet(r3, &(0x7f00000007c0)={0x2, 0xfffffffffffffffb, @multicast2}, 0x10) 08:55:14 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0xc0045878, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:14 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x6) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:55:15 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0xc0046209, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2895.686192][T26363] binder: BINDER_SET_CONTEXT_MGR already set [ 2895.703066][T26363] binder: 26362:26363 ioctl 40046207 6 returned -16 [ 2895.713290][T26359] binder: 26358:26359 unknown command -506855424 [ 2895.752914][T26359] binder: 26358:26359 ioctl c0306201 200002c0 returned -22 [ 2895.774040][T26363] binder: 26362:26363 ioctl c0306201 0 returned -14 [ 2895.824816][T26363] binder: BINDER_SET_CONTEXT_MGR already set [ 2895.835147][T26384] binder: 26362:26384 ioctl c0306201 0 returned -14 [ 2895.880160][T26363] binder: 26362:26363 ioctl 40046207 6 returned -16 [ 2895.904582][T26420] binder: 26380:26420 ioctl c0046209 0 returned -22 08:55:15 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x7) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:55:15 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000000)={0x1}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$TIOCSIG(r1, 0x40045436, 0x2e) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:55:15 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0xc00c642d, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2896.212347][T26484] binder: 26483:26484 ioctl c0306201 0 returned -14 [ 2896.277816][T26580] binder: 26483:26580 ioctl c0306201 0 returned -14 [ 2896.345177][T26553] binder: 26521:26553 ioctl c00c642d 0 returned -22 08:55:16 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) syz_open_procfs(0x0, &(0x7f0000272000)) 08:55:16 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dsp\x00', 0x200, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r1, 0x89e2, &(0x7f0000000140)={r0}) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x8000000000006, 0x0) r4 = dup2(r3, r3) write$P9_RMKNOD(r1, &(0x7f0000000000)={0x14, 0x13, 0x4000000000000002, {0x6, 0x400000000000}}, 0x14) ioctl$sock_FIOGETOWN(r2, 0x8903, &(0x7f0000000180)) ioctl$TCSETSF(r4, 0x5404, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x816f}) 08:55:16 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0xc0106426, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:16 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0xffffffffffffffff, 0x3) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="89da6f8e612e91fc73b2f68db8217038155eb9730e4851efa3cfb963e7780c5f4fbc65adb06b799e91ba721bf4836ad7dc3a59ca34ca60e5282b6c9e58468e7076588027e80b3f29888600d016c4a72be521c46221894ba322db2c82c8890b2386b0313bddba6aa5d00001bf011f000e3070f98ea4355d5d508434942f6cbb4a2a87fb3618c5d0ac2da9d717ad6e"], 0x0, 0x0, 0x0}) 08:55:16 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:55:16 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0xea37000000000000, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) [ 2896.721908][T26608] binder: 26607:26608 ioctl c0106426 0 returned -22 [ 2896.768957][T26613] binder: 26611:26613 ioctl c0306201 0 returned -14 [ 2896.795537][T26639] binder: 26607:26639 ioctl c0106426 0 returned -22 08:55:16 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2896.857048][T26691] binder: 26611:26691 ioctl c0306201 0 returned -14 08:55:16 executing program 3: r0 = socket(0x5, 0x2, 0x200) r1 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x9, 0x14000) ioctl$KVM_PPC_GET_PVINFO(r1, 0x4080aea1, &(0x7f00000000c0)=""/65) getsockopt(r0, 0x200000000114, 0x5, 0x0, &(0x7f0000000080)) 08:55:16 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x48) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:55:16 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_int(r0, 0x0, 0x37, &(0x7f0000000000), &(0x7f0000000040)=0x4) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) [ 2897.096283][T26729] binder: 26728:26729 ioctl c018620b 0 returned -14 08:55:16 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0xc018620c, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2897.187184][T26737] binder: 26733:26737 ioctl c0306201 0 returned -14 [ 2897.204710][T26741] binder: BINDER_SET_CONTEXT_MGR already set [ 2897.226723][T26743] binder: 26733:26743 ioctl c0306201 0 returned -14 [ 2897.243796][T26741] binder: 26738:26741 ioctl 40046207 0 returned -16 08:55:16 executing program 3: mknod$loop(&(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff) mount(&(0x7f0000000080), &(0x7f0000000240)='./file0\x00', 0x0, 0x1000, 0x0) unlink(&(0x7f0000000040)='./file0\x00') [ 2897.427156][T26780] binder: 26762:26780 ioctl c018620c 0 returned -14 [ 2897.527788][T26855] binder: 26762:26855 ioctl c018620c 0 returned -14 [ 2897.609216][T26617] validate_nla: 4 callbacks suppressed [ 2897.609228][T26617] netlink: 'syz-executor.5': attribute type 12 has an invalid length. [ 2897.709151][T26853] netlink: 'syz-executor.5': attribute type 12 has an invalid length. [ 2897.752771][ C1] net_ratelimit: 6 callbacks suppressed [ 2897.752780][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2897.764457][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2897.788558][T26856] netlink: 'syz-executor.0': attribute type 12 has an invalid length. 08:55:17 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) syz_open_procfs(0x0, &(0x7f0000272000)) 08:55:17 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x4c) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:55:17 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x8000, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:55:17 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0xc0189436, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:17 executing program 3: ioctl(0xffffffffffffffff, 0x0, 0x0) mprotect(&(0x7f000040b000/0x2000)=nil, 0x2000, 0x1000804) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x0, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r0, 0x4048ae9b, &(0x7f0000000040)={0x80003, 0x0, [0x10000, 0x81, 0x1, 0x180ec813, 0x8000, 0x10000, 0x6, 0x3]}) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x0, 0x0, 0x0, 0x3) 08:55:17 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0xf0ffffff00000000, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) [ 2897.965955][T26867] netlink: 'syz-executor.5': attribute type 12 has an invalid length. [ 2898.006787][T26873] binder: BINDER_SET_CONTEXT_MGR already set [ 2898.038916][T26873] binder: 26866:26873 ioctl 40046207 4c returned -16 08:55:17 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0xc020660b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:17 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000080)="c0dca5055e00b4ec7be070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000400)=@allocspi={0xf8, 0x16, 0x317, 0x0, 0x0, {{{@in6=@loopback, @in=@multicast2}, {@in6=@local, 0x0, 0x32}, @in6=@remote}, 0x0, 0x8}}, 0xf8}}, 0x0) socket$rxrpc(0x21, 0x2, 0x2) [ 2898.068204][T26891] binder: 26866:26891 ioctl c0306201 0 returned -14 [ 2898.126816][T26873] binder: BINDER_SET_CONTEXT_MGR already set [ 2898.168805][T26891] binder: 26866:26891 ioctl c0306201 0 returned -14 [ 2898.213307][T26873] binder: 26866:26873 ioctl 40046207 4c returned -16 08:55:17 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) r2 = perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0) ioctl$SG_GET_PACK_ID(r0, 0x227c, &(0x7f0000000000)) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$EXT4_IOC_MIGRATE(r2, 0x6609) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0x0) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r3, 0x800c6613, &(0x7f0000000040)={0x0, @aes256, 0x0, "4e84dbfa25db5443"}) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000080)=0x0) get_robust_list(r5, &(0x7f0000000280)=&(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)}}, &(0x7f0000000300)=0x18) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840080000000000a9c2c5f2f36fc0760000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:55:17 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x60) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:55:17 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0xc020aa00, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2898.517481][T26999] binder: BINDER_SET_CONTEXT_MGR already set [ 2898.542252][T27000] binder: 26998:27000 ioctl c020aa00 0 returned -22 [ 2898.552419][T26997] binder: 26994:26997 ioctl 800c6613 20000040 returned -22 [ 2898.554451][T26999] binder: 26995:26999 ioctl 40046207 60 returned -16 [ 2898.584416][T27002] binder: 26998:27002 ioctl c020aa00 0 returned -22 [ 2898.599650][T27016] binder: 26995:27016 ioctl c0306201 0 returned -14 08:55:18 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0xc028aa03, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2898.792787][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2898.798702][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2898.926333][T26877] netlink: 'syz-executor.0': attribute type 12 has an invalid length. [ 2899.027071][T27001] netlink: 'syz-executor.0': attribute type 12 has an invalid length. 08:55:18 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) syz_open_procfs(0x0, &(0x7f0000272000)) 08:55:18 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x68) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:55:18 executing program 4: syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xfff, 0x100) r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x40, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM(0x23, 0x6, &(0x7f0000002000/0x2000)=nil) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:55:18 executing program 3: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0xc020660b, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:18 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0xc02c564a, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2899.078454][T27114] netlink: 'syz-executor.5': attribute type 12 has an invalid length. [ 2899.193568][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2899.200245][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2899.477649][T27130] netlink: 'syz-executor.0': attribute type 12 has an invalid length. 08:55:18 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0xffffff7f00000000, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) 08:55:18 executing program 3: r0 = socket(0xf, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000000)={0x7ff}, 0x34e) write(r0, &(0x7f0000000040)="200000001a00010000000066835f7f081c140000a00080000f00000000800000", 0x20) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f00000000c0)={{{@in, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}}}, &(0x7f00000001c0)=0xe8) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000240)=0xc) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000280)={0x0, 0x0}, &(0x7f00000002c0)=0xc) getsockname$tipc(r0, &(0x7f00000005c0), &(0x7f0000000600)=0x10) stat(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0}) getresgid(&(0x7f00000003c0), &(0x7f0000000400)=0x0, &(0x7f0000000440)) getresgid(&(0x7f0000000480), &(0x7f00000004c0)=0x0, &(0x7f0000000500)) fsetxattr$system_posix_acl(r0, &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000540)=ANY=[@ANYBLOB="0200000000fe03000000000002000500", @ANYRES32=r1, @ANYBLOB="02000300", @ANYRES32=r2, @ANYBLOB="02000100", @ANYRES32=r3, @ANYBLOB="02000100", @ANYRES32=r4, @ANYBLOB="040006000000000008000200", @ANYRES32=r5, @ANYBLOB="08000300", @ANYRES32=r6, @ANYBLOB="10000400000000002000010000000000"], 0x54, 0x2) 08:55:18 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x6c) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:55:18 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:18 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840000000000000000000000000000000004737e0a6658d574f80af4ed29a56dc7b56a836f0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) [ 2899.615573][T27243] binder: 27242:27243 ioctl c0306201 0 returned -14 [ 2899.646976][T27248] binder: BINDER_SET_CONTEXT_MGR already set 08:55:19 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000140)='/dev/dsp\x00', 0x40000, 0x0) ioctl$KDDISABIO(r1, 0x4b37) bind$alg(r0, &(0x7f0000000040)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r2 = accept4$alg(r0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffff9c, 0x84, 0x18, &(0x7f0000000000)={0x0, 0x8}, &(0x7f0000000100)=0x8) getsockopt$inet_sctp_SCTP_DELAYED_SACK(0xffffffffffffffff, 0x84, 0x10, &(0x7f0000000780)=@assoc_value={r3, 0x9}, &(0x7f00000007c0)=0x8) syz_genetlink_get_family_id$nbd(&(0x7f00000000c0)='nbd\x00') sendto(r2, &(0x7f00005c8f58), 0xffffffffffffff54, 0x0, 0x0, 0xfffffffffffffe29) [ 2899.684984][T27248] binder: 27240:27248 ioctl 40046207 6c returned -16 [ 2899.710743][T27275] binder: 27242:27275 ioctl c0306201 0 returned -14 [ 2899.722349][T27248] binder: 27240:27248 ioctl c0306201 0 returned -14 08:55:19 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0xc0385650, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2899.785869][T27248] binder: BINDER_SET_CONTEXT_MGR already set [ 2899.832165][T27351] binder: 27240:27351 ioctl c0306201 0 returned -14 [ 2899.840337][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2899.840989][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2899.881304][T27248] binder: 27240:27248 ioctl 40046207 6c returned -16 [ 2899.990422][T27361] binder: 27360:27361 ioctl c0385650 0 returned -22 [ 2900.035015][T27365] binder: 27360:27365 ioctl c0385650 0 returned -22 [ 2900.186113][T27251] netlink: 'syz-executor.5': attribute type 12 has an invalid length. [ 2900.398962][T27367] netlink: 'syz-executor.0': attribute type 12 has an invalid length. 08:55:19 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) syz_open_procfs(0x0, &(0x7f0000272000)) 08:55:19 executing program 4: r0 = syz_open_dev$audion(0x0, 0x800001f, 0x3fe) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="126348400128549f5256448a0d784c573bfed8408fafee69328f66d3ee0177bed1a8934bf66fa560503444941bb68215012b0912292eeec81637258ad5d6fd3a829cfa5e54457046af"], 0x0, 0x0, 0x0}) 08:55:19 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x74) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:55:19 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0xc040563e, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:19 executing program 3: write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x133, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x106}}, 0x20) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="c0dca5055e0bcfec7be070") write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000000240)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @rand_addr="0200"}, {0xa, 0x0, 0x0, @mcast1}, r0}}, 0x48) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcs\x00', 0x80, 0x0) write$P9_RREMOVE(r2, &(0x7f0000000140)={0x7, 0x7b, 0x1}, 0x7) bind$pptp(r2, &(0x7f0000000100)={0x18, 0x2, {0x2, @initdev={0xac, 0x1e, 0x1, 0x0}}}, 0x1e) getsockopt$IPT_SO_GET_ENTRIES(r1, 0x0, 0x41, &(0x7f0000000540)=ANY=[@ANYBLOB="66696c746572040000000000000000000000000000459f000000000000000000b7000000ac32ea158d6c3804006196e82756bc9375cd123197c8635602fc8d9a4e1bb3b978fb68c421f20e8e7f28ed9914f60e6a1643ae02870d7da56ff93662b40a2e64c3b4ebc3883afe3ca5642e44208400ddc1ae8c4619aceb7ecdc32b17437671323e49fc3fdd33ee23444c2a00c850f8c4c59500aea206b35c82ee50e98be96b39f99c981048915f771daae2431aa85f4651979b76d9b28cdaf9256cbbc65887dc26fec459a1192ebe48e1ccb4f4484d21672171a37deea9efc7939b3fb07584f6919e67f27a97941261c506bbe7b3611117e78800fa434980f053c0f35eb57e0a8a968a1034a8274025722092e5a4a63f13f116f7ac148f4784775ed6fbf4893e676201c2ccb92620acd9b4b6fa20ddf6870100ffff406f8d5e566e7079934483d0c7c01d96a141cce815b4c9b5faa2cc7c8fa03f479b84b69a87a30c641da6d808c6d610f42f4006f1f8e0ffd86a1179bccba6784353257ed337ef9de22281ee8f68c9046c76630cd28278f2da263d8cd8d4389716ccb8f300ab6ca4cb06acfdf0b5a1419daef77f8a7dc7574ee853cdf4a6234b34f0eb34b93cc8eee4e90abb7021a1e6c012edd0291e53d000006d1b31112059e86f8364decb173c42ef3daaddd90103190a3af772c880276d37e3ec6486e7a10fad492e2501fee025a15c7232d695c63627ba51e2f9ae69f38bcfe20d42805428be53b3f5e9c21eb536ebfacb9d0a127f54d61f5cf817446137452ddd9eae778a15cbd67c5d42a92616340fd8c137c80b7fd9d482b0fd973e82f37295cb2b7d87"], &(0x7f00000001c0)=0xdb) write$P9_RSTAT(r2, &(0x7f00000002c0)={0x60, 0x7d, 0x2, {0x0, 0x59, 0x100000001, 0x3b, {0x8, 0x1, 0x3}, 0x90000000, 0x401, 0xfff, 0x80, 0x9, '/dev/vcs\x00', 0xb, ']bdev/user&', 0x9, '/dev/vcs\x00', 0x9, '/dev/vcs\x00'}}, 0x60) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) [ 2900.698967][T27378] binder: BINDER_SET_CONTEXT_MGR already set [ 2900.712949][T27378] binder: 27369:27378 ioctl 40046207 74 returned -16 [ 2900.730557][T27380] binder: 27371:27380 ioctl c040563e 0 returned -22 [ 2900.747506][T27454] binder: 27369:27454 ioctl c0306201 0 returned -14 [ 2900.777746][T27487] binder: 27371:27487 ioctl c040563e 0 returned -22 08:55:20 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0xffffffff00000000, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) 08:55:20 executing program 3: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000500)='/dev/vcs\x00', 0x101000, 0x0) getsockopt$inet6_udp_int(r0, 0x11, 0x1, &(0x7f0000000540), &(0x7f00000009c0)=0x3) r1 = socket$kcm(0x29, 0x2, 0x0) setsockopt$kcm_KCM_RECV_DISABLE(r1, 0x119, 0x1, &(0x7f0000000000)=0x401, 0x4) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vsock\x00', 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000080)={{{@in6=@mcast1, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}}}, &(0x7f0000000180)=0xe8) getsockopt$inet_sctp6_SCTP_PR_STREAM_STATUS(r2, 0x84, 0x74, &(0x7f0000000400)=""/150, &(0x7f00000004c0)=0x96) ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f00000005c0)={"d0022c0a8ce9fffcad43662388010b88e742876ffa794f450b33c5387b1c3d875b192a6590759a8865f92715b492f1c0a73e101c4f1b83c66859030bbcf96192959d6a534304b64415b118fac573c6e7b1e3df0f1c536d0fffc4736c75657cfc49f638be9da330163f7aa9eab6648440bc6ab1c5aabb520964d54975c56ddb2855a1b87464262613c4f890ffda29f07516e669185c7390d3589e8be52bc5f6ad9ea74449e13525aa0ad44dfb9c9d2f048f045490696f3f31b00e385274e296faa9e6d3150c3be510fec8c9dd2a18e85d2c8bf867394a2dc4aecb8147cbd7f34e03429c79407b13e0342364ce5370c27c6501391a67995ca3576531b5ec33837bb0224379f5793cac65a8199991e44101fe6cc7ee561c7dbe4dff0513283628562fbedb6e2e05c9602b6970368af982ff1bc95886153ab4b3cd16cd045c356ac55fa88cfd93a3e41bf54e122a00b81e5cba63ed4c59761d4ee8a2012774e34b5e6d4bddc3bf9da34a24f9b0bab7074121a17b3ab2e907708971e56f99d0e38a4f38e41600487fbfe7581062485ab7a80f68b4296c48212075dbe61e6aad20c30af9482c3a74ca945b2f2bc2129d2a312e354167ff03780e8c106d8deb977a3b7daa143d7af9601859060651d75af5bbb8e11611a929c8e606672e2d38e10a1deac67c1acb29665fafa4bde44df9bc72a170901791e5c9959d1182164a466da33e8cadd2c15a6c961a6cca5d1cec101115932bd9d56f37ffd87f3a4b9287ac8907ae67e647441e1119feefb458f0f17f022f494dff1df89cc3709b3299d466c88561cf9c5693677fc04e0d166e06472f6e62b49557899454a93c18577179157bee5ee66d7a365872cb914ec68928806c33a1f4bad73d0ee2af7ee9312cd7f58f9d3acce1cb288390d68299fb242bc2a4318d4900661ccc4527405b1c1f41bc493dacd2086c71fe663526f3e1e4de730874eed958488ee1da931fa398377819267b246d0005a3338e4e07b958434f1cbaf7e75bdae7354b697d2e4f7c1644351d1059998a75cf50dcaafff82d0861d27f34d13095763eba3ab74d2fa21012ef691149b5d9f9c70a74a0725f7db3e876723242e13e3c30999e4629a51cd1fe820bbafb6740e6115548fda1491775aa700ab592a7cf209171e3bfe48036802fe33f8345cbc38d7a31d8d0e6d56a860997e32e879aea03eff00bd6267fc302a18ac3e091a52e8bd0c640b95156b1e956ba167a5b26d5c497b416c0cb9762efc051d79bf17c63e8dd066e0e19ef20bc2559f5aa669352f606dc375eec4f9d5759968703da1947930a00e73b7552861dd7601803a19a1f61e38e4d4ed7271a56c82ad275bfcb9d17e5312cfe8dcf5d4f3fb93bc8f65f20e90c13bc003377532926da6bf2dcfe5c2266f432c28d9197d6ceec4486c58206d297efc5b7901e62da2925dc79"}) sendmsg$xdp(r2, &(0x7f0000000280)={&(0x7f00000001c0)={0x2c, 0x7, r3, 0x40}, 0x10, &(0x7f0000000240)=[{&(0x7f0000000200)="d2bf2eddbb947b64078152628f2ec29bb38d73b78bc70b8ba9ff896beb2c", 0x1e}], 0x1}, 0x1) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f00000002c0)={{0x5000, 0xf002, 0x8, 0x4, 0x7ff, 0x10001, 0x5, 0x2, 0x2, 0xffffffff, 0xc5e6, 0x8}, {0x4, 0xf000, 0xd, 0x8, 0x7, 0x3, 0x0, 0xfff, 0x0, 0xffff, 0x3faa, 0x10000}, {0x6000, 0xf001, 0x3, 0x5, 0x1, 0x3ff, 0x10000, 0x3f, 0xf3d, 0x80000001, 0x3, 0x9}, {0x0, 0x5000, 0x0, 0x1000, 0x4, 0x7f, 0xfffffffffffffffc, 0x0, 0x3, 0x8, 0x401, 0x2}, {0x7000, 0x1, 0xf, 0x7, 0x8001, 0x4, 0x8, 0x3, 0x7, 0x1, 0x100000001, 0x1ff}, {0x1000, 0xf000, 0xc, 0x0, 0xfffffffffffffe10, 0x2, 0x1, 0x7, 0x0, 0xfff, 0xfffffffffffff4a7, 0x9}, {0xf000, 0x10d000, 0x1f, 0x4, 0x2, 0x6, 0x8001, 0x9, 0x20, 0x1e, 0x0, 0x3ff}, {0xf002, 0x7000, 0xe, 0x3, 0x20, 0x8001, 0xf2a00, 0x70, 0x1, 0x7, 0x0, 0x1}, {0xf002, 0x3003}, {0x2000, 0x5001}, 0x20050004, 0x0, 0x17000, 0x22004, 0x0, 0x1, 0x10f001, [0xffff, 0xed, 0x0, 0x8]}) 08:55:20 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) readlinkat(r0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000140)=""/151, 0x97) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="116348400000000100"/20], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="126348401eabf06d4cbe95b1bf861c0600b0ec4944609a6df279e2dc48630225132c96c45d350c31abb8ee904de81d1b15e9551809e2cb00c1a3cff22e83efddf0469c7748dec298afde2b68a7000000000000"], 0x0, 0x0, 0x0}) 08:55:20 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0xc0406429, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2900.872811][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2900.878849][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2900.936931][T27492] Unknown ioctl 1140895375 08:55:20 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x7a) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 2900.998055][T27492] Unknown ioctl 1094233732 [ 2901.056363][T27500] Unknown ioctl 1140895375 08:55:20 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0xffffff7f00000000, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) [ 2901.190300][T27505] binder: 27495:27505 ioctl c0406429 0 returned -22 [ 2901.252470][T27528] binder: BINDER_SET_CONTEXT_MGR already set [ 2901.272328][T27572] binder: 27495:27572 ioctl c0406429 0 returned -22 [ 2901.283772][T27528] binder: 27506:27528 ioctl 40046207 7a returned -16 08:55:20 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) [ 2901.321937][T27612] binder: 27506:27612 ioctl c0306201 0 returned -14 08:55:21 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) syz_open_procfs(0x0, &(0x7f0000272000)) 08:55:21 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x300) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:55:21 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0xc05c5340, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:21 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0x0, 0x800) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x20000000000001, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) lsetxattr$security_smack_transmute(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000140)='TRUE', 0x4, 0x3) syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x8000, 0x20280) 08:55:21 executing program 3: r0 = socket$packet(0x11, 0x2, 0x300) r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x3, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(0xffffffffffffff9c, 0x84, 0x70, &(0x7f0000000140)={0x0, @in6={{0xa, 0x4e23, 0x2, @empty, 0x7}}, [0x6, 0x7ff, 0x200, 0x9, 0xd10, 0x1f, 0xc2a, 0x5, 0x100000001, 0x3, 0x1, 0x1000, 0x7, 0x7ff, 0x8b]}, &(0x7f0000000040)=0x100) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f00000000c0)={r2, 0x4, 0x3ff}, &(0x7f0000000240)=0x8) ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS(r1, 0x80845663, &(0x7f0000000280)) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000100)={'bridge_slave_0\x00\x04'}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000080)={'bridge_slave_0\x00?', 0x22000000c0ffffff}) [ 2902.246440][T27729] binder: 27726:27729 ioctl c0306201 0 returned -14 [ 2902.266539][T27731] binder: 27727:27731 ioctl c05c5340 0 returned -22 08:55:21 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0xfffffffffffff000, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) [ 2902.291801][T27729] binder: BINDER_SET_CONTEXT_MGR already set [ 2902.312555][T27737] binder: 27727:27737 ioctl c05c5340 0 returned -22 [ 2902.329344][T27735] binder: 27726:27735 ioctl c0306201 0 returned -14 [ 2902.348239][T27729] binder: 27726:27729 ioctl 40046207 300 returned -16 08:55:21 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0xc0d05605, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:21 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x500) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:55:21 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040)='IPVS\x00') sendmsg$IPVS_CMD_GET_DAEMON(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000080)={&(0x7f0000000300)={0xd4, r3, 0x202, 0x70bd2b, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3cf3}, @IPVS_CMD_ATTR_DAEMON={0x58, 0x3, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x3}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e24}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast2}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'sit0\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @empty}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @empty}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1000}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e24}, @IPVS_DEST_ATTR_TUN_TYPE={0x8}]}, @IPVS_CMD_ATTR_SERVICE={0x44, 0x1, [@IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e23}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x8}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@empty}, @IPVS_SVC_ATTR_FWMARK={0x8}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x10, 0x2b}}]}]}, 0xd4}, 0x1, 0x0, 0x0, 0x8000}, 0x80) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) [ 2902.593907][T27848] binder: 27827:27848 ioctl c0d05605 0 returned -22 [ 2902.670571][T27857] binder: 27827:27857 ioctl c0d05605 0 returned -22 [ 2902.698898][T27854] binder_alloc: 27851: binder_alloc_buf, no vma [ 2902.703165][T27856] binder: BINDER_SET_CONTEXT_MGR already set 08:55:22 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0xc208ae62, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2902.722159][T27856] binder: 27853:27856 ioctl 40046207 500 returned -16 [ 2902.743376][T27858] binder: 27853:27858 ioctl c0306201 0 returned -14 08:55:22 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x600) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 2902.901632][T27923] binder: 27916:27923 ioctl c208ae62 0 returned -22 [ 2902.942429][T27968] binder: BINDER_SET_CONTEXT_MGR already set [ 2902.962803][ C0] net_ratelimit: 4 callbacks suppressed [ 2902.962812][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2902.974265][ C0] protocol 88fb is buggy, dev hsr_slave_1 08:55:22 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0xc4c85513, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2902.988574][T27969] binder: 27916:27969 ioctl c208ae62 0 returned -22 [ 2902.996467][T27968] binder: 27943:27968 ioctl 40046207 600 returned -16 [ 2902.996703][T27970] binder: 27943:27970 ioctl c0306201 0 returned -14 [ 2903.136563][T27976] binder: 27974:27976 ioctl c4c85513 0 returned -22 [ 2903.174642][T27978] binder: 27974:27978 ioctl c4c85513 0 returned -22 [ 2903.352812][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2903.358659][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2903.365916][T10924] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 2903.391160][T27814] validate_nla: 7 callbacks suppressed [ 2903.391171][T27814] netlink: 'syz-executor.5': attribute type 12 has an invalid length. [ 2903.489642][T27977] netlink: 'syz-executor.0': attribute type 12 has an invalid length. 08:55:23 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) syz_open_procfs(0x0, &(0x7f0000272000)) 08:55:23 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x700) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:55:23 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x2) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:23 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) stat(&(0x7f0000000000)='./file0\x00', 0x0) r0 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) getpriority(0x0, 0x0) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dlm-control\x00', 0x0, 0x0) fcntl$getown(r1, 0x9) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000200)) ioctl$VIDIOC_QUERYSTD(r1, 0x8008563f, &(0x7f0000000340)) gettid() fcntl$getown(r0, 0x9) ioctl$KVM_GET_DEBUGREGS(r1, 0x8080aea1, &(0x7f00000002c0)) r2 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x0, 0x2000) ioctl$BLKTRACETEARDOWN(r2, 0x1276, 0x0) semctl$SEM_STAT(0x0, 0x1, 0x12, &(0x7f0000000240)=""/78) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f0000000080)={[], 0x0, 0x400, 0x3fa}) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r1, 0x4058534c, &(0x7f0000000380)={0x1ff, 0x4, 0x6, 0x9, 0x3, 0x7}) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rfkill\x00', 0x400003, 0x0) 08:55:23 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, &(0x7f0000000000)=0xfffffffeffffffff, 0x4) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) [ 2903.641650][T27980] netlink: 'syz-executor.5': attribute type 12 has an invalid length. [ 2903.796931][T27991] binder: BINDER_SET_CONTEXT_MGR already set [ 2903.806024][T27995] binder: 27994:27995 ioctl c0306201 0 returned -14 [ 2903.826188][T27999] binder: BINDER_SET_CONTEXT_MGR already set [ 2903.835056][T27991] binder: 27989:27991 ioctl 40046207 0 returned -16 [ 2903.847844][T27999] binder: 27988:27999 ioctl 40046207 2 returned -16 [ 2903.858027][T28007] binder: 27994:28007 ioctl c0306201 0 returned -14 [ 2903.993952][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2903.999888][ C1] protocol 88fb is buggy, dev hsr_slave_1 08:55:23 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x2, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) 08:55:23 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x3) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:23 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000000)=0x0) ioprio_set$pid(0x1, r3, 0x1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:55:23 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x2000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 2904.097229][T27998] netlink: 'syz-executor.0': attribute type 12 has an invalid length. 08:55:23 executing program 3: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040)='IPVS\x00') sendmsg$IPVS_CMD_GET_DAEMON(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000080)={&(0x7f0000000300)={0xd4, r3, 0x202, 0x70bd2b, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3cf3}, @IPVS_CMD_ATTR_DAEMON={0x58, 0x3, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x3}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e24}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast2}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'sit0\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @empty}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @empty}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1000}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e24}, @IPVS_DEST_ATTR_TUN_TYPE={0x8}]}, @IPVS_CMD_ATTR_SERVICE={0x44, 0x1, [@IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e23}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x8}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@empty}, @IPVS_SVC_ATTR_FWMARK={0x8}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x10, 0x2b}}]}]}, 0xd4}, 0x1, 0x0, 0x0, 0x8000}, 0x80) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) [ 2904.298301][T28117] binder: BINDER_SET_CONTEXT_MGR already set [ 2904.349795][T28118] binder: BINDER_SET_CONTEXT_MGR already set [ 2904.350207][T28163] binder: 28115:28163 ioctl c0306201 0 returned -14 [ 2904.362452][T28118] binder: 28112:28118 ioctl 40046207 3 returned -16 [ 2904.369829][T28117] binder: 28115:28117 ioctl 40046207 2000 returned -16 08:55:23 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0x0, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:55:23 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x4) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2904.517571][T28195] binder_alloc: 28185: binder_alloc_buf, no vma [ 2904.648910][T28241] binder: BINDER_SET_CONTEXT_MGR already set [ 2904.700882][T28241] binder: 28239:28241 ioctl 40046207 4 returned -16 [ 2904.754548][T28120] netlink: 'syz-executor.5': attribute type 12 has an invalid length. [ 2905.032832][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2905.038852][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2905.110343][T28109] netlink: 'syz-executor.0': attribute type 12 has an invalid length. [ 2905.208603][T28178] netlink: 'syz-executor.5': attribute type 12 has an invalid length. 08:55:24 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) syz_open_procfs(0x0, &(0x7f0000272000)) 08:55:24 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x4000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:55:24 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x5) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:24 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="116b4d62735f484000000000000400"/24], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='cH@\x00'], 0x0, 0x0, 0x0}) 08:55:24 executing program 3: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040)='IPVS\x00') sendmsg$IPVS_CMD_GET_DAEMON(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000080)={&(0x7f0000000300)={0xd4, r3, 0x202, 0x70bd2b, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3cf3}, @IPVS_CMD_ATTR_DAEMON={0x58, 0x3, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x3}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e24}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast2}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'sit0\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @empty}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @empty}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1000}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e24}, @IPVS_DEST_ATTR_TUN_TYPE={0x8}]}, @IPVS_CMD_ATTR_SERVICE={0x44, 0x1, [@IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e23}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x8}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@empty}, @IPVS_SVC_ATTR_FWMARK={0x8}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x10, 0x2b}}]}]}, 0xd4}, 0x1, 0x0, 0x0, 0x8000}, 0x80) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) [ 2905.369405][T28360] binder: 28358:28360 ioctl c0306201 0 returned -14 [ 2905.385621][T28361] binder: BINDER_SET_CONTEXT_MGR already set [ 2905.406486][T28362] binder: BINDER_SET_CONTEXT_MGR already set [ 2905.413375][T28361] binder: 28355:28361 ioctl 40046207 0 returned -16 [ 2905.430216][T28366] binder: 28358:28366 ioctl c0306201 0 returned -14 [ 2905.431393][T28359] binder: BINDER_SET_CONTEXT_MGR already set [ 2905.438133][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2905.438599][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2905.454466][T28362] binder: 28356:28362 ioctl 40046207 5 returned -16 [ 2905.469525][T28391] binder_alloc: 28358: binder_alloc_buf, no vma [ 2905.479065][T28359] binder: 28357:28359 ioctl 40046207 0 returned -16 08:55:24 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x4, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) 08:55:24 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x4800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:55:24 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x21d, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:55:25 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x6) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2905.750778][T28477] binder: BINDER_SET_CONTEXT_MGR already set [ 2905.777731][T28482] netlink: 'syz-executor.5': attribute type 12 has an invalid length. [ 2905.780126][T28477] binder: 28475:28477 ioctl 40046207 4800 returned -16 08:55:25 executing program 3: syz_emit_ethernet(0x300b00, &(0x7f0000000000)={@local, @empty, [], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x300049, 0x0, 0x0, @ipv4={[], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff88, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x300af2, 0x0, @ipv4={[], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) r0 = fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffff9c) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000080)={0x0, @in6={{0xa, 0x4e21, 0x1, @rand_addr="d7e3ccfffc2c02c622b1b3c1a86fb71f", 0x7}}, 0x6, 0xd47d, 0x80000000, 0x1, 0x40}, &(0x7f0000000140)=0x98) setsockopt$inet_sctp6_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000180)={r1, 0x4, 0x2, 0x8, 0x80000000, 0x9}, 0x14) [ 2905.838253][T28483] binder: BINDER_SET_CONTEXT_MGR already set [ 2905.865002][T28567] binder: 28475:28567 ioctl c0306201 0 returned -14 [ 2905.870508][T28483] binder: 28481:28483 ioctl 40046207 6 returned -16 08:55:25 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x101003) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) fanotify_mark(r1, 0x1, 0x8, r1, &(0x7f0000000040)='./file0\x00') ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="122565e7c8cc"], 0x0, 0x0, 0x0}) [ 2905.956750][T28477] binder: BINDER_SET_CONTEXT_MGR already set 08:55:25 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x7) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2906.050960][T28567] binder: 28475:28567 ioctl c0306201 0 returned -14 [ 2906.114999][T28477] binder: 28475:28477 ioctl 40046207 4800 returned -16 [ 2906.157608][T28599] binder: 28598:28599 unknown command -412801774 [ 2906.193541][T28599] binder: 28598:28599 ioctl c0306201 200002c0 returned -22 [ 2906.248045][T28602] binder: BINDER_SET_CONTEXT_MGR already set [ 2906.274018][T28602] binder: 28601:28602 ioctl 40046207 7 returned -16 [ 2906.549670][T28548] netlink: 'syz-executor.0': attribute type 12 has an invalid length. [ 2906.600711][T28633] netlink: 'syz-executor.0': attribute type 12 has an invalid length. 08:55:26 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) syz_open_procfs(0x0, &(0x7f0000272000)) 08:55:26 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="c0dca5055e0bcfec7be070") r1 = socket$inet(0xa, 0x801, 0x84) connect$inet(r1, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) rt_sigsuspend(&(0x7f0000000000), 0x8) listen(r1, 0xfffffffffffffffe) r2 = accept4(r1, 0x0, 0x0, 0x0) openat$vicodec1(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/video37\x00', 0x2, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r2, 0x84, 0x7c, &(0x7f0000000080)={0x0, 0x9}, 0x7) r3 = syz_open_dev$vbi(&(0x7f0000000100)='/dev/vbi#\x00', 0x3, 0x2) ioctl$VIDIOC_S_CTRL(r3, 0xc008561c, &(0x7f0000000140)={0x0, 0x10001}) 08:55:26 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x8) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:26 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x4c00) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:55:26 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) ioctl$SCSI_IOCTL_GET_BUS_NUMBER(r0, 0x5386, &(0x7f0000000000)) [ 2906.771730][T28720] binder: 28719:28720 ioctl c0306201 0 returned -14 [ 2906.771815][T28717] binder: BINDER_SET_CONTEXT_MGR already set [ 2906.793363][T28717] binder: 28715:28717 ioctl 40046207 0 returned -16 [ 2906.810442][T28721] binder: BINDER_SET_CONTEXT_MGR already set [ 2906.820133][T28721] binder: 28714:28721 ioctl 40046207 8 returned -16 [ 2906.848112][T28737] binder: 28719:28737 ioctl c0306201 0 returned -14 08:55:26 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0xa, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) 08:55:26 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x6000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:55:26 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x10) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:26 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1263fd97dc7aa1f516ae43b7"], 0x0, 0x0, 0x0}) [ 2907.226953][T28834] binder: 28833:28834 ioctl c0306201 0 returned -14 [ 2907.257510][T28836] binder: BINDER_SET_CONTEXT_MGR already set [ 2907.294247][T28843] binder: 28833:28843 ioctl c0306201 0 returned -14 [ 2907.308842][T28836] binder: 28835:28836 ioctl 40046207 10 returned -16 [ 2907.309738][T28842] binder: BINDER_SET_CONTEXT_MGR already set 08:55:26 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x48) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2907.352352][T28842] binder: 28833:28842 ioctl 40046207 6000 returned -16 [ 2907.355548][T28838] binder: 28837:28838 unknown command -1745001710 [ 2907.374498][T28838] binder: 28837:28838 ioctl c0306201 200002c0 returned -22 08:55:26 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x6800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 2907.604916][T28934] binder: BINDER_SET_CONTEXT_MGR already set [ 2907.611123][T28934] binder: 28911:28934 ioctl 40046207 6800 returned -16 [ 2907.621524][T28923] binder: BINDER_SET_CONTEXT_MGR already set [ 2907.635187][T28934] binder: 28911:28934 ioctl c0306201 0 returned -14 08:55:27 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f0000000180)=0x5) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b97000)={0x1, &(0x7f000048fff0)=[{0x6}]}, 0x10) write$P9_RREMOVE(r0, &(0x7f00000000c0)={0x7, 0x7b, 0x1}, 0xfffffe68) getsockopt$sock_buf(r0, 0x1, 0x1a, 0x0, &(0x7f0000000000)=0x25f) getsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000040), &(0x7f0000000080)=0x4) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000100)='/dev/full\x00', 0x20200, 0x0) ioctl$PPPIOCGMRU(r1, 0x80047453, &(0x7f0000000140)) [ 2907.648828][T28923] binder: 28901:28923 ioctl 40046207 48 returned -16 [ 2907.663136][T28934] binder: BINDER_SET_CONTEXT_MGR already set [ 2907.670282][T28960] binder: 28911:28960 ioctl c0306201 0 returned -14 [ 2907.678700][T28934] binder: 28911:28934 ioctl 40046207 6800 returned -16 [ 2908.152817][ C1] net_ratelimit: 6 callbacks suppressed [ 2908.152826][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2908.164470][ C1] protocol 88fb is buggy, dev hsr_slave_1 08:55:27 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) syz_open_procfs(0x0, &(0x7f0000272000)) 08:55:27 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0x0, 0x7ff) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000000000), 0xffffff49, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:55:27 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x6c00) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:55:27 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x4c) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:27 executing program 3: pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) write$binfmt_elf32(r1, &(0x7f00000018c0)=ANY=[@ANYBLOB="d3be2513541216865801e7a7277f454c46000000"], 0x14) r3 = socket$inet(0x2, 0x3, 0x7f) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f0000000000)=0x580, 0x4) bind$inet(r2, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) setsockopt$inet_int(r3, 0x0, 0x3, &(0x7f00000000c0)=0x7ff, 0x4) connect$inet(r2, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) pipe(&(0x7f0000000100)) splice(r0, 0x0, r2, 0x0, 0x10005, 0x0) [ 2908.293908][T28981] binder: 28975:28981 unknown command 0 [ 2908.315429][T28983] binder: 28974:28983 ioctl c0306201 0 returned -14 [ 2908.319144][T28981] binder: 28975:28981 ioctl c0306201 20000100 returned -22 [ 2908.327959][T28978] binder: BINDER_SET_CONTEXT_MGR already set [ 2908.342150][T28987] binder: 28974:28987 ioctl c0306201 0 returned -14 [ 2908.342370][T28978] binder: 28976:28978 ioctl 40046207 4c returned -16 [ 2908.520161][T28988] validate_nla: 5 callbacks suppressed [ 2908.520187][T28988] netlink: 'syz-executor.0': attribute type 12 has an invalid length. 08:55:28 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0xe, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) 08:55:28 executing program 3: socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) socket$inet_icmp_raw(0x2, 0x3, 0x1) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000240)=0xfffffffffffffc60) r2 = getgid() chown(&(0x7f0000000040)='./file0\x00', r1, r2) add_key$keyring(&(0x7f0000000100)='keyring\x00', &(0x7f0000000140)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffb) r3 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x2400, 0x0) setsockopt$SO_RDS_TRANSPORT(r3, 0x114, 0x8, &(0x7f00000000c0)=0x939ba9229ed9be89, 0x4) add_key$keyring(&(0x7f0000000180)='keyring\x00', &(0x7f00000001c0)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) sendmmsg(r0, &(0x7f0000004e80)=[{{0x0, 0x0, 0x0}}, {{&(0x7f0000000940)=@ll={0x1e, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, 0xec, 0x0, 0x39b}}], 0x2, 0x0) 08:55:28 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x60) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:28 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x7400) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:55:28 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(r1, 0xc0206434, &(0x7f0000000000)={0x77bab48e, 0x0, 0x1, 0xe83}) ioctl$DRM_IOCTL_AGP_FREE(r1, 0x40206435, &(0x7f0000000040)={0x9, r4, 0x10001, 0x7}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) [ 2908.705453][T29108] binder: 29107:29108 ioctl c0306201 0 returned -14 [ 2908.736329][T29110] binder: BINDER_SET_CONTEXT_MGR already set 08:55:28 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0xa, 0x2, 0x73) bind$inet6(0xffffffffffffffff, 0x0, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x0, 0x0) getsockopt$sock_int(r0, 0x1, 0x2f, 0x0, &(0x7f00000000c0)) [ 2908.803233][T29110] binder: 29109:29110 ioctl 40046207 0 returned -16 [ 2908.809250][T29121] binder: 29107:29121 ioctl c0306201 0 returned -14 08:55:28 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x7a00) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 2909.101573][T29224] binder: 29223:29224 ioctl c0306201 0 returned -14 [ 2909.158936][T29229] binder: 29223:29229 ioctl c0306201 0 returned -14 [ 2909.185844][T29114] netlink: 'syz-executor.5': attribute type 12 has an invalid length. [ 2909.202770][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2909.208646][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2909.443182][T29230] netlink: 'syz-executor.0': attribute type 12 has an invalid length. 08:55:28 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) syz_open_procfs(0x0, &(0x7f0000272000)) 08:55:28 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x68) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:28 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) write$UHID_GET_REPORT_REPLY(r0, &(0x7f0000000000)={0xa, 0x2, 0xf2d, 0x7}, 0xa) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:55:28 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="c0dca5055e0bcfec7be070") r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x0, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000001680)={0x0, 0x0, 0x0}, &(0x7f00000016c0)=0xc) r5 = geteuid() getresgid(&(0x7f0000001700)=0x0, &(0x7f0000001740), &(0x7f0000001780)=0x0) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f00000017c0)=0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000001800)={0x0, 0x0}, &(0x7f0000001840)=0xc) r10 = getgid() getgroups(0x4, &(0x7f0000000080)=[r10, r10, r4, r6]) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000001880)={0x0}, &(0x7f00000018c0)=0xc) fstat(r0, &(0x7f0000001900)={0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f0000001980)='./file0\x00', &(0x7f00000019c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r14 = gettid() stat(&(0x7f0000001a40)='./file0\x00', &(0x7f0000001a80)={0x0, 0x0, 0x0, 0x0, 0x0}) getresgid(&(0x7f0000001b00), &(0x7f0000001b40), &(0x7f0000001b80)=0x0) sendmsg$unix(r2, &(0x7f0000001c80)={&(0x7f00000000c0)=@abs={0x1, 0x0, 0x4e20}, 0x6e, &(0x7f00000015c0)=[{&(0x7f0000000140)="3e4e327aa029e7fe64663377d8e1c45d0604ff19f56beea47c4c8032a273cc4f7167bb7fecfe3906c7b4b975e38051593570dbc81feb8e23843016c547f5fd47fe3ed6399cf2a9e2405ae0011f0392992cae6f8c26ab6350e76ed2935730758d23905daa991b0505534335e3748a35c44e5505efb6c4ed6e5ddeea2e1e7ac81358da86862c15ffb99c3c1238806876c0549778c9dd763319acf5e7ee8ed07a604d0a647ebd887baba585878e7684885e5a6301fd435c289518b389a62dd58157c8cda39711862e96dfac0886e8b3eb6d51c4eb02", 0xd4}, {&(0x7f0000000240)="4015a55f43a933bfc6af4cd7b93e8575ea29389e4dd01884df36baada6cd075b0a2f232f49ce8a15a65dfd9b4f5b2a9bd20da627ed0368a79a46aec7086231ef8cc6eda0de92a46d3c8dd90a1e67f27fb36c47b8a0d9fc09be3c9e93d399e003a5d04e294e9f9a227e95f7dba9c9770220b2eea5b2", 0x75}, {&(0x7f00000002c0)="d28bccc38c02f0a635839f08d06caf1a1ec8477eefd058256e83e8777b0cd15ae25d861526d6249aff64676873287a094e8e16505140740582533b0a04b2451276668bb1573a45c498edb8908143be114475551bc884d686be1f3f4fec6154d0590a36fb10cca303dec1e247435f4d7cb8af7e6984a1e10afd59dff2eb1d2697cf003f2d85790dcdd076f8bfd63f5db5f6f110d5212bf3b8d87e629fdb52581fcb9f67a1ae9f032adb3c97eb880286a6f12e7ab459194e4d7d08ce339ed9c14b09738ab35e79c303e8ad3225434989bf2beedf7cea049d907a31c0c8290199800d0a76016b1c528d45bc0b478134ebd0438a4e94a0959b940546dfa3f5595e28eff440582fb664feb4312d232748b7140d20bd4764b6eaef0a9cb616e0b2300d2123c761735bbefda1ba031a1aeed920cb4a190601250f2a61b41ddd4cf47ad33ebf6adf6f3dcf988ab26a0152f9af8d11b43dc44d4ae32804f3cdbab084d6583df3e5e24173e8266d2df1d3a61cd6e2f3ea68e1952bd2a95721f6c5bbcd9411ca0eb56e20488f4f68dc440d1165e63aefaa87c6599a78c6690c89313f3eb51d098d6ad9b3975f0c64cd66512dacccb86dd503e55f371aafcf61c326610c8be401542f78f8b641e46530917461745b1913d71721c5e5a85ae395b6b80df634f611efd9e2620979dda51f9104715dc15f305ae13040f1913cb67d5b58189ab9ca06fe37f561a7f1a5c3287628727f6f0485ed8f8fb45a52370b5b591a2790ef525abbe8c6a995a577b5f73c95a9841f6d9afb2ee6c865db7269e973a4f416f8975d6added9fe228b5fbafdd6c7ce617f869369b13a9e63fef4b79581ca191c88218dd77cac73ef119aba3fb9e26609ff5208571d5b29a9856aa55a56de07877b93f7aff8fb7bac6d10dbe896aed36d6e3a0e15e07af944e11a3a3e648c056775ca07a5bdf009f5f11b4229d0a75fd4ffa935fa8325e891d1e2ca41d52b2827d26c3a4d114b1033af870b1a80685ae89439480beb41ad9c03f3d45237c92870b2b1a53049c9ad2b378d0dc558cf86bab2ae821c4fb0d56c2525c08be6d56ca7d8cfe97fb90cf441b6d784e68e35a9e41aaf881b2910eb0f46eae915c140234ca787710a1ee08775e3be43d809c63b0501b413938d2ca47261fa876c0659642052d7710fc99031bf3212f7430f5d9dfe63c21acfe7d823a762dfcda53d2c5da0f06eca98ecac90de4f321789d806458a6d6a3d625db80b12dfcb662badb50576dc018e8e6e53170973a11ae6fbf5bba994303598001b4c7e428862b9cd55f670a15a30ac1cd447e2dd9c30da439426fe48811de3fa82ae4c7630481dc4d8f4b558ded7941e9a646b08b4b1d78c46e896571112b85663f84ac921a677764d31ac054524aefdefca929281b815334e179c1fad5a1195e3712991d84590d94caad88b5b853fb77926d622720c259ec192382ea62027d5bc8e9f3ebcf3c74caf0e58342ff28faaa4750945a9f3f06bd885e4dde508f3166d3b0d141d09af68e9398a7610a1b1c9bdc4425cb3f3a7b32c357a1358858403d8a9557a99f8acc499092a9ed3a59a15f2474e039567203c55135df95f47c3843251b44f04f7b93c41054ab00928b9dcf712629e3f4f2f7646070c407bb46ceaf4a0ce20123845264d65351f6ade14620e4dd7ce0d8639718bc7660744c3e1e6ab4846e78521c2a46ca0bf2fc6688a906e71bfe7307ff2003ad2e4076125e4ef4833f9c5ae0f18a583ce643a5ec10ba3d200655ba50a4d2649baafe6136b0529e734abacccc02ca138b59d6627530811afd96234d3f216482921aa81c1560855901b08b8ecc3d140c6f964a468f33172f5e03e2649d7743fa787a2918c3bddc14830790d2a0c3bc984594896831542ccb398628a21d2526eef93fc39082cf1629f19e9781d4fda7d1fc40e4a0cd83e91081a602d0f7086e27e8d13da16fecebb01019e38ecbb28606f91bae57a5956a41ba8357292dcf17f775606fec3aca5e68169745d25ab4588da6669e3b18b8e0d1ca3d2e1275547a2c44bc8f73a2ab5ec95a5a0b78ba2b355df3cb7d4d1dda09e87899788ff0f09c8e9f70e196d38b6429b81418b4d5c2db715b1bef585ef94380641b79ae0850b0e612d52947fe6c126f04052edbe6ed7a31cca5bfa16cf77e961da1247ed9703b0c836fe1e741b4d9abffc5fa28cf1c6ef3cde8a89596564a2c9fb13bd7ac44018396d4085b71159a57b30a95fdcb15dc171439ce7b62b29cd8bdac30ac54f3f79e12068e5f094ab363ded2a4adfc2bbaf19c82f57be37d47a99753c5b7432deac0f57f2a46a34adeb2fa7592d10d6cd25f0d6b143dca69963201a57482ced1700e6447f9fee6d6fc3ef18cc527c3245eab8f1dc27a0756663bad3b63840cd5e71be5489b269459f66b6722e7cd9c429d0abeedaacacd430b833d3a9461eabef18793d36071ca561e2e04bc89c70a83b5ace34a717421715bd550e1f80ca7cc263ce11f22ab9f2ca88e8d471c9c335bb4873a64cbd628458cf64c81e5063f7e0536a72d190be08a61331b8b19779a03b70618756c486feabac0c7fd380128ef1f1c210d5ebaf4e54ace6b3c0b1cc8379c3e69d979f46b2c52bb5d09c5e6a19d7a77c1139a042cb45110237879fcaf1e0683f7e869048f8b64b0fa0120e3ce60ad4d0c449f0adc69d7485a22e292f5583a5a573fc6ba7aba793db5dcd9304950664bd93783d7faa67d1a3a917715468a6ab5a3eeaf2b5213a235c51a2ee34dea1258ea53ad454a1e8057d945bd3782b3a7e45bc9e968aa7e69781269f3dfd50b6a85dbfc8f19b6b8f41c9d20c95f1471c4eba3412a05073598d8b25be6b797227a2a0d5336ac3e80da716d95b352c0ff5acca27f5b3b637ffe72ccbb5992f0ad87f843cad86e82860fe75157f9a03275dcf901247a37e6ea72d9cc931b096736925677fa0b40d4d41473d5dfb20ec303617a371066bcb33865afe9e4ea146c791eae13922078617e9b56c18be5abd31bcf461d81b507fbab4b6eb148f7536dea2b89f2d9cfaab869376375f429ef003d537b35b4da3561269676f996f98fd6f7dcd02e5f9a37cf14112c474ad9a54525677b84a8b3e689977f3ac76b3ecc083e287cbc314db9750577800869c72a0e08dcaedadfcf91c391c717ab9ffc01656c739c64860f8cb2883064eea43b004ca76a78f1ef3959824cebf5c112a39730848028329d3f11dc04738a657783aadcf6cd0a48d0ce3e02a5bb87add11abf27a81b40143ea6f0955aea6595b489f6d58db846e6ee94a5b18d0a4d22e5b8e45e23fc6fcd6196458e04197796565b268d1ce376a0e96e2db12faa6454cdeb5adae940429a5abb06e95cc7f2f706811d6f20005812df6948beee75e8d8a692242ad9517674368d95915dde67f9cabf915724f143ff5e213f94732afe61aef651df1f597589946fce1aacf501b205b2c1c6723545a9a853066422d06f350d317b43bf9d298e1facdf9adba8a3b24067edea0fc120642536dd44d9b67181284d968bbb55e9f279e9abfb9ada21398d31f2599fc7cbdb2a408a472cc5e640c8d58550b2f344af75c73400ff6726873927e9219a392317e2c892247e3939a5935ad094ee4eb85ef615185c83fc95cc6a099d72ce8c7609fea6506fffd2fccf88935e014013934276074a5ea5aaa76eeb44cc56220f9fb0f7679e7a27ddcbd27c0ef3480847f1cad795adae8ba018f90720ac5935b6e3c2f6961f85e8cf93ad519971cbf6194422eb4debcfcdd5c63fd147c49906d3539bef6e74800436abfb15d426c8e97a683d0b9ef513a8e7ffde14bcb955409a9186ef5123077f5bdfe69c191e3ae42149d8ca21b584007991fa1ab904971206baaa4326a88ae64959ebaa93d5d81599b4f934cfef467b3d2c66ab184dd3de368b9ecdae4bd29110d3b7331d08e9356ff52b7562109e59580d301a6d1aabb72e78ec635b50cc7f3a2e91c5052f284a17f555649b3d979bfe42a36cbe69d9719d28972d87d8a9239aa835c96b6e0ae66af0fc198b59d99f63c0a10b88e0066cb805837ccf89974a9b6bb912827451d64b413cf00843a2eeb142435526eae916138fc19816975269134ee914c747557475cb2169e62b7a704e644836486eff833d0032b790ff79d91af7abf8b6a5e89675a0b53234fd79997bcd01563b6243ac601b52ab395025bd0c3bcdca6e97a3968334ec42f53b80ce7153e567ba883f3b3d34294213dfa3f9e851388d3fe3dee9897af037d9b805694d4324aa3beafac95998121b736362717a9fdb5cfdf76d2d54bf1f0e9bc8f7c793c3d969f4e37a1f7b199e7e7bc6326ec88e1b6296b0da48e1bc979942f62b7422ed6ef9b2f03ee96a7b1a8b42e0174e0d806bf00349242e5a90a281d983738345d43567bbc50dd1b2461a3da3d2859e85a4887690d992f9b0677a4ab0cf89fe7022a5e0fca40f8bfa622305822dc2dc2756d69e26bbd937ce7286d7b0721a4effe0b9f2b13916e1eb7fc9c8b9552b4c6c1eeddc954aae13167f763902efa5238088e2efc50dc8f73526971cd0ae2456654d4a1049836a8b9e2af2e759e7dbc5d50643ed77c8cd597a452a82617b234f621fa57ed8857f597f601f762de3ac78c027237f52d9e9b13c24695fac59bc3c144858f9d104d4743297a4b111860c4a7059b39816533707bedaaf7031a34853a77960f2882fc89b6853e4bf3400c6ab00c3a9d4662dc3e0028b00be41cddc75ce0d9702ce8a06d79d64afea7a885c557a732c833ed6285bb9f85d50ccac148357fc07536fa5fa7dc6ddbb7c4d422cdeacb6bef6913b91c1719dcbd69b7d4fc32c01e7aa0f24ee26814fc6bf431ac8c01ecbc39507ff2d7660669f0daf5996b5f634a92561bb2080d2e799542292f58e0d0e2a76bc9cb667189afc46c39939408f3a9a656416e313397216a060729cd699a9a370fb339a7d1b60c2087eab51ef14bf1b0a35cc3c42259bae11aedceb72b4aa56ededd808bd59b217af76a7bcc7706b1fd9243a6f5f51f2569e5d25f3380a169f935b15b134908443de02364419853e24222fbae9ba3cab1ca5abb272baa68ce01a7bc86b05cf9195f89ed7faaffc3851e8b744164c5bf3c3da7647362ab8f3b8d3ecc9545f70b080234dddf9d7f455d0297aab047c1bd906f919c374a8473166fc36e9c47697655b374380b1f46cc71855a76c83727e09360dccc7f171b09bfb9a9b4e0d59a29bdb089f5b68d64089bcc6de2c2e870602e8799122dddc8a2c9b65ea6e8cd2c6ec253d27a7317a329685bb4f4f9567cf92e5ad154d98a963341a960974a1dd755d7898ce224ec42c7047ca2cd46a69efa137727b99fa50cfcdb1cc444bad28c2ee646867d9295891a186ec379ceb1f3ccfec199f1bcb3d50535be5e7ec32a586e90f274c817b59865426e917c5a0505f826b9cc6defc1a1fc92c9beafd146300672d7e20cf01d4d94b0bb9a0fb21ea66ef08c3db4b50bad61fb7a3c1a1f65371c5526f3433844b7211ec89d8c13e86f7156291a95a276a30a8ede67db1b3c357ca49389c61171b21a723ef2cff852cc97b248f380a2cb1b8159b7f826a4c86fd7ec878dba93cbf7f489dc925a126abbd52865691fbb0e2496d0cfa9d0787e8806352b426a6a635d8917f0a0ae5ec53af826973805385dd31f18c16f6e01007049a69802a6510c5ab4adf2abbf89a222d3c1cbbb397e36c8ff0054fc9594acacf8fafe6cc114ff18578f2128765cc800f5b4286fa5c673666bb174288ed0303ba3915b0b3d8", 0x1000}, {&(0x7f00000012c0)="ebb8bffbca006b189d8a6f99e957150229c4211cb143bcb0218bea4717cd10d93ad36268274039ffaf78dc5a0c41b57f3039f891a8b87a9d7d9f7f6b9712c026f6f9dcdd31004745c863af94286c8e6111a4479e89f6ce0b3af364c8ee73ada955ca1da1676cef6e7370f4ea0e1bbda801c29eb7970555", 0x77}, {&(0x7f0000001340)="c36732b929e909fe53c499b7a879c1593fbf12d4f5b3381b8a937901975b3e75d3348bd2a538199686a6a184a3c1875c6c789b4eee663f8eb6f4ce5b83b80bb9adf33148f2a5494634827a528e113ba835471bd7c161a6e57a79c8513dbe0845bc161b6d24f64cb7e47bf8e150ccb7094009aa", 0x73}, {&(0x7f00000013c0)="20dedc811437936d35996a2e2cd79acdec7667911e55d2969fe62bfd4c82", 0x1e}, {&(0x7f0000001400)="82c2349da875c990365892e8ae84854af3f1f6871a335de794068442689cde8b0718ae164f02276417dfb58364d257051d70957dc8f54a89973e9b36d4631481dce1c910d6873154efb0311081f2e287fabb0d3fda555077d6b942c4089276d6f1b41bb5ca6d569cf190c3ece2f509b3bb629ad8816b44c7234e0eb7ed9049a1acc0f4baec286ecb318d73435d47069fc2f3", 0x92}, {&(0x7f00000014c0)}, {&(0x7f0000001500)="cf1f2e5bf6034d260014385965db6d0bbff9cd8fb66f968a2ebab67afb25fedc9bf2b720e2010741c9c99fcf00500dd9b383df84db5609ff700a1c9f730f8f445ed7b7c6feb691024654eb03e161b41f6c30e6b0e0c76a9e2be8c26d67e716d6a819bdb409088b5a026d47a2265a6cff1f10900d112e0a6fbd3dbacec0d6b2e54ce9ef75543d758b99bd4a4051eac30cce6118d333ed15d09d8f7d7a965f5e6aeb123c1dbacb8e6f48a55e9880822e5f394b17f7914c4ecd41d7acc97cef", 0xbe}], 0x9, &(0x7f0000001cc0)=ANY=[@ANYBLOB="1c000000000000000100000001000000", @ANYRES32=r0, @ANYRES32=r0, @ANYRES32=r1, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r3, @ANYRES32=r5, @ANYRES32=r7, @ANYBLOB="000000001c1000840000000001000000f5000000a3e8118be4cb359e4706f95420b71df120f3d0849c4a06a7af52d28e85e89a3037951435", @ANYRES32=r8, @ANYRES32=r9, @ANYRES32=r10, @ANYBLOB="000000001c000000000001000000020000000000", @ANYRES32=r11, @ANYRES32=r12, @ANYRES32=r13, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r14, @ANYRES32=r15, @ANYRES32=r16, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r0, @ANYRES32=r0], 0xb8}, 0x8000) getsockopt$inet6_int(r1, 0x29, 0x48, &(0x7f0000b67000), &(0x7f00007d0000)=0x2fd71482) sendmsg$nl_generic(r2, &(0x7f0000001c00)={&(0x7f00000014c0)={0x10, 0x0, 0x0, 0x80000004}, 0xc, &(0x7f0000001bc0)={&(0x7f0000001dc0)={0x25c, 0x30, 0x800, 0x70bd2c, 0x25dfdbff, {0x12}, [@generic="e56039adb36dd562e66f2a5d162f34af2dcf01d8fa6843b341c9d4489da88022e1c5bb848c966324469bc87c3386df81acd637d2b4465366f5a05797ef820959655c1634807649cc5f574512a06f406ec397eadf57122cbcc3bed3261580a8c1afba1202926db7c689474e7ee64543f48bb6f4fb802e5119d5d48415e38d1d2347ef598db95dd03cc2475c4b14aea80a597482a434d135b30a9ab242effd8ec23cbc2d07aff11b9b2d55e9eb3d11489815eb07bed97245f906d6791b9bc43ecf592903132b4ed1805b19988d463e0efe3488eccd17ef39dc6f8d0b9d24da3c1192ce", @nested={0x10c, 0x52, [@typed={0x4, 0x63}, @typed={0x88, 0x91, @binary="3767cee3e0ef724865406cfab99427c2840b64e0610689bc801a46eb4b8acc6669b0e911d94a5676fde2cc39d95607d259d83bd01017b7a1ef4a681b36fdbbef5bf06bd3469be10dcbe4282a7632f801caaea3a8ba46102f6fe88c0bc9394c0699be79c71611f20ff9c637a7d032268ad5eb42b77f49806eb8c109aa6b89b2542b15b2"}, @generic="8f4783b0b531e8f8f9e6d1a172b768902f9af2ae531143c1e0168dfb1b04c66b6bc8629d91e6ad06fa12b585a8fd83cd63fda42abb2fc965954dfefb497d230c48699fddd132e4953ae454d7be77cbc03b7557caf3c9692733d410445a938d7e2b90f45ed95c9975f76e1570405ab9ad22a3ec", @typed={0x8, 0x69, @ipv4=@remote}]}, @generic="51b50ae9cc2e486166110fafa67d850f720e1416b318770066e535b6322a089670091eb4553485fe0212846a408baec54461778b881864d49077e6a3e94eb1254f5c36fb04a1d96244a989fff48f095bcbf45319adca89"]}, 0x25c}, 0x1, 0x0, 0x0, 0x4000080}, 0x4000000) 08:55:28 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x1000000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 2909.501426][T29114] netlink: 'syz-executor.5': attribute type 12 has an invalid length. [ 2909.603349][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2909.609862][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2909.646812][T29244] binder: BINDER_SET_CONTEXT_MGR already set [ 2909.658995][T29242] binder: 29237:29242 ioctl c0306201 0 returned -14 [ 2909.715336][T29244] binder: 29233:29244 ioctl 40046207 68 returned -16 [ 2909.901284][T29241] netlink: 'syz-executor.0': attribute type 12 has an invalid length. 08:55:29 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x60, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) 08:55:29 executing program 3: socket$netlink(0x10, 0x3, 0x4) openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x163800, 0xe) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000380)) openat$nullb(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/nullb0\x00', 0x0, 0x0) ioctl$sock_bt_hidp_HIDPGETCONNINFO(0xffffffffffffffff, 0x800448d3, &(0x7f0000000280)={{0x1, 0x3, 0x4, 0x100000001, 0x0, 0x5}, 0x46f7, 0x6, 0x1ff, 0x1, 0x100000000, "e10faaad2a268c8b4b75582907e8c53750291e6f3e78457d0a168faaefd10785f65f0429c096856870f874280e1b07c45fd75f48b7a96e82033d04e1cfcd5ec01ac021e0174ee9111315f017157d534157ffbd93c586858426bd380468ed4024d165b248802bc36e5167c97e227d889f00"}) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100)='/dev/nullb0\x00', 0x801, 0x0) ioctl$BLKZEROOUT(r0, 0x127f, &(0x7f0000000080)={0x0, 0x4004400}) 08:55:29 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x2000000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:55:29 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x6c) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:29 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$PPPIOCGFLAGS(r1, 0x8004745a, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) [ 2910.065060][T29363] binder: BINDER_SET_CONTEXT_MGR already set [ 2910.091130][T29363] binder: 29356:29363 ioctl 40046207 2000000 returned -16 [ 2910.091261][T29364] binder: BINDER_SET_CONTEXT_MGR already set [ 2910.140795][T29364] binder: 29359:29364 ioctl 40046207 6c returned -16 [ 2910.148826][T29446] binder: 29356:29446 ioctl c0306201 0 returned -14 08:55:29 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000480)=ANY=[], 0x0, 0x0, 0x0}) [ 2910.231830][T29476] binder: 29356:29476 ioctl c0306201 0 returned -14 [ 2910.232877][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2910.245118][ C1] protocol 88fb is buggy, dev hsr_slave_1 08:55:29 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x74) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2910.669513][T29369] netlink: 'syz-executor.5': attribute type 12 has an invalid length. [ 2910.905770][T29482] netlink: 'syz-executor.0': attribute type 12 has an invalid length. 08:55:30 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11634840010000007d08000f0000000000000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12636840"], 0x0, 0x0, 0x0}) 08:55:30 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x3000000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:55:30 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x7a) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2910.967315][T29607] netlink: 'syz-executor.5': attribute type 12 has an invalid length. 08:55:30 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) syz_open_procfs(0x0, &(0x7f0000272000)) 08:55:30 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0xe, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) [ 2911.100612][T29615] binder: BINDER_SET_CONTEXT_MGR already set [ 2911.115853][T29609] binder: 29608:29609 unknown command 1080582930 [ 2911.130801][T29615] binder: 29614:29615 ioctl 40046207 3000000 returned -16 [ 2911.135997][T29611] binder: BINDER_SET_CONTEXT_MGR already set [ 2911.150456][T29609] binder: 29608:29609 ioctl c0306201 200002c0 returned -22 [ 2911.188338][T29624] binder: 29614:29624 ioctl c0306201 0 returned -14 [ 2911.195461][T29616] netlink: 'syz-executor.3': attribute type 12 has an invalid length. [ 2911.213365][T29611] binder: 29610:29611 ioctl 40046207 7a returned -16 08:55:30 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0xf0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) [ 2911.265981][T29615] binder: BINDER_SET_CONTEXT_MGR already set [ 2911.272853][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2911.278736][ C0] protocol 88fb is buggy, dev hsr_slave_1 08:55:30 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x300) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2911.327749][T29624] binder: 29614:29624 ioctl c0306201 0 returned -14 08:55:30 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) [ 2911.368182][T29615] binder: 29614:29615 ioctl 40046207 3000000 returned -16 08:55:30 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x4000000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 2911.564413][T29736] binder: BINDER_SET_CONTEXT_MGR already set [ 2911.570637][T29736] binder: 29735:29736 ioctl 40046207 300 returned -16 08:55:31 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x500) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2911.686302][T29745] binder: BINDER_SET_CONTEXT_MGR already set 08:55:31 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000000140)={0x0, 0x81}, &(0x7f0000000180)=0x8) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r0, 0x84, 0x6c, &(0x7f00000001c0)={r1, 0x23, "f740afe5a2c7c5ba157a36325eabb11c5e4b37a46d6c5e3ab996f94af5702053320059"}, &(0x7f0000000280)=0x2b) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0x7, &(0x7f0000000440)={0x1, 0xfffffffffffffed8, 0x2d30000000000000, 0x3d6f}, 0x10) getsockopt$inet_sctp_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000000)={0x0, 0x401, 0x80000001, 0x7, 0x9, 0x20}, &(0x7f0000000040)=0x14) setsockopt$inet_sctp_SCTP_ASSOCINFO(r2, 0x84, 0x1, &(0x7f0000000080)={r5, 0x8, 0x32, 0x80000000, 0x4, 0x8}, 0x14) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB='\x00'/20], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0bd672d71163666b34ad99411b1b4b0eca4bb22465476c07fcbe9bfc4cb6a979fff88846c42ba261a0915d52616cb59bb42850b4287a877b41cb859d32753e253fa261332b5cc4313098a04b655c764e026c9584a68c864387d14b3c8c51f2da442678cadc594f25135cee635daac4ec69c14ce5b7224cc1e7d4bef95e858dd9cdcdf62117eaea84321f8e5bb67da2880f5bf65d07510defb6910ae52eb26c32f70abcbdb3314fca589fadb9e3d25529abc8563c7b5c359126f6dcac19218bbe6922b6c837b7529d6d2f30072f861432f272fab8b7a8192cca517dcdd71c92685263008cf87360ece1ff2c9d1ee8549319e513f8615356369e60554d499672a775758675698ad328802920188f798e9bd7b304"], 0x0, 0x0, 0x0}) [ 2911.730363][T29745] binder: 29742:29745 ioctl 40046207 4000000 returned -16 [ 2911.787063][T29849] binder: 29742:29849 ioctl c0306201 0 returned -14 08:55:31 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x5000000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:55:31 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x600) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2911.929951][T29855] binder: 29854:29855 unknown command 0 [ 2911.945423][T29855] binder: 29854:29855 ioctl c0306201 20000100 returned -22 08:55:31 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="2cbc590c"], 0x0, 0x0, 0x0}) [ 2912.109282][T29889] binder: 29887:29889 ioctl c0306201 0 returned -14 [ 2912.148008][T29968] binder: BINDER_SET_CONTEXT_MGR already set 08:55:31 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x700) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2912.167742][T29969] binder: 29887:29969 ioctl c0306201 0 returned -14 [ 2912.186516][T29968] binder: 29887:29968 ioctl 40046207 5000000 returned -16 [ 2912.258265][T29973] binder: 29972:29973 unknown command 207207468 [ 2912.267233][T29973] binder: 29972:29973 ioctl c0306201 200002c0 returned -22 [ 2912.448086][T29618] netlink: 'syz-executor.0': attribute type 12 has an invalid length. 08:55:32 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$VIDIOC_QUERYSTD(r0, 0x8008563f, &(0x7f0000000000)) r1 = perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000008, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) mmap$perf(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x2000000, 0x72, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:55:32 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x6000000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:55:32 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x2000) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:32 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) syz_open_procfs(0x0, &(0x7f0000272000)) 08:55:32 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0xe, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) 08:55:32 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0xa00, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) [ 2912.880933][T30092] binder: BINDER_SET_CONTEXT_MGR already set [ 2912.941362][T30127] binder: 30095:30127 ioctl c0306201 0 returned -14 [ 2912.945008][T30092] binder: 30091:30092 ioctl 40046207 2000 returned -16 [ 2912.956748][T30090] binder_alloc: 30089: binder_alloc_buf, no vma [ 2912.964444][T30096] binder: BINDER_SET_CONTEXT_MGR already set [ 2912.998918][T30096] binder: 30095:30096 ioctl 40046207 6000000 returned -16 08:55:32 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x3f00) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:32 executing program 4: openat$mixer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mixer\x00', 0x40, 0x0) r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) setsockopt$ARPT_SO_SET_ADD_COUNTERS(r1, 0x0, 0x61, &(0x7f0000000140)={'filter\x00', 0x4}, 0x68) [ 2913.070990][T30096] binder: BINDER_SET_CONTEXT_MGR already set [ 2913.081598][T30127] binder: 30095:30127 ioctl c0306201 0 returned -14 [ 2913.096580][T30096] binder: 30095:30096 ioctl 40046207 6000000 returned -16 08:55:32 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x7000000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 2913.318533][T30215] binder: BINDER_SET_CONTEXT_MGR already set [ 2913.345607][T30215] binder: 30213:30215 ioctl 40046207 0 returned -16 [ 2913.352810][ C0] net_ratelimit: 4 callbacks suppressed [ 2913.352819][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2913.364288][ C0] protocol 88fb is buggy, dev hsr_slave_1 08:55:32 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x4000) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2913.407332][T30218] binder: 30217:30218 ioctl c0306201 0 returned -14 08:55:32 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x48300, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:55:33 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x10000000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:55:33 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x4800) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2913.721919][T30098] validate_nla: 4 callbacks suppressed [ 2913.721931][T30098] netlink: 'syz-executor.3': attribute type 12 has an invalid length. [ 2913.752763][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2913.758660][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2913.848176][T30354] binder: BINDER_SET_CONTEXT_MGR already set [ 2913.874506][T30354] binder: 30338:30354 ioctl 40046207 10000000 returned -16 [ 2913.879703][T30428] binder: BINDER_SET_CONTEXT_MGR already set 08:55:33 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) ioctl$VIDIOC_PREPARE_BUF(r1, 0xc058565d, &(0x7f0000000000)={0x1ff, 0x8, 0x4, 0x0, {0x0, 0x7530}, {0x2, 0xe, 0x101, 0x4, 0x401, 0x0, "87f691c5"}, 0x9, 0x4, @offset=0x100000000, 0x4}) [ 2913.902909][T30428] binder: 30408:30428 ioctl 40046207 4800 returned -16 [ 2913.917264][T30451] binder: 30338:30451 ioctl c0306201 0 returned -14 08:55:33 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x4c00) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2913.977904][T30455] binder: 30338:30455 ioctl c0306201 0 returned -14 [ 2913.986326][T30100] netlink: 'syz-executor.0': attribute type 12 has an invalid length. [ 2914.215169][T30561] binder: BINDER_SET_CONTEXT_MGR already set [ 2914.223699][T30334] netlink: 'syz-executor.5': attribute type 12 has an invalid length. [ 2914.229850][T30561] binder: 30532:30561 ioctl 40046207 4c00 returned -16 [ 2914.329706][T30337] netlink: 'syz-executor.0': attribute type 12 has an invalid length. [ 2914.392794][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2914.398739][ C1] protocol 88fb is buggy, dev hsr_slave_1 08:55:33 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) syz_open_procfs(0x0, &(0x7f0000272000)) 08:55:33 executing program 3: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0xe, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) 08:55:33 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000000), &(0x7f0000000040)=0x14) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$apparmor_task_current(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/self/attr/current\x00', 0x2, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x80010, r1, 0x0) setxattr(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)=@random={'btrfs.', '\x1a{security\\self\x00'}, &(0x7f0000000180)='/dev/binder#\x00', 0xd, 0x6) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000000340)=[@transaction_sg={0x40486311, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={@flat=@weak_binder={0x77622a85, 0xb, 0x1}, @flat=@weak_binder={0x77622a85, 0x1000, 0x1}, @fda={0x66646185, 0x9, 0x2, 0x16}}, &(0x7f0000000300)}, 0x40}], 0x36e, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:55:33 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x20000000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:55:33 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x6000) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:33 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0xe00, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) [ 2914.542531][T30575] netlink: 'syz-executor.5': attribute type 12 has an invalid length. [ 2914.572172][T30573] binder: BINDER_SET_CONTEXT_MGR already set [ 2914.603960][T30573] binder: 30571:30573 ioctl 40046207 20000000 returned -16 08:55:34 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x6800) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2914.659566][T30573] binder: 30571:30573 ioctl c0306201 0 returned -14 [ 2914.750148][T30675] binder: 30571:30675 ioctl c0306201 0 returned -14 08:55:34 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$vcsa(&(0x7f0000000140)='/dev/vcsa#\x00', 0x800, 0x2000) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) setxattr$security_smack_transmute(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000080)='TRUE', 0x4, 0x2) 08:55:34 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x40000000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:55:34 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x6c00) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2915.124757][T30700] binder: BINDER_SET_CONTEXT_MGR already set [ 2915.130964][T30700] binder: 30694:30700 ioctl 40046207 40000000 returned -16 [ 2915.155567][T30700] binder: 30694:30700 ioctl c0306201 0 returned -14 08:55:34 executing program 4: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) [ 2915.205327][T30798] binder: BINDER_SET_CONTEXT_MGR already set [ 2915.225671][T30801] binder: 30694:30801 ioctl c0306201 0 returned -14 [ 2915.226021][T30798] binder: 30740:30798 ioctl 40046207 6c00 returned -16 08:55:34 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x48000000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 2915.432773][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2915.438646][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2915.470082][T30808] netlink: 'syz-executor.0': attribute type 12 has an invalid length. [ 2915.507218][T30892] binder: BINDER_SET_CONTEXT_MGR already set [ 2915.526407][T30892] binder: 30844:30892 ioctl 40046207 48000000 returned -16 [ 2915.564332][T30892] binder: 30844:30892 ioctl c0306201 0 returned -14 [ 2915.578323][T30921] binder: 30844:30921 ioctl c0306201 0 returned -14 [ 2915.670899][T30576] netlink: 'syz-executor.3': attribute type 12 has an invalid length. [ 2915.725058][T30579] netlink: 'syz-executor.0': attribute type 12 has an invalid length. 08:55:35 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) syz_open_procfs(0x0, &(0x7f0000272000)) 08:55:35 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x7400) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:35 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) setsockopt$inet6_udp_encap(r0, 0x11, 0x64, &(0x7f0000000440)=0x4, 0x4) ioctl$KVM_GET_DEBUGREGS(r0, 0x8080aea1, &(0x7f0000000000)) ioctl$sock_bt_cmtp_CMTPCONNADD(r0, 0x400443c8, &(0x7f0000000080)={r0, 0x1}) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, &(0x7f0000000600)={0x0, @in={{0x2, 0x4e21, @local}}}, &(0x7f0000000480)=0x84) getsockopt$inet_sctp6_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000000500)={r2, 0x5, 0x0, 0x1}, &(0x7f00000006c0)=0x10) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7c6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xfffffffffffffffc) r3 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0x0, 0x400000000000) r4 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$sock_SIOCGIFBR(r1, 0x8940, &(0x7f0000000280)=@get={0x1, &(0x7f0000000140)=""/137, 0x7}) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000380)={'bond_slave_0\x00', &(0x7f0000000900)=ANY=[@ANYBLOB="3f000000feffffffb60900005d000000b13810d374f38d21685c4d5826d78bbe476f51cef8d381e3fa1f6f858993c2ae3309c497204a5aaf9407d015e7e981152851424a738f00524339c1cf2e50792c4d26cdf63f71dd679bf257d611706c2bf959c6aebd0b303677e39b1d946965b8b56ed3f4c0dc75d570c887260455addfd82174a1c9d41b4efd8ac631f81597e305dc45c5347644151feb85088108edbef366f6a8e274b5ec3bdaa9e5826131a69e5a1054493c627357a4d6358b4329abcf8692c8a5bc6a18f255aaa24450602abc9911eb977720822d581fe84159762fd501169fd5500e2dc685dc18065a2aad184ed45413cd4b1ac691"]}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000004c0)={0x142, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0000000050a7ec79bea1852e2e37bbdc79b45f2bddc94f0b2302fbd7839a99b5636ea613f8b2ac938436f034b975b20bf4adadb99cac3b26d207fbb6c6a460d535b91af7a506a124c7f77368d333e0184829478531bf5dc5d6c3e330786753115229121417c734e527728dbe3732245806be7b0d54c4de06a6e2632bb21da9fc0f4c77e2dc94dad63524877db1ef54bd839b5f3c4115ca72a0d06dc397dd7dd923a3ccec64a615f8be57595eb2935b66f0a101c9b93e7eea1af4555fb5fccd1bcd11a04cea036a491af87d8715648719a76b1efb057d3a89e5486044b3364d07e4f3df97ae2c3c569f8ca518c3d2b4aa6a95a18b6390047e73df229b035901ce90a18ff137e6e65e9b8aba66f2fcbf77c63d128afa3c0b73ff511a1b187ab055d5dae1d7f95428b5f578c540aa94065cb6eae4d258202f1df12858e5165c7e31f59e506aeeabb7bb591d525146e488ada8a8e91c7569ed8fb9d186cb16a70cf5ef3d8981db2f0858fcc6021dc7329a07f4970e8ec63223778ecc0cfdf616563d0f3b0fc3c0a2dca6f0daee677f83df54d6341876e637243fa1874cfe8c029a01ef9d9176052e644fb4db1cf7882be763ab5b42065bbb974cd2eefb1d2abf5bd3352fe9e3e2bc1138"], 0x0, 0x0, 0x0}) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r1, 0x40505331, &(0x7f00000003c0)={{0x8, 0xffffffffffffff7f}, {0x0, 0xfffffffffffffff7}, 0x3f, 0x6, 0x8}) ioctl$LOOP_GET_STATUS64(r1, 0x4c05, &(0x7f0000000a00)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="03004840153eb34f2e47dfc56b0f6811f9dd065a480bb3a186b91e9f69ecadc857a1d5d3692b2771677f503b340b1a0c20f51bcf4d9fb2f28044c1763ba9d2219a9b8c3f4df21a4d8880f6f585fb6daf3186023b47e0ae4287f8e7553ac794a9b58b32d9976ad934a347c28604e3d05cec2d295d39c53a678cec3937af3cf03d0ef2ccd3fa420ac5e79365f3e1b774c25f32ba78bb4b8e6d990cd42c7afb6f43d6b4c82c0ece399e905864181046100ae5d396ed9cb219e26b478b42"], 0x0, 0x0, 0x0}) 08:55:35 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x4c000000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:55:35 executing program 3: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$VIDIOC_QUERYSTD(r0, 0x8008563f, &(0x7f0000000000)) r1 = perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000008, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) mmap$perf(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x2000000, 0x72, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) [ 2915.806341][T30807] netlink: 'syz-executor.5': attribute type 12 has an invalid length. [ 2915.832773][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2915.838710][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2915.906629][T30926] binder: 30925:30926 unknown command 0 [ 2915.944356][T30926] binder: 30925:30926 ioctl c0306201 200004c0 returned -22 [ 2916.006021][T30929] binder: BINDER_SET_CONTEXT_MGR already set [ 2916.014092][T30933] binder: 30930:30933 ioctl c0306201 0 returned -14 [ 2916.026606][T30929] binder: 30927:30929 ioctl 40046207 0 returned -16 [ 2916.027224][T30943] binder: BINDER_SET_CONTEXT_MGR already set [ 2916.041469][T30943] binder: 30924:30943 ioctl 40046207 7400 returned -16 [ 2916.054790][T30973] binder: 30930:30973 ioctl c0306201 0 returned -14 [ 2916.063827][T30968] binder_alloc: 30930: binder_alloc_buf, no vma [ 2916.166491][T30939] netlink: 'syz-executor.0': attribute type 12 has an invalid length. 08:55:35 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x37ea, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) 08:55:35 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x60000000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:55:35 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x7a00) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:35 executing program 3: unshare(0x40000000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) getsockopt$IPT_SO_GET_INFO(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) getcwd(&(0x7f0000000000)=""/120, 0x78) r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$IPT_SO_GET_INFO(r0, 0x0, 0x40, &(0x7f0000002280)={'filter\x00'}, &(0x7f0000002300)=0xffffffb4) 08:55:35 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$FIONREAD(r1, 0x541b, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) [ 2916.344847][T31048] IPVS: ftp: loaded support on port[0] = 21 [ 2916.451286][T31057] binder: BINDER_SET_CONTEXT_MGR already set [ 2916.496524][T31053] binder: BINDER_SET_CONTEXT_MGR already set [ 2916.515558][T31057] binder: 31047:31057 ioctl 40046207 7a00 returned -16 [ 2916.525333][T31053] binder: 31045:31053 ioctl 40046207 60000000 returned -16 [ 2916.564669][T31121] binder: 31045:31121 ioctl c0306201 0 returned -14 08:55:36 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) getsockopt$inet_dccp_buf(r0, 0x21, 0xc0, &(0x7f0000000000)=""/49, &(0x7f0000000040)=0x31) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, &(0x7f0000000140)=0x4, 0x4) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:55:36 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0xff00) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2916.650164][T31165] binder: 31045:31165 ioctl c0306201 0 returned -14 [ 2917.281546][T31048] IPVS: ftp: loaded support on port[0] = 21 08:55:37 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) syz_open_procfs(0x0, &(0x7f0000272000)) 08:55:37 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x68000000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:55:37 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) r1 = perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) readv(r1, &(0x7f0000000040)=[{&(0x7f0000000300)=""/220, 0xdc}, {&(0x7f00000004c0)=""/200, 0xc8}, {&(0x7f0000000000)=""/9, 0x9}], 0x3) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:55:37 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x1000000) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:37 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x3f00, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) [ 2917.701163][T31287] binder: BINDER_SET_CONTEXT_MGR already set [ 2917.750518][T31287] binder: 31286:31287 ioctl 40046207 1000000 returned -16 [ 2917.758345][T31291] binder: BINDER_SET_CONTEXT_MGR already set [ 2917.772869][T31326] binder: 31284:31326 ioctl c0306201 0 returned -14 [ 2917.779088][T31291] binder: 31284:31291 ioctl 40046207 68000000 returned -16 08:55:37 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x2000000) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2917.835724][T31291] binder: BINDER_SET_CONTEXT_MGR already set [ 2917.873839][T31326] binder: 31284:31326 ioctl c0306201 0 returned -14 08:55:37 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="11634840e5ffffffffffffff000000000000000c359227c20f6cafb1fe56c8f497dd8e598decd4c8a06d3ded04d56d87b774cd8c720b173db2b7a2"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) [ 2917.934081][T31291] binder: 31284:31291 ioctl 40046207 68000000 returned -16 08:55:37 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x6c000000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 2918.244214][T31416] binder: BINDER_SET_CONTEXT_MGR already set [ 2918.250594][T31416] binder: 31415:31416 ioctl 40046207 6c000000 returned -16 08:55:37 executing program 3: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) getsockopt$inet_dccp_buf(r0, 0x21, 0xc0, &(0x7f0000000000)=""/49, &(0x7f0000000040)=0x31) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, &(0x7f0000000140)=0x4, 0x4) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:55:37 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x3000000) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2918.320508][T31416] binder: 31415:31416 ioctl c0306201 0 returned -14 08:55:37 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000300)={{{@in=@initdev, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in6=@dev}}, &(0x7f0000000140)=0xe8) setsockopt$packet_add_memb(r1, 0x107, 0x1, &(0x7f0000000180)={r4, 0x1, 0x6, @broadcast}, 0x10) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) [ 2918.367138][T31522] binder: 31415:31522 ioctl c0306201 0 returned -14 08:55:37 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x74000000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 2918.553656][ C1] net_ratelimit: 6 callbacks suppressed [ 2918.553682][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2918.566092][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2918.607924][T31526] binder: BINDER_SET_CONTEXT_MGR already set [ 2918.657433][T31526] binder: 31525:31526 ioctl 40046207 0 returned -16 [ 2918.760677][T31574] binder: BINDER_SET_CONTEXT_MGR already set [ 2918.791316][T31574] binder: 31535:31574 ioctl 40046207 74000000 returned -16 [ 2918.823749][T31640] binder: 31535:31640 ioctl c0306201 0 returned -14 [ 2918.875118][T31640] binder: 31535:31640 ioctl c0306201 0 returned -14 [ 2918.909691][T31528] validate_nla: 5 callbacks suppressed [ 2918.909708][T31528] netlink: 'syz-executor.0': attribute type 12 has an invalid length. 08:55:38 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) syz_open_procfs(0x0, &(0x7f0000272000)) 08:55:38 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x4000000) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:38 executing program 3: mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) r0 = socket$inet6(0xa, 0x80001, 0x0) getsockopt$bt_hci(r0, 0x0, 0x60, &(0x7f00001e3000)=""/30, &(0x7f0000d23000)=0x44) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000040)=@filter={'filter\x00\x11\x00', 0xe, 0x2, 0x250, [0x0, 0x20000100, 0x20000130, 0x20000280], 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000002000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0100000003000000000000000000697036677265300000000000000000007465616d30000000000000000000000076657468305f746f5f626f6e6400000076657468305f746f5f626f6e64000000aaaaaaaaaa00000000000000ffffffffffff0000000000000000f0000000f0000000200100006c696d697400000000000000000000000000000000000000000000000000000020000000000000000000000002000000000000000000000000000000000000000000000000000000636c75737465720000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000041554449540000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff0100000011000000000000000000766c616e3000000000000000000000006c6f0000000000000000000000000000726f736530000000000000000000000062726964676530000000000000000000ffffffffffff000000000000aaaaaaaaaa0000000000000000007000000070000000a000000041554449540000000000000000000000000000000000000000000000000000000800"/592]}, 0x2c8) 08:55:38 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) getpeername$netlink(r0, &(0x7f0000000000), &(0x7f0000000040)=0xc) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12400000"], 0x0, 0x0, 0x0}) [ 2919.001809][T31290] netlink: 'syz-executor.5': attribute type 12 has an invalid length. [ 2919.139867][T31650] binder: BINDER_SET_CONTEXT_MGR already set [ 2919.144150][T31648] binder: 31645:31648 unknown command 16402 [ 2919.172129][T31650] binder: 31646:31650 ioctl 40046207 4000000 returned -16 [ 2919.173303][T31648] binder: 31645:31648 ioctl c0306201 200002c0 returned -22 [ 2919.216515][T31655] binder: BINDER_SET_CONTEXT_MGR already set [ 2919.243212][T31654] netlink: 'syz-executor.0': attribute type 12 has an invalid length. [ 2919.262963][T31655] binder: 31646:31655 ioctl 40046207 4000000 returned -16 08:55:38 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x7a000000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:55:38 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x4000, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) 08:55:38 executing program 3: r0 = syz_open_dev$video4linux(&(0x7f0000000040)='/dev/v4l-subdev#\x00', 0x3, 0x3ffd) ioctl$VIDIOC_SUBDEV_G_CROP(r0, 0xc0905664, &(0x7f00000000c0)={0x0, 0x0, {0xfffffffffffffffc}}) 08:55:38 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x299, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:55:38 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x5000000) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2919.399652][T31760] binder: BINDER_SET_CONTEXT_MGR already set [ 2919.433345][T31760] binder: 31759:31760 ioctl 40046207 7a000000 returned -16 08:55:38 executing program 3: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x100, 0x0) ioctl$TIOCNXCL(r1, 0x540d) r2 = socket(0x40000000015, 0x5, 0x0) bind$inet(r2, &(0x7f00008a5ff0)={0x2, 0x0, @loopback}, 0x10) dup3(r0, r2, 0x0) [ 2919.530852][T31771] binder: 31759:31771 ioctl c0306201 0 returned -14 [ 2919.592819][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2919.598668][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2919.656467][T31773] binder: BINDER_SET_CONTEXT_MGR already set [ 2919.724920][T31773] binder: 31772:31773 ioctl 40046207 5000000 returned -16 08:55:39 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x100000000000000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:55:39 executing program 3: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x400, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000140)='TIPC\x00') sendmsg$TIPC_CMD_RESET_LINK_STATS(r0, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400004}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x28, r1, 0x0, 0x70bd2a, 0x25dfdbfe, {{}, 0x0, 0x410c, 0x0, {0xc, 0x14, 'syz1\x00'}}, ["", "", ""]}, 0x28}}, 0x40) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="1c000000350029080000000000000000040e000008f8ff0000000000ed8ee3ab81a88c73ec7948b826574b75925fe03001047dd56e92a2b7133394e45bc5e803cd1a46f43edc5e0899d31c78b8d5dd5aaa0a60e7d8089db0a55d0d9c520882b05393e75041870200"/113], 0x1c}}, 0x0) [ 2919.992778][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2919.998613][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2920.037636][T31899] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.3'. [ 2920.043690][T31896] binder: 31893:31896 ioctl c0306201 0 returned -14 [ 2920.095238][T31900] binder: 31893:31900 ioctl c0306201 0 returned -14 [ 2920.293206][T31767] netlink: 'syz-executor.5': attribute type 12 has an invalid length. [ 2920.414435][T31902] netlink: 'syz-executor.5': attribute type 12 has an invalid length. [ 2920.576246][T31654] netlink: 'syz-executor.0': attribute type 12 has an invalid length. [ 2920.632794][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2920.638851][ C1] protocol 88fb is buggy, dev hsr_slave_1 08:55:40 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) syz_open_procfs(0x0, &(0x7f0000272000)) 08:55:40 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) fcntl$setpipe(r0, 0x407, 0x75) 08:55:40 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x6000000) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:40 executing program 3: set_mempolicy(0x0, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x30, r1, 0x1, 0x0, 0x0, {{}, 0x0, 0x4108, 0x0, {0x14, 0x18, {0x0, @bearer=@l2={'ib', 0x3a, 'ip6_vti0\x00'}}}}}, 0x30}}, 0x0) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cgroup.events\x00', 0x0, 0x0) ioctl$KDDISABIO(r2, 0x4b37) ioctl$IMGETDEVINFO(r0, 0x80044944, &(0x7f0000000180)={0x2}) 08:55:40 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x200000000000000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:55:40 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x6000, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) [ 2920.824775][T31911] binder: 31910:31911 ioctl c0306201 0 returned -14 [ 2920.824872][T31912] netlink: 'syz-executor.5': attribute type 12 has an invalid length. [ 2920.871029][T31911] binder: BINDER_SET_CONTEXT_MGR already set 08:55:40 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="1954ecf658d242465e21f16cd753169ba6dca085727304663e78649abba25c766e4a581635b78160a75c847aa3350de654abcdd69da785dcca80a92160dd3ec42e979dd724b2405197d259f7bfdee950c8e1ed65fdf6148cc342b35f0099102312795b0722cbdb842daae26e29a27827db8957dc8ea6c49d05e9e428afc3bff27f38e7379e08335b7c2b22dbc1d42945db01f8d3b795fc4be8242e6353bd63f9000000000000004688ac2588959d3716b71a3140038217ab24a2543f1dc268687f6a853dbd4ab8394a147c36efd3518c1c6995d6d494f6352ac06f7e91c01efdb807b3870356d9fe38a949dba1b9c8af8de9c349f77af3749877af42a8"], 0x0, 0x0, 0x0}) [ 2920.920007][T31928] binder: 31910:31928 ioctl c0306201 0 returned -14 [ 2920.938081][T31911] binder: 31910:31911 ioctl 40046207 200000000000000 returned -16 08:55:40 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x7000000) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:40 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x300000000000000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 2921.146269][T32038] binder: 32036:32038 unknown command -152284135 [ 2921.176055][T32038] binder: 32036:32038 ioctl c0306201 200002c0 returned -22 [ 2921.258526][T32043] binder: BINDER_SET_CONTEXT_MGR already set [ 2921.310656][T32043] binder: 32040:32043 ioctl 40046207 7000000 returned -16 [ 2921.329251][T32047] binder: BINDER_SET_CONTEXT_MGR already set [ 2921.358705][T32047] binder: 32044:32047 ioctl 40046207 300000000000000 returned -16 08:55:40 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000000000)={0xc9, 0x3f, 0x200, 0x7, 0x7f, 0x200, 0x3, 0x542, 0x0}, &(0x7f0000000040)=0x20) setsockopt$inet_sctp_SCTP_AUTH_DELETE_KEY(r0, 0x84, 0x19, &(0x7f0000000080)={r1}, 0x8) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) r3 = perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f0000000300)={0xff, 0x3f, 0x8, 0x0, 0x0, [{r5, 0x0, 0x2}, {r2, 0x0, 0x5}, {r3, 0x0, 0x3f}, {r4, 0x0, 0x6}, {r3, 0x0, 0x1}, {r4, 0x0, 0xffffffff00000000}, {r5, 0x0, 0x5}, {r4, 0x0, 0xb5b}]}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1163484000fffffffffffffff800f7de0a00000082a8c4de63173d613927fd8409814838080358c439ec5f155594d9ad1a88e71675902bf507231d9960c8c6a997cd9376c66029a114899bdcd1ed5043307b659050984a6e0898a99205f36f12378fd1598269f9052005ad063b68affafc5c25e41d2561747b9d074f91865dc1249b1eabd624e947585e2c5f4bdbf4a5c268793bccf9f7921f18da5ce459201ab4f9e89819d3f33aafef34fabd67"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840aa1f3aebfc934c72ce0acb124897cc8422a2204f4abb2e98e68399043b483818e50f2ca49bc6e8b88e86bf45e9a9ef14dafb5645a227a8da7d14583fb1177279bbf874bc74b665573cfadc6bfd7455aad66cb31c74cf9cb27a17bba76b96edc0e6ade7292e"], 0x0, 0x0, 0x0}) 08:55:40 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x7620440) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2921.415106][T32152] binder: 32044:32152 ioctl c0306201 0 returned -14 08:55:41 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x400000000000000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 2921.650599][T32161] binder: BINDER_SET_CONTEXT_MGR already set [ 2921.672823][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2921.678705][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2921.697646][T32161] binder: 32156:32161 ioctl 40046207 7620440 returned -16 [ 2921.863927][T32153] netlink: 'syz-executor.0': attribute type 12 has an invalid length. [ 2921.881580][T32273] binder: 32272:32273 ioctl c0306201 0 returned -14 [ 2921.956435][T32276] binder: 32272:32276 ioctl c0306201 0 returned -14 [ 2922.332788][T32164] netlink: 'syz-executor.5': attribute type 12 has an invalid length. [ 2922.455976][T32159] netlink: 'syz-executor.0': attribute type 12 has an invalid length. 08:55:42 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) syz_open_procfs(0x0, &(0x7f0000272000)) 08:55:42 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="1263484038a27934435c832659bcf0a6c0e21166b0a29c2694f2626b20352f7c8d8fb3083fedde2aecb883b908566af2e10d5a8ada4ecf5b4a6265e1923ac35c14bd8f5b9fffa16b4a68335e5f5c6d8e7bd313f84f372c42c06e7486910406ed488102f1c5089deaf92f7dd94eb0be4ba75de73f8e928274688c4a8af86aae6d65a415fddb4b4f34ace3e3e51efdaf7fae6bc5fa4a3ed229003c88b6bfb9c86fba35f418553f661b5c6bf0e7f47f9582d1b11ceeb569a9fe3c6867666266c72948206ca8817baf76b9e8810e71599c847be5ee6acf0605baff28088a27f1f2687b7eef73a6618b00f47f19368ce2d5c9212d7f31917f8b0cfdeba21440b0ecde26c8ea05ac621af6205e7daf6319b0899049b9edaf1b61e00d4020aad70f476f2f9d5b528c0c34beca595e7c044c706844bb3d51cd"], 0x0, 0x0, 0x0}) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r1, 0x28, 0x2, &(0x7f0000000000)=0x3f, 0x8) 08:55:42 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x8000000) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:42 executing program 3: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000000000)={0xc9, 0x3f, 0x200, 0x7, 0x7f, 0x200, 0x3, 0x542, 0x0}, &(0x7f0000000040)=0x20) setsockopt$inet_sctp_SCTP_AUTH_DELETE_KEY(r0, 0x84, 0x19, &(0x7f0000000080)={r1}, 0x8) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) r3 = perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f0000000300)={0xff, 0x3f, 0x8, 0x0, 0x0, [{r5, 0x0, 0x2}, {r2, 0x0, 0x5}, {r3, 0x0, 0x3f}, {r4, 0x0, 0x6}, {r3, 0x0, 0x1}, {r4, 0x0, 0xffffffff00000000}, {r5, 0x0, 0x5}, {r4, 0x0, 0xb5b}]}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1163484000fffffffffffffff800f7de0a00000082a8c4de63173d613927fd8409814838080358c439ec5f155594d9ad1a88e71675902bf507231d9960c8c6a997cd9376c66029a114899bdcd1ed5043307b659050984a6e0898a99205f36f12378fd1598269f9052005ad063b68affafc5c25e41d2561747b9d074f91865dc1249b1eabd624e947585e2c5f4bdbf4a5c268793bccf9f7921f18da5ce459201ab4f9e89819d3f33aafef34fabd67"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12634840aa1f3aebfc934c72ce0acb124897cc8422a2204f4abb2e98e68399043b483818e50f2ca49bc6e8b88e86bf45e9a9ef14dafb5645a227a8da7d14583fb1177279bbf874bc74b665573cfadc6bfd7455aad66cb31c74cf9cb27a17bba76b96edc0e6ade7292e"], 0x0, 0x0, 0x0}) 08:55:42 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x500000000000000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:55:42 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0xea37, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) [ 2922.717085][T32285] binder: 32280:32285 ioctl c0306201 0 returned -14 [ 2922.755376][T32288] binder: BINDER_SET_CONTEXT_MGR already set [ 2922.791818][T32284] binder: BINDER_SET_CONTEXT_MGR already set [ 2922.800030][T32293] binder: 32280:32293 ioctl c0306201 0 returned -14 [ 2922.809413][T32288] binder: 32287:32288 ioctl 40046207 0 returned -16 [ 2922.823653][T32284] binder: 32283:32284 ioctl 40046207 8000000 returned -16 08:55:42 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x600000000000000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 2922.870846][T32336] binder: BINDER_SET_CONTEXT_MGR already set 08:55:42 executing program 3: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) fcntl$setpipe(r0, 0x407, 0x75) 08:55:42 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) r1 = perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="116348400000000000000000000d5abe950c000000f3ffffff"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) [ 2922.925130][T32336] binder: 32283:32336 ioctl 40046207 8000000 returned -16 08:55:42 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x10000000) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2923.094351][T32415] binder: 32414:32415 ioctl c0306201 0 returned -14 [ 2923.239844][T32420] binder: BINDER_SET_CONTEXT_MGR already set 08:55:42 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x700000000000000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:55:42 executing program 3: r0 = socket$inet6(0xa, 0x800000000000000b, 0x1) connect$inet6(r0, &(0x7f0000005d00)={0xa, 0x0, 0x0, @mcast1, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x4e24, 0x0, @ipv4={[], [], @initdev}}, 0x4c) sendmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x2, &(0x7f0000002d40), 0x2bc}}, {{0x0, 0x0, &(0x7f0000000040), 0x361, &(0x7f0000000140)}}], 0x40001ab, 0x9400) r1 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x7f5c, 0x40) ioctl$UI_SET_PROPBIT(r1, 0x4004556e, 0x11) [ 2923.286703][T32426] binder: BINDER_SET_CONTEXT_MGR already set [ 2923.296169][T32420] binder: 32419:32420 ioctl 40046207 0 returned -16 [ 2923.329063][T32426] binder: 32421:32426 ioctl 40046207 10000000 returned -16 [ 2923.519640][T32506] binder: 32481:32506 ioctl c0306201 0 returned -14 [ 2923.633722][T32545] binder: 32481:32545 ioctl c0306201 0 returned -14 [ 2923.752793][ C0] net_ratelimit: 4 callbacks suppressed [ 2923.752803][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2923.758527][ C0] protocol 88fb is buggy, dev hsr_slave_1 08:55:43 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) syz_open_procfs(0x0, &(0x7f0000272000)) 08:55:43 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x20000000) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:43 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xca04, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000140)='IPVS\x00') sendmsg$IPVS_CMD_GET_DEST(r0, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000180)={0x24, r1, 0x10e, 0x70bd2d, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xc5b}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x2400c800) r2 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$FS_IOC_FSSETXATTR(r3, 0x401c5820, &(0x7f0000000000)={0x1, 0x8000, 0x7, 0x6, 0x3}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="00000000000000ffffffff00000000f600000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x86e, 0x0, &(0x7f00000001c0)=ANY=[@ANYRESHEX=r3], 0x0, 0x0, 0x0}) 08:55:43 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_open_dev$sg(&(0x7f00000000c0)='/dev/sg#\x00', 0x0, 0x0) openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/cache_bypass\x00', 0x2, 0x0) getsockopt$inet_sctp_SCTP_PR_STREAM_STATUS(0xffffffffffffffff, 0x84, 0x74, 0x0, &(0x7f0000000200)) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(0xffffffffffffffff, 0x8250aea6, &(0x7f00000001c0)=""/247) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f00000000c0)={0x0, 0x2, 0x113000, 0x1000, &(0x7f0000002000/0x1000)=nil}) ioctl$KVM_ASSIGN_PCI_DEVICE(r1, 0x8040ae69, &(0x7f0000000100)={0x9, 0xc597, 0x9, 0x4, 0x6}) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000040)={0x0, 0x2, 0x0, 0x2000, &(0x7f0000001000/0x2000)=nil}) write$evdev(0xffffffffffffffff, &(0x7f0000000100), 0x0) openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(0xffffffffffffffff, 0x84, 0x79, 0x0, 0x545ab53f) r3 = syz_open_dev$dri(&(0x7f0000000240)='/dev/dri/card#\x00', 0xc72f, 0x0) statfs(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)=""/172) ioctl$DRM_IOCTL_MODE_SETCRTC(r3, 0xc06864a2, &(0x7f0000000000)={0x0, 0x400000000000000, 0x200000000001f, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "77100b6a1cc076a15ad9f0552d5b12bfc338e5269b12ac2a4ee4202c64122b0a"}}) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x0, 0x20011, r2, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) 08:55:43 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x1000000000000000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:55:43 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0xf000, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) [ 2924.089838][T32562] validate_nla: 4 callbacks suppressed [ 2924.089898][T32562] netlink: 'syz-executor.0': attribute type 12 has an invalid length. [ 2924.110687][T32560] binder: 32555:32560 ioctl c0306201 0 returned -14 [ 2924.116329][T32575] binder: BINDER_SET_CONTEXT_MGR already set [ 2924.154057][T32575] binder: 32553:32575 ioctl 40046207 20000000 returned -16 [ 2924.163988][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2924.170466][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2924.192282][T32607] binder: 32555:32607 ioctl c0306201 0 returned -14 08:55:43 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x3f000000) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:43 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x2000000000000000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:55:43 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280)='/dev/sequencer\x00', 0x0, 0x0) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f00000000c0)=0x0) r3 = syz_open_procfs(r2, &(0x7f0000000100)='net/ipx\x00') write$FUSE_DIRENT(0xffffffffffffffff, 0x0, 0x0) r4 = syz_open_dev$dspn(&(0x7f0000000080)='/dev/dsp#\x00', 0x1, 0x0) syz_genetlink_get_family_id$team(&(0x7f00000001c0)='team\x00') getsockopt$inet6_mreq(r4, 0x29, 0x0, 0x0, &(0x7f00000002c0)) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000680)={{{@in6=@initdev, @in=@multicast2}}, {{@in6=@mcast1}, 0x0, @in=@initdev}}, &(0x7f0000000780)=0xe8) getsockopt$inet6_mreq(r3, 0x29, 0x0, &(0x7f00000007c0)={@local}, &(0x7f0000000800)=0x14) ioctl$RTC_WKALM_RD(r4, 0x80287010, &(0x7f0000000240)) getsockname$packet(0xffffffffffffffff, &(0x7f0000000a40)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000a80)=0x14) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000ac0)={'dummy0\x00'}) getsockopt$inet_IP_IPSEC_POLICY(r3, 0x0, 0x10, &(0x7f0000000bc0)={{{@in6=@mcast2, @in=@multicast1}}, {{@in6=@local}, 0x0, @in6=@loopback}}, &(0x7f0000000cc0)=0xe8) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000e80)={{{@in=@multicast1, @in6=@initdev}}, {{@in=@multicast1}, 0x0, @in6=@remote}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000fc0)={'vcan0\x00'}) getsockopt$inet_mreqn(r0, 0x0, 0x24, 0x0, &(0x7f0000001040)) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000001080)={0x0, @remote}, 0x0) accept$packet(r3, &(0x7f0000001100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001140)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r3, &(0x7f0000001640)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001600)={&(0x7f00000003c0)=ANY=[@ANYBLOB="cc66340e23ac5fb0d00000000000230500767c82d97e58b7436ab314c88e12000000007f0568c033b8346fe303b9fd1f31da987ca8aaccf4ff98b9469641954a9b326337b6e25b357368b22ae195eefd7ae596cfd65e40deb8ffa1a4f0b0e1cbb6a15818c64c9da3f0ba78d6355f09", @ANYRES32=r5], 0x2}, 0x1, 0x0, 0x0, 0x8081}, 0x10) setsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(0xffffffffffffffff, 0x84, 0x12, 0x0, 0x0) ioctl$int_in(r4, 0x800000c0045005, &(0x7f0000000000)=0x1000) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x3, 0x2012, r4, 0x0) poll(&(0x7f0000000040), 0x0, 0x3) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e23, @broadcast}, 0x10) shutdown(0xffffffffffffffff, 0x1) recvmsg(r1, &(0x7f0000000140)={0x0, 0x12a, 0x0, 0xffffffffffffffa0, 0x0, 0xfffffc80}, 0x200100) ioctl$FS_IOC_GETFLAGS(0xffffffffffffffff, 0x80086601, 0x0) 08:55:44 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x40000000) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:44 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) r3 = openat(r0, &(0x7f0000000000)='./file0\x00', 0x4c0000, 0x30) syz_open_pts(r3, 0x200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:55:44 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x4000000000000000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 2924.792802][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2924.798806][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2925.037492][T32738] binder: BINDER_SET_CONTEXT_MGR already set [ 2925.076401][T32738] binder: 32707:32738 ioctl 40046207 4000000000000000 returned -16 [ 2925.076559][ T326] binder: 32707:326 ioctl c0306201 0 returned -14 [ 2925.121697][T32577] netlink: 'syz-executor.5': attribute type 12 has an invalid length. [ 2925.158483][T32738] binder: BINDER_SET_CONTEXT_MGR already set [ 2925.171441][ T326] binder: 32707:326 ioctl c0306201 0 returned -14 [ 2925.189220][T32738] binder: 32707:32738 ioctl 40046207 4000000000000000 returned -16 [ 2925.363265][T32705] netlink: 'syz-executor.5': attribute type 12 has an invalid length. [ 2925.511797][T32704] netlink: 'syz-executor.0': attribute type 12 has an invalid length. 08:55:45 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) syz_open_procfs(0x0, &(0x7f0000272000)) 08:55:45 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x40046207) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:45 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x4800000000000000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:55:45 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="116348400000000900"/20], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:55:45 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0xf0ffff, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) 08:55:45 executing program 3: unshare(0x8000400) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net\x00\x00\x00\x000\x8a\x0eU\\\x98\x10\xba\xa8\x11\xb0\x0e)\xd0BD\xa6Z<\x98c\xa4\xb3$\xa5c&\x01\xda78!E\x0e=\\\xef4\xc6I\xbb\xcb:B\xedCe\xa0\xbe\xe1>\xf3\x87x;\xd6r|\xc0\xee\x85F#\xd6w\x8b\xba\xbd}\xfeM\xa7\xdf \xafAPaQ\x14\x86\x14lXS\xa7\xe2\xcb\x83I\xbe\xe1\a\v\xdb*\x04>Tmwh\xf3\xe8\xdb\x97\x87\xb7\x80K\x7f\b\x86\x98\x86\xfd\x1b\x81\x11\xf5T*\x1f\xd9\xfc\x9d\x1e\xd3\xaf\xfd\xed\\\xeb\xbcBQP\x18\xb0\xdc{\xa7\xe0\xe3\xa2\xc5\xca\xcaR\xa4h\xa7\x8ak\x05\xceK\xeei\x962P`\xfbuk\x1ck\xf6\xf5\xcdAa\xe0\xe3\xcbI.\xb9oD\x0e)?\x8b0x0, 0x68, &(0x7f00000005c0)=[@in={0x2, 0x4e21, @multicast2}, @in6={0xa, 0x4e20, 0x7, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0xff}, @in={0x2, 0x4e20, @empty}, @in6={0xa, 0x4e22, 0xddb, @empty, 0x4}, @in={0x2, 0x4e22, @multicast2}]}, &(0x7f0000000300)=0x10) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r3, 0x84, 0x5, &(0x7f00000009c0)={r4, @in6={{0xa, 0x4e22, 0x5, @loopback, 0x3}}}, 0x84) ioctl(r2, 0x10001, &(0x7f0000000100)="153f6234488dd25d766070") socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000540)={0xffffffffffffffff}) r6 = socket(0xa, 0x3, 0x8) r7 = syz_open_dev$amidi(&(0x7f0000000340)='/dev/amidi#\x00', 0x9c4, 0x70000) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000800)=0x0) ioctl$sock_FIOSETOWN(r5, 0x8901, &(0x7f0000000440)=r8) ioctl$sock_inet_SIOCSIFFLAGS(r6, 0x89a2, &(0x7f0000000180)={'bridge0\x00\x00\x01\x00', 0x4}) ioctl$RTC_WKALM_RD(r6, 0x80287010, &(0x7f00000004c0)) setsockopt$IP_VS_SO_SET_DELDEST(r6, 0x0, 0x488, &(0x7f0000000080)={{0x6c, @remote, 0x4e24, 0x2, 'lblcr\x00', 0x1e, 0x0, 0x13}, {@empty, 0x4e21, 0x7, 0xffff, 0x7f, 0x2}}, 0x44) r9 = memfd_create(&(0x7f0000000140)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02\x05\x00\x00\x00\xac', 0x0) write$binfmt_misc(r5, &(0x7f0000000200)=ANY=[], 0x0) close(r7) r10 = dup3(r1, r9, 0x10000) setsockopt$inet_sctp_SCTP_EVENTS(r10, 0x84, 0xb, &(0x7f0000000280)={0x7fff, 0x1, 0x40, 0x7, 0x1f, 0x6, 0x100000000, 0x8001, 0x7d, 0x2, 0x86}, 0xb) write$RDMA_USER_CM_CMD_CREATE_ID(r7, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000040), 0x143}}, 0xa) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r11 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r11, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000a80)=ANY=[@ANYBLOB="2c0000002000290f0000000000000000020000000000000000000000040000000c00140099658d955ba42d723edc276785e9b38ab8d4bfa5d729255e39cfc0a2e4a39c97f5a4d2509d4d3b2831f588be3af1457dc8a38b290c5c6e8b421f6833c0fea102e09e08f312fc96f834ec7c557e23fa24174fe328151ad7efdfb22f045c4b2adea5ab634f7ada777c3c1d0f76d1a57be22b4430713b7e295f249dab5269bd6b00a367e33fddcaab219dae120d031479bca0f0638e25f5c06c5eb91eae05fd50fed115a3", @ANYRES32=0x0, @ANYRES32=0x0], 0x2c}}, 0x0) sendmsg$key(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000006c0)=ANY=[@ANYBLOB="5452ae4ec1a377b4eb763893cbb396aa12e33814a23d86d1f2644115bd0b6e81191a76415cff9cba07449bcac0abbaea0004000000000000f1fff14ac1b1e061867c68134a357cbcf9a0626e63d92e02218174337c49a6b2131f5aa516b50e7497b0a4e31226a3ba053972a89b15c6eaf8dc2b59ab7623be0328b875881ce6da5054f7013bcd5570f8c2d8ef70683e18bb4cbdfc2db575030260b3f65a6c9abaa9077a0475dbef8bdad7fdc63e37e361ae89cac4df8e7930d4c23faedb09d2a90c88b91b8442f90223035ea7c1f35e"], 0xcf}}, 0x4000001) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000840)=ANY=[@ANYBLOB="020110daf3cfc664d42fd2f7d810000000000006f6fffffc0000000000008000009b54000000e000000100000000000094f40337ff6b4ed6cd69675e973e00003500bb7a7a2d00000000000000ff0000000058d52a000000bb00000000eeff48f89f48a0d44b9a8238ce8005ffff03000500000000e90200423b00000000000000400000000000000000000000002000d40470c90b2bc791a93d1260cfcb71b779839a8713564f074461669c16c64aedc3c25152e01a8ce5141e33580d608b0100000000000000e508f32571efa7ae4630fc30eca5a3769370b5f39e26fec23cee7a49a14e2c1bc46152dd6fb4edf14c4fae5c1547e65f6d0ba9a9cd944959000064d4078dce8e1ecf9f4edfbe20d4ac5056bb3cd9985ad80e2ce2b9b293e1246622aaed04aadf78d9a414a1012c3b0bf5222fd4f99f83d08a3d3f6e5b94f2e203ccdfd43ce79d215952ca7c4ab8cafeab51e6f662a65e11dfb8fe"], 0x14d}}, 0x0) [ 2925.991374][ T379] binder: 363:379 ioctl c0306201 0 returned -14 08:55:45 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x4c00000000000000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:55:45 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x48000000) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:45 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="116348400000000000000000000000000000000018fed3c3906816f25b1f0707033fc11a98d2b09eb14839bf0296a5584d6c8b9f8666f2a55173842512fdc9debe0b91c6f29c52c94bf69a878b69e2c07b1a85ab33dd1d8c41377de0359dc82b0f1fff7155987e493268d2c69dc94c7768f5669078b75be7e70d17b2312530de77b1a07314af484c0b4b5c10d3525cc8fbdc0dc65b3ec298c68772b5b0d8051d3aa7f1ee26dcccb408b30e1ad6560a6abfe63fab14a6800b08b20337"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000140)=0x80) [ 2926.232845][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2926.238733][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2926.490344][ T498] binder: BINDER_SET_CONTEXT_MGR already set [ 2926.491412][ T514] binder: 494:514 ioctl c0306201 0 returned -14 [ 2926.553918][ T498] binder: 493:498 ioctl 40046207 48000000 returned -16 [ 2926.562139][ T610] binder: 494:610 ioctl c0306201 0 returned -14 08:55:46 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$DRM_IOCTL_SET_MASTER(r1, 0x641e) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:55:46 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x4c000000) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2926.899571][ T620] binder: BINDER_SET_CONTEXT_MGR already set [ 2926.934422][ T620] binder: 618:620 ioctl 40046207 4c000000 returned -16 [ 2926.996509][ T372] netlink: 'syz-executor.0': attribute type 12 has an invalid length. [ 2927.259381][ T611] netlink: 'syz-executor.0': attribute type 12 has an invalid length. [ 2927.503269][ T616] netlink: 'syz-executor.5': attribute type 12 has an invalid length. 08:55:47 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000440)=ANY=[@ANYBLOB="38f81009f83e974f824fd02f127e99fa36f5d2418bda3e7debd1dbe3fa410ad9020001000000000000000af2954981b7b4f4d125459442a400007bf0974ef7f4c97c205996d3c8715ce1342fe07d97bd6200a2989c6651127c00000000000000ec7d6b745b1b4975c5c6fee68bf7f6ee6c38ccf01259268b77cd3a0f83c0d38cccfeab45d86b0474d4cf"], 0x0, 0x80}, 0x20) pipe(&(0x7f0000000180)={0xffffffffffffffff}) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r3, 0xc0bc5310, &(0x7f0000000380)) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000040)={0x3, 0x2, 0xf000, 0x1000, &(0x7f0000015000/0x1000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x1f004}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_NMI(r4, 0xae9a) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f00000002c0)) r5 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x20041, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r5, 0xc0405519, &(0x7f0000000080)={0x9, 0x5, 0x51f, 0x2, '\x00', 0xb9a}) ioctl$KVM_RUN(r4, 0xae80, 0x0) 08:55:47 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) syz_open_procfs(0x0, &(0x7f0000272000)) 08:55:47 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x60000000) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:47 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_NMI(r0, 0xae9a) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) [ 2927.762911][ T739] binder: BINDER_SET_CONTEXT_MGR already set [ 2927.798818][ T739] binder: 730:739 ioctl 40046207 60000000 returned -16 [ 2927.958801][ T742] netlink: 'syz-executor.0': attribute type 12 has an invalid length. 08:55:47 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x68000000) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:47 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x6000000000000000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:55:47 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x1000000, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) 08:55:47 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/ip_tables_targets\x00') preadv(r0, &(0x7f0000000000)=[{&(0x7f0000000240)=""/202, 0xca}], 0x1, 0x0) 08:55:47 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) r2 = perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$getownex(r2, 0x10, &(0x7f0000000000)={0x0, 0x0}) setpriority(0x0, r3, 0x0) ioctl$TUNSETVNETHDRSZ(r1, 0x400454d8, &(0x7f0000000040)=0xa9b) r4 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(0x0, 0x0, 0x2) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ptrace$getregset(0x4204, r3, 0x200, &(0x7f0000000180)={&(0x7f0000000140)=""/16, 0x10}) ioctl$HDIO_GETGEO(r1, 0x301, &(0x7f0000000080)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) syz_open_dev$amidi(&(0x7f00000001c0)='/dev/amidi#\x00', 0x1, 0x40) [ 2928.307449][ T862] binder: 861:862 ioctl c0306201 0 returned -14 08:55:47 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x6c000000) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:47 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = creat(0x0, 0x85) openat(0xffffffffffffffff, 0x0, 0x800, 0x68) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0xfffffffffffffff1, &(0x7f00000001c0)=0xd) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000001, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000040)='fdinfo\x00') r5 = add_key$user(&(0x7f00000000c0)='user\x00', &(0x7f0000000200)={'syz', 0x1}, &(0x7f0000000240)="79ee8e1d51af38a7003ba7c6d84887713abfa26ed63e8ec84d30bbb1efc437e1c688fc7406e91a", 0x27, 0xfffffffffffffffd) keyctl$set_timeout(0xf, r5, 0x7) getdents(r4, &(0x7f0000002480)=""/4096, 0x12fe) r6 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff], 0x1f004}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000002c0)) ioctl$KVM_CHECK_EXTENSION(r0, 0xae03, 0xb4) syncfs(r2) ioctl$EVIOCSABS2F(r3, 0x401845ef, &(0x7f0000000380)={0x9, 0x7, 0x0, 0x2, 0x4, 0x5}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000000)=[@text16={0x10, &(0x7f0000000100)="640ff24101660f08f20f1bfa0f20e06635000040000f22e0bad004b00fee36260f01dfaa8fc900010b0f080f005b9a", 0x2f}], 0x1, 0x0, 0x0, 0x183) ioctl$KVM_RUN(r2, 0xae80, 0x0) getpeername$packet(r3, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000440)=0x14) setsockopt$inet_mreqn(r6, 0x0, 0x24, &(0x7f0000000480)={@remote, @initdev={0xac, 0x1e, 0x1, 0x0}, r7}, 0xc) [ 2928.377887][ T869] binder: BINDER_SET_CONTEXT_MGR already set [ 2928.411849][ T869] binder: 867:869 ioctl 40046207 0 returned -16 [ 2928.416774][ T874] binder: 861:874 ioctl c0306201 0 returned -14 08:55:47 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x6800000000000000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 2928.747382][ T989] binder: 988:989 ioctl c0306201 0 returned -14 [ 2928.862126][ T994] binder: 988:994 ioctl c0306201 0 returned -14 [ 2928.952873][ C1] net_ratelimit: 6 callbacks suppressed [ 2928.952883][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2928.964542][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 2929.133328][ T872] netlink: 'syz-executor.5': attribute type 12 has an invalid length. 08:55:48 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) syz_open_procfs(0x0, &(0x7f0000272000)) 08:55:48 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) r1 = getpgid(0x0) ptrace$pokeuser(0x6, r1, 0x8, 0x6) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') sendmsg$IPVS_CMD_SET_CONFIG(r0, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, r2, 0x408, 0x70bd29, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x814}, 0x40) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TUNSETSNDBUF(r3, 0x400454d4, &(0x7f0000000280)=0x7fffffff) r4 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) semget$private(0x0, 0x2, 0x205) r5 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) setsockopt(r0, 0x8, 0x6, &(0x7f0000000300)="7e3391cf3360b264cff6c72aa6e766afdaf5b02fcb7f7b5c816174c82abc3ace95795c63f57a52b5c804929287416de47c322b38c059b2a5a87e7daeac5fb1c8144c7e5cf148cb3e595f6d0851361168efe69fda257bc21b2b4fba11ee100c4fdf97804fe3b9dc2cec95e98f40d059e35240bdb9e9368faaa12c53cc6f627d7414cfcae39e11bb5c0d973e8b92c32b5d68be4e26d2ff8ac1007a15a85cfce4344cf5e7587e8dde693445f6abfd707c72924b4765bee8f113751647821a8eb545d9c3f15bc9e51e063073703fb15315e85a8b05a36cb6fb3f7fcae31fe9247f61906e003ae3d5e589c33db36e", 0xec) prctl$PR_SET_MM_AUXV(0x23, 0xc, &(0x7f00000004c0)="cc6af981484a1a4dbd5e1529d3b694ac090a75b5a075409d1876d88286da77a31a0e352393fc70ae644190c6ca54878df5de24f55f11b91033644d2af0c0a87fa6f56294b93501fbaace614f31629211d3c9d51e097642b4969b0a2c62cd6b98f8f60cf22651126555417ae65aaa2d87958d5d4d86749d4333b2900a285d02e7903df5bba4e871b9396a8d8871c4ceecb9579f596d8490f35b3a5db50613fc8ae15fa755f118d1569a40f550b11b100a1df13672f4d698ffe00d3fd9c696eb2810c65bfa32bbd5411b25db11cabc706e480972b0741cbf5c92730072928b3ac53304f8dd1d16bff39fb0be01d9fb02046c8b9df144516d97780820c1ec56239caa6dd0eccb4aed76e467ba980853ee41a7aa2804130f3db69f86aa0cc45a41fd8fca85903b4ca91dbaa4b810006610156c451d54230552092dae74f89891f250d96d46195cef8971c2d4d761d9390cb3cb030635e716fdfcd7b795bc8ef4fb5898457e85f70f937c5c888930082e82734b0611e24831bbd24c94ec8e8cdab5363998c482997100f82b1bc0a8bd598333c5074746a5a9a3776ec988c319f56f22e2295c34eb30e8f6a01b8bac0d045217269ad8fa995723e6525dec45927463cfec1dca871cb685a33f624c981877319a7c591f70e744d67c35978ddb7c2bd6c97ecbb3bae145df9a5d59f75243f45c81a5468485b3ae7c366f77bfbed333aa9a7541bbb12018f1ec6bf244e4e8c6cbf3feafadd098c64dc4031562a76853c868cc065bc20919b33dadb0e6025afa06d39e552190363018964b5367c1b6e5cb94af1dc8542ae8cdbc78a5600b199f9607d459acf2806ce24bdae758053d1e17d91dc4854f7f0163ba5bede1687223a104630dfb1efb38acacf3350b0f0a80d19c82802aa4deb9e02013dc5bb7e21467ab145d8d24935282345c7846b16865d92929279c017ba6a44e46cf18ba25ab0642ebb74866aa2ee57f92aa47ee7a789c4b0d328dff4babbd7928cc4347efbffbf95c4a6b51fbb9fab956cf6c74f61b5fc2d87115c35858fd0fe7c320ffa04b1790211e25213e71393ad4ba0efd653f7f3de04d9c759e8405167764c871dae43ec78cabb3af88b817d2f9aacc0b7ad3efdbb959a9df8c6e0768eadf272d64d8c111723eb6cfdfc97645b0ad22788e95bf3ad897323fa7f624b847095541bdb9e9371f4c0f0ca6988046c599664d613d3b4174a545783c6ee3c7b3958061582b5fbf8346c9985ebcb8034106f9a5c2b42031cee99e376ba4556750ab450b761a963ee29fd54da931c20dce88d5f448d56541185b77ea141dc3440934da1fea7418a42c305d841878a37c05db8ca7ae21049f886a3d3f753eab42081bda501cfcece8511e14d630077d090e145bcf21a5f5349121cc04c2fcb225d4167729ce794e25ca20b8bb6dfcd06cd86f8739f40f6dfaba7d5210512768d95660661c01b857a5d8b94835cdc26b577464aa5ae53eb32be55732d0660d5c56344643e483ac6e6c35d8ca912462ea3d0078baa4583ba140dc25f99815bf63d39fa800666dea1765815c1ce6ee232c933007c8287567535e78dbfd2f259884ec380a7e4f132d3039f02276de3f8a33e6dd153de8b421942cc5df09d3b211f965b3270854a0c987be86f079d567833ba1bab76dfcf042af455babf4ff3677ed3bb22f93ef93dfdc399bc54df856f6689e2c623a173e014d3669b280dd857b33ff69e743feca4f2567ad8389387722ea9e77132be5d1ee996e687bc3f38f102891e669cc3ee489500a921f45605645310f9e1ac7df8fa7a2784d67223361124a163cf129ade5fb5159b102e3fd3f36a6fa849d4ee0959e0365d765b894e18a3b9324b7ab991ae137107651a92e8960c6b226a1ba3900e26e47de4a9c22e92272d10121775af06fcbc35e0246380a4ffa378eaea565a5ec28f7b31ed1bb6bf43aa4f8f878a30cb32fe0092c8a86e83d6a7e970515f8230308ea939a02024c46f21dc60442a2c17532076b7cafe99c2957aa13d6a097e960036056b93020cb8b3b82ab10f92bb5da79cf926ab79b97b7bdb2d5197cf52cce2151dfe03d8a663abd1b34acc392439ec0d17d334ade9a3e7e7405638c06b3eb81f4514bbaf4ddcd893a4abd1ea200682c7b0e3dc96d24521ef61abc5d141349cb68660a09597d1a893a43783ab154a84ccfa9aaeb3aac058e50f2c899d8ceea9ad9c3ef41593cea78ae165fee6bdd81865484ec3be99c5f944aa87f87cd3e0f16c93142556b2b3c869bc99dcb89b34e0739679605091fb98e4b41885a6b695e698640b112985f72285098f5caa71efd9100b1fb539f7dd64bae08a2535ee1c0df15383cfcf09344949ec5daea99a4916f3ec35d2b27653684f39580a99bdd63b50f2c6514c4a8fffcf753133c0d8101c585bc739f1f44f81f6c8973386e930938f2aa909add331ca3f6bd536890225d08127355bf7c1499219a31729577b4d7ca86b18706fdf094a3329c0db82dd03aa908e5ca202277186e44f2b8ba0fe4afae8827033dffe4128dd026adabf0f4ef83662db3026050e5b8b69d7d9079b3a1deb581298771b5df04f83736c76328f351475d4c28b87b2689f0c14245bf5976efeed047e0cafac4f17bb474bd6b578f1aa9e977a2acb15c4b25b6907c5a3055c754a189c9671b69d0ca3c6b364067bbb71b8824ae52cf066dadede6d55f46216269656990352ab96a6f65b43c6d3f19d05566e16a865159f7ba407f14ea7c13d84d885f801549d70886140cdb990aa9261411739e1e13a2378ba5f978e2f9a9f879a38e2e0a137e9c186402174422c2e9421e3416821a9e9b3afbd34b8b932a489cac76580bc307b7e79f731456ede7de36026070a326483fb7083ca5a28dd49a00c116ebecaeb39a1a54ebe36fe95d7e40f3df9ed5b7a1c563eaa2a2d8bf154063476b3e699a0d01ed626010d31774735ce9cc0821b03453095bc43c7a4ea9e8a392184105860561d3ade0e4452886f1fe2c99b4051d18bb0b371189d1b522f780b3f3d11fc63a978e9ef142d0027d2570ff8dc3766daab9c293d544042a01957b0bc97deb3c48b4830cdc52b2e1cc76e656a0532c95be0413efed817b7d55e30298bc4d95c2d7f5c0570b08c739834d40e38e699fcfd7234a0f6f7845f8742f66c5240cfd913cf3d08070a096df8baaaa75f72dace15e2ca4bbb760f80402d8227e1b25aac7ae3c6014e66cf01d03680bf9d89dbd4248fa4c68490ef1b9a3f70b9b162419a3233f92ca444a26a35359577361352fe4cd1f248d8d5a7679225028d18dbcd2f15a9882b65333c436c828b4b806e75303bca8325ff8d8c5abe2fa24e3f0caf8b65466f01713f10db5f8b2cd6db33ab81df54a548c67f0c8f5d60e19016a999918aae9e1b8e2027ec138892534b55321057ff0340c2e6af572e133a79a86fe795571a2f1f85a396cf87c48f3c83382f812c63876c5519cac29d1bb472d366b4df08639b888ad58d90a97ffcc793a68fef20dfdab51d465391d00d8eecaadf684089fa160b545afdf00af90b78a7476db04feeae1b756d0e6b841f50f13052c57654cce9259f725a012d5573e03e9a17604bf687de029d0e804f650f16b7aeee6954ace0f5943e3199adfb7087f393538bcdbaee58b432643d09cccfce5a16c48ae80e58427a4d27c3963646e5de710d6708d94935502dfc7ee7e64d52b1112ab5abaa348a6734ec5ac8a18fc855493f041f50b6e2cbcb57ee150f873e3599fe86cb70f9e406fd7d926731602f8a03f503add0ed3845abac294019bd190721eee2f076d53951c028269e63d1c74a2a8aeada97afdb535d58816e01fdb0b093809fe739ae657aa97c4321bcfe8e0e23c8865ab9270ca117e0efc0218b2bf4b5a2e39899c9b9c93a567b74371d87b8e23632ec2623535f94adae1962a9b81075fb324b982f6bd0909b1b32f284bb06732c1166a60bd7fdb73a2f6f5d7effa507f644ef97fc088e9f0096c51373480d419bdbeb894de7ed188db8eca467d2d8c37c675afab2f552cda05cf7a4641f3134d4ea7db25a03c879dd67e1185e3898291d885adeda97ac2f2fdca578a5eadc8ce54f355060b91b5650868a396b413a96e37138187d5b276e258d13ba76bd5198984b68bdc9d2c9ae650fc769ce790b47231abd260c427b71ef18abcb654d778c522aad839cc4b6de2ad64640b210c3e9b5e0313999211a6428a80c8ae8d8f46c255fe48c8264e47728c9a4134d0527a7b54334e8d4a53cd8f3f4685274c67136d60ae29bea8c907891849eaea0b5e7a0779d4d0b35b8f6f6642572a89f2ce040072795c2f484859b532826e7656821bb423485022e86ad8b47d3af5c2512a634e71724ba4d094ed230d0a454001e17659225d60184a242eb1898a1f82d0f1a4673cc55f90638526129247c48a5a47206bb39a766e7e986128b0acd65088cc2bf99597ed2aced24aabf6f31a49f5d89caf639fc264604f74cf00e820ac15ee48e22a13c2661218d9bab3f49e388d0d416238049b0f0342fe171fb460e5facfa18be3be4066b6c6077e0d6fef91e165ea2320dc4e20e0409a328e387d609076a02fdc530e82c64ec62524da793c92e72f2f2e0d0de7089626219900b1432c7191cbb631412211a50e8f2441e256b8bf86019d671b7d53c5cc89f2fe86065fad0729b4224fce699064f77c23770595fc060dffe6134387f2e01ee84d52565738bea319cedac0ecf9e8e6b08052a7819c859287fb0ee641643955da507c1dbb8f05d988e5bf954e446e09921fb5ba04d851588bf548564d6c8fd7c6c16f103ac179e2811efb33ee5a0b041ea683c64bd84c8f478f17aeb3b7c25417482a4fc9c9f1596d1c33a1e332d8505eca2e9dd9a1260f58dabff1bc3ef2df892e3ae02ca05b8f09132a3c4b8be0d5963139446f7c61791091ace9e078b8044965fa4d3faa343e1776e359b295a5a39b32ce32733ae4d7435ddbe3353c311ff76081e511ab70b3e6bae9aa13a37c771d109d99d4e0e3c37689920549c9c4ff1ae0f7362e3085a8ac75a0e8c9c0a87aed5609a8139e49662cc8bbe1df10d3ef7845d20495dbbe5c0c47ae3a92ce656db8298122a8d1b412d6675c2513ba89282d36a79e0f9409e540b1bab7b048ed529ec43b877c36967eae59981b24bdaab160bca9a88908d9c3d1e825919fa722c15a3437c59255759c2ad140e39ec60e883e1468d5f1ae27be019233e842a1dad05f5c882c30402314b7cd347ec512e361da7d4cff8f7e0962d5b76a2277e25185264eb894284c0b0e2a7f81a9d4adb390816d81c1109a75f711febc7abc2b23aff864afef26db5a98ddd9da43a92765a58bbcdee421bc1d0fea05c4edfc0ef7e41496980ff2520da9b881c9ecec11bb9b2b7ef59768756cc781b6f048cb5048d26f0a71d99c1854a585fa96812864f336b26bb79a1fb3cd25ba3a4a822fa636f8c9f28164ecc40bec69192eb7d0b8f0ff6e6a6dae943a9d6a44178a6dca2149ad690f8d605e9696a74c5c2f0d7d7dd1e05025cb9a35835f4ba1fd2702ac89b527d4d7c23ea49016d8aae52cac847fc50a0fac8b8efe51f98f6b04922ddd87adbf0890bbea717640afb91079744c7cf6b421db7944bb361aabf9776283c2331b7681903750d8e1d695581d0db88f07ba1747965ef256a12e8d2c25b37003dfb1d1360533cd9a5d2abd8629ac6f327f803bf822b379b91835c8b4117abe758177c370b95ab88647cb75e9a9f7802befed80124e76c4af4de217bce2be1577cce651cd64c26514", 0x1000) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="116348400000000000000065e2780d91cb0c2502be3a0c000000000000000000bcaa2ebd3a40404989324bae8e7274fd946df21cc1302a4748292684dadc7c202d6fa8601196c2a61d46c0b5217fe840e34ca5ffeb06b466fc1f0dc8ae0a7b3658283ab50a17c736c2123286b7"], 0x0, 0x0, 0x0}) wait4(r1, &(0x7f0000000000), 0x20000000, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(r0, 0x84, 0x65, &(0x7f00000014c0)=[@in6={0xa, 0x4e20, 0x8, @rand_addr="0ff0776be95ae8a13f636efd1da8e781", 0x8000}, @in={0x2, 0x4e21, @multicast1}, @in6={0xa, 0x4e24, 0x7, @mcast1, 0xffff}, @in={0x2, 0x4e21, @multicast1}, @in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x12}}, @in={0x2, 0x4e21, @loopback}, @in={0x2, 0x4e22, @multicast2}, @in={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}], 0x98) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:55:48 executing program 3: socket(0x0, 0x0, 0x0) r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$packet(0x11, 0x0, 0x300) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x1000005, 0x32, 0xffffffffffffffff, 0x0) ioctl$RTC_ALM_SET(r0, 0x40247007, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1a}) 08:55:48 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x6c00000000000000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 2929.286256][ T1004] binder: 1001:1004 ioctl c0306201 0 returned -14 [ 2929.326988][ T998] netlink: 'syz-executor.5': attribute type 12 has an invalid length. [ 2929.378668][ T1127] binder: 1001:1127 ioctl c0306201 0 returned -14 [ 2929.593086][ T1009] netlink: 'syz-executor.0': attribute type 12 has an invalid length. 08:55:49 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x2000000, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) 08:55:49 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x74000000) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:49 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x7400000000000000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:55:49 executing program 3: unshare(0x8000400) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="11dca5055e0bcfec7be070") getsockopt$inet_mreq(r0, 0x0, 0x20, &(0x7f0000000000)={@local, @broadcast}, &(0x7f0000000040)=0x8) 08:55:49 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x403) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="11632189506b9e4d527a882330176465b1b30000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000000)={0x3}) [ 2929.807746][ T1140] binder: 1138:1140 ioctl c0306201 0 returned -14 [ 2929.821492][ T1141] binder: BINDER_SET_CONTEXT_MGR already set [ 2929.863146][ T1141] binder: 1135:1141 ioctl 40046207 74000000 returned -16 [ 2929.874578][ T1142] binder: 1139:1142 unknown command -1994300655 [ 2929.877593][ T1140] binder: BINDER_SET_CONTEXT_MGR already set [ 2929.896757][ T1142] binder: 1139:1142 ioctl c0306201 20000100 returned -22 08:55:49 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x7a000000) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2929.923646][ T1147] binder: 1138:1147 ioctl c0306201 0 returned -14 [ 2929.947881][ T1140] binder: 1138:1140 ioctl 40046207 7400000000000000 returned -16 08:55:49 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x7a00000000000000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 2930.002751][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2930.008615][ C0] protocol 88fb is buggy, dev hsr_slave_1 08:55:49 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) [ 2930.228712][ T1260] binder: BINDER_SET_CONTEXT_MGR already set [ 2930.244050][ T1259] binder: 1258:1259 ioctl c0306201 0 returned -14 [ 2930.270772][ T1260] binder: 1256:1260 ioctl 40046207 7a000000 returned -16 [ 2930.310127][ T1259] binder: BINDER_SET_CONTEXT_MGR already set [ 2930.337504][ T1266] binder: 1258:1266 ioctl c0306201 0 returned -14 [ 2930.392767][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2930.395704][ T1259] binder: 1258:1259 ioctl 40046207 7a00000000000000 returned -16 [ 2930.398666][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2930.698054][ T1146] netlink: 'syz-executor.5': attribute type 12 has an invalid length. [ 2930.766441][ T1388] netlink: 'syz-executor.5': attribute type 12 has an invalid length. [ 2930.821234][ T1390] netlink: 'syz-executor.0': attribute type 12 has an invalid length. 08:55:50 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) syz_open_procfs(0x0, &(0x7f0000272000)) 08:55:50 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_ALM_SET(r0, 0x40247007, &(0x7f0000000240)) 08:55:50 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup2(r1, r1) setsockopt$inet6_buf(r2, 0x29, 0x30, &(0x7f0000000100)="9f35ce1c34ccc2f39450cecb776dce7796c61ccbbdd29b9d01e0cf47987776750df8c1af39f3859f849df11b709b77d02a3675975af0afb53b8199594d81378bc74a8f976c923585f4bd96aa40e09147504761075e550927b6a158392fb555d605c63c57f7703922d985d2fa26208e824eb39df4c449c7f7d40ca3f7d07599ff88a7b6073fada60ed19d43b3d4354d3b", 0x90) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:55:50 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0xff000000) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:50 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) getsockopt$inet_sctp6_SCTP_HMAC_IDENT(r0, 0x84, 0x16, &(0x7f0000000040)={0x2, [0x6, 0x0]}, &(0x7f0000000080)=0x8) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r1, 0x6, 0x15, &(0x7f0000000000), 0x4) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:55:50 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x4000000, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) 08:55:50 executing program 3: r0 = socket$inet6(0xa, 0x80803, 0x2f) getsockopt$inet6_int(r0, 0x29, 0x1, 0x0, &(0x7f0000000000)) [ 2931.026067][ T1403] netlink: 'syz-executor.5': attribute type 12 has an invalid length. [ 2931.040342][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2931.041111][ C1] protocol 88fb is buggy, dev hsr_slave_1 08:55:50 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x100000000000000) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:50 executing program 2: r0 = syz_open_dev$audion(0x0, 0x0, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$KVM_S390_UCAS_MAP(r1, 0x4018ae50, &(0x7f0000000000)={0x401, 0x300, 0x4}) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$KVM_GET_NR_MMU_PAGES(r0, 0xae45, 0x7) 08:55:50 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) fsetxattr$security_ima(r1, &(0x7f0000000080)='security.ima\x00', &(0x7f0000000140)=@v1={0x2, "8c19ee"}, 0x4, 0x1) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x20000, 0x0) r4 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) socket$bt_cmtp(0x1f, 0x3, 0x5) bind$bt_rfcomm(r1, &(0x7f0000000280)={0x1f, {0x1f, 0xffffffffffffa10d, 0x635, 0x0, 0x7, 0xfffffffffffff624}, 0x80000001}, 0xa) bind$bt_rfcomm(r1, &(0x7f0000000000)={0x1f, {0x1, 0xffff, 0x3, 0x100000000, 0xffffffff00000000, 0x9}, 0x74}, 0xa) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_VERSION(r3, 0xc0406400, &(0x7f00000001c0)={0x400, 0x763135ce, 0x3ff, 0xc4, &(0x7f0000000300)=""/196, 0xdb, &(0x7f00000004c0)=""/219, 0x4, &(0x7f0000000180)=""/4}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12734840"], 0x0, 0x0, 0x0}) 08:55:50 executing program 3: unshare(0x8000400) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="11dca5055e0bcfec7be070") lseek(r0, 0x0, 0x0) [ 2931.463594][ T1535] binder: BINDER_SET_CONTEXT_MGR already set [ 2931.473868][ T1536] binder: 1534:1536 ioctl c0306201 0 returned -14 [ 2931.499352][ T1535] binder: 1533:1535 ioctl 40046207 100000000000000 returned -16 [ 2931.522861][ T1536] binder: 1534:1536 ioctl c0306201 0 returned -14 [ 2931.552001][ T1546] binder: 1534:1546 ioctl ae45 7 returned -22 [ 2931.569720][ T1542] binder: BINDER_SET_CONTEXT_MGR already set 08:55:51 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x200000000000000) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2931.594557][ T1542] binder: 1541:1542 ioctl 40046207 0 returned -16 [ 2931.828889][ T1405] netlink: 'syz-executor.0': attribute type 12 has an invalid length. [ 2932.010110][ T1663] netlink: 'syz-executor.0': attribute type 12 has an invalid length. 08:55:51 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) syz_open_procfs(0x0, &(0x7f0000272000)) 08:55:51 executing program 2: r0 = syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) getsockopt$EBT_SO_GET_INFO(r0, 0x0, 0x80, &(0x7f0000000000)={'filter\x00'}, &(0x7f0000000080)=0x78) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 08:55:51 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) getsockopt$IPT_SO_GET_INFO(r0, 0x0, 0x40, &(0x7f0000000000)={'security\x00'}, &(0x7f0000000080)=0x54) 08:55:51 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="11dca5055e0bcfec7be070") sendmmsg(0xffffffffffffffff, &(0x7f0000004340)=[{{0x0, 0x0, &(0x7f0000001480)=[{&(0x7f0000001440)="c73c0662b7ef4f5dec146f22cca92aeb3703c79133a3fa72a75d92", 0x1b}], 0x1}}, {{&(0x7f0000001640)=@xdp={0x2c, 0x3, 0x0, 0xc}, 0x80, &(0x7f0000001780)=[{&(0x7f0000001740)="d825a57444dfaa65891d16ffedc183bdf2e976bef0381e6149520d32eee6e42519c226bce3b9451b36690787e3b317499c", 0x31}], 0x1}}, {{&(0x7f00000018c0)=@in6={0xa, 0x4e22, 0x5, @mcast2, 0x93}, 0x80, &(0x7f0000001a80)=[{&(0x7f0000001a00)="bc554462e00eb3f869bc92b22e739eea2d082b4564793566bee3fed5d5f07700f3e549a127504d7996bc7ad572374a5fd15fea95ced8699fcc5b221e8bf2078dd448552a23cc1843ba664e5ba2a3d43684679d6699dc3e7bf80c3d2437db4c1745b6773f5a5703ceaa0566d62a67d25a", 0x70}], 0x1}}, {{&(0x7f0000001b00)=@pppol2tpin6={0x18, 0x1, {0x0, r0, 0x3, 0x3, 0x1, 0x4, {0xa, 0x4e23, 0x8, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x4}}}, 0x80, &(0x7f0000001d00)=[{&(0x7f0000001c40)="62b4ba04b3b8096e00da12599b8e07aa1b3f2bf812b6e359648b8bf50561002cb2b839bf7b904abcb5d07c94b5e61730cd36e2060a0bc5aa0d9352615b080028dc856053688d1df963bf6e1f4d8a2b16ea6e6ec0c008fc3f716ae3c0c2", 0x5d}], 0x1}}, {{&(0x7f0000002ec0)=@can, 0x80, &(0x7f0000004180)=[{&(0x7f0000004140)}], 0x1}}], 0x5, 0x0) 08:55:51 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x300000000000000) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2932.068894][ T1660] netlink: 'syz-executor.5': attribute type 12 has an invalid length. [ 2932.077393][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2932.077468][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2932.224355][ T1670] binder: 1669:1670 ioctl c0306201 0 returned -14 [ 2932.240476][ T1679] binder: BINDER_SET_CONTEXT_MGR already set [ 2932.265991][ T1683] binder: BINDER_SET_CONTEXT_MGR already set [ 2932.266021][ T1679] binder: 1675:1679 ioctl 40046207 0 returned -16 [ 2932.290293][ T1684] binder: 1669:1684 ioctl c0306201 0 returned -14 [ 2932.310057][ T1683] binder: 1673:1683 ioctl 40046207 300000000000000 returned -16 08:55:51 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0xa000000, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) 08:55:51 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x6) ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, "a3269907f9f3e9512a183e92f417ac1f007e4c56d1171d85bc4612c9f90faf90b4b0b72a6129e0c4f93a218000da24d972000040b95f4e46fbc2c9b4017df7e2", "2eb3a35bdaeebc66c0ec1124e1d8715ead7f47fc78c18d1f0012ad565751445d72362a11511b06cf1ed7a633684783952ae3178b6a33143d973df8e415683055", "5a911fedf707000000000000c99959587b69f941bf6a604b3afd2e84a0c59e29"}) 08:55:51 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x400000000000000) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:51 executing program 2: r0 = socket$inet(0x2, 0x7, 0x0) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0x4, 0x20}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000000080)={0x6, 0x6, 0x2, 0x2, 0x0, 0x0, 0x200, 0xffffffff, r1}, &(0x7f0000000140)=0x20) syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) 08:55:51 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040)='TIPCv2\x00') sendmsg$TIPC_NL_NAME_TABLE_GET(r0, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000080)={&(0x7f0000000140)={0xbc, r3, 0xe22, 0x70bd28, 0x25dfdbff, {}, [@TIPC_NLA_MON={0x34, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x3f}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x200}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x46ff1740}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xf7f}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x10001}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x7fff}]}, @TIPC_NLA_NODE={0x24, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x6}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x1000}]}, @TIPC_NLA_NET={0x3c, 0x7, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x80000000}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x6}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x40}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x800}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x8}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x40}]}, @TIPC_NLA_BEARER={0x4}, @TIPC_NLA_NODE={0x10, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x8}, @TIPC_NLA_NODE_UP={0x4}]}]}, 0xbc}, 0x1, 0x0, 0x0, 0x10}, 0x8000) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) 08:55:52 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$inet_int(r0, 0x0, 0x13, &(0x7f0000000040)=0x9, 0x4) [ 2932.645819][ T1818] binder: 1807:1818 ioctl c0306201 0 returned -14 [ 2932.718673][ T1820] binder: BINDER_SET_CONTEXT_MGR already set [ 2932.758684][ T1820] binder: 1817:1820 ioctl 40046207 400000000000000 returned -16 08:55:52 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/ip_tables_targets\x00') r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") preadv(r0, &(0x7f0000000000)=[{&(0x7f0000000240)=""/202, 0xca}, {&(0x7f0000000340)=""/166, 0xa6}], 0x2, 0x0) 08:55:52 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) syz_open_procfs(0x0, &(0x7f0000272000)) 08:55:52 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x500000000000000) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:53 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 08:55:53 executing program 3: r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/fib_trie\x00') r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") preadv(r0, &(0x7f0000000000)=[{&(0x7f0000000240)=""/202, 0xca}], 0x1, 0x0) 08:55:53 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000040)={0x0, r1, 0x0, 0xd, &(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff}, 0x30) fcntl$setownex(r0, 0xf, &(0x7f0000000080)={0x3, r4}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) syz_open_dev$mice(&(0x7f0000000140)='/dev/input/mice\x00', 0x0, 0x10080) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="12634840"], 0x0, 0x0, 0x0}) [ 2933.645831][ T1954] binder: 1952:1954 ioctl c0306201 0 returned -14 [ 2933.668782][ T1958] binder: 1952:1958 ioctl c0306201 0 returned -14 [ 2933.677189][ T1949] binder: BINDER_SET_CONTEXT_MGR already set [ 2933.702896][ T1949] binder: 1948:1949 ioctl 40046207 500000000000000 returned -16 08:55:53 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0xe000000, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) 08:55:53 executing program 3: r0 = syz_open_dev$vbi(&(0x7f0000000080)='/dev/vbi#\x00', 0x1, 0x2) ioctl$VIDIOC_ENUMINPUT(r0, 0xc050561a, &(0x7f0000000000)={0x69359011, "7c37e9d362a4ae58d4538881a97e09697b78ac14efc3e8675a532b20582f58c0", 0x3, 0x8, 0x1, 0x1700, 0x20000, 0x2}) write$P9_RFLUSH(r0, &(0x7f0000000240)={0x7}, 0x7) 08:55:53 executing program 2: r0 = syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$KVM_CREATE_IRQCHIP(r0, 0xae60) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 08:55:53 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x600000000000000) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:53 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x401) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x10000002, 0x0) r2 = perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0xa0, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="1063084000000000000000000863104002000000000000000000000000000000056304400100000005630440000000000d630000066304400100000008631040010000000000000000000000000000001063084000000000000000000063404be20000000000000000000000000000000000000010000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000040)=ANY=[@ANYBLOB="852a646600000000", @ANYRES32=r2, @ANYBLOB="000000000000000000000000852a62730a00000002000000000000000000000000000000852a646600000000", @ANYRES32=r1, @ANYBLOB='\x00'/12], @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="000000000000000018000000000000003000000000000000"]], 0x0, 0x0, &(0x7f0000000180)}) r3 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r0, 0x541b, &(0x7f0000000000)) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="1163484000000000000000000000000004000000"], 0x0, 0x0, 0x0}) ioctl$EXT4_IOC_GROUP_ADD(r2, 0x40286608, &(0x7f0000000180)={0x8, 0x3f, 0xff, 0x401, 0x9d, 0x45}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="f6061e712c35b68184c3b76f0858b19c8032156efe89376e95f1c75aad92c86a96531c32bb38e46935d1b327758972d40388e63262ef105a4300b801016e03a1083315dacbf7443281b5c8543379a076b67de64c99abb8f543b696cd1222c2a35631b82b9beaed430b2dc718d08a9d7ef50000003dcad22e7c823f484356582b8aefab00af80417da26f3b67b95e8e743f009904c75ff46b63795301105a84daa2a0c945fed7c04ac64ee924826da2ff8a8efde3d10c40ecd25b2f6cede429e90e47dce5af2ac35a3a73208e9a60c2a0c2472a7a3d2399585284fffe93c9d09f3381a1d3bfe6444eac2b35e0ee96e6148f652eec52cd239becbcee3d48c33ddf9543532ebdeda98c3a93dc21c95a1b4b6d58bfa2b62eacc3995388652c603e5e074761e9e50d20bc7d8174a5ae64c16ca266f1bfe1e9c886c2b6b4a5cb47bc3badbddedf2c8698f11f83ade5acab58c4b1c511c96846ca4c0a57a0a4baf4627bce26ff4fc2698dc8b74b951fb48829d0eeb0e328e993562149c68c60c9b4d1038242a6805516166c15b48b6d1a420fe71915403ad80530"], 0x0, 0x0, 0x0}) [ 2934.010691][ T2082] binder: BINDER_SET_CONTEXT_MGR already set 08:55:53 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000001c0)={{{@in6=@local, @in, 0x0, 0x0, 0x0, 0x0, 0xa}}, {{}, 0x0, @in6=@mcast2}}, 0xe8) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x8001, @mcast2}, 0x2) setsockopt$IP_VS_SO_SET_STOPDAEMON(r0, 0x6800000000000000, 0x60, &(0x7f00000001c0)={0x0, 'bridge_slave_0\x00'}, 0x18) r2 = syz_open_dev$vcsn(&(0x7f0000000040)='/dev/vcs#\x00', 0x8, 0x0) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r2, 0x10e, 0x4, &(0x7f0000000080)=0xd3c5, 0x4) [ 2934.073514][ T2082] binder: 2020:2082 ioctl 40046207 0 returned -16 08:55:53 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x700000000000000) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2934.146127][ T2082] binder: 2020:2082 ioctl c0306201 0 returned -14 [ 2934.162811][ C0] net_ratelimit: 4 callbacks suppressed [ 2934.162820][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2934.174404][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2934.263952][ T2089] binder: 2020:2089 ioctl ae60 0 returned -22 [ 2934.300547][ T2101] binder: BINDER_SET_CONTEXT_MGR already set [ 2934.307722][ T2082] binder: 2020:2082 ioctl c0306201 0 returned -14 [ 2934.315249][ T2101] binder: 2094:2101 ioctl 40046207 0 returned -16 [ 2934.320714][ T2105] binder: BINDER_SET_CONTEXT_MGR already set [ 2934.338421][ T2105] binder: 2104:2105 ioctl 40046207 700000000000000 returned -16 [ 2934.358766][ T2101] binder: 2094:2101 unknown command 1897793270 [ 2934.371165][ T2101] binder: 2094:2101 ioctl c0306201 200002c0 returned -22 [ 2934.553963][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2934.560526][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2934.665470][ T2088] validate_nla: 5 callbacks suppressed [ 2934.665535][ T2088] netlink: 'syz-executor.5': attribute type 12 has an invalid length. [ 2934.838422][ T2092] netlink: 'syz-executor.0': attribute type 12 has an invalid length. [ 2934.897301][ T2221] netlink: 'syz-executor.5': attribute type 12 has an invalid length. 08:55:54 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) syz_open_procfs(0x0, &(0x7f0000272000)) 08:55:54 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) setsockopt$inet_int(r0, 0x0, 0xc, &(0x7f0000000000)=0x9, 0x4) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 08:55:54 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x762044000000000) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:54 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="ef629bed647ff526086e28168f0c47bd4a97b9f3523ca9e933b4035ab4332f4b4afd6bfa278f57a080a686c8f06a57055c92a3fa470370298df2c135cc0722bcc6ecfa8b4990234e763c30bb8c6ae569ad78bf5e0dc7e238f5fd04933e4c57e99f627c8cfea6d52dfe6c8ac5b3ea7f12ab9d342cc6614f4627f88ee0b377c8584e9bdd2e6738fd29e0939516b9e78ca096531af76c599aab17d9e2a318"], 0x0, 0x0, 0x0}) 08:55:54 executing program 3: r0 = socket$kcm(0x2, 0x2, 0x73) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @multicast1}, 0x10) connect(r0, &(0x7f0000000000)=@pppol2tpv3={0x2, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, 0x80) sendmsg$sock(r0, &(0x7f0000000600)={&(0x7f0000000100)=@isdn={0x22, 0x6, 0xfffffffffffffff7, 0xc9}, 0x80, &(0x7f0000000500)=[{&(0x7f0000000080)="51cc9c69b6498e70435864251a3ecff82c4fa097028858d13eade697", 0x1c}, {&(0x7f0000000180)="774ac4181dca37870fc51da79a47a63a97c4495cb6bf6e2bfd80c327d51dbea872be13552eff114f27d1d251796a6fc3b320165d2590c02b733de0a62a35c79df071ce7589c0cf6871769c40b3baa597fce8606f03cafc0e28c98297cae6f60c924aa7114c0378e4e62c79556b7cdb5397bbe391c9ed5f2b07c999127c365414f3ffb2c71c045785b1488686a16ebc6f4e366c6375409774b74aeef4c762600dd117ce520eb592d2c8b478d98b4d833e10", 0xb1}, {&(0x7f0000000240)="8c5125be3cc4cc240d5e542022379b9aa7b6bb32f7fc7cc1f97dfbf63807ba21882a57786d4d11b333810ae3de471387f4b72981580c52266f0b29", 0x3b}, {&(0x7f0000000280)="da55a8c77fdf112a71c49b3bc846bf84ad01e575bfe77104ddf16d2a42d70ece8183ec5949cb7bed68014b419d2b49359565dbd4dc069f2b13a04d3c4e931f8f03cf7ba520717f77dd14a169b16c0ef76ced07d7b59c88dffbaf2c9f", 0x5c}, {&(0x7f0000000300)="37e91dcae48b6414de92ba87c9b3be8deee0b4de8b60999372d4f433d5aaa112e4652d66fb39e72812b08b59cf76dcbbefe32353234bf928346afbf9b217ed3be0840114e921c8e2fcaddeb3d09275a17fe7e086886289a73482d7c729060f66a66a56d4b8349c3b432c25ee7a106ba56a56d75ce5807e7fd4dfd3d772eb3dd883698a63fa2b4b5cf859cb86d3381c331dd1fb415398f9ae9716c8c15b5bbe0bd3cb397abd39fa0e47b9a71212c5bcab48224d9040dd1c353abcc8563089460e52f6d250c3482018dad4ca711dee35362961aa873d5d6cea98d867547a2b13198b9463225dd397a8076b", 0xea}, {&(0x7f0000000400)="d86be4ec2b6c86c53490b4d7db022fe038a9995d9804f08f3087da35c592f52e50074daf5007e8026c9b2a32852c022d044a83d74a96744cb65d19579aaa12f27d1c5f263a932d784a61b9fa642af5c9932afdd14c09b4144ebe3709db9430c04f075f0a550ec1e452933f", 0x6b}, {&(0x7f0000000480)="9959688e5d02efeaaa83978a532acb4cbebe3598590eb8b7594d9d1ac8b59997a1c9cea72788fb1fc4bb10884718e75b0a2c87de3d8b4b868fbb80dd94e37efa3a42438752a080473cd8c750439d8bde2a22682dd6da25d9ee0c9002af862145", 0x60}], 0x7, &(0x7f0000000580)=[@txtime={{0x18, 0x1, 0x3d, 0x10001}}, @mark={{0x14, 0x1, 0x24, 0xc}}, @mark={{0x14, 0x1, 0x24, 0x9bc}}, @timestamping={{0x14, 0x1, 0x25, 0x3}}], 0x60}, 0x8000) [ 2935.047306][ T2225] binder: 2223:2225 ioctl c0306201 0 returned -14 [ 2935.071610][ T2229] binder: BINDER_SET_CONTEXT_MGR already set [ 2935.078236][ T2234] netlink: 'syz-executor.0': attribute type 12 has an invalid length. 08:55:54 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000180)={{{@in=@multicast1, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in=@empty}}, &(0x7f0000000280)=0xe8) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f00000002c0)={{{@in6=@loopback, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@dev}}, &(0x7f00000003c0)=0xe8) lstat(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000580)={{{@in=@broadcast, @in6=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6}}, &(0x7f0000000680)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000006c0)={{{@in6=@initdev, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in6=@ipv4={[], [], @multicast1}}}, &(0x7f00000007c0)=0xe8) r7 = getegid() getgroups(0x6, &(0x7f0000000800)=[0xee00, 0xee01, 0xee00, 0xee01, 0xee00, 0xee01]) lsetxattr$system_posix_acl(&(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='system.posix_acl_default\x00', &(0x7f0000000840)={{}, {0x1, 0x5}, [{0x2, 0x4, r1}, {0x2, 0x4, r2}, {0x2, 0x0, r3}, {0x2, 0x2, r4}, {0x2, 0x278773637e5c3b5b, r5}, {0x2, 0x0, r6}], {0x4, 0x4}, [{0x8, 0x7, r7}, {0x8, 0x5, r8}], {0x10, 0x4}, {0x20, 0x7}}, 0x64, 0x2) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r9, &(0x7f00000000c0)={0xa, 0x4e22}, 0x1c) listen(r9, 0x0) sendto$inet6(r0, 0x0, 0xfffffffffffffe32, 0x20004004, &(0x7f0000000040)={0xa, 0x20004e22, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000000)='tls\x00', 0xc498ead121f97dd6) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100)=@ccm_128={{0x303}, "371d6d65c5de2745", "bd8a497d70ec99686bfc9e9440245251", "e4ba2866", "b775207300a5e9ab"}, 0x28) sendto$inet6(r0, &(0x7f00000005c0), 0xffffffffffffffc1, 0x0, 0x0, 0x1201000000003618) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x40031, 0xffffffffffffffff, 0x0) [ 2935.093282][ T2229] binder: 2222:2229 ioctl 40046207 762044000000000 returned -16 [ 2935.096006][ T2228] binder: BINDER_SET_CONTEXT_MGR already set [ 2935.126359][ T2228] binder: 2224:2228 ioctl 40046207 0 returned -16 [ 2935.131073][ T2225] binder: 2223:2225 ioctl c0306201 0 returned -14 08:55:54 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x3f000000, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) 08:55:54 executing program 2: syz_open_dev$audion(0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="c0dca5055e0bcfec7be070") sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=@updsa={0x10c, 0x1a, 0x205, 0x0, 0x0, {{@in6=@mcast1, @in=@loopback}, {@in=@remote, 0x0, 0x3c}, @in=@multicast1, {}, {}, {}, 0x0, 0x0, 0xa}, [@output_mark={0x8}, @coaddr={0x14, 0xe, @in6=@dev}]}, 0x10c}}, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) [ 2935.192828][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 2935.198999][ C1] protocol 88fb is buggy, dev hsr_slave_1 08:55:54 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x800000000000000) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2935.405329][ T2304] mip6: mip6_destopt_init_state: state's mode is not 2: 0 [ 2935.432287][ C0] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 2935.505467][ T2304] binder: 2279:2304 ioctl c0306201 0 returned -14 [ 2935.539851][ T2324] binder: BINDER_SET_CONTEXT_MGR already set [ 2935.598584][ T2324] binder: 2319:2324 ioctl 40046207 800000000000000 returned -16 08:55:55 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TCSETSW(0xffffffffffffffff, 0x5403, &(0x7f0000000080)={0x0, 0x0, 0x1f}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$UFFDIO_ZEROPAGE(r2, 0xc020aa04, &(0x7f0000000000)={{&(0x7f0000001000/0x3000)=nil, 0x3000}, 0x1}) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = syz_open_dev$cec(&(0x7f0000000040)='/dev/cec#\x00', 0x2, 0x2) ioctl$UI_SET_RELBIT(r3, 0x40045566, 0x9) 08:55:55 executing program 4: r0 = syz_open_dev$audion(0x0, 0x10000000000000, 0x400) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x14, 0x0, &(0x7f0000005fd4)=[@acquire_done={0x40486311}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="98734888"], 0x0, 0x0, 0x0}) 08:55:55 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x1000000000000000) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) [ 2935.934984][ T2373] binder: BINDER_SET_CONTEXT_MGR already set [ 2935.983483][ T2375] binder: BINDER_SET_CONTEXT_MGR already set [ 2935.991071][ T2373] binder: 2372:2373 ioctl 40046207 1000000000000000 returned -16 [ 2936.005418][ T2375] binder: 2374:2375 ioctl 40046207 0 returned -16 [ 2936.072357][ T2401] binder: 2279:2401 ioctl c0306201 0 returned -14 [ 2936.168549][ T2264] netlink: 'syz-executor.5': attribute type 12 has an invalid length. [ 2936.232847][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2936.238710][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 2936.387793][ T2414] netlink: 'syz-executor.5': attribute type 12 has an invalid length. [ 2936.441049][ T2234] netlink: 'syz-executor.0': attribute type 12 has an invalid length. 08:55:55 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x0, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) syz_open_procfs(0x0, &(0x7f0000272000)) 08:55:55 executing program 1: ioctl$BINDER_THREAD_EXIT(0xffffffffffffffff, 0x40046208, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x2000000000000000) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) 08:55:55 executing program 4: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/sequencer2\x00', 0x400040, 0x0) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f0000000380)={0x16, 0x98, 0xfa00, {&(0x7f0000000340)={0xffffffffffffffff}, 0x4, 0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x4e24, 0x0, @mcast2, 0x2}}}, 0xa0) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f0000000440)={0x11, 0x10, 0xfa00, {&(0x7f0000000300), r1}}, 0x18) syz_open_dev$vivid(&(0x7f0000000040)='/dev/video#\x00', 0x2, 0x2) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vga_arbiter\x00', 0x2401, 0x0) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_TOL(r2, &(0x7f0000000280)={&(0x7f0000000140), 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x68, r3, 0x600, 0x70bd27, 0x25dfdbfe, {{}, 0x0, 0x4107, 0x0, {0x4c, 0x18, {0x82, @link='syz1\x00'}}}, [""]}, 0x68}, 0x1, 0x0, 0x0, 0x800}, 0x20004000) ioctl$sock_bt_cmtp_CMTPCONNDEL(r2, 0x400443c9, &(0x7f0000000100)={{0x0, 0x4, 0x8, 0x8001, 0x3, 0x3f}, 0x1}) r4 = syz_open_dev$vivid(&(0x7f0000000000)='/dev/video#\x00', 0xffffffffffffffff, 0x2) ioctl$VIDIOC_REQBUFS(r4, 0xc0145608, &(0x7f0000000080)={0x81, 0x1, 0x4}) 08:55:55 executing program 3: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/nullb0\x00', 0x0, 0x0) fadvise64(r0, 0x0, 0x0, 0x2) r1 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x3ff, 0x404000) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000040)={0x10003, 0x3, 0x4000, 0x1000, &(0x7f0000fff000/0x1000)=nil}) 08:55:55 executing program 2: r0 = syz_open_dev$audion(0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_GETFLAGS(r0, 0x80086601, &(0x7f0000000000)) syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 08:55:55 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, &(0x7f0000000900)=[{{&(0x7f0000000200)=@generic, 0x80, &(0x7f0000000280)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000540)=""/230, 0xe6}, {&(0x7f0000000340)=""/186, 0xba}, {&(0x7f0000000b80)=""/165, 0xa5}], 0x4}, 0x1ff}, {{&(0x7f0000000b00)=@rc, 0x80, 0x0, 0x0, &(0x7f0000000d40)}, 0x5c}, {{&(0x7f0000002000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000004240)=[{&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/226, 0xe2}, {&(0x7f0000004180)=""/171, 0xab}], 0x4}, 0x3}], 0x3, 0x40000000, &(0x7f0000004400)={0x77359400}) getpid() getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000044c0)={0x0, @initdev, @multicast2}, &(0x7f0000004500)=0xc) getpeername$packet(0xffffffffffffff9c, &(0x7f0000004540)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004580)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000046c0)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000004680)={&(0x7f00000045c0)={0x98, 0x0, 0x0, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x400040, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffff9c, 0xc00c642e, &(0x7f0000000140)) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000001c0)={&(0x7f0000000040)={0x28, 0x23, 0x1, 0x0, 0x40000000, {0x20000000004, 0xe00000000000000}, [@typed={0x14, 0xc, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) process_vm_readv(r0, 0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000c80)=""/31, 0x1f}], 0x1, 0x0) syz_open_pts(0xffffffffffffffff, 0x2) [ 2936.632763][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 2936.668934][ T2507] netlink: 'syz-executor.5': attribute type 12 has an invalid length. 08:55:56 executing program 3: r0 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000300)='/dev/urandom\x00', 0x501000, 0x0) finit_module(r0, &(0x7f0000001340)='trusted.overlay.redirect\x00', 0x2) ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f0000000100)=0x0) r2 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000140)='/dev/qat_adf_ctl\x00', 0x40, 0x0) syncfs(r2) r3 = syz_open_procfs(r1, &(0x7f00000000c0)='\x00\x00\x00\x00H') r4 = openat$cgroup_ro(r3, &(0x7f0000000180)='mem\x00\x01y7swaS.cur\x89\xc9B\xab\xe3\xfarent\x00\x1aw\xb7\xc3B\xef\xf0\xd5\xf34|\x98.\x857Y\xab[d\xfa\x83\xdf\xc6\xf3\xb5\xab\xbb\x98y\xe7\xff\x87o\xb2\xfe\xd0\x9d\x9a\x89\xfe\xc4\x1d\x92|z\xbc\nl%\x97,#\xab3aEW\x18A3@\x94\x05%Y\x1d\x90\xf3\xc8\x89\x9a.\x7fm5\xaa\b\xceo\t\xcc\x98\xb7\x18\x90\x1cM\x91\x0fzb\x85\xb5$\x86\xe4\xd9\x1bJ\x1f\xf0>\x18\xed\xb0\r.8\xc9\xcb\x03t\xa7\xd0D\x04\x1d\x04$\xecAb\b\xcf\xd40\xe8qg\xc5\x18\xd1\x8f\xe6D\xa8\x00\xf6H|y\xa1\x0f\xde\xe3\xbb\'\xb1\x02\x00\xc8p\xbfQh\"\n=\x90\xf9vUo9\x85\xb3\xa9\xec\xda\xc2\x99\xbe8\x9f[*\x80\xb7%\x9d33\xb9\xc3\xf0\x11!\x11\xc3\xa5$<\xcfC\x91|\x05\x1aO\xb4\xf0_\xbd>\xf3[\xbb[\x058\x01\xf4\xca\xf4(\xab8\x87R\xc8\xe0l\xce\x930\xec\xf5\x8f\xb0%I\xb7\x7f[\\i\xfb\x96d\xa1aA\x97j\xc3\xef\xb65\xc0e\xb2%\x1f\xba}\x0e$\x16\xbcw\xff&DRYp\xb8I\xc3\xa8\xee\x03\x19\xe8\xd9\x18i\xffHw\xea\x9d\x86\x0e\bl5\x945\xab\xd3\xef\x11\xbd\"\xbc\xf3\x8b\xf2.:\x8c\xe2\xb2\a\xac\x8b\x19\x80\x8b\xa3&\x19\x16\x80\xa1\x88\xbe\xc3\x0f\xf3\xb7V]\x89e\xf2D\xf6T\xc0\xb8/\xa5\x11\x15\x8cqV/', 0x0, 0x0) fgetxattr(r4, &(0x7f0000000000)=@known='trusted.overlay.redirect\x00', &(0x7f0000000040)=""/124, 0x7c) preadv(r4, &(0x7f00000024c0)=[{&(0x7f0000000340)=""/4096, 0x1000}], 0x1, 0x800000) [ 2936.681155][ T2504] binder: 2498:2504 ioctl c0306201 0 returned -14 [ 2936.683831][ T2509] binder: BINDER_SET_CONTEXT_MGR already set [ 2936.698657][ T2502] WARNING: CPU: 0 PID: 2502 at drivers/media/common/videobuf2/videobuf2-core.c:733 vb2_core_reqbufs+0x48f/0xd90 [ 2936.711129][ T2502] Kernel panic - not syncing: panic_on_warn set ... [ 2936.717769][ T2502] CPU: 0 PID: 2502 Comm: syz-executor.4 Not tainted 5.2.0-rc5+ #57 [ 2936.725673][ T2502] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2936.726965][ T2504] binder: 2498:2504 ioctl 80086601 20000000 returned -22 [ 2936.735743][ T2502] Call Trace: [ 2936.735823][ T2502] dump_stack+0x172/0x1f0 [ 2936.735848][ T2502] ? vb2_core_reqbufs+0x460/0xd90 [ 2936.735891][ T2502] panic+0x2cb/0x744 [ 2936.735908][ T2502] ? __warn_printk+0xf3/0xf3 [ 2936.735932][ T2502] ? vb2_core_reqbufs+0x48f/0xd90 [ 2936.735950][ T2502] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2936.735965][ T2502] ? __warn.cold+0x5/0x4d [ 2936.735983][ T2502] ? vb2_core_reqbufs+0x48f/0xd90 [ 2936.735999][ T2502] __warn.cold+0x20/0x4d [ 2936.736016][ T2502] ? vb2_core_reqbufs+0x48f/0xd90 [ 2936.736034][ T2502] report_bug+0x263/0x2b0 [ 2936.736058][ T2502] do_error_trap+0x11b/0x200 [ 2936.736080][ T2502] do_invalid_op+0x37/0x50 [ 2936.754693][ T2507] kobject: 'hwsim1067' (0000000055da84e1): kobject_add_internal: parent: 'mac80211_hwsim', set: 'devices' [ 2936.755760][ T2502] ? vb2_core_reqbufs+0x48f/0xd90 [ 2936.755782][ T2502] invalid_op+0x14/0x20 [ 2936.755800][ T2502] RIP: 0010:vb2_core_reqbufs+0x48f/0xd90 [ 2936.755822][ T2502] Code: 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 34 08 00 00 45 8b 3c 9c 31 ff 44 89 fe e8 8b 52 b6 fc 45 85 ff 75 9a e8 01 51 b6 fc <0f> 0b 41 bc ea ff ff ff e8 f4 50 b6 fc 48 b8 00 00 00 00 00 fc ff [ 2936.780003][ T2507] kobject: 'hwsim1067' (0000000055da84e1): kobject_uevent_env [ 2936.784909][ T2502] RSP: 0018:ffff8881fab178a0 EFLAGS: 00010216 [ 2936.784924][ T2502] RAX: 0000000000040000 RBX: 0000000000000000 RCX: ffffc9000c790000 [ 2936.784933][ T2502] RDX: 0000000000007967 RSI: ffffffff84ba702f RDI: 0000000000000005 [ 2936.784942][ T2502] RBP: ffff8881fab179b0 R08: ffff888097670280 R09: ffff88809ea0d388 [ 2936.784950][ T2502] R10: ffffed1013d41a78 R11: ffff88809ea0d3c7 R12: ffff8881fab17928 [ 2936.784958][ T2502] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000000 [ 2936.784996][ T2502] ? vb2_core_reqbufs+0x48f/0xd90 [ 2936.785027][ T2502] ? vb2_core_create_bufs+0x830/0x830 [ 2936.785045][ T2502] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2936.785065][ T2502] ? mutex_trylock+0x1e0/0x1e0 [ 2936.785088][ T2502] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2936.785111][ T2502] vb2_ioctl_reqbufs+0x2c2/0x450 [ 2936.785134][ T2502] v4l_reqbufs+0xa7/0xd0 [ 2936.785160][ T2502] __video_do_ioctl+0x7eb/0xcd0 [ 2936.785186][ T2502] ? v4l_s_fmt+0xab0/0xab0 [ 2936.785209][ T2502] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 2936.785228][ T2502] ? _copy_from_user+0xdd/0x150 [ 2936.785249][ T2502] video_usercopy+0x4c2/0x10c0 [ 2936.785265][ T2502] ? v4l_s_fmt+0xab0/0xab0 [ 2936.785285][ T2502] ? v4l_enumstd+0x70/0x70 [ 2936.785298][ T2502] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 2936.785320][ T2502] ? tomoyo_execute_permission+0x4a0/0x4a0 [ 2936.785349][ T2502] ? video_usercopy+0x10c0/0x10c0 [ 2936.785362][ T2502] video_ioctl2+0x2d/0x35 [ 2936.785379][ T2502] v4l2_ioctl+0x150/0x1b0 [ 2936.785392][ T2502] ? video_devdata+0xa0/0xa0 [ 2936.785413][ T2502] do_vfs_ioctl+0xd5f/0x1380 [ 2936.785432][ T2502] ? ioctl_preallocate+0x210/0x210 [ 2936.785446][ T2502] ? __fget+0x381/0x550 [ 2936.785467][ T2502] ? ksys_dup3+0x3e0/0x3e0 [ 2936.808735][ T2507] kobject: 'hwsim1067' (0000000055da84e1): fill_kobj_path: path = '/devices/virtual/mac80211_hwsim/hwsim1067' [ 2936.811107][ T2502] ? nsecs_to_jiffies+0x30/0x30 [ 2936.811134][ T2502] ? tomoyo_file_ioctl+0x23/0x30 [ 2936.811161][ T2502] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2936.811178][ T2502] ? security_file_ioctl+0x8d/0xc0 [ 2936.811197][ T2502] ksys_ioctl+0xab/0xd0 [ 2936.811217][ T2502] __x64_sys_ioctl+0x73/0xb0 [ 2936.811251][ T2502] do_syscall_64+0xfd/0x680 [ 2936.834758][ T2507] kobject: 'hwsim1067' (0000000055da84e1): kobject_uevent_env [ 2936.837359][ T2502] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2936.837373][ T2502] RIP: 0033:0x4592c9 [ 2936.837391][ T2502] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2936.837400][ T2502] RSP: 002b:00007f28dea75c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2936.837415][ T2502] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000004592c9 [ 2936.837425][ T2502] RDX: 0000000020000080 RSI: 00000000c0145608 RDI: 0000000000000005 [ 2936.837434][ T2502] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 2936.837443][ T2502] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f28dea766d4 [ 2936.837453][ T2502] R13: 00000000004c470a R14: 00000000004d83d8 R15: 00000000ffffffff [ 2936.858559][ T2502] Kernel Offset: disabled [ 2937.166396][ T2502] Rebooting in 86400 seconds..